MurphyA/hacker-news huggingface dataset:
by lucideer | 2025-10-22 10:11:16+00:00
I haven't tried Headscale but isn't it more complicated than Wireguard?

The selling point of Tailscale is that they simplify Wireguard UX by adding a proprietary control server - this adds complexity to the stack (extra component) but simplifies user experience (Tailscale run the control server for you).

Headscale seems like it's complicating the stack (adding an extra component) as well as complicating the user experience (you have to maintain two components yourself now instead of just the one Wireguard instance).

Granted I presume the Headscale control server might simplify management of your Wireguard instance but... you're still maintaining the control server yourself.
by pveierland | 2025-10-22 10:11:16+00:00
> The forcing factors aren't what they are supposed to be though.

Is it clear what they should rather be - and are there any examples of mechanisms that have worked better at a scale like this? How are you judging that they are not what they are supposed to be?

If the resulting body of work, which is the totality of Wikipedia, is able to be a curated and high signal collection of knowledge as a result of these mechanisms, how can it be said that they are not working? Having forcing factors, even if they are not ideally aligned or executed, which pushes contributors to increase the quality of their edits to pass, seems overall like a good thing. I'm not saying that its processes and mechanisms cannot be improved, I'm saying I believe it is incorrect to say that they are not working as a whole.

> "Credible" sources and citations are exclusively up to the article moderators personal tastes which are very rarely objective.

Overall I believe Wikipedia to be curated by a large group of people which coordinate through various rules and consensus mechanisms, where I don't believe it is correct to state that sources and citations are exclusively up to any specific article moderators, as they need to be able to build consensus and co-exist with other moderation.

Exactly because Wikipedia is such a large body of work it seems more resistant to corruption to have a large number of curators with different tastes and motivations. How would you determine that their selection of sources and citations is very rarely objective - especially when objectiveness itself seems quite hard to agree upon for many of the topics covered?

From my perspective it seems far more important to consider the quality and value of the totality of Wikipedia, which is massive and signs that many things are working, rather than insisting that it is not working, especially in times where knowledge is being broadly attacked, and where Wikipedia is one of the targets.
by seec | 2025-10-22 10:11:44+00:00
If the task takes "dozens of seconds" on the PC, there is no way it is shortened to millisecond on the Mac. Unless you purposefully make it a bad comparison to favor the Mac.

I'm going to call it and say that you are full of shit. The improvements seem to come from the software: https://duckdb.org/2024/06/26/benchmarks-over-time

If you were to benchmark 2 current comparable machines, the difference would be negligible.
by Version467 | 2025-10-22 10:12:15+00:00
Yeah I mean I get that, but surely we have research like this already. "Garbage in, garbage out" is basically the catchphrase of the entire ml field. I guess the contribution here is that "brainrot"-like text is garbage which, even though it seems obvious, does warrant scientific investigation. But then that's what the paper should focus on. Not that "LLMs can get 'brain rot'".

I guess I don't actually have an issue with this research paper existing, but I do have an issue with its clickbait-y title that gets it a bunch of attention, even though the actual research is really not that interesting.
by bayindirh | 2025-10-22 10:13:50+00:00
You can request things from Kernel, like pinning cores or telling kernel not swap your pages out (see mlockall() / madvise()).

The easiest way affecting everything running on the system might not be the best or even the correct way to do things.

There's always more than one way to solve a problem.

Reading the Full Manual (TM) is important.
by SideburnsOfDoom | 2025-10-22 10:14:07+00:00
Peanut Butter is not as common in UK as it is in USA.

source: https://www.visualcapitalist.com/cp/charted-peanut-butter-co...

yes, there were some surprises to me there. I suspect that it's a cooking ingredient in Satay sauce for the top countries. Not on e.g. sandwiches as in the USA.

But the UK is not the same in USA.
by thrance | 2025-10-22 10:14:25+00:00
I understand, I do believe in the golden rule. I would not wish physical punishment on the guy, I am merely wishing for him to experience the same terrible living conditions he helped create. Let a man savour justice, for however long is lasts. He'll probably get to go home in a few weeks with an electronic bracelet anyway, and then move in and out of his home freely, as no one enforces these rules on the powerful.
by ezascanbe | 2025-10-22 10:15:09+00:00
Full disclosure: I work for Cloudian.

While I understand the frustration with MinIO’s approach here, I want to be upfront about what Cloudian HyperStore is and isn’t - it is designed for multi-node, multi-site deployments (think 3+ nodes minimum) and performs best on bare metal or dedicated infrastructure rather than containerized environments.

It’s a very mature S3 and offers IAM, SQS and STS endpoints as well.

If you’re running MinIO at scale in production and looking at migration options, I’m happy to connect you with our team who can discuss whether HyperStore makes sense for your use case. That said, for single-node dev environments or lightweight deployments that many here are using MinIO for, the community alternatives mentioned in this thread are probably better fits. Different tools for different scales. Happy to answer any technical questions about HyperStore’s architecture if helpful.
Show HN: Coach Thyself – Replace your morning scroll with structured journaling
by rrranch | 2025-10-22 10:15:18+00:00
Hi HN, I'm a solo dev who built this because I kept opening my phone and falling into social media instead of working on myself.

Coach Thyself is a journaling app with structure instead of blank pages: - Daily prompts and community questions to write about - Goal tracking and task organization built in - Optional insights from philosophy/astrology/psychology as reflection triggers - No social features, followers, or performance metrics

I use it every morning now instead of scrolling. It's the motivation that keeps me working on it.

Tech stack: [whatever you used - mention it if interesting] 7-day free trial, $12/month after: https://thyself.coach

Happy to answer questions about the build process or journaling habits. Looking for feedback on what would make this more useful.
by thyristan | 2025-10-22 10:15:29+00:00
Nope, not "anti-". The 5% are visible "bright" mass and energy. "Bright" meaning that we can see it through telescopes, by various wavelengths of light, particle emissions, gravity waves. The rest is "dark matter" and "dark energy", which just means that we see signs of it being there, because the bright matter around it behaves differently. But we don't directly see it in a telescope of any kind. Those "dark" things are stand-ins for our not understanding: Those could be real matter and energy that we just cannot see for some reason. Or those could be problems in our cosmological theories, like gravity working differently on large scales, the expansion of the universe being different, or physical constants changing over time. We just notice that things are off and that we should see more matter and more energy than we do.

Most theories that involve "dark matter" being ordinary matter like tons of neutron stars, huge clouds of dust, bazillions of asteroids or dark planets have been checked for and excluded. So if there were "dark matter" aliens, they really would be completely strange in that they aren't even made from the same kind of matter, but from maybe particles that we don't even know about. But if those hypothetical dark matter particles were capable of this kind of organisation, like clumping together into stars or planets, we would have probably seen those by now. So extremely strange, and improbable imho.

Btw. anti-matter is not "dark matter" in this sense, and dark matter being anti-matter was excluded very very early on by a simple observation: anti-matter and matter, when they come into contact, react in an annihilation reaction. E.g. an electron and anti-electron annihilate into two photons of a characteristic and exact 511keV energy. All other particles and their anti-particles also do this and exhibit their own characteristic energy. Any contact between a region of matter and region of anti-matter in space would radiate in these energy signatures, something which is very easy to detect. Dark matter is known to exist within galaxies, even within star systems, so this kind of contact zone would have to be there, and would be extremely visible to us.

Anti-energy doesn't exist in our current understanding of physics. Energy is always positive, and in quantum theories energy cannot even become zero, always slightly above zero.
by dotancohen | 2025-10-22 10:15:42+00:00
> How does an aged post on this site go from +4 to -1 in the span of a few minutes?

Oh, I can answer that one. It's happened consistently to me on HN when I post about a specific topic.

First, the post looses two points at once. When I see that, I know it's going to continue losing points consistently until it settles into -2 to -4. There is some trigger that starts with a loss of two points, and then continues down.
by jinkylist | 2025-10-22 10:16:24+00:00
>It only works if everyone in the ecosystem is honest

In general, applying this to anything with the general public, I don't expect it to work. This is why we have laws, licenses and rules in the first place. You can preach all you want but it won't change humanity, you need something concrete, something written and agreed, like a license.

Not all licenses protect the freedoms and rights you're used to in other licenses, and it needs to be taken into account when adopting any project. License terms that don't guarantee any sort of support or updates when you need them aren't in consideration at that point.
by GuB-42 | 2025-10-22 10:16:25+00:00
How are they supposed to contact their suppliers without email? Even for phone calls, they are probably using some kind of VoIP. For sensitive communication, they most likely encrypt and sign their messages on the airgapped side before moving it to the internet facing side and sending it using regular email.

Not having internet access at all is like not having your building connected to public roads. That makes it harder (but not impossible) for bad guys to come, but it is so much of a hassle that almost no one does that. Instead, they use gates and checkpoints.

Same idea for internet access. They have internet access, but they have security systems, from traditional firewalls and VPNs to airgaps.

Security is about letting the good guys in while keeping the bad guys out, the latter is meaningless without the former. That's why security is hard, if is was just about blocking everything, it would be easy, but nothing would be done.
by imiric | 2025-10-22 10:17:01+00:00
Neat project, thanks for sharing. I'll stay away since it was vibecoded, but I appreciate the honesty.

Though this is not technically a "knocker", but a typical token-based auth gateway. I experimented with something similar recently as well, and think it has its use cases.

But I would agree with some of the comments here. If you need to expose many services to the internet, especially if their protocols are not encrypted, then a tunneling/mesh/overlay network would be a better solution. I was a happy tinc user for several years, and WireGuard now fills that purpose well. As much as people use solutions like Tailscale, ZeroTier, etc., I personally don't trust them, and would prefer to roll my own with WG. It's not that difficult anyway.

There's also Teleport, which is more of an identity-aware proxy, and it worked well last time I tried it, but I wouldn't use it for personal use.
by aspenmayer | 2025-10-22 10:17:16+00:00
It likely does add some complexity, though it’s relative. Self-hosting is always going to have some overhead. Managing WireGuard servers and clients and associated keys etc is probably the part that is most annoying, so I can see how it might be easier to throw that over the fence to Headscale even though it is introducing another dependency.

I was speaking more to doing it all in-house, versus outsourcing things to Tailscale, a third party not fully under one’s control, even if they act of behalf of the user. I think I largely agree with what you said.
by neciudan | 2025-10-22 10:17:24+00:00
Most frontend breaches come down to 3 mistakes: unescaped input, weak cookie policies, and trust in client-side validation. Last year, I ran a quick security audit on 12 production SPAs. All 12 were vulnerable to at least one XSS vector. Example: dangerouslySetInnerHTML={{ __html: userBio }} → looks harmless until a crafted payload like <img src=x onerror=alert(1)> sneaks in. Fix: sanitize with DOMPurify, enforce a strict CSP, and default to textContent. I’m building a FREE, framework-agnostic frontend-security course that walks through XSS, CSRF, and real attack labs for React/Vue/Angular. Primarily, it's based on workshops I have given at CityJS Athens and React Alicante, and on talks at various conferences. I have gotten really good feedback and appreciation for it, and decided to publish it online for Free. I'm hoping to have it released fully by 2026, but I will probably release each module gradually until then. The Module will be: - Exploits and managing package.json - XSS - Spoofing - CSRF - Personal security (You saw the damage that happened when hackers got access to open source contributors npm credentials) If you want early access & bonus modules → Join the waitlist [here](https://neciudan.dev/master-security).
by simianparrot | 2025-10-22 10:17:34+00:00
> Each new staging environment still required DNS and CDN configuration - not difficult, but not automatic either. The team also took on responsibility for server monitoring, security updates, and handling any infrastructure issues themselves - operational overhead that Heroku had previously covered. And while Hetzner's price-performance is exceptional, its limited presence in the US was a consideration; for this staging workload, it wasn't an issue, but it's a factor for production services targeting US users.

If you factor in salaries, I can see this ending up costing more than Heroku. $3000/m is one (underpaid) developer here in Scandinavia.

That's the equation that's often lacking, and why Heroku is still worth it where I work.
by sindriava | 2025-10-22 10:18:18+00:00
> LLMs have already hit their limits

This is the most profoundly idiotic sentiment to ever come out of the AI discourse. Not only has it been sung for so long that it's been proven wrong mutliple times now, it also pulls the strawman of the century because NO ONE working in frontier AI labs is pushing the narrative that "we don't need anything to change to reach AGI". You can stick your head in the sand all you want, progress is happening and it's not slowing down as of yet. Your knowledge of AI being limited to talking to chatbots doesn't change a thing.
by jbstack | 2025-10-22 10:19:13+00:00
> If you disregard short lifespans, then intergalactic journeys well below light speed (think 0.1c, 0.2c) is perfectly feasible for such a civilization

They're feasible even with short lifespans with the use of generation ships. Or with suspended animation technology. Given that all three possibilities (life extension, generation ship, suspended animation) are already considered within the realms of possibility by humans (even though we haven't solved any of them yet), it seems a very flawed assumption that no other civilization could solve any of them.
by CuriouslyC | 2025-10-22 10:19:23+00:00
The Stanford study showed mixed results, and you can stratify the data to show that AI failures are driven by process differences as much as circumstantial differences.

The MIT study just has a whole host of problems, but ultimately it boils down to: giving your engineers cursor and telling them to be 10x doesn't work. Beyond each individual engineer being skilled at using AI, you have to adjust your process for it. Code review is a perfect example; until you optimize the review process to reduce human friction, AI tools are going to be massively bottlenecked.
by swiftcoder | 2025-10-22 10:20:01+00:00
> But alligators rarely show compassion for humans, barracudas are not known for saving drowning babies and plants frequently show no compassion to anything.

On the other hand, even predatory mammals are documented on occasion to render aid to humans (i.e. dolphins rescuing humans from drowning, or intervening in shark attacks), and in domestic settings can be convinced to raise young from other species (domestic cats/dogs will raise most baby animals if introduced correctly). It's not as cut and dried as a hard species boundary on compassion.
by jonathanlydall | 2025-10-22 10:20:06+00:00
Many years ago I was using 12v passive homemade PoE at my house, manually had injection wires in on switch side of cable and manual break out on far end into barrel connector plugged into an AP.

Once I accidentally plugged the cable into a laptop and the port didn’t work until I powered the laptop off and on again, but no lasting ill effects on laptop at all.
by simiones | 2025-10-22 10:20:35+00:00
You realize that if relations really broke down to that level, then most likely NATO would simply exclude the USA, it wouldn't be all of the other NATO members leaving it, right? Also, if it gets to the level that the EU / Europe would feel they no longer want a military alliance with the USA, then it's likely that they wouldn't want to counter just Russian and Chinese influence, but US influence as well - there's nothing inherently better about US influence than the other two (Chinese influence so far has been the least bad outside of China itself, out of the three, by far - though I have no delusion that this will continue as China's power grows).
by mrtksn | 2025-10-22 10:20:39+00:00
So? That part of the world used to be the leading civilizations for centuries. Maybe its their turn again.

Personally I don't have problem with that, my stuck is with the decay of the west. I like the European way of life, makes me sad to think that it might be coming to an end and that the rest of my life I will have to care deeply about the implications of geopolitics and power instead of more important things higher in the Maslow pyramid.
by jinkylist | 2025-10-22 10:21:19+00:00
>I certainly wouldn’t use it after seeing them remove features.

All sorts of projects remove features all the time though, even the linux kernel drops support for hardware that may or may not be in use somewhere

>Their users are entitled to get salty and go find alternative products.

People are entitled to feeling things of course, others will only point out that it may not be justified and that the user is liable to get hurt again if they never adjust their expectations to meet reality
by clan | 2025-10-22 10:21:35+00:00
What do you think is happening now?

With fewer friends the super power ends up simply being a power. A more volatile world.

Brilliant minds thought up the Marshall plan. It secured the world. Nothing less! The world.

Did it come with a price? Yes. But what the protectionist do not get today as they dismantle the system is that is might actually have been cheaper than the alternative while remaining the leader.

Those who think that governments should be run as a business are delusional. They think we buy F35 because they are the best. The sales proves it! They will never realize that SAAB had better and more fitting options for us. They will never understand that we did pay some protection money. It is not a simple Luca Brasi situation. It is more subtle.

Ou friend is gone so we will try to do that. We have to. Now you understand that might not actually be to your advantage.
by krapp | 2025-10-22 10:21:45+00:00
>Just giving out money does seem like it lacks imagination for people who think state services can only be provided by private sector (and co-incidentally the wealthy will own the private providers hence getting the money)

I think UBI is a concession to this unfortunate political reality. In the US (and maybe the UK I don't know, they seem to love privatizing everything now) universal basic services are an absolute existential impossibility. Americans hear that and they imagine Stalinism and mass graves.

A better argument against UBI, to me, would be that it would only pass muster with voters under the Devil's deal of repealing all existing social services (and likely privatizing them) to cut government expenditures, and so it would never be enough to allow people to afford those services to begin with.

It would also cease to be universal. Voters would demand means testing and governments would attach strings and limitations in order to keep money out of the hands of immigrants and the indigent poor, as welfare policies often reflect systemically racist biases. And of course there would be corruption and grift at all levels.

And I'm saying this as someone who supports UBI as a concept. I think coupling people's access to the economy (and in the US, to healthcare and education) entirely to the value the market can extract from them is a moral evil. Food deserts are a moral evil. But I absolutely don't trust the US to implement UBI in any way that doesn't somehow benefit the rich and punish everyone else.
by goldsteinq | 2025-10-22 10:21:45+00:00
Hi! Could you elaborate on the first attack scenario?

> Target: Python package managers using tokio-tar (e.g., uv). An attacker uploads a malicious package to PyPI. The package's outer TAR contains a legitimate pyproject.toml, but the hidden inner TAR contains a malicious one that hijacks the build backend. During package installation, the malicious config overwrites the legitimate one, leading to RCE on developer machines and CI systems.

It seems to imply that you’re already installing a package uploaded by a malicious entity. Is the vulnerable workflow something like “you manually download the package archive, unpack it with system tar, audit all the files and then run uv install, which will see different files”?
by ignoramous | 2025-10-22 10:21:58+00:00
> And exception handling

If you read & write Go regularly, the rather verbose error handling simply fades into the background.

That said, errors in Go don't really translate to Exceptions as generally thought of; panic, however; may be does.

Making changes to error handling wasn't for the lack of trying, though: https://news.ycombinator.com/item?id=44171677

> issue with nil pointers

This is why most APIs strive for a non-nil zero value, where possible, as methods (on structs) can still dictate if it will act on a pointer. Though, I get what you're saying with Go missing Optional / Maybe / ? operator, as the only other way to warn about nil types is through documentation; ex: https://github.com/tailscale/tailscale/blob/afaa23c3b4/syncs... (a recent example I stumbled upon).

Static code analysers like nilaway (https://news.ycombinator.com/item?id=38300425) help, but these aren't without false positives (annoying) & false negatives (fatal).