MurphyA/hacker-news huggingface dataset:
by ACCount37 | 2025-10-22 12:57:10+00:00
The interface definitely should be implemented at the browser level.

If a user sets "allow performance telemetry, deny fingerprinting, ads, tracking" or "decline everything non-vital" once in the browser settings, he should never see a cookie banner ever again - with all of that communicated to the websites by the browser for him, and the websites being obligated to respect the user preferences.

The cookie banner vomit should be reserved only for browsers that don't support that. The fact that this obnoxious behavior somehow became the Internet's default is an atrocity.
by nasmorn | 2025-10-22 12:57:14+00:00
We use it to play music in the car on Spotify sometimes. While it is really bad ad this we found out it mishears quite reliably so there are now some crazy things that I would have never played myself that my family has heard in the car. This has brought a lot of joy to some mundane drives.

But when I am alone on a run I really wished it would just work because without someone else to laugh about it, it really sucks
by code_biologist | 2025-10-22 12:57:15+00:00
Reading Erowid trip reports persuaded me to try high dose tripping on Robitussin (DXM). From Wikipedia:

The first plateau (1.5 to 2.5 mg per kg body weight) is described as having euphoria, auditory changes, mild stimulation, and change in perception of gravity.

The second plateau (2.5 to 7.5 mg/kg) causes intense euphoria, vivid imagination, and closed-eye hallucinations.

I like recovered.org's description of fourth plateau dose experiences:

The fourth plateau (at extremely high doses) can cause complete disconnection from reality, a sense of entering “another universe,” and a loss of sensory contact with the environment.

Sounds about right. Definitely kills some brain cells, but a hell of a ride. Would not recommend it if you don't like dissociatives.
by giuliomagnifico | 2025-10-22 12:57:37+00:00
There aren’t many details available yet, but you can find some information here: https://treblle.com/blog/jlr-breach-breakdown-analysis

The main issue appears to be that the attack crippled JLR’s internal systems and production databases, preventing them from manufacturing new cars because they cannot properly track parts or generate serial numbers.

I’ve also read reports claiming that around 40k vehicles have already been built but are now essentially “ghost cars” since they aren’t registered in the system.

Imagine what would happen if JLR had to issue a safety recall without knowing which components are installed in which vehicles.
by DyslexicAtheist | 2025-10-22 12:57:45+00:00
some info here https://www.cyfirma.com/research/investigation-report-on-jag...

> The breach was enabled through stolen Jira credentials harvested via Infostealer malware, a known hallmark of HELLCAT’s operations. The exposed data includes development logs, tracking information, source code, and a large employee dataset with usernames, email addresses, display names, and time zones. The presence of verified employee information from JLR’s global workforce raises significant concerns about identity theft and targeted phishing campaigns.

then

> the JLR breach escalated when a second threat actor, “APTS,” appeared on DarkForums on March 14, 2025. APTS claimed to have exploited Infostealer credentials dating back to 2021, belonging to an employee who held third-party access to JLR’s Jira server. Using these compromised credentials, the actor gained entry and shared a screenshot of a Jira dashboard as proof. APTS also leaked an additional tranche of sensitive data, estimated at around 350 GB, which contained information not included in Rey’s original dump, further amplifying the scale and severity of the breach.
by soburn | 2025-10-22 12:57:48+00:00
Every jurisdiction has its own rules but in broad strokes: receiving a package containing drugs isn’t illegal, otherwise, anyone could send their enemy drugs.

To safely receive drugs through the mail, you do not do anything clever (like mailing them to an empty house) instead you behave in a way that gives you plausible deniability. And you do not do anything that would lead police to think you’re distributing.

Order small, personal use quantities to your name and your address and leave the package on your counter for a couple of days after it arrives. If the police show up, say you didn’t recognise the package and left it on the counter until you had time to return it to the post office.

Where you’re ordering from and to matters too. Ordering from the Netherlands into Australia almost guarantees the drugs will be found because all international mail is processed by Australia’s postal service and the Netherlands is an obvious source country. Order nationally to avoid processing.

Ultimately, it’s just like buying drugs on the street: be a nobody buying for personal use.

The biggest risk is that inevitably the seller will eventually get busted and your address will be in the seller’s records. If you’ve bought large quantities, the police will see you as a dealer and try to catch you in a sting. The best sellers do not keep records for this reason, but it’s something you won’t know until they get caught. If you buy personal use quantities, the police aren’t going to waste time on you, even if they have records of your orders.
by whywhywhywhy | 2025-10-22 12:58:04+00:00
The problem is exactly the law then because it was written so incompetently that it left the loopholes to allow websites to try and trick accepting.

Should have been written in the law that it’s a one toggle in browser settings.

If government is going to impose on the internet the least they could do is be competent in what they impose. Not writing laws that waste lifetimes in collective hours a day as every person in Europe deals with multiple of these dialogs a day and thousands a year.
by JustExAWS | 2025-10-22 12:58:04+00:00
The question is why is AWS a shining star for you even if all of those issues are addressed? Having AWS on your resume as a developer doesn’t set you apart from hundreds of thousands of other developers who were able to grind enough leetcode to make it in BigTech.

True, it opened a lot of doors for me - some I chose not to go through. But I went into ProServe working in the consulting division, became a major contributor to a popular open source “AWS Solution” in its niche and made industry contacts by working with outside companies.

You don’t have to memorize LPs. You just have to know how to answer standard behavioral questions like I’ve done a million times before and since - 30 years across 10 jobs.

Every tech company that pays top of market requires coding screens and all of the BigTech companies are forcing RTO and they all have a toxic work culture.

It’s par for the course if you want to make the money they offer.

Google is no better if you look at the leveling guidelines. It’s still based on politics and working on the new and shiny - the reason they have so many products that go nowhere and at one point had 5 or 6 messaging apps simultaneously.

I think you are looking at BigTech - any of them - through rose colored glasses
by GJim | 2025-10-22 12:58:07+00:00
If your asking if the GDPR is effective, yes, it is.

The only ones ignoring it completely are either dodgy companies, or the clueless. The companies exercising malicious compliance are now (quite rightly) increasingly seen as dodgy and need to up their game if they want to become respectable.

The days of not protecting user data are over.
by troupo | 2025-10-22 12:58:08+00:00
As always, there are some nebulous "processional" and "vetted" (by whom) distirbutions that will serve "better" (what is the definition of "better")? And it's always a different set. The article doesn't even pretend to qualify why the distributions it picked are better. It even goes as far as saying "If that’s still not to your liking, maybe explore something completely different." and links to distrowatch, as if that's helpful
by bArray | 2025-10-22 12:58:19+00:00
> A pop-up, a slide-in, a full-screen overlay demanding you "Accept All," "Manage Preferences," or navigate a labyrinth of toggles designed by a corporate lawyer.

It's the dark patterns and lack of consistency that makes it worse. Some websites even refuse to allow you to reject data collection unless you pay to use their service (i.e. news websites)!

As others have echoed, we just need to make this large data collection illegal.
by Moomoomoo309 | 2025-10-22 12:58:38+00:00
I can believe it, though I believe it to be untrue. SJW is not a neutral term. In the same way that the word "woke" has been corrupted, SJW now almost exclusively refers to dyed-hair screaming women making mountains out of molehills to try to strongarm people into policing things they don't like. It did not used to mean that, but it is now used primarily pejoratively, not descriptively, like "woke".
by cduzz | 2025-10-22 12:58:41+00:00
I haven't used minio in years, and when I did I only fiddled around with it, but my recollection of it is that it's about the simplest build chain imaginable. Install modern golang, build minio, get single binary.

Anyone relying on an opensource tool like minio, needs to look at:

* organization supporting it * the license * the build chain * who else uses it? * the distribution artifact needed for production.

Once you've looked at that you can decide "is this an anchor I want to handcuff myself to and hope the anchor won't jump into the icy blue deep taking me and my dreams with it?"

If the org behind it ever decides to rugpull/elastic you, what're you gonna do? At least with something like minio, if they're still distributing the source it's trivial to build (and if you can't build it you should evaluate if you're in a position to rely on it).

Let's look at other cool open source things like SigNoz which distribute only docker artifacts (as far as I remember, anyhow) -- if they were to rugpull that people relying on it would be totally lost at sea.

This isn't to say that this isn't poor behavior on minio's part, but I feel like they've been signaling us for a while that they're looking to repay their VC patrons.
by hirako2000 | 2025-10-22 12:58:58+00:00
Exactly that, and how regulations are a sinking costs, at times for absurdly poor impact.

the solution is simple, shift the cost of compliance, onto regulators!

it would work like this:

1/ Somewhat competent but disconnected from reality politicians vote for adding yet another rule.

2/ Incompetent, disconnected from reality, so called Experts articulate how to implement the rule.

3/ Estimate costs and report back to clouded brains up there.

4/ Clouded brains but budget wise acute, look at the numbers, and say no way

I bet we would get regulations that would always be welcomed by industries.

We could start by rolling everything back, the "economy", you bet, would finally "recover".

Without incentive to make it right, it can't be a surprise you get what you seeded for.
by fart-fart-FART | 2025-10-22 12:59:47+00:00
there are more complex tests in that benchmark. my point was, a decent server can serve tens or hundreds of thousands requests per second when it's a few kilobytes of static content from a RAM database.

as long as your web service isn't horribly mismanaged, even to a $5 VPS the bot traffic is infinitesimal background radiation.
by phkahler | 2025-10-22 12:59:51+00:00
>> Most people do the same thing: sigh, their eyes glaze over, and they click "Accept All" with the muscle memory of a weary soldier.

My instinct is to find the other option is either easy or obfuscated a little bit. But the EU regulation requires that it not take more than 2 clicks to do the other thing.

I thought cookies were kind of evil back in the 1990's and I still think they need to go away entirely.
by ben_w | 2025-10-22 12:59:59+00:00
My least-favourite is websites with the "Pay or OK" model: "If you don't want more companies tracking you than were people in your high school, teachers and students both, you must pay us! [Pay] [Accept tracking]"

*Copy URL, close window, open private browsing session, paste*

As an aside, is anyone else getting LLM-writing-style vibes from the linked page, or is that just me?
by luizfelberti | 2025-10-22 13:00:08+00:00
Do not reference these kinds of docs whenever you need practical, actionable advice. They serve their purpose, but are for a completely different kind of audience.

For anyone perusing this thread, your first resource for this kind of security advice should probably be the OWASP cheatsheets which is a living set of documents that packages current practice into direct recommendations for implementers.

Here's what it says about tuning Argon2:

https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
by kayhantolga | 2025-10-22 13:00:25+00:00
I think there’s a small detail missing. Most browsers also track user behavior and use your data. I can’t imagine big tech companies fighting each other in court just to give you the best internet experience. The idea sounds good in theory, but in practice, I don’t think it would change much. What we really need are regulations that truly understand business models and target and punish those that abuse them.

For example, right now any company can ask for your consent ten times a day until you give up, and once you click “yes” even once, your data begins an eternal journey.

A few months ago, my Samsung TV (which I bought four years ago) suddenly blocked everything and displayed a new agreement on the screen with only two options: Read and Agree. There was no way to use the TV without accepting the agreement.
by QuantumNomad_ | 2025-10-22 13:00:38+00:00
> How do you know XYZ repo isn't coded for some bootcampers capstone project?

I gate access to my homelab using Wireguard.

Wireguard is widely deployed across the world, and has been worked on for years.

No random new repo that was vibe coded can measure up in the slightest to that.
by boudin | 2025-10-22 13:00:39+00:00
Why would he have a treatment of favor? Almost every person convicted in his situation has a an execution provisoire, there's no special treatment here. Same for lepen.

Let's put things straight, both of them are criminals, giving them a treatment of favor would be insane.

And to show how morally corrupted they are, both of them have been really loud about a no tolerance justice system. I guess that speaks for itself.
by Madmallard | 2025-10-22 13:00:39+00:00
If only AI was not completely and utterly useless for any unique problems for which there isn't extreme amounts of available training data. You know, something any competent programmer knows and has already known for years. And these problems end up being involved in basically every single non-trivial application and after not very long into development on those applications. If only AI didn't very readily and aggressively lead you down very bad rabbit holes when it makes large changes or implementations even on code-bases for which there is ample training data, because that's just the nature of how it works. It doesn't fact check itself, it doesn't compare different approaches, it doesn't actually summarize and effectively utilize the "wisdom of the crowd", it just makes stuff up. It makes up whatever looks the most correct based on its training data, with some randomness added. Turns out that's seriously unhelpful in important ways for large projects with lots of different technical and architectural decisions that have to make tradeoffs and pick a specific road among multiple over and over again.

Really sick and tired of these AI grifters. The bubble needs to pop already so these scammers can go bankrupt and we can get back to a rational market again.
by hollywood_court | 2025-10-22 13:00:45+00:00
I don't understand how Jaguar/Land Rover is still even a thing. This is unrelated to the hack, but they consistently make the most unreliable vehicles you can buy.

When I had my import repair shop, I made a fortune repairing Jags and LRs. My business partner named his lake house 'Discovery' because of all the money we made off of those things.
by TacticalCoder | 2025-10-22 13:00:46+00:00
That's not the issue. The issue is that there are hundreds, if not thousands, of french politicians who should be in jail.

I don't disagree with him going to jail: but it's one heck of a corrupt country where they all have their hands in the cookie jar.

Most french politicians who served at the EU, for example, have friends and family as "employees" on their payroll (well, on the EU citizens' payroll). Same at non-EU level: it's called "emplois fictifs" in french ("fictional jobs"). Soooo many stories about politicians at so many local, regional, national and supra-national levels engaging in "emplois fictifs".

So many mayors in France have dirty money on their hands. Where for example they block construction permits then, once joyfully greased with cash, allow the construction permits.

But Sarkozy was right-wing and the EU, and France in particular, is ultra left-wing. So it's good to put a right-wing president in jail.

Once again: I've got nothing against him going to jail. But we're talking about a country were judges are openly leftists. They're not impartial.

It's all rotten and disgusting.

And why do you think all the leftist french mainstream media root for right-wing Sarkozy? Because these media are at the hand of corrupt politicians who think a politician going to jail is a dangerous precedent. They're nearly all corrupt, so they're shitting their pants to see that even a president is sent to jail.

But yup: one politician in jail. Great. Only 9999 more to go. And corrupt judges.
by jeroenhd | 2025-10-22 13:01:00+00:00
DNT doesn't solve all problems, though. Not only is DNT being deprecated, it also lacks the proper customisability the law actually prescribes for data processing.

There's no value you can give DNT that says "you can do your own on-site tracking and telemetry and I accept sharing my data with Sendgrid for your newsletter, but I do not want third-party trackers".

As a practical example: there are news sites that will not play videos if you hit "deny all" because their video host does some viewership analytics. I'm fine with that, but not the 750 other advertisers the news site tries to have me track.

Of course, "deny all" should be an option, "accept all or deny all" isn't control.

For the longest time we had https://en.wikipedia.org/wiki/P3P as a basis to build on, but that officially died the day Edge became Chromium-based.
by buellerbueller | 2025-10-22 13:01:11+00:00
That's the debate we should be having, but aren't. It isn't by definition "reckless." It is a calculated risk. The thing with science and exploration is that you never know what is at the end of it. Maybe we should just give up science and exploration?

>The public has spend billions of dollars on this program, if the end result is astronauts getting cooked during reentry then how could that possibly be an outcome worth the expense?

The public has spent [tons of 15th century money] on earth exploration. If the end result is sailors drowning, then then how could global exploration be an outcome worth the expense?
by oabraham1 | 2025-10-22 13:01:17+00:00
Hi HN! Ojima here.

This started as a side project to solve GPU sharing conflicts in research labs. One GPU, many grad students, constant headaches.

Key idea: time-based allocation with automatic expiration. Simple but effective.

Performance: < 1% overhead, sub-5ms operations. Works on any OpenCL GPU.

Implementation details (since this is HN): - Filesystem locks for inter-process coordination - Background thread for expiration monitoring - Memory enforcement via OpenCL buffer tracking - C++ core, Python bindings, cross-platform

Built this nights/weekends. Apache 2.0 licensed. Would genuinely appreciate feedback - especially if something breaks or if the approach is fundamentally flawed!

Happy to answer questions about the implementation or design decisions.
by mannykannot | 2025-10-22 13:01:30+00:00
LLMs are capable of performing the task specified for the Chinese room over a wide range of complex topics and for a considerable length of time. While it is true that their productions are wrong or ill-conceived more often than one would expect from a well-informed human, and sometimes look like the work of a rather stupid one, the burden now rests on Searle's successors to show that every such interaction is purely syntactic.
by sReinwald | 2025-10-22 13:01:33+00:00
This screams of classic techno-optimist "just build one simple solution" mindset.

Yes, consent fatigue is real and nobody likes these cookie banners. Which is also the exact reason why I think they are important. Making tracking visible to the user is the point. It creates an actual "cost" for tracking by forcing websites to actively ask the user to consent. The moment you hide it in a one-time set-and-forget browser setting is the moment when informed consent dies, tracking becomes invisible, and accountability disappears.

We are also looking at very perverse incentives here: Who controls the biggest browsers? Google's Chromium is basically the engine behind 80% of the browser market right now. Apple and Microsoft aren't exactly neutral parties either. Google is an advertising company, and Apple and Microsoft still have a huge interest in data. The idea that you should trust these parties to implement a "simple" consent system that runs counter to their business model is... optimistic, to put it mildly.

You would also have to trust websites to accurately categorize their cookies. If your cookie preferences are a set-and-forget setting in your browser, are you sure that random website you just visited didn't declare Google Analytics as "essential" for their website to work? Are you going to check?

The blog post also assumes cookie preferences are universal, but perhaps I'm okay with analytics on a random tech blog but absolutely not on a website about medical issues.

The funniest part: The "Do Not Track" signal already exists, and it failed spectacularly. The post even mentions it. DNT was supposed to be exactly this simple, browser-level signal. And websites just ignore it.

Sidenote:

> Imagine if every time you got into your car, you had to manually approve the engine's use of oil, the tires' use of air, and the radio's use of electricity. It’s absurd, right? You’d set your preferences once, and the car would just work.

Yes, absurd. Except that's more or less happening with different features. Every time I start my car, I need to manually disable the speed limit warning because it's annoying, and the lane keep assist because I feel like it is overly aggressive and sometimes genuinely dangerous. Also, the analogy is exceptionally weak. The author compares mechanical necessities (oil, air) with optional data extraction. That's hardly the same thing. Cookies required for basic functionality of websites is usually enabled by default. A more appropriate equivalent would be a popup by the car's dealership asking you to track everywhere you drive, and how fast, and if you looked at some billboards along the way.
by dns_snek | 2025-10-22 13:02:07+00:00
> it left the loopholes to allow websites to try and trick accepting.

It did not. These practices are illegal under the GDPR, the problem is a chronic lack of enforcement by most national enforcement agencies in all but the most severe cases.

Some are just ineffective but others have gone completely rogue. Swedish Data Protection Authority (DPA) for example takes the position that commercial data brokers like Mrkoll are allowed to publish and sell people's personal information (including your current home address, hello stalkers!) [1] and that this is somehow protected under the pretense of "journalism" [2].

[1] https://mrkoll.se/resultat?n=Otto&c=&min=16&max=120&sex=a&c_...

[2] https://noyb.eu/en/swedish-data-brokers-claim-journalists-le...