MurphyA/hacker-news huggingface dataset:
by lsaferite | 2025-10-01 16:54:50+00:00
> I never claimed to have that data.

Sorry for my switch to 'you' on the second part there. I was more trying to call out if you were claiming there was data to support your assertions, not that you possessed the data personally.

I too do not trust anything being published by the US government at this point. I've always been leery of trusting their data around contentious topics, but that's progressed to zero trust and an expectation that the data is purposefully incorrect.

> "100 year floods" happening every 3-5 years

A 100-year flood plain is simply saying that each year has a 1% chance of a flood based on historical data. It does *not* mean there's only 1 flood every 100 years. We could have such a flood for 10 years running and the data could still work out to it being a 1% probability. That probability is not accumulated.

> This isn't hyperbolic.

A blanket statement saying that flood plains should increase their probabilities by an order of magnitude is hyperbolic. I'm not trying to argue climate change isn't happening, it is. I'm saying statements like that don't help the cause as they are disprovable on the whole and work against getting meaningful recognition and addressing of the issues.

> Part of my original comment is, if your house is destroyed, rebuild elsewhere.

The thing is, if your home was destroyed by a low-probability event, you can make an assessment of the risk and determine if you're willing to accept that risk. Moving from one location to another doesn't suddenly remove risk though. I might move from an area at risk of hurricanes to an area at risk of wildfire, mudslide, tornado, or flooding. Every location has risk. From a concrete POV, should you rebuild a home in a high-probability coastal hurricane impact zone with super-low elevation? I'd say heck no! I'm generally in the 'less government involvement' camp, but I'd also not have much issue with the government declining to provide last-resort insurance to people in super-high risk areas as an incentive to move them out. Or at the very least, make such last-resort insurance prohibitively expensive commensurate with the actual risk.

> decide how much elevation you need to relatively guarantee your safety

Elevation isn't even a guarantee (I know you said 'relatively'). Precipitation based flooding can (and does) happen away from waterways. Flood plain maps are generated based on flawed and spotty (literally) data. They fail to capture the totality of precipitation going into a flood and, as a result, leave people with a false sense of security in relation to potential flooding.
by whycome | 2025-10-01 16:55:14+00:00
Imagine a situation where a person reasonably believes there was a fire (they saw smoke, but it turned out to be a vape or some sort of smoke machine part of the show). They're arrested for the false claim. Others know that it's too risky. Now, when there's a fire, people are reluctant to speak up just in case. It's the chilling effect that can affect speech. We have whistleblowers who are afraid to speak up. And when the means of speaking out or alerting others (ie via email or social media or smartphone) is controlled by a large corporation that may feel threatened...
by dmix | 2025-10-01 16:55:36+00:00
Having worked with Figmas from pure UI-designers that translation to HTML/CSS is not at all as straightforward as they like to pretend.

I don't know about this startup's product but based on their homepage having (real) HTML/CSS output as a core part of the creation process would have helped me many times. Designers need to be constrained.

Expecting designers to know how to build production websites in html/css/js before designing is apparently a step people skip over these days. It creates meaningless design and dev cycles + tons of extra approval meetings by marketing/execs.
by hackingonempty | 2025-10-01 16:55:42+00:00
> The study met its primary endpoint in phase A, with a mean pain reduction of −1.9 NRS points in the VER-01 group (mean difference (MD) versus placebo = −0.6, 95% confidence interval (CI) = −0.9 to −0.3; P < 0.001).

That's not very good considering this meta-analysis[0] found that exercise had a mean difference of "−7.9 (−13.6 to −2.2)" compared to placebo for chronic low back pain. ...and the authors say that is a small effect.

0: https://doi.org/10.1136/bmjebm-2024-112974
by gregates | 2025-10-01 16:55:45+00:00
I have no doubt that the stories of complex spreadsheet models as the beating heart of a business are true. But those models are likely the sole survivor from a thousand dead and gone spreadsheets that people extracted value from for a time, but just didn't have the ongoing utility or wide enough audience to merit being turned into a dashboard or web app. It would be a mistake to insist that all of those spreadsheets should have started life as something else, just in case maintenance should someday become necessary.

In other words, one of the core use cases for a spreadsheet is that it empowers a broad swathe of users (broader than Tableau or PowerBI) to quickly extract insights from their data to fill immediate needs.

Or at least, that's a core use case if you can get your data into a spreadsheet without too much trouble.
by makeitdouble | 2025-10-01 16:55:51+00:00
The problem as described:

> Designers would go into a design team and draw user interfaces. Developers would go into a dev team and write code. And thus, the hand-off was born.

Which is exactly what Figma solves and why it's so valuable.

Figma is the place where the UX team and dev team meet and discuss, specify design and behavior together through back and forth, and helps the dev team move from there with exactly what they need.

Nordcraft might want to be the next Figma, as it's apparently a lucrative position provided you execute incredibly and capture most of the market. But how they describe it they're not properly assessing or representing any of the current reality.

I kinda wonder what it would need to achieve to be significantly different from Figma. Perhaps if it was actually a whole production runtime where designers define front layers and the dev team codes binds them to a backend ? Basically a WordPress competitor ?
by kcplate | 2025-10-01 16:56:00+00:00
Not at all, but they already approved the funding that the government operated under until yesterday. So choosing not to this time which will only give the president cover to blame the democrats for something else and if the shutdown lasts, provides optics that the federal government didn’t really need those non-essential workers anyway.

To me, as an independent, it comes off as a childish tantrum by the democrats.
by criddell | 2025-10-01 16:56:31+00:00
I think it's 75% Microsoft's fault with modern sleep. They want the machine to go into a low power state rather than sleep so that it can still receive email and other notifications just like a phone does. But since the thermals are total garbage on most PCs, that means even the lower power modes need active cooling which doesn't really work when the machine is in a bag. After a few minutes all the fans are blasting.
by alterom | 2025-10-01 16:56:38+00:00
Ponders

Damn, it's way past the time for me to take my SSRIs, because I forgot to take Adderall earlier in the day and zoned out on HN instead when I should've been finishing that API.

Narrator: the actual task didn't call for an API redesign, but if we're doing things, we're doing them The Right Way™ or we don't do them at all, right?
by zevon | 2025-10-01 16:56:40+00:00
I think it worked technically and I‘ve seen a few Access-based solutions to problems faced by people/groups without any real access to development resources. However, these solutions pretty much always came from people with rather technical mindsets and I think many of them involved tinkering in the evening and on weekends. So, my assumption would be that the demise of Access was more about UI/UX, complexity, familiarity and the like than it was about functionality.
by Loughla | 2025-10-01 16:56:58+00:00
Parasocial relationships have always been a thing. People felt like they 'knew' celebrities and would commit weird acts of stalking or violence when that worldview was shattered.

but now it's ABSOLUTELY EVERYWHERE and almost completely socially acceptable. In fact, people look at you weird if you don't have a favorite youtuber or what-have-you.

It's not healthy. Not healthy one bit. Whereas it used to be for 'others' (meaning rich and famous people who lived lives we could never hope for), parasocial relationships tend to be focused on people who are 'just like us' now. There's probably something in there to be studied.
by pqtyw | 2025-10-01 16:57:02+00:00
The American electoral system makes this near impossible.

Certainly for congressional elections, at least. Presidential elections might be more feasible if still highly far fetched. Of course at this point any 3rd party candidate is more likely to split the left-wing and moderate electorate than the radical/MAGA voters who usually don't really carry about specific policies or stances on most economic or other important issues.
by ploxiln | 2025-10-01 16:57:31+00:00
I've seen a bunch of big companies have edicts sent down from the top, "all employees should be using LLMs, if you're not then you're not doing your job". But many employees just don't have much that it applies to. Like, I spend a huge amount of time reviewing PRs. (Somebody, who actually knows stuff, has to do it.) Some of the more data-sci guys have added LLM review bots to some repos, but they're rather dumb and useless.

(And then the CISO sends some security tips email/slack announcement which is still dumb and useless even after an LLM added a bunch of emojis and fun language to it.)

I've always been an old-fashioned and slow developer. But it still seems to me, if most "regular" "average" developers churn out code that is more of a liability than an asset, if they can do that 10x faster, it doesn't really change the world. Most stuff still ends up waiting, in the end, for some slow work done right, or else gets thrown away soon enough.
by tsukikage | 2025-10-01 16:57:39+00:00
Yes, you do need to include:amazonses.com in your SPF. Amazon aren't too bad at kicking spammers off SES promptly. More importantly, Amazon doesn't sign for DKIM - your server still does that; so no-one else gets to DKIM for you; and you can set the DMARC policy to require both.

SES currently charges $0.10 per 1000 outbound emails. The first 3000 mails are free. I received my first official bill for $0.02 after around two years of use.

Do investigate other relay services. I only stopped at SES because I was in a mad rush and it was the first one I tried that did everything I needed, without bouncing or getting filed to trash on any services I cared about. I have done nothing like a full survey of the market, and there may well be a better option. It is the general approach I am suggesting, not trying to shill SES specifically despite what it may look like.
by SXX | 2025-10-01 16:57:39+00:00
I guess you forgot the most important part: making sure your security and devops teams and people in company management follow exactly the same protocol as everyone else with no exception.

Because big bosses hate it when their PC don't just let them run whatever they want and they are not allowed to VPN into network from their home or their grandma desktop because they like her very much.

Also any Linux nerd sysadmin dude (like me) who know better is another type of person who hate following rules.
by growingkittens | 2025-10-01 16:57:52+00:00
Again, psychiatry is in its infancy. Many professionals use outdated models or stereotypes in practice. Living as an autistic individual can make it easier to clock other autistic people, because it's rare to meet someone who functions or thinks the same way you do and sticks out like a sore thumb. For example, "thinking in pictures" is not a universal autistic trait, but it's a pretty well known one.
by ksymph | 2025-10-01 16:58:05+00:00
I agree that autism has become a label for the "shared experiences of things", and that people often derive their identity from the label to an unhealthy and unproductive degree.

However, I strongly disagree that the only use of the label is for developing personal coping skills. I shared your mindset for most of my life, having seen the negative effects of basing one's identity around it, but in the past couple years I've come to see the utility of the autism label and accept it for myself.

Its function (in the modern sense) is to be a tag for shared experiences, that's not a side effect. A sizeable portion of the population shares a similar grouping of frustrations with -- and difficulties functioning in -- society at large. It would be great if direct communication, respect for sensory processing issues, acceptance of stimming and other unusual behaviors, etc. etc. were widespread without the need for a special label, but society at large is slow to change; if the label is the catalyst needed for us to be more accepting of those different than us, so be it.

The typical reaction from a non-ND person to seeing [non-disruptive] autistic behaviors is one of fear or light disgust; however, give that same person a box to put those behaviors in and they understand how to look past them, and see you as a human. That's my experience, anyway. The loudest champions of autism often have a different perspective, one more based around identity; I see issues with that for the same reasons you describe, but nonetheless the label as a whole still carries utility on a societal level too.
by nathan_douglas | 2025-10-01 16:58:18+00:00
Location: Ohio, USA Remote: Yes Willing to relocate: No Technologies: DevOps/SRE/Infra/GitOps stuff, cloud (mostly AWS), backend (mostly Node and Python), a little embedded/lowlevel (mostly C and a few different assembly languages), Rust (favorite language, relegated to hobby/project work). Jack-of-all-trades except Java. Résumé/CV: https://bitterbridge.github.io/resume/resume.pdf Email: On résumé or in my profile.

Hi, I'm Nate. I've been beating my head against computers for about thirty years, twenty or so of that with varying degrees of professionalism. I've done pretty much everything "software" at one time or another. I know a little about everything and a whole lot about nothing. I've been at my current employer five years this month and I'm getting a little restless.

I'd love to get into ML if there's a scientific/research slant, e.g. simulations, optimizations, etc. I'm very interested in HPC and have played a little with Slurm/Lmod/Singularity, but haven't managed to break in. I want to do work that benefits humanity, or at least a nontrivial subset thereof.

My major lifelong fascinations center around artificial life, computability, computational social sciences, GOFAI, etc, but I tend to shift focus a lot and do a lot of deep dives into random spots on the CS/IT landscape.

My weaknesses: in-depth knowledge; I'm really not an SME of anything. I haven't scaled things to millions of requests per minute. I don't spend time grinding LeetCode. I'm probably not suited for early-stage startups, either temperamentally or professionally; I lean toward sustainability, pragmatism, and care, eating my own dogfood, and sticking around long enough to learn from my own mistakes. I tend to write too much.

My strengths: I'm curious, easy to get along with, focused on continual improvement, and probably some kind of workaholic. I'm a good researcher and I've developed some good instincts.
by potato3732842 | 2025-10-01 16:58:26+00:00
> yet keeps coming up as an example of speech that's permissible to suppress for some reason

Because they don't actually have an example of not imminently violence causing non-fraudulent speech that SCOTUS has upheld a ban of. And then when you call them out they'll say "but wait, it's metaphorical". If they had a better example they'd be using it.
by Aurornis | 2025-10-01 16:58:44+00:00
> Our reliability came from software not hardware, though of course we had hundreds of spares sitting by, the defense in depth (multiple datacenters, each datacenter having 2 'brains' which could hotswap, each client multiply backed up on 3-4 machines)...

Of course, but building and managing the software stack, managing hundreds of spares across locations, spanning across datacenters, having a hotswap backup system is not a simple engineering endeavor.

The only way to reach this point is to invest a very large amount of time into it. It requires additional headcount or to put other work on pause.

I was trying to address the type of buildout in this article: Small team, single datacenter, gets the job done but comes with tradeoffs.

The other type of self buildout that you describe is ideal when you have a larger team and extra funds to allocate to putting it all together, managing it, and staffing it. However, once you do that it's not fair to exclude the cost of R&D and the ongoing headcount needs.

It's tempting to sweep it under the rug and call it part of the overall engineering R&D budget, but there is no question a large cost associated with what you described as opposed to spinning up an AWS or Cloudflare account and having access to your battle-tested storage system a few minutes later.
by viridian | 2025-10-01 16:59:05+00:00
US military doctrine does often play out like this in the field. We prefer maneuver warfare strategies and tactics to positional and attrition ones as a general rule, and a key element of maneuver warfare is the units doing the work having the unilateral ability to maneuver or retreat regardless of some greater plan.

The battlefield is not a democracy, nor a top down dictatorship. In proper combined arms maneuver warfare its more akin to a network of syndicates working towards a common goal.
by darth_avocado | 2025-10-01 16:59:13+00:00
> Keep in mind, we are not talking about reasonable takes, we are talking about extreme views that are formed solely through online spaces

You’re taking it out of context. I’m not talking about a 996 culture or regular overtime, I’m talking about ocasional extra push to make things work. Any full time salaried employee will tell you that it is completely acceptable to work extra here and there, when you are allowed to take it slow at times.
by ryandrake | 2025-10-01 16:59:13+00:00
Unfortunately, as it turned out, standing up a public-facing web page (even a single static HTML one) is more complex than saving a word doc. Especially if it gets a lot of traffic, has any kind of user-input, or it comes under attack. So far, out of the attempts to bring web publishing to the masses, the only successful ones so far have been the "hosted" ones where you have to pay someone else to do the hard, non-creative work for you, and are for the most part dependent on them.

The dream of laymen, needing nothing else but an Internet connection, pushing a button on a locally-running application and "poof" a web page appears and is accessible to the world, remains out of reach.
by dmix | 2025-10-01 16:59:14+00:00
The Figma as a design space works better when the designers understand that constraints of HTML/CSS/JS animations. That's not often the case in reality (unless you hire around that idea).

I find many Figma designs basically force you to use fancy JS to assemble their UI designs. I know everyone uses React these days but you really shouldn't have to constantly write JS just to reproduce what's in a UI design. It creates so much needless dev and browser overhead.
by paullikestocode | 2025-10-01 17:00:01+00:00
Experienced software engineer (> 10 years) looking for a part-time opportunity (20-30 hours/week). I'm located in SF and can come to you or can work remotely. More of my experience is on the back-end, but I'm comfortable on the front-end and full stack development. I've worked on security products used by governments, financial institutions, hospitals, etc, and I have high standards for reliable and secure code. I've also worked at startups and on 0 -> 1 projects, and understand speed is a crucial factor in the market.

Location: San Francisco

Remote: remote, hybrid, or in-person

Willing to relocate: no

Technologies: Python, TypeScript, Go, Java, Bash, PHP, Lua, SQL, HTML, CSS, Ruby, Postgres, MySQL, DynamoDB, Elasticsearch, Hbase, Redis, Nginx, AWS Services, Kafka, Docker, Numpy, Jupyter Notebooks, Ubuntu, Kubernetes, Terraform, Git, Datadog, Ansible, Jenkins, OpenSSL, Networking, React

Résumé/CV: https://gist.github.com/PaulLikesToCode/d14488c7f539edec1490...

Email: please see resume
by card_zero | 2025-10-01 17:00:12+00:00
Why's that, then?

I'm digging around in the Wikipedia article on "burden of proof", quick, head me off at the pass before I quote it.

Heh, it mentions "burden tennis". It all devolves to who's got the status quo on their side and who's making the extraordinary claim, or not. I can see why fistfights are a popular way to resolve disagreements.
by nneonneo | 2025-10-01 17:00:27+00:00
As far as I can tell, the exploit works like this:

`metadataupload` takes a .zip file as POST input. This endpoint can be trivially reached on any SAP instance without authentication. The .zip file can contain a .properties file, which is deserialized into a java.util.Properties instance.

Since they're using Java deserialization, it is possible to deserialize arbitrary objects. The actual exploit uses a payload generated by ysoserial (https://github.com/frohoff/ysoserial) to either execute a command directly or drop a file on the filesystem. The basic idea behind a deserialization attack is to construct an object graph such that, when deserialized, functions that run normally as part of the deserialization process end up calling arbitrary code.

Deserialization attacks are well-known in the Java world, and are very common thanks to the fact that the serializer is both easy to use and baked into the language. With a large enough codebase (or the right dependencies) you're practically guaranteed to have enough serializable types to string together an RCE.

As an example, one of the classes used in this exploit is org.apache.xalan.xsltc.trax.TemplatesImpl (https://xalan.apache.org/xalan-j/apidocs/org/apache/xalan/xs...). This class contains a serializable array of Java .class bytecodes which will be dynamically loaded if the `newTransformer` method is called; note that merely loading a Java `.class` will be enough to run arbitrary code via static constructors. Other serializable classes are used to get the `newTransformer` method to be called on the object during deserialization.

The OP post is full of nonsensical and outright incorrect fluff. This is a straightforward deserialization-to-RCE bug; the RCE is what's being used to upload arbitrary files.