MurphyA/hacker-news huggingface dataset:
by constantcrying | 2025-10-10 14:33:35+00:00
The part about them being a company "with no reputation to loose" really hits home. If you know your customer is going to hate you, because you suck at being a reliable service provider, then them hating you also because you scammed them for 500 Euros is no loss at all. The actual difference in reputation is marginal.

They also do not really suffer any financial damage. They do not have competition and no matter how badly run their business is, their losses are paid for by the tax payer.
by defanor | 2025-10-10 14:34:17+00:00
It is too annoying to carefully scroll to the small ranges at which texts are visible, with a custom horizontal scroll, to fish out small bits of text, which do not even seem to be written well. And that is after enabling JS, without which it is broken, yet not obviously (not much more than with JS). Websites about design and typography tend to be broken and illegible, but this one seems to stand out even among those.

But as with quite a few of other such websites, disabling CSS actually renders it easily legible and navigable, even without JS.
by ndriscoll | 2025-10-10 14:35:02+00:00
So are we to compensate the workers who make pipes and plumbers that install them each time we open the tap and water comes out? Or each time an air conditioner turns on to cool you off? Do we compensate the manufacturers of processors and fiber optic lines each time we write a message online instead of needing to give it to a courier to take to a scribe's home to copy?

Instead of making your entire life into a microtransaction-fest requiring dystopian tracking of everything, what if we just converted expected sequence of value to current dollars and made a lump sum payment? Of course different people will have different utility functions, so we could allow them to judge what is a fair trade.
by nchmy | 2025-10-10 14:35:14+00:00
> The author was constantly pushing it in the HTMX discord, telling anyone who would listen that if they liked HTMX how great Datastar would be for them

You know who else does that? THE DEVELOPER OF HTMX! https://htmx.org/essays/alternatives/

> Some pretty classy comments from them on reddit too:

What is unclassy about those comments? Seem sensible to me...
by troupo | 2025-10-10 14:35:29+00:00
You literally have a custom Javascript-like DSL already https://data-star.dev/guide/datastar_expressions

This wilful insanity is completely incomprehensible to me (HTMX and lit are also fully infected with it): "Oh no, we are just HTML, we can't do anything" while literally doing tons of things outside of HTML.
by diyer22 | 2025-10-10 14:35:48+00:00
Thank you very much for your interest.

1. The comparison with GANs and the issue of mode collapse are addressed in Q2 at the end of the blog: https://github.com/Discrete-Distribution-Networks/Discrete-D...

2. Regarding scalability, please see “Future Research Directions” in the same blog: https://github.com/Discrete-Distribution-Networks/Discrete-D...

3. Answers or relevant explanations to any other questions can be found directly in the original paper (https://arxiv.org/abs/2401.00036), so I won’t restate them here.
by dormento | 2025-10-10 14:36:07+00:00
> I think Trump genuinely doesn't like people being killed

While I do understand this might be true in essence, things are a lot more complicated. He's said some heinous things that riled up actual loonies into a frenzy more than once. Deliberately. Not peace price material IMHO.

(To be fair, I generally lean left, but I don't agree with Obama getting the prize in 2009 as well, what with the targeted assassination program and all)

Its almost like there should be a Nobel "anti-prize" denouncing these people.
by triceratops | 2025-10-10 14:36:29+00:00
> Especially on 12hr flight where it should be provided for free imo

That's junkie talk /s

No but seriously if you think Internet access is so vital that it has to be provided for free on a long-ish flight, you may have a problem. Watch an in-flight movie, read a book, take a nap, look out the window. There are many ways to pass 12 hours.
by nicholast | 2025-10-10 14:37:12+00:00
A few comments: - It has long been known in other settings that a small number of points can impact performance of different conventions, this could perhaps be considered a validation of relevance towards the largest scales - I wonder if the reverse could be considered true, if such a small scale of data included in a training corpus can impact the model performance in a negative direction, could that same amount of data impact a model in the positive direction? - I think this is suggestive that there remains benefit to more authoritative sources of data aggregators, like respected publishers, journals, libraries, whereby inclusion of data in such more respected repositories can be considered validation of reliability for training.
by cestith | 2025-10-10 14:37:14+00:00
It means there are people with personal wealth larger than the GDP of many nation states. Some of those people like Musk, Murdoch, Thiel, Putin, bin Salman, Gates, Koch brothers, Zuckerberg, Ellison, Turner, Bloomberg, Adelson, Hoffman, and more who fund campaigns, media blitzes, and activism for various issues and candidates in various parties. Some of them do that worldwide. Some of them own their own media companies. Some of them also control countries, but have enough personal wealth to fund things themselves rather than tying their government personnel to it.
by IAmBroom | 2025-10-10 14:38:28+00:00
I'd settle for "earliest known", without an assumption that there was probably an older one.

Much like fossils, the vast majority of human writing is quickly lost to posterity. Paper, bark, and string decompose; clay and rock break; all writing materials can be repurposed for other writing (palimpsets) or other uses (reshaped to wall stones).

Still, given the paucity of known, independently invented writing systems... We may well know of all of them.
by jlengrand | 2025-10-10 14:38:30+00:00
> I had a running service written in htmx for some time. It is a clinic opening hour service to inform my patients when I will be available in which clinic. (Yes, I am not a programmer, but a healthcare professional.)

-> that was pretty freaking cool to read, loved it

also chuckled at the idea of my website making, health professional going all "What the fuck." in front of his codebase.
by array_key_first | 2025-10-10 14:38:43+00:00
> If all proprietary software that dared to charge a fee was destined to “die” this very forum wouldn’t exist.

I don't follow. All proprietary software IS destined to die.

Even extremely popular proprietary software. Windows 10? That's destined to die. iOS 14? Destined to die.

It's inevitable. If you're lucky, the overlords making the software will give you a new alternative. Hopefully the new alternative has all the functionality and isn't 100x more expensive.

But OS doesn't work this way, because it can be forked.

The way it works is that, in the beginning, proprietary software is really good compared to OS. As time goes on, the proprietary software rots.

It either stays the same, obsolences, or actively gets worse. Usually the last one. OS software, by comparison, gets better and better. Eventually they intersect, and if you chose the proprietary tree, you lost.
by LeifCarrotson | 2025-10-10 14:39:32+00:00
Absolutely! Examples (or 'tutorials') are just one quadrant of education about a system.

Not sure who came up with it first, but your link is similar to the author's link at the conclusion of the article:

> Since even major software projects rarely offer [4 distinct kinds of documentation][1], I am often hesitant to click on a "Documentation" link

Personally, I prefer documentation written as an explanation. If I understand how the thing works or why it's done that way, everything else is easy. Examples/tutorials/how-to guides only help me develop a conceptual framework by experiencing it, and I know that's how some people learn, but a skilled technical writer or educator can help me generate that conceptual framework correctly the first time.

I think the reason API references are so common is that they're really best suited for someone trying to build a wrapper or fully-compatible alternative implementation...which is what the original authors were doing, before the project existed. Many projects started as an internal, private API reference, and generating documentation can be as easy as making that public.

[1]: https://docs.divio.com/documentation-system/
by aj_hackman | 2025-10-10 14:39:53+00:00
It's officially deprecated in favor of Vulkan, but it will likely live on for decades to come due to legacy CAD software and a bunch of older games still using it. I don't share the distaste many have for it, it's good to have a cross-platform medium-complexity graphics API for doing the 90% of rendering that isn't cutting-edge AAA gaming.
by mkishi | 2025-10-10 14:40:32+00:00
It's hard to get that point because you're conflating two different stories.

Folks around here are generally uneasy about tracking in general too, but remove big brother monitoring from Safe Browsing and this story could still be the same: whole domain blacklisted by Google, only due to manual reporting instead.

"Oh, but a human reviewer would've known `*.statichost.eu` isn't managed by us"—not in a lot of cases, not really.
by adlpz | 2025-10-10 14:40:47+00:00
I just come from writing a comment on the other Datastar post on the home page, literally saying that I don't see the point of it and that I don't like it.

But I'm now here to defend Datastar.

It's their code, which, up to now, they built and literally given away totally for free, under a MIT license. Everything (even what "they moved to the Pro tier") should still be free and under the MIT license that it was published under originally.

You just decided to rely and freeload (as, as far as I can tell, you never contributed to the project).

You decided to rely on a random third party that owns the framework. And now you're outraged because they've decided that from now on, future work will be paid.

You know the three magic words:

Just. Fork. It.
by guywithahat | 2025-10-10 14:41:42+00:00
I'm not sure this article would say it but I wonder if it was, at least in part, banned because it's "stealing" content from other apps? It seems like their could be a privacy or usage policy violation in there.

That said, any app who's end goal is to doxx federal agents for doing their job is probably not going to last long on the app store.
by nasmorn | 2025-10-10 14:41:47+00:00
While Shein is enabled by machine weaving it took centuries to find this business model. The first person I heard about buying single use clothing was Michael Jackson allegedly in the 90s and it was seen as the height of eccentricity. Obviously many wealthy people since the 1960 have been rich enough to easily afford throw away clothing (after all they spend as much on meals or flights all the time). It just never occurred to anyone outside of ball gowns or wedding dresses.

In conclusions SHEIN is more of a social phenomenon piggybacking on a hack on the global postal system fee structure.
by modeless | 2025-10-10 14:41:53+00:00
The purpose of banning insider trading in markets is not "fairness". The purpose is to encourage participation. We want to promote investment in the stock market by the general public who don't have insider information, because that stimulates the economy by providing capital for productive businesses.

Prediction markets don't provide capital for productive businesses. The only purpose of a prediction market is to get accurate predictions. Insider information makes the predictions more accurate. Unlike the stock market, we don't need to encourage public participation in prediction markets. In fact we might want to discourage it because it's essentially gambling. Therefore, we should definitely not outlaw insider trading in prediction markets.
by fifticon | 2025-10-10 14:42:16+00:00
as others have warned.. a scary counterexample is the npm ecosystem, where people are gaming it with questionable npm package spam, to get the 'astroturf footprint' of being the author of widely installed packages. (which get their footprint by piggybacking on actual useful packages, akin to stapled-together law packages in the us congress).
by intrasight | 2025-10-10 14:42:54+00:00
Documentation is often wrong, incomplete, poorly written.

If you only have N hours to work on "documentation", I say spend it on examples.

Also AI can probably turn a quality example into a doc whereas it can't turn a doc into a quality example.

Another thing to contemplate. I stand here as a 75 kilo entity - an example. I am, IHMO, a good example. The documentation on this example is so far many millions of page long, is very incomplete, certainly wrong, and could not be used to create said example.
by xphos | 2025-10-10 14:42:56+00:00
Yeah but like Hamburger is not from Hamburg though... Maybe you could say Hamburg steak or something but Hamburgers as we know them almost certainly originated in the US.

I don't think accurate food labeling is a bad thing but the contension shouldn't really be around burger to me that's just a pressed shape of cruft but the veggie part. Because Veggie I feel like implies vegatable but like soy-protein or bean mush or impossible burger all could be classified as a veggie burger but like they are very different things and have very different additives. I don't think we are crushing people or industry by trying to accurately label foods though.

I do think that the protectinism to regional foods confusing though. It would be interesting if you could make "feta" elsewhere than in greece for example, but maybe like the originating countries could get a special sigil rather than an exclusively protected food name when its basically indistingusiable to all but a connoisseur.
by theelderemo | 2025-10-10 14:42:58+00:00
I'm publicly disclosing three high-severity vulnerabilities I discovered in the Suno.com web application on October 9, 2025, after the vendor failed to engage in a proper coordinated disclosure process.

The vulnerabilities are:

Finding 1: Excessive Data Exposure / JWT Token Leakage (High Severity): Critical API endpoints return active JWT session tokens directly in the JSON response body. This allows for session hijacking and account takeover by any malicious browser extension, completely bypassing MFA. Suno's response indicated a misunderstanding of client-side threats, claiming that since the client already has the token, it's not an issue.

Finding 2: Broken Object Level Authorization (IDOR) (High Severity): The API does not validate if a user owns a resource before returning data. This allows any authenticated user to access the private content of any other user, including private songs, prompts, and generation history, simply by enumerating user IDs.

Finding 3: Unrestricted Resource Consumption (DoS) (Medium Severity): A batch endpoint for retrieving songs has no server-side limits on the number of IDs that can be requested. This allows an attacker to trigger resource exhaustion and cause a denial of service.

I attempted to responsibly disclose these findings to Suno. They dismissed the first two findings and, most concerningly, suggested I transmit the full proof-of-concept details through a Google Form. After I rejected this insecure method and offered multiple secure alternatives to which they did not respond, I made the decision to publicly disclose to protect users.

For a full technical breakdown, including disclosure timeline, proof-of-concept code, and remediation guidance for both users and Suno, please see the full advisory
by Imustaskforhelp | 2025-10-10 14:44:35+00:00
Damn Today I learnt that termux doesn't in fact run through proot or is an emulator like userland but that it somehow does it natively using android-ndk

I was using userland which is doing emulation from what i know, my phone for god knows what for some reason doesn't work through termux but now I kinda want to patch an app with termux or something and publishing it to f-droid :p
by sfn42 | 2025-10-10 14:44:39+00:00
This is the right answer. Everyone who disagrees with you are amateurs.

A Javadoc-esque API doc is the minimum requirement for a serious language/library. Examples and tutorials are nice too, but the API doc can be automatically generated in every serious language so not having it is just plain unacceptable.

Tutorials, articles and examples etc are fine too, they can be combined with the API doc like Java does. But that's gravy, on top. You don't have just gravy, it needs to be on top of something and that something is a proper API doc.

This isn't even a discussion in my mind, it's just the right way to do it. It's a solved problem. You optimize for power users not amateurs. 99% of the time when I look up docs what I need is a plain boring API doc, I only need examples in my first week.
by ArnoVW | 2025-10-10 14:44:55+00:00
As a CISO I am happy with many of the protections that Google creates. They are in a unique position, and probably the only ones to be able to do it.

However, I think the issue is that with great power comes great responsibility.

They are better than most organisations, and working with many constraints that we cannot always imagine.

But several times a week we get a false "this mail is phishing" incident, where a mail from a customer or prospect is put in "Spam", with a red security banner saying it contains "dangerous links". Generally it is caused by domain reputation issues, that block all mail that uses an e-mail scanning product. These products wrap URLs so they can scan when the mail is read, and thus when they do not detect a virus, they become defacto purveyors of virii, and their entire domain is tagged as dangerous.

I have raised this to Google in May (!) and have been exchanging mail on a nearly daily basis. Pointing out a new security product that has been blacklisted, explaining the situation to a new agent, etc.

Not only does this mean that they are training our staff that security warnings are generally false, but it means we are missing important mail from prospects and customers. Our customers are generally huge corporations, missing a mail for us is not like missing one mail for a B2C outfit.

So far the issue is not resolved (we are in Oct now!) and recently they have stopped responding. I appreciate our organisation is not the US Government, but still, we pay upwards of 20K$ / year for "Google Workspace Enterprise" accounts. I guess I was expecting something more.

If someone within Google reads this: you need to fix this.
by SanjayMehta | 2025-10-10 14:45:23+00:00
Patel was under the thumb of Gandhi.

Gandhi is the one who made Patel step aside in favour of Nehru, despite the latter losing the April 1946 election for the role Congress president; the understanding with the British was that the President of the Congress would be the first PM.

Gandhi had a history of appeasement and compliance (see "The South African Gandhi" by Vahed and Desai) to the British, so Patel could be considered compromised indirectly. Personally I don't believe Patel was a stooge, just a victim of the personality cult around Gandhi.

As for "Azad" - real name Abul Kalam Ghulam Muhiyuddin - I have not looked into his history.
by cestith | 2025-10-10 14:45:27+00:00
As one of several people, yes. In-kind contributions to causes and now (with Citizens United) candidates are not limited. You don’t have to be a nation state to hire human influencers, bot farms, coders to create new bot farms, or to influence search results and LLM outputs. You just have to have the cash or control to do it.

Years before he was President, in 1989, Trump himself took out four full-page newspaper ads in all four major NYC newspapers of the time calling for the deaths of the Central Park Five and broader use of the death penalty in general. The railroaded teenagers were later exonerated, thankfully without first being killed by the government. That’s just a small example of the kind of influence money can have on public discourse, well before everyone had a smartphone in their pocket.
by jsheard | 2025-10-10 14:45:42+00:00
It's steadily getting better as they keep walking back aspects which turned out to be needlessly complex, or only needed to be complex for the sake of older hardware that hardly anyone cares about anymore, but yeah there's still a way to go. Those simpler ways of doing things are just grafted onto the side of the existing API surface so just knowing which parts you're supposed to use is a battle in itself. Hopefully they'll eventually do a clean-slate Vulkan 2.0 to tidy up the cruft, but I'm not getting my hopes up.
by RiverCrochet | 2025-10-10 14:45:48+00:00
> Mainstream Hollywood can’t use genAI in a way that doesn’t get push back because like every other intentionally built industry, it’s primarily focused on maintaining labor infrastructure for people who join the “entertainment industry.”

Agree. But Hollywood is dying, both in a similar fashion and for a similar reason as the music industry. It grew up around physical content limitations - people needed to go to theaters to see movies. The Internet destroyed that limitation.

> it’s primarily focused on maintaining labor infrastructure for people who join the “entertainment industry.”

Draconian IP laws are part of this. Interestingly, if look you at things from the late 90's over the 2000's and 2010's, this factor didn't make the Internet less attractive as an entertainment option, but instead made non-celebrity culture something more people chose and cared about. Hence the rise of YouTube and social media.

> History indicates that transactional consumers don’t care about any supply chain, value steam etc…or labor share of a market.

They don't, but people are tired of Hollywood franchise reboots. There was something on here about how anime is popular because it's actually doing new franchises instead of the same rehashed stuff, and it was absolutely right.

GenAI, in the sense of being something used by financed producers, assuming it gets good enough for people to not notice too much, will much more easily fall into that trap.

The real future is me, in 2045, signing on to Netflix, providing a couple inputs like talking about the type of movie I want to see, maybe a webcam recording me demonstrating some things in addition to just speaking what I want, and a GenAI generates one for me right then and there. Real people as celebrites won't exist anymore, memes will be the new celebrites: they'll all be characters other people request to see in generated movies, and their lifecycle will be about the same as Tiktok memes today. Theaters by this time will be bulldozed and have become mini nuclear power plants, with big NVIDIA logos on them.
by ericselin | 2025-10-10 14:45:52+00:00
The thing is, you cannot just add any domain to the PSL. You need a significant amount of users before they will include your domain. Before recently, there really was no point in even submitting, since the domain would have been rejected as too small. An increase in user base, increase in malicious content and the ability to add your domain to the PSL all happen sort of simultaneously.

I'm also trusting my users to not expose their cookies for the whole *.statichost.eu domain. And all "production" sites use a custom domain anyway, which avoids all of this anyway.
by apple1417 | 2025-10-10 14:46:15+00:00
On a recent 12h Air New Zealand flight I went on they offered free wifi for everyone. They say you can:

- Browse the web.

- Send and receive emails and messages.

- Check and post to social media

In practice I think they just whitelist a few messenger apps. Everything else was unusable - I couldn't even load this site. Only had my phone so couldn't check if I was actually receiving any bytes from other sites, but it at least wasn't immediately blocked.