MurphyA/hacker-news huggingface dataset:
by gorniv | 2025-10-22 21:39:45+00:00
On May 3rd, 2025, Sign in with Apple suddenly broke.

Around 30% of users couldn’t log in anymore: their userIdentifier silently changed, and the email field started returning null. Some accounts even “came back to life” for a short time - then disappeared again. It didn’t look like a normal migration or integration issue.

We filed a detailed bug report and a DTS case (FB17664946 / Case 13610776) explaining everything: same bundle, no code changes, stable since April 30, and the issue started suddenly.

It took five months for Apple to reply. And the reply, in full, was basically:

“Your app was once transferred between teams. Please read TN3159: Migrating Sign in with Apple users for an app transfer.”

That’s it. No explanation of why the problem appeared almost a year after the transfer. No answer to why some users temporarily recovered, or why the userIdentifier changed in the first place.

⸻

The real question: why change userIdentifier at all?

userIdentifier is not a token, not an email alias, not a JWT claim. It’s supposed to be a stable, internal ID - the only reliable way to match a user to their data.

Changing it is like deciding to replace every user’s primary key in a production database just because the app moved to another developer account. Sure, rotating emails or tokens makes sense for privacy. But rotating the internal ID of a user? That’s an architectural nightmare.

Apple’s approach essentially offloads a manual “ID migration” problem to developers - something most apps can’t safely implement, because it means rewriting their identity model. And the official documentation that describes this risk? Hidden deep in a technote (TN3159) no one ever sees until it’s too late.

⸻

Five months later

So yes - technically, Apple did reply. But it took five months just to tell us to “read the doc,” without explaining why this behavior even exists, why it triggered a year late, or why anyone thought changing a persistent user ID was acceptable in the first place.
by ahnick | 2025-10-22 21:39:47+00:00
> It isn't that this can't be enforced, it just lagged because of the size and changes that this law brought.

How long have these laws been out and we are still dealing with these issues. They seem to have gotten worse, not better.

> How does it solve itself?

People build services that don't track others and people pay for those services. It's pretty simple.

> Due to website operators doing illegal things.

If it was so illegal it would be stopped, but apparently businesses are indeed complying with the law.

> Why would people care about something they don't know about?

It's well known that cookies track you across sites and some people choose not to use those sites. The sites are required to disclose this information, so users are definitely aware.
by immibis | 2025-10-22 21:39:51+00:00
Sure there is, if the attacker has to fulfil some basic obfuscation then it cuts down on the amount of crypto work you have to do before ignoring the packet.

It's not extra security but it is a little extra efficiency.

Wireguard has something like this built in though, the PresharedKey (which is in addition to the public key crypto, and doesn't reduce your security to the level of a shared-key system). It's still more work to verify that than a port knock however.
by whatevertrevor | 2025-10-22 21:40:56+00:00
To me, it's the opposite. I think the words used are not exactly well-thought-through, but what they seem to want to be saying is they want less bureaucratic overhead, smaller teams responsible for bigger projects and impact.

And wanting that is not automatically a bad thing. The fallacy of linearly scaling man-hour-output applies in both directions, otherwise it's illogical. We can't make fun of claims that 100 people can produce a product 10 times as fast as 10 people, but then turn around and automatically assume that layoffs lead to overburdened employees if the scope doesn't change, because now they'll have to do 10 times as much work.

Now they can, often in practice. But for that claim to hold more evidence is needed about the specifics of who is laid off and what projects have been culled, which we certainly don't seem to have here.
by sp4rki | 2025-10-22 21:41:05+00:00
I agree... but not at the engineering level.

This is, IMO, a leadership-level problem. You'll always (hopefully) have an engineering manager or staff-level engineer capable of keeping the dev team in check.

I say it's a leadership problem because "partnering with X", "getting Y to market first", and "Z fits our current... strategy" seem to take precedence over what customers really ask for and what engineering is suggesting actually works.
by chermi | 2025-10-22 21:41:18+00:00
You forget that everything related to cars is just a bonus, as Tesla is no longer a car company ;) ""We should be thought of as an AI robotics company. If you value Tesla as just an auto company—it’s just the wrong framework." edit- just noticed how little focus there was on optimus. Maybe they can't play up an uproven product too much for SEC compliance resason.

That being said, every time there was some event or report or earning that I thought the tesla stans would finally see as negative and thus stock drop, I've been wrong. I guess the sales drops for 1 quarter actually effected the stock some time earlier this year.

Everyone in SV that isn't filled with Musk hate always says "Don't bet against Elon". And they've been proven right many times, no matter how much people don't want to admit it. Maybe this time is different, nothing lasts forever. For any standard CEO, the NASA news, the starship delays, the tesla sales, the embarassing tesla demos... people would be very reasonable to predict failure and even full-blown implosion. But I for one won't be taking out any short positions any time soon.

Specifically for tesla, I do think it's very possible that this is top revenue quarter for at least year, if not forever. But I just can't make myself completely discount the possibility of them succeeding wildly with robotics. He and his team have pretty impressive experience in cross-sections no one else has. They've built complicated physical things AND they've developed and deployed complicated controls/automation technology (FSD, Falcon/Starship) AND they've done so profitably, at least at times. Just the supply chain expertise is top tier, especially important with China shit. A successful robotics company will have to have all of that, and Tesla does. That being said, I don't understand how you can say stuff as stupid as, paraphrasing, "Having more sensors (lidar) can actually make things worse" and lead companies who must have controls knowledge/expertise as a core competency. I can only assume he knows he's full of shit and is playing to his loyalists who will eat it up as a valid critique of other self-driving efforts.
by immibis | 2025-10-22 21:41:58+00:00
It is a VPN. The point was to block all external traffic except for VPN traffic. Then make sure your VPN is secure, and you're all set. When you want to connect to some service, connect to the VPN first and then connect to the service through the VPN. Then all your traffic has actual security and not just some light obfuscation via secret handshake.

IMO, "only wireguard" is too restrictive of a policy - I also trust openssh and nginx to be open to the internet, if configured moderately carefully. Most FOSS servers that are widely deployed on the internet are safe to be deployed on the internet, or we'd know about it. I reviewed something that's not widely deployed on the internet though (Apache Zookeeper) and couldn't convince myself that every code path was properly checking authentication. That would have to go behind a VPN.
by bigyabai | 2025-10-22 21:42:06+00:00
Selling to defense requires that you abandon every pretense of free market economics and moral righteousness to appease the government: https://en.wikipedia.org/wiki/Last_Supper_(defense_industry)

If you expect to be owed anything for competitive technology, frugal design or a "moral code" then you probably don't want to work in the defense sector.
by softwaredoug | 2025-10-22 21:42:19+00:00
The only studies we have are long term longitudinal. IE this one:

> After adjustment for confounding, there were statistically significant positive associations for people reporting four or more ACEs relative to those reporting no ACEs, and this was true for all chronic diseases except hypertension.

https://pmc.ncbi.nlm.nih.gov/articles/PMC8462987

A twin study would be about as close as we could get to a randomized control trial:

https://jamanetwork.com/journals/jamapsychiatry/fullarticle/...

I'm willing to use the term "cause" here, given the copious amount of studies controlling for other confounders. That's the best we can do given there's no ethical way to run a randomized control trial.
by nearbuy | 2025-10-22 21:42:21+00:00
He's relaying what the textbook he cited claimed. You'll have to check the textbook for their sources. Getting into the weeds about different theories for why various hunter-gatherer societies have lower rates of PTSD is rather off-topic for this blog post. They're just trying to raise a few counter-examples to trauma causing this dysfunction and suggest that unhealthy people or people with abnormal brain scans may be more susceptible to trauma. This would invalidate many of the arguments in The Body Keeps the Score.
by roarcher | 2025-10-22 21:42:29+00:00
I think AI has its place in special effects, but "making a blockbuster movie for $1000" requires replacing all the actors, music, cinematography, everything that makes a movie "art" except maybe the plot. And I have never seen anyone respond well to AI "art" of any form. I've seen some fairly passable (if a bit boring) AI music passed around on Reddit and it was universally met with disgust simply because it was AI.
by Gigachad | 2025-10-22 21:43:14+00:00
The Xbox died the moment they announced it would require a constant connection to the Kinect, and internet in order to function. Even after backtracking from that, it never recovered. There’s also just a lack of reason for it to exist anymore. The PlayStation fills the need for a high power console, Nintendo offers something portable and gimmicky, what would Xbox even offer here?

These days most consoles run fairly standard hardware and games are programmed to be generic and published on every console.
by amterp | 2025-10-22 21:44:01+00:00
Love this, lots of great ideas I'll be stealing :)

Folks interested in scripting like this might like this tool I'm working on https://github.com/amterp/rad

Rad is built specifically for writing CLI scripts and is perfect for these sorts of small to medium scripts, takes a declarative approach to script arguments, and has first-class shell command integration. I basically don't write scripts in anything else anymore.
by jchw | 2025-10-22 21:44:02+00:00
Honestly, I think it's just something you either like or don't. If all you were trying to do was understand SSA, I agree this blog post is probably inefficient at that particular task, but often blog posts are entertainment as much as education, so meandering through a bunch of different things along the way is part of the deal. Personally I thought there were a lot of pretty interesting insights that I haven't seen a lot of discussion about in other places, though I will admit I mostly learned about SSA from Wikipedia and from people yelling about compilers online.
by imiric | 2025-10-22 21:44:39+00:00
I've heard this often, but I'm going on ~25 years of using Linux, and I would be lost without my dotfiles. They represent years of carefully crafting my environment to suit my preferences, and without them it would be like working on someone else's machine. Not impossible, just very cumbersome.

Admittedly, I've toned down the configs of some programs, as my usage of them has evolved or diminished, but many are still highly tailored to my preferences. For example, you can't really use Emacs without a considerable amount of tweaking. I mean, you technically could, but such programs are a blank slate made to be configured (and Emacs is awful OOB...). Similarly for zsh, which is my main shell, although I keep bash more vanilla. Practically the entire command-line environment and the choices you make about which programs to use can be considered configuration. If you use NixOS or Guix, then that extends to the entire system.

If you're willing to allow someone else to tell you how you should use your computer, then you might as well use macOS or Windows. :)
by jack_pp | 2025-10-22 21:45:30+00:00
You should read https://www.fimfiction.net/story/62074/friendship-is-optimal.

Even tho the creator says LLMS aren't going in that direction it's a fun read, especially when you're talking about VR + AI.

Author's note from late 2023: https://www.fimfiction.net/blog/1026612/friendship-is-optima...
by deivid | 2025-10-22 21:45:43+00:00
C at least has const ptr. In go I've seen pointers mutated 7 levels down the callstack. And of course, the rest of the sphagetti depended on those side effects.

C is so limited that you would try to avoid mutation and even complex datastructures.

Go is "powerful" enough to let you shoot yourself much harder.

Go with `const` and NonNull<ptr> (call it a reference if you need) would be a much nicer language
by AnthonyMouse | 2025-10-22 21:46:35+00:00
The problem here is that people need some way to know if doing something will incur a penalty before they actually do it.

One way to do that is to interpret the law strictly according to the text, or in the case of ambiguity to choose the interpretation that benefits the accused rather than the government. Then you could just read the law to know if it prohibits what you want to do, because unless it unambiguously does, then it doesn't. And then if the government doesn't like it once they see someone doing that, it's up to them to change the law.

Another is to give people a way to get clarification ahead of time. This is called advisory opinions and governments generally hate them because as soon as you allow it, the government is going to be absolutely swamped with requests for clarification because everybody wants to pre-clear everything they're going to do rather than take the risk of getting punished for doing something without clearing it. But in order for this to work, getting a clarification has to be cheap, because "pay a million dollars for an advisory opinion to avoid the risk of a million dollar fine" isn't a real solution to the problem of people getting punished when the law is unclear.

So the first one is actually better, the only "problem" with it is that you need the government to be paying attention and promptly rework the law when it isn't having the intended effect, otherwise you'll have people complaining about it because in the meantime there is a dumb law on the books. But if your government is bad at making good laws then you're going to have a bad time no matter what.
by fluoridation | 2025-10-22 21:46:38+00:00
>it is possible for there to be one person with two natures just as well as there can be one person with two titles.

Of course, but that falls apart as soon as you reread the dogma. Jesus is entirely human and entirely divine. He is both things in the same way at the same time. He has to be entirely human for his sacrifice to have any meaning, but he has to entirely divine... I can't remember why. So he could be worshiped?

A man who is both a doctor and a judge isn't entirely either one. There are moments of his day where he is neither presiding over a courtroom nor seeing any patients, and there are parts of his body that are neither judicial nor medical. More importantly, when he passes sentence he doesn't exercise his medical privileges, and when he prescribes medicine he doesn't do it in a judicial capacity. Even if both aspects bleed somewhat into each other, they're still mostly compartmentalized.

None of this can apply to Jesus, if the word "entirely" or "fully" means anything. If he dies, he must simultaneously die like mortals do and live on like deities do. So which is it? Did he die or didn't he?
by wkat4242 | 2025-10-22 21:46:38+00:00
Tbh yes. I like AI but I'm getting a bit sick of the hype. All our top dogs want AI in everything no matter whether it actually benefits the product. They even know it's senseless but they need to show the shareholders that they are all-in on AI.

It's really time for this bubble to collapse so we can go back to working on things that actually make sense rather than ticking boxes.
by donmcronald | 2025-10-22 21:46:54+00:00
I tried to submit this, but the direct link here is probably better than the Reddit thread I linked to:

https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a...

I had my personal domain I use for self-hosting flagged. I've had the domain for 25 years and it's never had a hint of spam, phishing, or even unintentional issues like compromised sites / services.

It's impossible to know what Google's black box is doing, but, in my case, I suspect my flagging was the result of failing to use a large email provider. I use MXRoute for locally hosted services and network devices because they do a better job of giving me simple, hard limits for sending accounts. That way if anything I have ever gets compromised, the damage in terms of spam will be limited to (ex) 10 messages every 24h.

I invited my sister to a shared Immich album a couple days ago, so I'm guessing that GMail scanned the email notifying her, used the contents + some kind of not-google-or-microsoft sender penalty, and flagged the message as potential spam or phishing. From there, I'd assume the linked domain gets pushed into another system that eventually decides they should blacklist the whole domain.

The thing that really pisses me off is that I just received an email in reply to my request for review and the whole thing is a gas-lighting extravaganza. Google systems indicate your domain no longer contains harmful links or downloads. Keep yourself safe in the future by blah blah blah blah.

Umm. No! It's actually Google's crappy, non-deterministic, careless detection that's flagging my legitimate resources as malicious. Then I have to spend my time running it down and double checking everything before submitting a request to have the false positive mistake on Google's end fixed.

Convince me that Google won't abuse this to make self hosting unbearable.
by josh-sematic | 2025-10-22 21:47:24+00:00
Self-reported data is subjective, but when the very thing you are studying is the self-reported subjective experiences of people then it is actually the only data you should care about. Yes “I don’t feel depressed anymore” is a subjective statement but so is “I feel depressed, can you help me?” That specific example is a caricature of course, the data are usually much more specific than “do you feel depressed?”
by LoganDark | 2025-10-22 21:47:51+00:00
> Due to regulations in some states and jurisdictions, throttle will act as an assist boost in those areas, temporarily increasing your assist multiplier while you hold it down.

The bike comes with DRM that automatically tracks which location you're in and applies regulations to the controls? Fucking hell.

The only things this seems to have over an electric scooter is larger wheels, a seat, and a cargo rack. It's almost impossible to tell in a time-efficient way though because they really want you to watch their presentation and individually click on each "SEE MORE" button and read each little excerpt one at a time. I'm super annoyed by this website.

Even the most premium possible scooter costs almost $1,000 less than this - Apollo Phantom 2.0 Stellar is $3,649 right now, and goes like 50 MPH, has far less DRM, and so on. No cargo space though.
by razeh | 2025-10-22 21:48:10+00:00
I meet Greg when I was an undergraduate at Syracuse University and he was earning his PhD. I helped out a bit with some of the graphics programming for his thesis. Greg was a class act, always patient and kind. It was super helpful to me when I went to UIUC for graduate schools and he showed up as a faculty member there; he knew how to get access to campus resources and was more willing to help me than faculty in my own department. He was a model RIP.
by BizarroLand | 2025-10-22 21:48:22+00:00
My dad had covid (and passed away), but the final nail in the coffin was when he coughed against the high pressure respirator and collapsed a lung.

If they had this, the would have been able to keep him oxygenated and alive long enough to repair the lung and he might have survived.

I'm sure many others might benefit from this option in an emergency in the future, so I'm glad it's being examined.
by caymanjim | 2025-10-22 21:48:34+00:00
Yeah, I saw that recently. linuxserver.io bundles a lot of apps into OCI images, and I use many of theirs because they tend to be better-designed than official ones—or at least more consistent.

And while some people might be intimidated by it, it's not a huge lift to make your own images. I don't mean to trivialize it, because it's at best inconvenient, and can be challenging. In many cases it's only a few minutes of work to bundle something up. LLMs are great at this. For a Golang app like Minio, it's a piece of cake, since you don't have to install a zillion dependencies manually.
by roarcher | 2025-10-22 21:48:40+00:00
A "blockbuster movie" implies commercial use. I think actual stars would object to their likeness being used in that way.

If you're talking about people firing up the ol' 5090 to make a "movie" about their favorite streamer falling madly in love with them for, ahem, personal use, I have no doubt that people will do that. And I will do everything in my power to avoid associating with such brain-rotted cretins.
by thrance | 2025-10-22 21:49:11+00:00
So you don't think that increasingly violent populist right wing rhetoric has any impact on the current surge of political violence, that is provably committed by mostly right wing individuals? I'm telling you to include these quotes because they're incredibly relevant. You remaining blind to this is in very bad taste.

Sarkozy is at the root of much prison violence, but we should feel sorry for him now that he's facing prison himself? I won't. I am merely wishing for him to get a taste of his own medicine, not to be subjected to senseless, uncalled for physical violence.

I'll link you aaplok's comment, somewhere else on this thread, that summarizes my viewpoint with much more verve than I: https://news.ycombinator.com/item?id=45667285
by devilsdata | 2025-10-22 21:50:03+00:00
As for the enterprise part of OP's comment, Bazzite is a community-contributed OCI container (similar to a Docker container) running on top of a Fedora bootc spin with GNOME or KDE. It is trivial for a company to add their own RUN instructions to the OCI Containerfile.

Here's a working one that I prepared earlier that installs 1Password on Bazzite GNOME and Bluefin:

https://github.com/lkdm/Phoenix
by jsheard | 2025-10-22 21:50:04+00:00
Yeah that's the thing, with good execution of a plausible effect you don't even realize you're looking at CGI. It's the toupée fallacy.

Obligatory Jonas Ussing plug: https://www.youtube.com/watch?v=7ttG90raCNo&list=PLgdTaHO8FL...
Show HN: Discover AI tools based on your real workflow
by elbuenluquitas | 2025-10-22 21:50:23+00:00
Hi HN! I built WorkMirror as a side-project because I was tired of generic “Top 10 AI Tools” lists that ignore how I actually work.

WorkMirror is a browser extension that watches your real workflow for a few hours and recommends AI tools based on what you actually do.

Ex: “You spent 2h 10m coding in Replit and switching files 74 times. Windsurf could cut context switching and save ~35 min/day.”

It’s privacy-first: no accounts & it's free.

The real challenge has been modeling workflow patterns reliably from noisy browser data. I’m using event timing + URL classification + interaction frequency to infer “work states” (coding, research, writing, idle) and feed those into a simple scoring model that ranks AI tools by expected time savings. Still iterating on the feature weighting and recommendation logic.

I'd love any feedback!