MurphyA/hacker-news huggingface dataset:
by jacquesm | 2025-10-04 00:37:11+00:00
Lazy imports are a great way to create runtime errors far into the operation of a long lived service. Yes, it gives the superficial benefit of 'fast startup', but that upside is negated by the downside of not being sure that once something runs it will run to completion due to a failed import much further down the line. It also allows for some interesting edge cases with the items that are going to be imported no longer being what is on the tin at the time the program is started.
by array_key_first | 2025-10-04 00:37:40+00:00
Sometimes the answer is your parents are just bad at this.

File browsers have been around for 50 years, and they haven't changed much at all. But even if you've never used one, fine - they're as intuitive at they can get.

They work just like actual real life files. I have folders, or maybe a cabinet (drive). Inside a folder I can have another folder or tab, or another inside that. And then I have files, with data of some kind on them.

Don't like that level of organization? Fine. Just don't then. You can throw all your papers in one drawer. Or, you can just dump all your files on the desktop.

It's the perfect analogy in my mind.
by AstroBen | 2025-10-04 00:37:43+00:00
His argument misses the point.. I don't particularly care if it's intelligent or understands anything. My question is does it help with what I'm trying to do

As for it being closed source and kept at arms length? Sure.. and if it's taken away or the value proposition changes, I stop using it

My freedom comes from having the ability to switch if needed, not from intentionally making myself less effective. There is no lock in
by rmccue | 2025-10-04 00:37:59+00:00
Excellent explanation as always from Dan, and timely with the latest news from Bluesky on moving the PLC management.

We picked the same DID systems for https://fair.pm/ to decentralise WordPress plugin distribution (and general management for user-facing packages; think App Store rather than Cargo).

The Bluesky folks (especially Bryan) were super helpful in helping us out - even shipping Ed25519 key support so we could use libsodium.

(We’re designing our protocol on top of DIDs and using Bluesky’s stackable moderation, but chose not to use atproto directly - but the great thing is that DIDs are a W3C standard, and PLC isn’t tied to atproto.)
by magicalhippo | 2025-10-04 00:38:08+00:00
So any server storing such at:// links will need to do some DNS/HTTPS dance to get the canonical representation, or permalink as the author calls it.

Doesn't that make it quite fragile without functioning DNSSEC?

Haven't really thought it through but my immediate reaction is DNS poisoning seems like it could do some damage here, allowing bad actors to post in my name, given the public key is part of the DID that you found from the DNS entry. Or?
by xmprt | 2025-10-04 00:41:20+00:00
If you're ever been to a third world country then you'd see how this is completely untrue. The dotcom boom has revolutionized the way of life for people in countries like India.

Even for the average person in America, the ability to do so many activities online that would have taken hours otherwise (eg. shopping, research, DMV/government activities, etc). The fact that we see negative consequences of this like social network polarization or brainrot doesn't negate the positives that have been brought about.
by kennyadam | 2025-10-04 00:41:26+00:00
I don’t know when it happened, but earlier in the week a non-tech member of staff, who was trying to install Audacity, called me really confused because it was asking about installing and then saving to some sort of cloud storage that was being pushed during the installation process. I personally haven’t used Audacity for a couple of years, so the cloud storage stuff added in 2024 is new to me showing up during install. It appeared again in the choice of save locations even after rejecting it during install and I have no interest in someone calling me in two years asking where their files are after the cloud storage shuts down or gets paywalled. For 95% of casual users looking to just split/combine/trim/etc some basic audio files, I’m just gonna tell them to use Ocenaudio.
by rpdillon | 2025-10-04 00:41:38+00:00
Fox always was an interesting personality, and this post seems a fitting tone to close out the project. I really like tt-rss, and self-hosted it for years after Google Reader's untimely demise, but switched to FreshRSS some years back, and haven't looked back. I will clone tt-rss's repo, though. It has more features in some ways, and is worth preserving.
by danabramov | 2025-10-04 00:41:38+00:00
>But that's how the web already works. If I own example.com I can change its target from, say, 1.2.2.2 to 2.3.3.3 any time I want. My identity doesn't change even while my host does. What's the difference?

To clarify, we're talking about generalizing the notion of a "username" or a "handle". E.g. I started with `danabramov.bsky.social` (given out to me) and then moved to `danabra.mov`. I might move to some other domain later. The idea is you should be able to do this as many times as you like without a chain of redirects where losing one domain in the chain loses all your links. (Also, "normal" people don't know what a redirect even is, much less how to set one up.) Hence, an indirection is "above" the chain rather than a part of the chain. The DID points at the domain.

In other words, "normal" people don't want their social media reply chains, or social media mentions, or their GitHub issues, or their Medium articles, to break when someone else swaps their user handle. We're using handles for domains so we need to add an affordance so they "act like handles".

>Sure. That's what DANE is for

Not familiar with it so can't comment unfortunately! But hopefully the above gives some context. We want to stay decoupled both from the handle and from the concrete hosting. Changing the handle and changing the hosting should be doable with zero cooperation from whoever holds your previous domain or previous hosting.

>We have a perfectly good web built out of normal, boring stateless HTTP requests and text formats.

Yes, and that still works — you can pull it on demand with plain HTTP as I show in the article. The CBOR/WebSocket stuff is for the high scale use case (have a look at https://pdsls.dev/jetstream?instance=wss%3A%2F%2Fjetstream1....), i.e. realtime large-scale social aggregation.

>I prefer my technologies to be minimal deltas built atop stable, proven foundations, and my NIH spidey sense is tingling when I read about stuff like this.

I hear ya! Someday it might become boring too. (See https://datatracker.ietf.org/doc/draft-newbold-at-architectu..., https://datatracker.ietf.org/doc/draft-holmgren-at-repositor...). I personally find the additions tasteful and minimal for what they try to accomplish.

>Why wouldn't adding per-update signature data to RSS (including previous entries, blockchain-style, in the hash) do exactly what this stack does but without all the new technology?

I'm not sure how you'd represent arbitrary application data in RSS (e.g. Tangled.org is essentially "GitHub on atproto"), how you'd do high-scale fanout with RSS (realtime to millions of users), or how you'd have properties like ability to move hosting with no disruption to user-visible experience in downstream apps, and no reduction in trust in the data.
by ndriscoll | 2025-10-04 00:42:09+00:00
Decentralized systems like the web already have a solution: lots of jurisdictions are making it illegal to provide adult content without age gating it. The point is for people to assume the same set of liabilities they would in person instead of the status quo where the web magically means you can do whatever. Then you just set up filters at home (or have ISPs offer following) to block the other jurisdictions. e.g. I lose nothing from simply blocking Russia altogether on my router.
by sgarland | 2025-10-04 00:42:27+00:00
> doubly-linked lists are approximately useless

Leaf pages in InnoDB’s B+tree implementation is the big one I can think of. Turns out being able to quickly walk pages for a range scan is helpful.

I agree that there isn’t wide variety of applications where they jump out as being the best choice. So, yeah, “approximately useless” sounds about right.
by empressplay | 2025-10-04 00:42:47+00:00
I drove down to SF a couple years back and people there drive like lunatics.

> About half of the drivers who got tickets were going between 16 and 20 miles an hour over the speed limit, a Chronicle analysis found, which incurs a $100 fine, though the amount is lower for people who qualify as low-income or receive public benefits.

Get caught here doing 30km/h over the speed limit and they suspend your license.
by lucb1e | 2025-10-04 00:43:06+00:00
I can't believe how infrequently this point comes up, given how fundamental a flaw to the whole scheme this point out. So long as you're allowed to have a computer and run code on it, you can run programs that do your bidding. ChatControl cannot be effective, at least I can't imagine for longer than a few months until the first 2% of CSAM handlers are caught who didn't get the memo and spread the word to the remaining 8% who didn't get the memo, until we outlaw computers

It's mind-bending levels of absurdity. Surely nobody intends to (be able to) truly outlaw computers? That cat is out of the bag and people will build them or get their hands on them if they wish

The only possible outcome is that only honest citizens have their chats scanned and devices locked down. The latter has as side effect that Google, Apple, and Microsoft can do whatever the heck they want because open OSes are illegal now
by bobthepanda | 2025-10-04 00:43:16+00:00
This is a function of geography.

Where I live in Seattle, a lot of businesses simply don't handle cash at all, because break-ins for the cash register are quite expensive to deal with, and they circumvent that problem by simply posting outside the business that there is no cash.

One of the few businesses near me that must take cash, a dispensary, recently had an issue where somebody tried to break in using a stolen pickup truck to crash into the building. They didn't get the cash because they didn't get past the interior bollard system, but they did cause enough structural damage that the roof partially collapsed into the street.
by array_key_first | 2025-10-04 00:44:01+00:00
Hijacking the power button for marketing of new features was evil from the get go.

I mean, I get it. It's the perfect engagement metric-driven design. It's the perfect dark pattern. I'm sure you switch that on and whoa!!! Look at how many people are using Siri!!! They must loooooove Siri!!!

It's a thing on Android too. I switch it off. I know it exists and I know not to activate it, and I still switch it off.
by craftkiller | 2025-10-04 00:44:45+00:00
My understanding is the big difference is REST must have URLs returned in the API responses to access additional data / actions. So in a REST API you'd have a single URL entrypoint that I'll call "/root". "/root" might then return to you something like:

{ "links": { "users": "/root/users", "posts": "/root/posts", "mail": "/root/mail" } }

So then the client could make a request for "/root/users" which would return a list of users along with URLs for how to access individual users.

So then the client could make a request for "/root/users/alice" and the server would return the information on alice along with URLs for actions like sending her a message or deleting her.

But all of that interaction is driven from information returned from the server. All the client needed to begin was just the root URL.

Most non-REST JSON APIs today communicate their endpoints via an out-of-band API documentation like swagger.

Quoting the Fielding:

> A REST API must not define fixed resource names or hierarchies (an obvious coupling of client and server). Servers must have the freedom to control their own namespace. Instead, allow servers to instruct clients on how to construct appropriate URIs

> [...]

> A REST API should be entered with no prior knowledge beyond the initial URI (bookmark) and set of standardized media types that are appropriate for the intended audience (i.e., expected to be understood by any client that might use the API). From that point on, all application state transitions must be driven by client selection of server-provided choices that are present in the received representations or implied by the user’s manipulation of those representations.

https://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypert...
by avianlyric | 2025-10-04 00:46:09+00:00
> The only meaningful difference is on how and when funds are reconciled.

Nope, even this is identical. These days the difference between a debit/credit card is pretty much aesthetic, from a transaction processing perspective there generally isn’t any actual differences. Differences that people see today are most artificial for the purpose of justifying extra fees, or higher interchange based an entirely arbitrary factor that has zero correlation to any risks that appear in the transaction processing and clearing mechanisms.

Basically the only reason anyone really bothers keeping the difference between credit/debit cards around, is as a technical excuse for discrimination and abusive fees. Notably in the EU nobody cares if a debit or credit card is used, because the EU outlawed all the crazy fees and other bullshit, so now there’s no commercial reason to differentiate between the two 99% of the time.
by mattnewton | 2025-10-04 00:46:24+00:00
I think they are doing both (in true Google fashion), there is an open source Gemini cli with a generous free tier that more directly competes with Claude code. https://github.com/google-gemini/gemini-cli

It was pretty rough at launch but has gotten a lot better. So has Claude code though, so I’ve never really switched over.
by paulcole | 2025-10-04 00:46:44+00:00
I hire for marketing and design (all levels) and only remote roles. For ICs it’s this:

1. 15-minute or 30-minute virtual meeting w/ me.

2. Take-home exercise - I limit this to about one hour if unpaid. I end up paying for some kind of work sample in about 50% of cases instead of the exercise. For some roles I do a 30-minute mock meeting exercise where I role play a client and we go through common situations.

3. 45-minute or 1-hour discussion/interview with boss and at least one person from the team they’re joining. This includes 15 minutes of questions led by the candidate.

4. Reference check of 2 previous bosses/managers (negotiable to some extent).

For managers/leaders it’s roughly the same but they will also meet w/ other senior leaders and will meet the whole team they’re joining.

I can usually go from initial meeting to offer in 10 days or less if it works for the candidate’s schedule. I also don’t post jobs and solicit applications, I do outreach only. But if someone sees our careers page and writes and has a good story I take a very close look at them.
by johndhi | 2025-10-04 00:46:55+00:00
I agree it's really sad and fucked up. But the way we deal with murder is long prison sentences and the death penalty. If we introduce horrible incentives for investing in medicine, we won't get compassionate care, we will just eliminate investment in healthcare.

We need really thoughtful incentives and simple policies that let doctors run hospitals. Idk it's hard - I was going to say we should reward them for providing better care but I know the pay for performance system in place also hasn't worked that well.
by dheera | 2025-10-04 00:47:15+00:00
That's messy.

I should be able to do "python foo.py" and everything should just work. foo.py should define what it wants and python should fetch it and provide it to foo. I should be able to do "pyc foo.py; ./foo" and everything should just work, dependencies balled up and statically included like Rust or Go. Even NodeJS can turn an entire project into one file to execute. That's what a modern language should look and work like.

The moment I see "--this --that" just to run the default version of something you've lost me. This is 2025.
by danabramov | 2025-10-04 00:48:50+00:00
This is a bit beyond my understanding (I'll ping someone who may be able to answer), but https://atproto.com/specs/handle#dns-txt-method mentions "DNSSEC is not required" (though I'm also not sure that's what you're asking).

>allowing bad actors to post in my name, given the public key is part of the DID that you found from the DNS entry. Or?

DNS only resolves the Handle->DID, but you still need to verify DID->Handle mapping by getting the DID Document. It's bidirectional.
by stebalien | 2025-10-04 00:48:53+00:00
The recommendation to resolve from handles to DIDs for "permalinks" is concerning to me:

- My handle is something _I_ control. I can make it point at a different PDS at any time.

- My DID is something my PDS controls.

I could solve this by indirecting through a web DID under my control, but there's no recommendation anywhere in Bluesky's documentation. Is that something everyone needs to do to ensure real identity portability?

edit: I'm not sure this CAN be solved without running a PDS given that I can't use my own keys. What am I missing here?
by d_burfoot | 2025-10-04 00:48:58+00:00
Looks good to me. I use a tab-completion trick where the tab-completer tool calls the script I'm about to invoke with special arguments, and the script reflects on itself and responds with possible completions. But because of slow imports, it often takes a while for the completion to respond.

I could, and sometimes do, go through all the imports to figure out which ones are taking a long time to load, but it's a chore.
by cowsandmilk | 2025-10-04 00:50:38+00:00
> doctors are rather good at providing care across corporate boundaries

I’ve found that to not be universally true. I say that as someone with eight different health systems in MyChart and who has been treated by two additional hospitals who don’t use MyChart in the past year.

Some systems are very competent about sharing across borders and good at it. I’m lucky my primary hospital is one of those. Others are god awful at it and take multiple calls to get them to even fax records.
by testing22321 | 2025-10-04 00:50:59+00:00
> Personally, I'd like to see a more "fail fast" type system for a lot of social programs. Run it, see what happens ... then make the call if it goes any further. But that would mean people would have to start up programs fast, and shut them down fast. Both are not easy.

My partner does exactly this with healthcare in BC. They spin up a project to trial, say, allowing nurses to prescribe methadone directly, or even for patients just to get it directly. They measure costs, patient outcomes, etc etc. After a set time get patient, doctor and nurse feedback.

Looks good? Great, roll it out to the whole province and hurry up about it.

They’re running 50+ of them continuously. Constant improvement is awesome.
by jedberg | 2025-10-04 00:51:03+00:00
A lot of people don't realize that our entire financial system is eventually consistent. They think that when they go to an ATM and withdraw money, it's instantly gone from their account.

The reality is that in most cases the convergence is so quick it looks like it's instantly gone, but it's not. For example, if the ATM is unable to get your current balance, it will still complete the transaction.

That's why your card has a daily limit -- that's basically the risk tolerance of the bank on how much they are willing to lose if the transactions don't get converge quickly enough.
by johannes1234321 | 2025-10-04 00:51:08+00:00
I don't have a final answer to this. However in m observation with different families and kids is that some start relatively early, before the kid can do arithmetics or such, they can count till a pile got enough money for the sweets or toy they want and then count the other pile to see how much is left and if they can buy the other.

Doing this in a digital system requires first some computing device (be it phone or laptop or whatever) then check the account value, read it correctly, then do some arithmetics and then interpret the result. That's a year or two older.
by coldblues | 2025-10-04 00:52:01+00:00
Every time I see posts like these related to fiat, my heart sinks. Despite pro privacy sentiments across the site, there is a concerning amount of people who have not only fallen to the trap of convenience, but even consider cash use suspicious or criminal (the morality of tax evasion is a whole different subject, the places where it's most popular often coincides with a corrupt, inefficient government). Soon, cash use will be made impractical due to digital currencies and growing government control, but cryptocurrency will take its place, it has already to a limited extent.
by K0balt | 2025-10-04 00:52:46+00:00
To be sure, the barrier to entry on professional level development is higher, but we also have chip-8, python, arduino, and other languages and systems that are arguably much more approachable than BASIC with a line only editor.

Many commenters have pointed out that it was always a tiny fraction of people that could do this kind of thing, and I think that’s probably true, in retrospect. My ideas about the subject are probably colored by the fact that it always seemed easy to me, and I assumed (at the time) that others would also find it easy because I hadn’t come to grips with the bell curve yet. But if I think critically, there was basically no one I knew that was doing anything more ambitious than typing in games from magazines at that time…. So perhaps my worries about the dumbing down of society are overblown?

After all, it’s not like no one is graduating high school or something.
by avianlyric | 2025-10-04 00:53:58+00:00
Yes EMV chips and the EMV standard are secure elements that were spec’d and have been manufactured since the 80s. The EU has been using these thing pretty much universally since the late 90s.

They’ve also supported offline transactions that entire time. Indeed offline transactions was the norm for a long time because internet connections were expensive. So payment terminals did offline transactions, then literally phoned home at the end of the day to upload all of the day’s transactions.

The transactions themselves are just signed by the cards, and stored by the payment terminals. Interestingly using symmetric encryption, because asymmetric encryption was two expensive to put into debit/credit cards when the EMV spec was originally created.

Card transactions being online by default in the EU is pretty recent phenomenon that only really happens in the past 5-10 years, as internet connections and cheap mobile data plans have become ubiquitous.
by flykespice | 2025-10-04 00:54:33+00:00
Side-effect means you're changing state outside the scope the code is running.

Sure thing you can declare globals variable and run anything on a module file global scope (outside funcs and class body), but even that 'global' scope is just an illusion, and everything declared there, as yourself said, is scoped to the module's namespace

(and you can't leak the 'globals' when importing the module unless you explicity do so 'from foo import *'. Think of python's import as eval but safer because it doesn't leaks the results from the module execution)

So for a module to have side-effect (for me) it would either:

- Change/Create attributes from other modules

- Call some other function that does side-effect (reflection builtins? IO stuff)