MurphyA/hacker-news huggingface dataset:
by matheusmoreira | 2025-10-13 00:22:42+00:00
Smartphones have cryptographic hardware that can provide proof that a device has not been "tampered with". This is called attestation. The hardware attests to the fact trust has been preserved since boot.

Your device will not attest to this if you install your own operating system, if you root your phone, if you do anything that they don't like, anything at all.

You install your bank's app and try to use it. The bank's servers ask for the attestation. You will not have one. They decide you cannot be trusted and deny you service.

Even if you can program your own keys into your device, nobody is gonna trust those keys. Why would your bank trust your own keys? They'll trust Google's keys, Apple's keys, the government's keys. You? You don't get to participate.

The corporations and governments want to own your computer. They demand cryptographic proof that your device is owned by them and that they have complete control. If you don't provide it, you're banned and ostracized from everything.
by yupyupyups | 2025-10-13 00:22:49+00:00
>This is something your insurance should be required to cover or should be part of a standard homeowners insurance package, and the insurance company can sue the government and try to get those questions answered from the city.

Then the city would have to charge the taxpayer. It's more fair to just revoke police personal immunity and have the incurence company sue the individual police officers involved. This way the police will be incentivized to not wreck people's homes, no?
by ggm | 2025-10-13 00:23:00+00:00
UAW flexes and asks what rate of pay the robot operator will get, agreeing to displace the line workers.

I've been around the Mazda plant in Hiroshima, and the man-machine work pattern there was interesting. Taking static site robotics and making it mobile is a pretty natural progression. Maybe has more complexities but also has less embedded capital in the ground, to construct the flow process around the static robot. So as a step along the path for automation, bizarre though I think it is, having autonomous robots might be short-term to a path of re-working the process to suit static, less expensive robots.
by seanmcdirmid | 2025-10-13 00:23:22+00:00
Banking is one kind of app where additional security constraints make a mobile app experience more convenient than a web app. Yes, you can do security stuff in a web app, no it isn't as seemless or nice as a mobile app. Everything else, sure, but anything that requires higher stakes authentication (beyond just buying things) I'm ok with it being a mobile app.
by kragen | 2025-10-13 00:23:38+00:00
By "asserting X" do you mean "checking whether X is true and crashing the program if not", like the assert macro in C or the assert statement in Python? No, that is almost never done, for three reasons:

• Crashing the program is often what you formally verified the program to prevent in the first place! A crashing program is what destroyed Ariane 5 on its maiden flight, for example. Crashing the program is often the worst possible outcome rather than an acceptable one.

• Many of the assumptions are not things that a program can check are true. Examples from the post include "nothing is concurrently modifying [variables]", "the compiler worked correctly, the hardware isn't faulty, and the OS doesn't mess with things," and, "unsafe [Rust] code does not have [a memory bug] either." None of these assumptions could be reliably verified by any conceivable test a program could make.

• Even when the program could check an assumption, it often isn't computationally feasible; for example, binary search of an array is only valid if the array is sorted, but checking that every time the binary search routine is invoked would take it from logarithmic time to linear time, typically an orders-of-magnitude slowdown that would defeat the purpose of using a binary search instead of a simpler sequential search. (I think Hillel tried to use this example in the article but accidentally wrote "binary sort" instead, which isn't a thing.)

When crashing the program is acceptable and correctness preconditions can be efficiently checked, postconditions usually can be too. In those cases, it's common to use either runtime checks or property-based testing instead of formal verification, which is harder.
by array_key_first | 2025-10-13 00:23:57+00:00
You don't understand how free speech works.

You're allowed to say whatever, that doesn't mean I'm forced to employ you.

If you call your boss an asshole, that is free speech. And you will be fired. Welcome to the real world.

And, if you favor free market dynamics instead, consider: as CEO, you are the face of the company. Perception is a form of advertising.

You don't want negative advertising. Ultimately his views and donations were costing Mozilla actual money. People were upset, and that matters when you sell stuff and ask for donations.

Him being fired was the free labor market at play.
by eduction | 2025-10-13 00:24:40+00:00
> that doesn't erase the fact that open software has completely reshaped the modern stack

What stack?

You give a bunch of web stack examples, great. The vast majority of people will never run a server nor benefit from the licenses of the code running on the server. They overwhelming give their money to the companies benefiting from those licenses and get typical crummy consumer EULAs in return.

Meanwhile phones tablets iot tvs appliances cars tractors pacemakers videogame consoles security cameras coffee makers printers juicers friggin Christmas lights routers, all that stuff, is overwhelmingly closed source.
by shivasurya | 2025-10-13 00:24:49+00:00
This is why codepathfinder.dev is born. It underhood use tree-sitter to search functions, class, member variables and pulls code accurately instead of regex.

I started using it like tool call in Security scanning (think of something like claude-code for security scanning)

Give it a read if you're interested:

https://codepathfinder.dev/blog/codeql-oss-alternative/

https://codepathfinder.dev/blog/introducing-secureflow-cli-t...

Happy to discuss!
by seanmcdirmid | 2025-10-13 00:24:58+00:00
> Robotics has catapulted Beijing into a dominant position in many industries

It is really weird that this could have been Japan in the 90s, but the rise of cheap labor in China put a stop to Japan's dominance and they somehow didn't get back into it when Chinese labor became more expensive.

Maybe its just bad luck that the tech in the 90s wasn't compelling enough while it is in the 2020s. But Japan was going through the same demographic shift in the 90s that China is going through today, they began to act but the world decided to do things in China instead...and then...its not really clear to me why Japan is not investing as aggressively now (unless they are broke, or the capability to do such investments is gone?).
by CuriouslyC | 2025-10-13 00:25:40+00:00
That would be my take under different circumstances as well, but there are two key differences in this situation:

1. The debt bomb. Not dealing with this could cause a great depression by itself. Having it go off at the same time as we're underwater on bad capex with a misaligned economy could produce something the likes of which we've never seen.

2. We have an authoritarian president that has effectively captured the entire government, and the window to prevent consolidation of power is closing rapidly. Worse, he's an ego driven, reckless, ham-fisted decision maker with a cabinet of spineless yes men.
by mauvehaus | 2025-10-13 00:25:43+00:00
Can confirm:

Cleveland, OH: Ohio City Bike Co-op https://ohio-city-bicycle-co-op.shoplightspeed.com/

Boston, MA: Bikes Not Bombs https://bikesnotbombs.org/

Somerville, MA: Somerville Bike Kitchen https://somervillebikekitchen.org/

Burlington VT: Old Spokes Home https://oldspokeshome.com

And many, many more.
by avianlyric | 2025-10-13 00:26:00+00:00
> The attempt to blame this on excessive policing in a broad stroke seems to be the wrong angle that doesn’t address the nuance of these situations.

I don’t really understand how any of these outcomes can be the result of anything except excessive policing. What kind of crimes warrants police turning up with enough fire power to destroy an entire building?

In the case of a search warrant, what was wrong with just knocking on the door and looking around inside?

For a criminal barricaded in a building, what wrong with surrounding the building and waiting them out? They’re gonna need food, water, sleep eventually.

If there isn’t a clear immediate risk to life, what’s the justification for turning someone home or business into a war zone?
by bpt3 | 2025-10-13 00:26:18+00:00
This sounds very similar to the commercial real estate market. What do they have in common? High amounts of leverage, and holding periods of 5-7 years for assets.

They're trying to sell assets bought with cheap money and a lower acceptable rate of return to buyers with higher financing costs and a higher risk free rate of return.

They're going to be holding onto those assets for a while, until they either accept that they need to eat the loss to get liquid or their paper losses are inflated away.
by mindslight | 2025-10-13 00:27:12+00:00
> Trying to make broad assertions regarding who is financially responsible for the lawful execution of police power seems useless.

No. Most people are distracted by qualified immunity, but this is exactly where the rot starts - poor incentives from damaged caused by "government agents" just being waved away as if it is nobody's fault, like it was some kind of natural disaster.

The primary reform we need here is that any damage caused by government agents should start off being the responsibility of the government itself. If the government wants to shift that liability (eg your stuff was damaged because you committed a crime and were found guilty, or as part of a plea), that's fine. If the government successfully subrogates (you were hit by a cop during a high speed chase, so the government and the criminal that necessitated the high speed chase are jointly liable, and the criminal's insurance company has paid out), that's fine. But the basic default should be one of making the victims of policing whole. To do otherwise is to fail to account for the full cost of policing, taking the extra from its victims in a perverted reverse-lottery.
by bigiain | 2025-10-13 00:27:14+00:00
While that'd be nice, I ended up deciding I probably didn't want something like this installed on my prod RDS Postgres, but instead I can easily run it on local dev/staging Postgres instances, and ensure I'm testing the prod config without having to run pg extensions on the prod instances. It looks like running this on a database dump from prod will be able to run all the tests except the Cluster Rules - which feels like a good tradeoff for me.
by ocdtrekkie | 2025-10-13 00:27:31+00:00
I think mistakes were made in not making it easier to adapt applications. (I disagree with Kenton's opinion this is futile, there are plenty of alternative systems which require bespoke apps, and if anything Sandstorm's biggest problem was not having enough name-brand ported apps working on it people expected.)

For example, making external network requests from a Sandstorm app is hard by default. Years after it was "dead", Ian Denhardt wrote a simple drop-in tool you could include in an app which would use a conventional HTTP proxy to hijack the requests from the app and turn them into Powerbox requests. Even though it isn't "the best" way to do it, it is very serviceable and approachable to devs. I think it's something Sandstorm should've supported by default, to abstract away that challenge.

The funny thing is, Sandstorm is actually kinda a pain if you know the engineering you want to do but the platform restricts you from it: It's actually much much better at nontechnical users just being able to use finished apps. I don't think the "use Sandstorm as infrastructure" story is nearly as good. The original Sandstorm company wasn't running a lot of their own infrastructure on Sandstorm, and some of it that was required hidden hacks to work around some of the big ways Sandstorm isn't really designed for hosting websites.

I still don't think it's dead, but since everyone who still really wants to work on Sandstorm has bills to pay and jobs to do (and kids to raise), we definitely aren't moving super fast.

Where I do agree with Kenton is that Sandstorm really excels at running vibe coded apps, I've been playing with it, and found it very easy to get AI tools to fix apps up for Sandstorm. And of course, a sandbox that only runs when the user is interacting with it and manages all of the authentication for you is the safest place to run untrustworthy code that may have security or performance bugs.
by grafmax | 2025-10-13 00:27:34+00:00
I just don’t think the AI supremacy scenario is realistic. I think it ignores our current context and postulates a clean break, almost a kind of magical thinking to be frank. AI is likely to intensify current trends not suddenly subvert and reverse them. Palantir, deepfakes, LLM propaganda. The seeds are all here today. To think otherwise - that’s just not how human societies work, not history, none of it. AI is likely to continue to be weaponized, only more so as tech advances.

What I found persuasive was the argument that this bubble could be worse than others due to the perceived geopolitical stakes by US leadership, plausibly leading to mass serfdom as our society implodes, based on the argument that we already have a version of serfdom today. I found that astute.

I do NOT think that scenario is favorable - it just seems like the most likely future. I hold that we should view our situation with clear eyes so that we can make the best decision from where we stand.

Thinking through this, what does that mean for how we should face our present moment? Eventually people will throw off their chains; our leadership is so incompetently invested in class war that the working class is going to continue to be squeezed and squeezed - until it pops. It’s a pattern familiar in history. The question in my mind is not if but when. And the sooner we get our collective act together the less painful it’s going to be. There’s some really bad stuff waiting for us round the bend.

What should we do? The economy depends on us the serfs and soon-to-be serfs. It’s the workers who can take control of it and can shut it down with mass strikes. It’s only this in my view that can plausibly free us from our reckless leadership (which goes beyond the current administration) and the bleak future they are preparing for us.
by leptons | 2025-10-13 00:27:55+00:00
That's a nonsense reply, and kind of an ad hominem attack. The claim was:

>"It will make your project 1000x more difficult to maintain and extend in the short term for no significant gain."

Nowhere was "launching" anything mentioned. Nice of you to move the goalposts wherever you want to. My project is doing just fine, thank you. Sorry I didn't rush out a piece of crap that nobody wants to use?

I hope you have a better day tomorrow.
by KrishinAsnani | 2025-10-13 00:27:57+00:00
Bourdain ran his kitchens like a punk rock software team—misfits, high pressure, improvisation, and a deep respect for skill. Kitchen Confidential isn’t just a memoir; it’s a masterclass in building culture where chaos becomes creativity. My essay explores how his approach to leadership and camaraderie can inspire teams in software and beyond.
by bpt3 | 2025-10-13 00:28:34+00:00
> Private equity is… private. Normal people have our savings invested in public markets. We can’t easily invest in private equity, and we shouldn’t because it’s too risky.

Financial entities you rely on (pension funds, insurance companies, and universities among others) invest, and you may be getting access yourself thanks to Trump!

> IMO any business over a certain size should be forced to be public and no option to go private again.

What on earth is the rationale for this policy? If you build a successful company, you're required by law to give up control?
by jabr | 2025-10-13 00:29:08+00:00
My best guess is the company was acqui-hired and will soon be working on implementing Kuzu's tech in a different database owned by the acquirer.

My _hope_ is that it was some IP issue with the University of Waterloo and a new company will appear shortly and pretty much pick up where they left off, but that's probably just wishful thinking on my part.
by cyphar | 2025-10-13 00:30:25+00:00
I know that Solaris (or at least, ZFS) has VERIFY and ASSERT macros where the ASSERT macros are compiled out in production builds. Is that the kind of thing you're referring to?

You can aslo mark certain codepaths as unreachable to hint to the compiler that it can make certain optimisations (e.g., "this argument is never negative"), but if you aren't validating that the assumption is correct I wouldn't call that an assertion -- though a plain reading of your comment would imply you would still call this an "assertion"? AFAIK, no language calls this construct "assert".

This is probably one of those "depends on where you first learned it" bits of nomenclature, but to me the distinction here is between debug assertions (compiled out in production code) and assertions (always run).
by neilv | 2025-10-13 00:30:58+00:00
1. An example result is "https://laboratory.love/product/117", which is a list of chemicals and measurements. Is there a visualization of how these levels relate to regulations and expert recommendations? What about a visualization of how different products in the same category compare, so that consumers know which brand is supposedly "best"? Maybe a summary rating, as stars or color-coded threat level?

2. If you find regulation-violating (or otherwise serious) levels of undesirable chemicals, do you... (a) report it to FDA; (b) initiate a class-action lawsuit; (c) short the brand's stock and then news blitz; or (d) make a Web page with the test results for people to do with it what they will?

3. Is 3 tests enough? On the several product test results I clicked, there's often wide variation among the 3 samples. Or would the visualization/rating tell me that all 3 numbers are unacceptably bad, whether it's 635.8 or 6728.6?

4. If I know that plastic contamination is a widespread problem, can I secretly fund testing of my competitors' products, to generate bad press for them?

5. Could this project be shut down by a lawsuit? Could the labs be?
by culi | 2025-10-13 00:31:15+00:00
This isn't even about Reddit the company. /r/canada got taken over by far right political people who will ban anyone not conservative. The /r/mattress mentioned in this post is also commonplace with private corporations taking over subreddits of interest to ban their competitors. Israel, a nation-state, also pays the mods of /r/news and /r/worldnews. You can't post anything, even factual articles, that goes against a very specific political narrative without being banned.

Besides allowing it to happen, Reddit the corporation is not the one doing this. It's private interests of all sorts that are driving down the quality and diversity of discussions for a website that often ranks at the top of google search results.
by mapontosevenths | 2025-10-13 00:31:28+00:00
> Citing experts is good practice, but invoking them to silence dissent is anti-scientific.

That's not really what we're discussing here. Wikipedia is an encyclopedia. The encyclopedia should report things that are widely regarded to be factual as facts. They should not give equal time to every looney tune with a pet theory.

Noteworthy dissent about complex subjects doesn't come from the unqualified, it comes from other qualified people with differing ideas.
by geoctl | 2025-10-13 00:31:39+00:00
There is actually. A way more interesting re-implementation of a popular L7 is SSH over QUIC. SSH has to implement its own mutual authentication and transport embedded in the protocol implementation since it operates on top of plaintext TCP, but with QUIC you can just offload the authentication (e.g. JWT bearer tokens issued by IdPs verified at L7 or automatically via mTLS x509 certs) and transport parts to QUIC and therefore have a much more minimal implementation.
by dangus | 2025-10-13 00:31:44+00:00
This take is way too generous to the current US administration’s quality of long term planning.

Tariffs aren’t there to pay for a race to superintelligence, they’re a lever that the authoritarian is pulling because it’s one of the most powerful levers the president is allowed to pull. It’s a narcissist’s toy to feel important and immediately impactful (and an obvious vehicle for insider trading).

If the present administration was interested in paying for a superintelligence race they wouldn’t have signed a law that increases the budget deficit.

They also wouldn’t be fucking with the “really smart foreign people to private US university, permanent residence, and corporate US employment” pipeline if they were interested in the superintelligence race.
by wmf | 2025-10-13 00:32:02+00:00
I think several of the assumptions are wrong.

GPUs will last much longer after the crash because there won't be any money available to replace them. You can either keep running the existing GPUs or throw them in the trash. The GPUs will keep running as long as they can generate enough revenue from inference to cover electricity. Tokens will become very cheap but free tokens might go away.

AI datacenters aren't that specialized. You can buy a 1 GW datacenter and put 300 MW of equipment in it and sell 2/3 of the gas generators. You'll have to buy some InRow units.

The AI stack isn't as proprietary as it sounds. GPU rental exists today and it's pretty interoperable. Ironically, Nvidia's moat has made their GPUs a de facto standard that is very well understood and supported by whatever software you want.
by peterashford | 2025-10-13 00:32:07+00:00
As someone who uses Go professionally now and Java previously, I disagree with your take on unchecked exceptions. I think that Panics and errors is worse than just using exceptions. I think the latter is just simpler to deal with. At the end of the day, when error handling is complex, its complex with either approach - you have to think carefully about what's happening in the problem domain and come up with a robust solution. What the code level adds is complexity: the Go approach is more complex and consequently worse. I love Go coding but its error handling sucks and I would gladly have the Java approach instead.
by gsf_emergency_4 | 2025-10-13 00:32:27+00:00
There's a structural issue with how society (east or west) is organized in that information flows one way from virtues -> action -> consequences.

That doesn't seem compatible with freedom or progress in the highest (astroarchitectural) sense

A better design allows "institutions" to update their "virtues" in accordance with uh reality (it's fashionable to mention "back-propagate" here) without breaking the flow
by technothrasher | 2025-10-13 00:32:28+00:00
I’m not anything but an enthusiastic hack, but the 99% rings true. I’ve made a goal for myself to get just one photo I’m happy with of as many cat species in the wild as I can. It’s taken me about ten thousand shots to cross off lion, cheetah, and leopard. Going to shoot bobcats in California for four days in a couple months, and I suspect I’ll get lots of interesting photos, but I’ll be very lucky to get “the shot”.