MurphyA/hacker-news huggingface dataset:
by AnimalMuppet | 2025-10-14 14:17:43+00:00
It's not just 30 years old. It's 30 years of people building libraries of useful code. If you "modernize" it so that much of that 30 years of work is thrown away, that's really expensive - maybe more expensive than continuing to build on a less-than-perfect foundation.

But that turns into the trap of short-term thinking - eventually you reach the point where you would have been better off throwing it away and starting over. You don't reach that in the year you throw it away, though, nor in the year after.
by surajrmal | 2025-10-14 14:17:53+00:00
Firefox is not a great representative example. It's development is primarily driven by a single company so it receives all of the benefits non FOSS would get as a result. However, most FOSS cannot find a similarly effective monetization strategy to Firefox to enable a company to invest and produce a good product that way.

Windows is poorly suited to be used as infrastructure compared to open source so again, your example isn't great.

Unless you have ever been in a position where you need to make important decisions, it's best not to assume things about the decision makers knowledge. Hiring folks who trained appropriately on the software you choose can be a very strong motivator.
by notmyjob | 2025-10-14 14:17:58+00:00
> Ecoterrorist groups do use arson, but they target cars and buildings, like car dealerships or chain stores, not forests.

False. If you know anything about forests you know that before “European colonizers” (not my preferred terminology tbh) wildfire was very common and a tool wielded by indigenous peoples to control overgrowth of the sort that is now common given “intrusion” of housing into forested land which is often a subject of the ecoterrorist’s disdain.

When a major serial arsonist is caught and he explains, “f** you f*** pigs!” a natural response is to pattern match to anarchist or ecoterrorist fringe groups and anti-authoritarian personality types. When the news censors or conspicuously avoids discussion of specific individuals and their motives, preferring an imo more beneficial focus on climate change (a very real and pressing threat) even more pattern matching occurs.

I’m not saying such speculation is useful or accurate, but I don’t think it’s insanity by any stretch.
by f311a | 2025-10-14 14:18:32+00:00
PyCharm has very basic type checking, though. It's not strict.

> pyrefly, ty, pyright, and basedpyright

All of them will complain 2-4x more about your code than PyCharm. I had more than 300 typing errors when I first opened my 20k LOC project in pyright that I wrote in Pycharm.

PyCharm works great when your code is not annotated. It infers types very well. But it won't complain in a lot of cases when your code is annotated.

Related reddit post https://old.reddit.com/r/Python/comments/1ajnikt/to_pycharm_...
by blenderob | 2025-10-14 14:18:43+00:00
> TOFU schemes aren't acceptable for the public web because the average user (1) isn't equipped to compare certificate fingerprints for their bank

This! Forget about average user. As a technical user too I don't know how I would compare fingerprints every single time without making a mistake. I could install software or write my own to do this on desktop but what would I do on cell phones?

And TOFU requires "trust" on first use. How do I make sure that if I should be trusting the website public key on first use? It doesn't seem like any easier to solve than PKI.
by jval43 | 2025-10-14 14:18:55+00:00
It used to be the case that you had to run certbot as root or it just wouldn't work. At least not officially, you could get it work without root but it wasn't supported.

The official docs still recommend doing so: >Certbot is most useful when run with root privileges, because it is then able to automatically configure TLS/SSL for Apache and nginx.
by bccdee | 2025-10-14 14:18:56+00:00
> Yes it advanced extremely quickly

The things that impress me about gpt-5 are basically the same ones that impressed me about gpt-3. For all the talk about exponential growth, I feel like we experienced one big technical leap forward and have spent the past 5 years fine-tuning the result—as if fiddling with it long enough will turn it into something it is not.
by lbhdc | 2025-10-14 14:19:20+00:00
I find your perspective to be very software centric, and I expect many people who work in heavy industry to have a very different perspective about this.

I was on the implementation end of a considerable amount of industrial automation and technological advancement about 10 years ago. When we were on site the result of making mistakes started at the death of a team member. There were a plethora of things that could kill you horribly, falls, hazardous environment, rotating equipment, etc.

Yet we all survived overhauling processes in hundreds of plants. Working in hazardous environments isn't untenable, or even particularly difficult to do safely. In fact we worked at a much faster pace (with fewer mistakes) than corporate world I work in now.
by jezek2 | 2025-10-14 14:20:08+00:00
All software is full of security bugs, supported or not. While supported SW fixes known security bugs it also introduces new ones. Therefore it doesn't matter much, it's all vulnerable.

Security patches are also increasingly misused by the vendors to push unwanted crap.

Other security approaches are needed: firewall, updated browser + adblocker, not clicking on everything, doing research before installing stuff, etc.
by absoluteunit1 | 2025-10-14 14:20:08+00:00
> Raycast is a desktop AI agent

No - it is a MacOS launcher app. This Spotlight but with quite a few more features and very extensible (especially if you code) and has a large open source extension community (mine is just one of many)

> does it run on Linux?

Sadly no, only Mac for now but I think they’re expanding to Windows and Linux on future.

> custom note types

Not really sadly :/

I want to add many improvements including this but I don’t have capacity right now - hands full with another project
by mid-kid | 2025-10-14 14:20:27+00:00
The branding does a major disservice to this application - it works like a charm on my windows and i3wm setups, having no trouble sharing a clipboard and files. There are very few features if any that only work on KDE.

Sometimes on windows it needs a click of the refresh button to get going after connecting to a network. The discovery is wonky on some platforms.
by sorcercode | 2025-10-14 14:20:40+00:00
but genuinely. how many people are "creating", like truly novel stuff that someone hasn't thought out before?

I'd wager a majority of software engineers today are using techniques that are well established... that most models are trained on.

most current creation (IMHO) comes from wielding existing techniques in different combinations. which i wager is very much possible with LLMs
by giancarlostoro | 2025-10-14 14:20:44+00:00
> There is a really interesting generation gap issue in the replies to your comment. What I perceive as younger people are horrified at the idea of fifty year old tools while the older folks are thinking (I imagine) “if the tools have lasted that long they must be well-honed and very good”.

It's like when someone wants to choose a brand new web framework that isn't battle tested over one of the most battle tested web frameworks. You can hire way more developers with battle tested tooling, than some bleeding edge thing you don't know if it can even scale.
by octoberfranklin | 2025-10-14 14:21:00+00:00
Your comment is disingenuous -- the article isn't arguing against TLS. It is arguing against WebPKI.

You can stop ISP ad injection with solutions much less complex than WebPKI.

Simply using TOFU-certificates (Trust On First Use) would achieve this. It also gives you the "people who controlled this website the first time I visited it still control it" guarantee you mention in your last paragraph.

TOFU isn't ideal, but it's an easy counterexample to your claims.
by DannyBee | 2025-10-14 14:21:10+00:00
I mean, it's not untypical as a view.

In reality, successful society lives halfway down tons of slippery slopes at any given point in time, and engineers in particular hate this. Yet this has been true since basically forever.

I'm sure cavemen engineers complained about how it's not secure to trust that your cave is the one with the symbol you made on the wall, etc.
by jabroni_salad | 2025-10-14 14:21:20+00:00
My ISP (Mediacom) appears to have a deal with certain websites to display service messages. The only two I've encountered it on is Amazon and Facebook but they are somehow able to insert a maintenance banner at the top of those two when downtime is anticipated or if I am near the end of my bandwidth quota. Haven't gotten any ads this way but they have the technology.
by kragen | 2025-10-14 14:21:25+00:00
A diplomatic passport from a third-world country? ;-)

Seriously, if the stock market is going to plunge, Pepsi stock is also going to plunge. The simplest way to reduce your exposure to the stock market is to shift assets toward cash: sell shares, keep dollars, maybe in the money market rather than just as cash. Dollars are exposed to the risk of inflation (hyperinflation hasn't happened yet in the US but it's so common that https://en.wikipedia.org/wiki/Hyperinflation doesn't even attempt to list all historical episodes of hyperinflation, just dozens of notable ones) so investors commonly try to move to metals to balance that risk. Cryptocurrencies have emerged as an alternative, and they have the advantage of being more portable in emergency evacuation situations.
by throw_a_grenade | 2025-10-14 14:22:01+00:00
> I'm not as convinced as the author is that nation states can easily tamper with certificates these days. I am not sure how much CT checking we do before each page load [...]

They can MITM the connection between the host and LE (or any other CA resolver, ACME or non-ACME, doesn't matter). This was demonstrated by the attack against jabber.ru, at the time hosted in OVH. I recommend reading the writeup by the admin (second link from the top in TFA).

This worked, because no-one checked CT.
by eugene-kim | 2025-10-14 14:22:28+00:00
When using codex-cli / Claude Code, I look for opportunities to improve either the AGENTS.md file based on the path that the LLM is taking or to improve repo structure, docs, var names, etc that might help make things more clear in the future. Since this is still somewhat task related, I can usually stay focused.

I haven't had much luck doing two completely different tasks at the same time. At net I think it slows me down due to the context switching.
by akerl_ | 2025-10-14 14:22:34+00:00
This is the sleight of hand being employed when folks suggest TOFU mechanisms. The problem with any communication boils down to trust. The modern web PKI has a bunch of complexity and a plenty of rough edges in how it handles resolving that trust. TOFU is then proposed as a simpler solution with none of those pesky rough edges, but it doesn't have the rough edges because it leaves all the hard parts as an exercise for the reader.

It's a bit like suggesting that AES-GCM has risks so we ought to just switch to one-time-pads.
Ask NH: How will adoption of AI coding impact development of new frameworks?
by AlexMoffat | 2025-10-14 14:22:39+00:00
I worry that because generative AI is based on what already exists and is already popular anything new will have lower adoption that it otherwise would. Even if it's an exciting development and offers benefits over what's out there already if Claude or Codex can't write it how successful will it be? If the biggest productivity gain comes from using AI to regenerate what's already popular how does something new arise?
by dmoy | 2025-10-14 14:22:44+00:00
It is the unfortunate reality that we tend to only remember the creator(s) of the first version (if anyone). Not just cgroups, but a lot of tech or protocols.

Anyways digging it up, looks like the primary author was at Facebook for a year before cgroupsv2, redhat for three years before that, and Google before that. So... I don't know haha you'd have to ask him.
by sudodevnull | 2025-10-14 14:22:55+00:00
> A guy told me that they were told to defend the project.

Might be nice if you can back that up. I see no drshapeless in our Discord logs.

> he only nice thing I got from them was an alternative method to imitate replace-url function using only free-tier features. So we did give you an alternative to you going against how the framework is suppose to work.

Yeah that tracks with writing that blog. Good luck to ya, Datastar is definitely not a good fit.
by bilekas | 2025-10-14 14:23:12+00:00
Yeah it reads as if the OP misunderstands the attack vectors of SSL. If there's a misconfiguration, or the server admin is not correctly authenticating the authority, then sure. But skips over what they mean.

Being generous I would say they are referring to if the client has an invalid ssl approved on their local, in which case its a client problem.

To ignore Encryption altogether is a silly idea. Maybe it shouldn't be so centralised to 1 company though.
by cmontella | 2025-10-14 14:23:22+00:00
> this sounds more like an artsclass to me.

Indeed, it is, and that's the point! Being interfaces to computers for humans, programming languages sit at the intersection of computer science and humanities. Lots of people like to treat programming languages like they're math class, but that's only half the picture. The other half is usability, ergonomics, learnability, and especially community. Not to mention the form of the language is all about aesthetics. How many times has someone on Hacker News called a language "beautiful" or "ugly" referring to the way it looks? When people praise Python they talk about how easy it is to read and how pleasant it is to look at compared to C++. Or look at what people say about Elm error messages versus C++ template errors. Actually a lot of what's wrong with C++ could have been averted if the designers had paid more attention in art class.

> But these days we would need greater insights into higher-level language semantics and inherent tradeoffs to guide language-design and language evolution.

Here's a talk that argues there's much more fertile languages ground for ideas outside of the "programming languages are math" area, which has been thoroughly strip-mined for decades:

https://medium.com/bits-and-behavior/my-splash-2016-keynote-...

This author takes the perspective that programming languages are much greater than the sum of the syntax + semantics + toolchain + libraries, and treating them as such is limiting their potential.
by mempko | 2025-10-14 14:23:29+00:00
First of all, half of Americans didn't vote for Trump, at best a fourth. Look up voter turnout and of those that voted. And yes, not voting is legitimate when you believe both parties don't represent you. This idea that half of Americans voted for Trump makes no sense.

Not only that but most people don't approve of his immigration policy.

https://www.economist.com/interactive/trump-approval-tracker

He is going against the will of the people with unpopular policies
by 18272837023 | 2025-10-14 14:23:37+00:00
Tarot is often framed in pop culture as a set of mystical images that predict the future; a more nuanced and useful framing is to see tarot as a cultural artifact and a dynamic hermeneutic system — one that has evolved over centuries from a simple card game into a rich symbolic language used for storytelling, reflection, therapy, and ritual. This essay traces the tarot’s historical roots, sketches key moments in its metamorphosis into an esoteric tradition, and offers a professional framework for interpretation that is both rigorous and practically useful for serious readers and scholars alike.
by blenderob | 2025-10-14 14:23:42+00:00
> I think it's pretty reasonable to turn off the "yes i would like to accept this key" on first connect.

Why is it reasonable to trust the key on first use? What if the first use itself has a man-in-the-middle that presents you the middle-man's key? Why should I trust it on first use? How do I tell if the key belongs to the real website or to a middle-man website?
by SoftTalker | 2025-10-14 14:23:51+00:00
> why did everyone start encyrpting their websites

Because Google forced us to, by throwing up scary warnings if we didn't do it.

Google doesn't care about $3.6mm. They do care about the additional control they have by this scheme.

> [HTTPS] at least hides the paths to the specific pages you are reading as you surf online, including things like search engine query terms.

This assumes there isn't a secret firehose feed from Google to the NSA, which I don't think is a safe assumption.
by Ajedi32 | 2025-10-14 14:23:57+00:00
Certainly a MITM between a website and LE is less likely than a MITM between a user on a random public Wi-Fi network and the website, but I've often wondered why more attention hasn't been given to securing the domain validation process itself.

There are a lot of random internet routers between CAs and websites which effectively have the ability to get certificates for any domain they want. It just seems like such an obvious vulnerability I'm kinda shocked it hasn't been exploited yet. Perhaps the fact that it hasn't is a sign such an attack is more difficult than my intuition suggests.

Still, I'd be a lot more comfortable if DNSSEC or an equivalent were enforced for domain validation. Or perhaps if we just cut out the middleman and built a PKI directly into the DNS protocol, similar to how DANE or Namecoin work.
by nradov | 2025-10-14 14:24:02+00:00
The other 95% of the planet has mostly been relying upon the USA as the global hegemon to provide the security guarantees and financial infrastructure necessary for large scale free trade since the end of WWII. If the USA steps back from that then global trade networks will gradually break down because no other country or stable coalition has the desire or resources to step into that role. The situation will revert to something more like what we saw pre-war when most trade was regional. New Zealand in particular is in a weak position as they are heavily reliant on agriculture exports, and lack any ability to project power beyond their own borders.
by corimaith | 2025-10-14 14:24:05+00:00
There are a million ways to cheat trade, the WTO was created to handle small disputes, not large structural imbalances. International Law was highly flawed in that regard owing back to Bretton Woods.

But of course it benefits everyone at the expense of deficit countries, so why change or truly address the literature. Appealing to international law today as such is just appealing to entrenched interests.

But the matter of fact is that in a true free trade regime, imbalances should rebalance back to zero. The fact that the deficit is only growing is more than enough evidence that China is obviously the violators here. And everybody knows this.

Under a multilateral Bancor System which Chinese economists themselves advocated back in 2009, China would have been immediately subjected to massive FX overvaluation to degrade their conpetiveness.
by maratc | 2025-10-14 14:24:08+00:00
My IT department performs a man-in-the-middle attack against all my VPN traffic, and issues on-the-fly certificates for all the sites I visit. There is zero warning on my side, and the only way I know of it is because I'm a nerd who looks into certificate chains sometimes. My other nerd coworkers are blissfully unaware.

EDIT: I understand how it works. This wasn’t my point.
by ReptileMan | 2025-10-14 14:24:26+00:00
>Exports to the E.U. rose more than 14%

And EU is not terribly happy with that. But EU right now is in the position that they have gripes with everyone, but not enough power to meaningfully resist or retaliate. They can't escalate trade war with China while having less than stellar relationship with US and hostile with Russia.

The EU never really recovered from the great recession and everything looks somewhat bleak as of late. Except Poland and some of the other Eastern bloc countries that are finally catching up.
by mikeocool | 2025-10-14 14:24:28+00:00
I think their critique is that to verify domain ownership, Let's Encrypt makes a request to your website over HTTP to the check the challenge -- which is true (because if you don't yet have an SSL certificate they can't make a request over HTTPS).

I think they are implying that if someone can man in the middle your website, then they can also man in the middle this request, and issue a certificate for you domain. However, the threat model of man in the middle between a user and your web server is very different than man in the middle between let's encrypt and your web server.

Before that widespread use of HTTPS it was trivial to connect to a coffeeshop's wifi network and sniff everyone else's traffic, and ISPs would man in the middle you to inject their own adds in websites you were looking at.

On the other hand to man in the middle Let's Encrypt -> your web server, you likely need to be state level actor and/or be or have hacked a major telecom (assuming your web server is running in a reputable data center). Folks like that can almost certainly already issue a certificate for your domain without running a man in the middle on Let's Encrypt.
by queenkjuul | 2025-10-14 14:24:52+00:00
He actually pretty explicitly pines for the condition of the past, where London was full of "native Brits," and makes no mention of immigration policy. Then he links to statistics showing that 60% of Londoners are native born British citizens.

So in his mind, you can be a British citizen born in Britain but not a "native Brit." I don't see how one can reach this conclusion unless you believe non-white people to be incapable of being "native Brits" despite being born and raised in Britain.

Again, would love to see where he advocates for any particular immigration policy. The post pretty explicitly admits to just preferring when London was more white (as evidenced by linking to stats showing London is not less British, simply less white)
by octoberfranklin | 2025-10-14 14:25:07+00:00
The same way you know if you should trust the WebPKI Rube-Goldberg-contraption: you don't.

It's a counterexample, not a recommendation.

If you need this guarantee, use self-certifying hostnames like Tor *.onion sites do, where the URL carries the public key. More examples of this: https://codeberg.org/amjoseph/not-your-keys-not-your-name
by dijit | 2025-10-14 14:25:25+00:00
Like all things, it's complicated.

Direct sites will load with a "Not Secure" warning, includes on the site might not load without chrome://settings/content/insecureContent

And of course: you won't manage to be visible to Google itself, as you'll be down-ranked for not having TLS.

If you happen to have a .dev domain: you're on the HSTS Preload list, so your site literally won't load.
by wongarsu | 2025-10-14 14:26:15+00:00
This argument comes up a lot, but it feels a bit silly to me. If you want a beefy server you start out with renting one. $150/month will give you a server with 24 core Xeon and 256GB of RAM, in a data center with everything you mentined plus a 24/7 hands-on technician you can book. Preferably rent two servers, because reliablity. Once you outgrow renting servers you start renting rack space in a certified data center with all the same amenities. Once you outgrow that you start renting entire racks, then rows of racks or small rooms inside the DC. Then you start renting portions of the DC. Once you have outgrown that you have to seriously worry about maintaining your own data center. But at that point you have so much scale that this will be the least of your worries
by bilekas | 2025-10-14 14:26:44+00:00
> I think that if we didn't do TLS, every ISP would be injecting ads into websites these days.

Thats the least of the problems, they (anyone with basic access to your network actually) could easily overwrite every cooking or session on your machine to use their referral links. IE : Honey &* PayPal's Fraud [0] without you having any idea, now maybe you don't care, but it's stealing other peoples potential earnings.

[0] https://www.theverge.com/24343913/paypal-honey-megalag-coupo...