MurphyA/hacker-news huggingface dataset:
by blauditore | 2025-11-30 23:25:41+00:00
Forced password changes are one of those security theater exercises that drive me absolutely nuts. It's a huge inconvenience long-term, and drives people to apply tricks (write it on a post-it note, or just keep adding dots, or +1 every time).

Plus, if your password gets stolen, there's a good chance most of the damage has already been done by the time you change the password based on a schedule, so any security benefit is only for preventing long-term access by account hijackers.
by wakawaka28 | 2025-11-30 23:26:08+00:00
Passwords are different from URLs because URLs are basically public, whereas passwords aren't supposed to be. Furthermore, this is not 1995. Everyone who is in the industry providing IT services is supposed to know that basic security measures are necessary. The physical analogy would be, walking through an unlocked and unmarked door that faces the street in a busy city, versus picking a lock on that door and then walking through it.
by pinkmuffinere | 2025-11-30 23:26:42+00:00
Having taught the new engineers, and having worked with those 1990s mechanical engineers, I strongly disagree. It’s a recurring belief that the new generation is regressing. When typewriters became common, teachers worried about handwriting. When calculators became common, math teachers worried about mental math skills. If anyone alive was old enough to protest, “the greatest generation” probably would have a different name.

Edit: initially i said “ People bemoaned the loss of chalk-on-blackboard skills when paper and pencil got cheap”, but apparently that’s not true, it was first claimed in a piece of satire, and then became mistaken for the truth.
by cesarb | 2025-11-30 23:27:52+00:00
> but I believe that success Linux has had is because of copyleft

No, the success Linux has had is because it ran on the machines people had at home, and was very easy to try out.

An instructive example would be my own path into Linux: I started with DJGPP, but got annoyed because it couldn't multi-task (if you started a compilation within an IDE like Emacs, you had to wait until it finished before you could interact with the IDE again). So I wanted a real Unix, or something close enough to it.

The best option I found was Slackware. Back then, it could install directly into the MS-DOS partition (within the C:\LINUX directory, through the magic of the UMSDOS filesystem), and boot directly from MS-DOS (through the LOADLIN bootloader). That is: like DJGPP, it could be treated like a normal MS-DOS program (with the only caveat being that you had to reboot to get back to MS-DOS). No need to dedicate a partition to it. No need to take over the MBR or bootloader. It even worked when the disk used Ontrack Disk Manager (for those too young to have heard of it, older BIOS didn't understand large disks, so newer HDDs came bundled with software like that to workaround the BIOS limitations; Linux transparently understood the special partition scheme used by Ontrack).

It worked with all the hardware I had, and worked better than MS-DOS; after a while, I noticed I was spending all my time booted into Linux, and only then I dedicated a whole partition to it (and later, the whole disk). Of course, since by then I had already gotten used to Linux, I stayed in the Linux world.

What I've read later (somewhere in a couple of HN comments) was that, beyond not having all these cool tricks (UMSDOS, LOADLIN, support for Ontrack partitions), FreeBSD was also picky with its hardware choices. I'm not sure that the hardware I had would have been fully supported, and even if it were, I'd have to dedicate a whole disk (or, at least, a whole partition) to it, and it would also take over the boot process (in a way which probably would be incompatible with Ontrack).
by SEMIPREMIUM | 2025-11-30 23:27:53+00:00
Yes, that is a good description of it. A clicker for skipping ads with closed eyes. I'm exited about this, but one last thing.

I chose to not ask friends and family to perform "help" orders and writing me fake reviews on my Etsy and Tindie pages. I wanted this product/feature set to meet the harsh reality through buying interest or better yet commitment to buy the hardcore way, and spending weeks to months to get that first one. I launched 3 weeks ago, and I am looking forward to serving my so far only customer and deserve a good review, eventually. You're that stranger I am happy to have taken the time to sit down and use attention that could have been spent elsewhere on what I've built - and for that I am grateful whether you choose to go through with it or not. I've already gotten a lot of value out of your time in explaining what the product is back to me. :)
by johncoatesdev | 2025-11-30 23:28:23+00:00
It's completely the opposite of "use one password for everything". When you do that any single compromise of a website you have an account on means all your accounts are likely compromised. With a password manager you have a long random password for every single website, meaning a compromise is siloed to just that site.

Even if your password vault is stored on the cloud you're likely using a very secure passphrase for it that has 0 reuse anywhere else, so even if your password vault is stolen it's impossible to brute force.

For a hacker to comprise your password vault it would likely involve hacking your computer, which if you're keeping your software updated is a very difficult task these days without the target user's active help.
by simonw | 2025-11-30 23:28:53+00:00
Charlie Marsh tweeted 7 hours ago "ty is coming" - https://x.com/charliermarsh/status/1995153742040330467

Then "Release post will cover all of this" in reply to a question asking for a detailed comparison to alternatives: https://x.com/charliermarsh/status/1995163183808643466
by thomastjeffery | 2025-11-30 23:29:03+00:00
Don't worry about cookies or bother using a VPN, because... you are being tracked anyway? What's the point of including such a defeatist stance?

> the real world across industry, academia, and government.

Gotcha, so no one here gives a shit about privacy. They only care about avoiding the inconveniences of fraud and leaked secrets.

Use a password manager and a feature-complete adblocker (ublock origin on Firefox). Send messages over end-to-end encrypted channels. Use a VPN along with your adblocker and some kind of cookie/browser-id isolation if you don't want your traffic stalked.
by zmmmmm | 2025-11-30 23:29:08+00:00
It has other advantages.

Operationally, it is very nice to be able to update one discrete function on its own in a patch cycle. You can try to persuade yourself you will pull it off with a modular monolith but the physical isolation of separate services provides guarantees that no amount of testing / review / good intentions can.

However, it's equally an argument for SOA as it is for microservices.
by hastily3114 | 2025-11-30 23:29:33+00:00
I think the reason AI is being pushed everywhere right now is simply that companies want to experiment with it.

They want to explore what is possible and what sticks with users.

The best way to do this is to just push it in their apps as many places as possible since 1. you get a nice list of real world problems to try and solve. 2. You have more pressure on devs to actually make something that works because it is going into production. 3. You get feedback from millions of users.

Also, by working heavily with their AI, they will discover areas that can be improved and thus make the AI itself better.

They don't care that it is annoying, unhelpful or uneconomical because the purpose is experimentation.
by toast0 | 2025-11-30 23:30:58+00:00
What would FreeBSD as GPL give you? You could fork it and release FreeGPL with that license tomorrow. (Minus ZFS, but that's in contrib)

Some users of FreeBSD prefer more freedoms than GPL offers. The contributors must not be put off by providing more freedoms.

Places I've worked have contributed changes to FreeBSD and Linux, mostly for the same reason ... regardless of any necessity from distributing code under license, it's nicer to keep your fork close to upstream and sending your changes upstream helps keep things close.
by josephcsible | 2025-11-30 23:31:11+00:00
> > Regularly change passwords: Frequent password changes were once common advice, but there is no evidence it reduces crime, and it often leads to weaker passwords and reuse across accounts.

> When I worked as a security professional the breaches were nearly always from someone's password getting leaked in a separate public breach. If those individuals had changed that password the in house breach would have been avoided.

You completely missed the point. The good advice is to not reuse passwords. That alone would have stopped the in house breach.
Show HN: The $1B problem with business cards nobody's solving properly
by abilafredkb | 2025-11-30 23:32:44+00:00
88% of business cards are thrown away within a week.

The average professional collects 200+ business cards per year. That's 176 contacts lost. If even 10% could've been valuable connections, we're talking about massive opportunity cost.

I got obsessed with this problem after watching my own business card graveyard grow. Built a real-time networking platform (Yenhyia) that makes business cards irrelevant.

The insight: The problem isn't paper vs digital cards. It's the entire networking workflow.

Traditional flow: 1. Arrive at event blind 2. Random encounters 3. Awkward small talk 4. Exchange cards 5. Cards go in pocket/wallet/trash 6. Never follow up

New flow with Yenhyia: 1. See attendees before event (prep who to meet) 2. Match based on goals (mutual opt-in) 3. Chat starts with context (you both chose each other) 4. Meet in person (not random, intentional) 5. Digital card auto-shared in chat thread 6. Contact synced to phone, conversation history preserved

The technical interesting bits:

- Built matching algorithm that weighs profile similarity, goals, and real-time proximity - Real-time venue mapping so you can find your match in a 5,000 person conference - Privacy-first: location data is ephemeral, deleted post-event - One-tap QR check-in: organizers can deploy without any tech integration

What surprised me:

1. Privacy toggle gets used A LOT. People want to control when they're discoverable. Not everyone wants to network for 8 straight hours at a conference.

2. Pre-event matching has higher engagement than on-site. People actually do their homework before showing up.

3. Event organizers care more about "connections made" metrics than we expected. They want to prove ROI to sponsors and attendees.

Tech stack: React Native, Firebase real-time DB, Node.js, serverless on Google Cloud.

Launched in Ghana/Nigeria because the professional networking ecosystem is still forming here. No legacy LinkedIn graphs, everyone's building from scratch. Perfect test market.

Questions

- How would you approach matching algorithms with sparse initial data? - Best way to handle real-time location at scale (5K+ concurrent users) without destroying battery? - Thoughts on privacy in location-based apps? We delete everything post-event but curious about other approaches.

Code isn't open source yet but considering it for the venue mapping component.

Try it: yenhyia.buzzchat.site

Feedback welcome, especially on the tech and privacy angles.
by rootusrootus | 2025-11-30 23:33:05+00:00
We just need a metric that can't be gamed which will reliably show who is performing and who is not, and we can rid ourselves of the latter. Everyone else can continue to work wherever the hell they want.

But that's a tall order, so maybe we just need managers to pay attention. It doesn't take that much effort to stay involved enough to know who is slacking and who is pulling their weight, and a good manager can do it without seeming to micromanage. Maybe they'll do this when they realize that what they're doing now could largely be replaced by an LLM...
by zmmmmm | 2025-11-30 23:33:55+00:00
It's an interesting question how AI influences this. If it scales up the scope of what an individual engineer can do, and if the primary driver of microservice scope is Conway's law, then in theory microservices should get "fatter".

However I go the other way than you: I have found AI needs as much context as possible and that means it understands monoliths (or fatter architectures) better. At least, the agentic style approach where it has access to the whole git tree / source repository. I find things break down a lot when changes are needed across source repositories.
by alexfoo | 2025-11-30 23:34:35+00:00
Some part of me would love a job that was effectively solving AoC type problems all the time, but then I'd probably burn out pretty quickly if that's all I ever had to do.

Sometimes it's nice to have a break by writing a load of error handling, system architecture documentation, test cases, etc.

> For me it's a great chance to sharpen the tools in my toolbox.

That's a good way of putting it.

My way of taking it a step further and honing my AoC solutions is to make them more efficient whilst ensuring they are still easy to follow, and to make sure they work on as many different inputs as possible (to ensure I'm not solving a specific instance based on my personal input). I keep improving and chipping away at the previous years problems in the 11 months between Decembers.
by simonw | 2025-11-30 23:35:33+00:00
That doesn't have open CORS headers: https://tools.simonwillison.net/cors-fetch?url=https%3A%2F%2...

It's also not being served via a caching CDN, which means I don't feel comfortable running anything automated against it as that might add load to the server that they aren't ready for.
by johncoatesdev | 2025-11-30 23:35:58+00:00
Updating software is good advice. Do you realize how many CVEs are reported on a daily basis? Once you've got a password manager you're largely protected against phishing, so the biggest target becomes your computer, and the most likely way to compromise that would be through outdated software with public vulnerabilities.

What do you expect your browser security levels to the max to do? Browsers are designed to be secure from default settings.
by posixjfie99 | 2025-11-30 23:36:29+00:00
I mean if someone says “be kind to animals get a dog” you already know they don’t quite know what “being kind to animals” is. If they say “all humans end up where I am” (even just in terms of age) you already know they don’t quite know what “all humans” is.

At the end of the day though, it’s just an out of touch person trying to pass on something in good faith. Their whistleblowing is an incidental side channel they probably didn’t really mean to get into.
Show HN: Fin2Cents – Learn investing by sandboxing portfolios with real data
by amywangyx | 2025-11-30 23:37:18+00:00
Hey HN,

I built Fin2Cents to help people learn to invest without risking real money or sliding into meme-stock gambling.

You can construct and stress-test portfolios using Mean-Variance Optimization (Markowitz / 1990 Nobel) every day. On top of that, there are: • Short, gamified lessons on risk, return, and diversification • A live leaderboard that tracks daily (simulated) returns of your portfolios.

The problem I’m trying to solve: most people either 1. YOLO into whatever’s trending, or 2. Avoid investing completely because it feels scary/opaque.

Fin2Cents aims for a middle path: helping people build wealth calmly with time-tested ideas, not vibes.

Would love feedback from the HN community — on the product, UX, or the approach in general.

iOS: https://apps.apple.com/us/app/fin2cents/id6754194187 (invite code: 2PZJmJ).

Happy to answer any technical/product questions in the comments.
by vdupras | 2025-11-30 23:38:09+00:00
This has to be related to Russia and the war in Ukraine. I'm not a military buff, so my analysis might be way off, but here we go.

1. The US has sent a shitload of weapons to Ukraine over the last years. 2. Given the US military superiority and how weak Russia is supposed to be, Russia should be on its knees right now. 3. The US is promoting a peace plan that seems to heavily favor Russia.

So, at that point, I see two possibilities:

1. Trump is a russian asset 2. The US military is privately shitting its pants about how weak they are in this proxy war.

Theoretically, if Trump was a russian asset, he wouldn't go after Venezuela. Why would Russia want to destroy its puppet state?

So I'm going with 2, and it's the cold war again. This is an attempt by the US military to spread Russia thin for further conflicts coming all over the place.
by addaon | 2025-11-30 23:38:46+00:00
> One thing to remember is that unless you explicitly made a device to operate in space and even there beyond LEO, you quite probably might have seen no requirement for ECC memory for radiation reasons.

This does not match my experience (although, admittedly, I've been in the field only a couple decades -- the hardware under discussion predates that). The problem with SEU-induced bit flips is not that errors happen, but that errors with unbounded behavior happen -- consider a bit flip in the program counter, especially in an architecture with variable sized instructions. This drives requirements around error detection, not correction -- but the three main tools here are lockstep processor cores, parity on small memories, and SECDED on large memories. SECDED ECC here is important both because it can catch double errors that happen close together in time, and because memory scrubbing with single error correction allows multiple errors spaced in time to be considered separately. At the system level, the key insight is that detectable failures of a single ECU have to be handled anyway, because of non-transient statistical failures -- connector failures, tin whiskers, etc. The goal, then, is to convert substantially all failures to detectable failures, and then have defined failure behavior (often fail-silent). This leads to dual-dual redundancy architectures and similar, instead of triplex; each channel consists of two units that cross-check each other, and downstream units can assume that commands received from either channel are either correct or absent.
by johng | 2025-11-30 23:39:15+00:00
Seems like a well written article and after I read it, I can't help but think there is definitely a bubble.

The question is... as someone who's invested in the stock market, what do you do? If the bubble bursts, I don't want to be in stocks. Do I want to be in bonds? Other than shorting the market which I'm not keen on doing, what's the best way to profit from the bubble bursting?
by tptacek | 2025-11-30 23:39:44+00:00
A significant fraction of every high-profile industry security person I know has signed this thing. There are people on that list that I'm not super impressed with, but also people everybody is impressed with. No argument that this thing is motivated by commercial interests is going to survive, and a lot of this is advice that security cool kids have been giving for upwards of 10 years.
by youngNed | 2025-11-30 23:39:50+00:00
Quite honestly, it's about time the penny dropped.

Look around you, look at the absolute shit people are believing, the hope that we have any more agency than machines... to use the language of the kids, is cope.

I have never considered myself particularly intelligent, which, I feel puts me at odds with many of HN readership, but I do always try to surround myself with myself with the smartest people I can.

The amount of them that have fallen down the stupidest rabbit holes i have ever seen really makes me think: as a species, we have no agency
by anonymous908213 | 2025-11-30 23:39:51+00:00
If we were to leap 300 years into the future, I don't think it'd be very surprising what they look down on us for, presuming they've advanced in a logic-oriented direction and not, say, a relapse into purely religious doctrine, which is by no means a given to occur. We will certainly be condemned, at minimum, for our utterly inhumane treatment of animals, for our relentless exhaustion and destruction of natural resources, for our abuse of the scientific method to proclaim things as factual with studies that can't actually be replicated, and for much more.

Perhaps it would be surprising to some people who haven't thought much about it that we will likely be viewed poorly for wasting non-replenishable helium, necessary for advanced medical technology, on party balloons. But I don't think there is anything we do that we can't currently reason about being considered immoral for. I have absolutely zero doubt that George Washington would not be surprised to leap to 2025 and see someone condemning him for his slave ownership. There is nothing about living in the 1700s that would prevent him from reasoning that what he did was immoral, and indeed, many people in the 1700s did reason that.

Cultural adoption of morality moves significantly slower than reason about morality. This is because cultural adoption requires action. Humans will behave immorally even if they know their actions are immoral, for their own benefit. To counteract this requires coordinated group effort, which is an extremely slow process because, for example, convincing people that it's worth them risking death in a bloody war to stop other people from owning slaves, when they are not themselves ever at risk of being treated as a slave, is a very challenging task. That one participates in selfish, immoral actions for one's own benefit because one's society does not yet coerce one through collective threat of violence to behave morally does not absolve one of one's actions, which can already be reasoned through even if the collective will to enforce it does not yet exist.

Cultural adoption can also diverge from reason about morality completely, of course. This is because selfish people with power can use their power to enforce immoral values like absolute service to themselves, for their own benefit. If a society does not collectively overcome powerful individuals acting selfishly, then the culture's apparent morality will be warped in the service of what benefits a specific individual at the greater expense of society. However, even in such a state, people can and do reason about morality. Human history is a long, long tale of people defying immoral abuse of authority.
by crazygringo | 2025-11-30 23:40:41+00:00
Because it's ultimately a form of censorship. Governments shouldn't be in the business of shutting down speech some people don't like, and in the same way shouldn't be in the business of shutting down software features some people don't like. As long as nobody is being harmed, censorship is bad and anti-democratic. (And we make exceptions for cases of actual harm, like libelous or threatening speech, or a product that injures or defrauds its users.) Freedom is a fundamental aspect of democracy, which is why freedoms are written into constitutions so simple majority vote can't remove them.
by 1659447091 | 2025-11-30 23:41:01+00:00
> broadcasting everyone's location and people self-announcing their pronouns/race/age whatever are backward steps

Or it could been seen as a pro-active way of eliminate the annoying "a/s/l" spam from them yonder days of internet chatrooms/forums.

> the silly people who want to be victims

Not really a great example to showcase how to advocate one "argue the facts of an issue"