MurphyA/hacker-news huggingface dataset:
by AnthonyMouse | 2025-11-11 20:16:17+00:00
Risk mitigation is about a) lowering the risk and b) lowering the cost in the event you get unlucky.

This doesn't seem to do the first one. It doesn't actually stop you from doing the things you could get in trouble for doing, even though that was ostensibly the original point.

And the second one is where you want to shave off the high side, not the low side. This is why normal insurance is typically a policy large enough to cover whatever plausible amount of damages there could be and then a deductible so you don't have tons of people filing claims for amounts small enough they could reasonably cover themselves instead of paying the insurance company a margin to do it. But this is the opposite of that, they'd cover a little claim you'd have been able to shrug off regardless but not the one where you'd most want coverage.
Instant Parameter Selection for Modular Systems (b, p, t, r)
by Patternician | 2025-11-11 20:16:22+00:00
If you’ve ever had to tune or verify modular parameters — for example in RNG design, PRBS/scrambler alignment, signal sequence generation, or NTT setups — you know how time-consuming it can be to make sure conditions like

b^A mod p^t = r

actually behave the way you need across multiple constraints.

Most teams rely on Hensel lifting, search loops, or heuristic checks that can take hours (or days) to verify — and still risk subtle misalignments.

I’ve developed a provably correct, closed-form method that computes the exact modulus gate M instantly, for any given (b, p, t, r) where b= base, p= prime, t= depth, r= residue. It’s not simulation or approximation — it’s a deterministic, math-verified result you can drop directly into a spec or test plan.

If you’d like, email me your constraints (b, p, t, r) or visit my site below. I’ll send back your local and combined M values with full factorization so you can verify or integrate immediately.

Email: cwstevens71@gmail.com Site: https://sites.google.com/view/christopherwstevens

Christopher W. Stevens Independent Researcher (Mathematics) ORCID: https://orcid.org/0009-0005-4161-6615
by BhavdeepSethi | 2025-11-11 20:16:29+00:00
From what I've learned, be as explicit as possible when users enter dates.

We had to change our date of birth field in the user sign-up to three separate "Month Name","Day" and "Year" drop downs, since so many people made mistakes (fat finger/ swap month and day) from the "MM/DD/YYYY" field, and would then send support ticket to update it.
by lcnPylGDnU4H9OF | 2025-11-11 20:16:36+00:00
The most compelling reason I've heard is a converse to the point that one is making the employee work more to get all of the carts. It's true, but (supposedly) actually beneficial to the worker.

The idea is that working in the store is Bad (essentially because the manager is in the store and the manager makes you do things) and working outside the store is Good because you can work more leisurely even though you have a task to complete. Therefore, being forced to take a long time to gather all of the carts because so many were left outside the corrals is Good. For what it's worth, the idea was introduced to me by someone who claimed to have worked at a grocery store and that their favorite thing to do at that job was to gather the carts because it was so laid-back.

I still return my carts but this would 100% be my (honest) justification if I was ever approached by a cart narc after not returning a cart. If only to see their reaction when I say, with a completely straight face and the willingness to argue the point, "This is a kindness." (Also, it's a bit interesting to me that this was not included as a justification in the videos the author watched.)
by HackerThemAll | 2025-11-11 20:16:56+00:00
FFmpeg should stop fixing security bugs reported by Google, MS, Amazon, Meta etc. and instead wait for security patches from them. If FFmpeg maintainers will leave it exposed, those companies will rush to fixing it, because they'd be screwed otherwise. Every single one of them is dependent on FFmpeg exactly as shown in https://xkcd.com/2347/
by sudobash1 | 2025-11-11 20:17:02+00:00
To make that analogy closer to the Internet reality, I would say that Internet tracking is more like a cabal of shop-keepers, librarians, neighbors, utility pole workers, and so on who are keeping track of all the faces, all their habits, what they look at, what they say, who they interact with, and share this information amongst themselves, recording it in perpetuity. They also share details with the police and anyone who cares to purchase them.

When you talk about a "shopkeeper" it gives it a small community charm. The Internet is anything but that.
by more_corn | 2025-11-11 20:17:13+00:00
He seems to lack the ability to admit he was wrong. (And smart as you might be, nobody is immune to error). He wanted to port the PayPal production stack to windows. He refused to listen to reason and bulled ahead. It was about this time that the revolt and ouster happened. Could you imagine trying to run a production stack on win in the early 2000s? (Or ever) had he got his way we wouldn’t even be talking about him because he would have failed and disappeared into obscurity.
by ch4s3 | 2025-11-11 20:17:25+00:00
FC is always fake even thought the facilitator usually believes earnestly that it is real. It works partially through the ideomotor effect where the facilitator subconsciously makes physical queues to the letter they are thinking of next. There are plenty of tests where the facilitator is blind to a piece of information that the subject of facilitation can see and the FC always fails this test.
by gruez | 2025-11-11 20:17:39+00:00
The quite sensible reason is that LTSC doesn't contain the windows store, and as a result a bunch of driver apps don't work because they moved to using UWP apps (eg. realtek audio console). Not to mention that you'll eventually get weird compatibility issues because you'll eventually be running a windows version 5-10 years old, whereas most devs assume you're using be using the normal versions which are at most 2 years out of date. All of these issues can be worked around if you're sufficiently technically inclined, but people who are hiring "Microsoft consultants" probably aren't.
by grayhatter | 2025-11-11 20:17:43+00:00
I feel this comment is far to shallow a take. I would expect that you know better than most of HN, exactly how much a reputation security has as a cost center. Google uses ffmpeg internally, how many millions would they have to spend if they were required to not only create, but maintain ffmpeg themselves? How significant would that cost be at Google's scale?

I dont agree the following framing is accurate, but I can mention it because you've already said the important part (about how this issue exists, and mearly knowing about it doesn't create required work.) But here announcing it, and registering a CVE, Google is starting the clock. By some metrics, it was already running, but the reputational risk clearly was not. This does change priorities, and requires as urgent context switch. neither are free actions, especially not within FOSS.

To me, being someone who believes everyone, individuals and groups, have a responsibility to contribute fairly. I would frame it as Google's behavior gives the appearance weaponizing their cost center externally, given this is something Google could easily fix, but instead they shirked that responsibility to unfunded volunteers.
by epolanski | 2025-11-11 20:17:59+00:00
> To "charities" owned by other billionaires such as Bill & Melinda Gates Foundation

Which are responsible among other things for the quasi-total eradication of polio from this planet, provided vaccines for billions (literally) people across the globe in poor countries and have been major contributors in malaria and hiv treatment, prevention and research.

Also, they provided funds to millions of small rural farmers in third world countries to improve productivity and yields.

When I traveled Madagascar, plenty of villages had water and waste infrastructure built with the aid of that foundation too.

By the way, their balance sheets are public, and audited every year.

I'm baffled by the low-level conspirationism encountered on HN, it feels more and more like reading boomer's facebook everyday.
by vouwfietsman | 2025-11-11 20:18:06+00:00
"I have spent more than $500 dollars on pants before, because I'm lucky to be in a position where for me these things are a matter of taste and whim, rather than budget, and don't really affect my finances too much whether I do or don't buy them."

I don't think I have to explain to you how the gap between what you said, and what I wrote above, is what is causing offense here. You likely deserve 100% of your success, but its just common sense to obscure the specifics of it if you are way out of band in relative terms.

Its like saying: "You know, I never really get ill" at the cancer ward. Sure, its true, but read the room.
by danaris | 2025-11-11 20:18:07+00:00
Here's the question:

Why is Google deliberately running an AI process to find these bugs if they're just going to dump them all on the FFmpeg team to fix?

They have the option to pay someone to fix them.

They also have the option to not spend resources finding the bugs in the first place.

If they think these are so damn important to find that it's worth devoting those resources to, then they can damn well pay for fixing them too.

Or they can shut the hell up and let FFmpeg do its thing in the way that has kept it one of the https://xkcd.com/2347/ pieces of everyone's infrastructure for over 2 decades.
by owenversteeg | 2025-11-11 20:18:09+00:00
That's a cool video, but a custom 500W water-cooled setup does indeed strike me as "quite difficult" for your average person. It seems that the LED in the video is the $500 YujiLEDs BC270H, which is 20,000 lumens. In other words, to match midday sun at ~120k lux, for a small room of 100 sq ft /~10 m2, where all light fell directly onto you/the floor and none on the walls, you would need 1.2 million lumens, or _sixty_ of the setups in the video, or about 30 kW continuous ignoring all cooling needs and other losses.

I completely believe him when he says that it feels like sunlight (it's a high-quality, high-CRI, extremely bright light source at infinity!) but us humans are very bad at determining brightness levels. An iPhone flashlight in your face is unpleasantly bright and yet it is a completely insignificant amount of light on an absolute scale. We humans perceive brightness on a sort of relative log scale.

The steelman argument - where someone does indeed build one 500W water-cooled setup with large dish etc - and all of this light falls into a small corner of 2m x 2m - is still only ~5000 lux, roughly an overcast day. To even get to the level of standing in the shade on a clear day - 20k lux - for a regular room, you would need an obscenely powerful setup.

---

The natural response to my comment, of course, is that "well, maybe they don't need those high levels!" The problem is that all of the research indicates that they do. You mention research on Taiwan, which I think is a perfect example. They already did try to brighten the indoors to prevent myopia - minimum government standard of 500 lux starting with a 1999 standard [1], and in many cases brighter than that. You say that they need a 1000 lux environment, which isn't much different than the current Taiwanese indoors. I, on the other hand, say they need a ~100k lux environment, which is orders of magnitude more light. The research agrees with me: it was not the 500 lux standard, but the later introduction of two hours outdoors daily that improved myopia rates [1,2.]

Mind you, this is two hours outdoors during school hours in Taiwan, which is near the Tropic of Cancer (think Mexico, Caribbean, North Africa) and thus has far sunnier winters (Taiwanese peak summer sun is 1.9x winter sun vs 4.2x in Boston, 3.7x in NYC, 10x in London [4]) despite total solar irradiation being similar to Western cities [3.]

[1] https://www.sciencedirect.com/science/article/pii/S016164202...

[2] https://pubmed.ncbi.nlm.nih.gov/34425129/

[3] https://solargis.com/resources/free-maps-and-gis-data?locali...

[4] https://weatherspark.com/y/137170/Average-Weather-in-Taipei-...
by PeaceTed | 2025-11-11 20:18:27+00:00
This is why many have warned against things like MIT licence. Yes, it gives you source code and does easily get incorporated into a lot of projects but it comes at the cost of potential abuse.

Yes, GPL 3 is a lot ideologically but it was trying to limit excessive leeching.

Now that I have opened the flood gates of a 20 year old debate, time to walk away.
by thewebguyd | 2025-11-11 20:18:29+00:00
Microsoft "consultants" are are usually just license auditors in disguise. We ignore them, and I suggest everyone else do the same. They "helpfully" reach out and offer to optimize your infrastructure and spend. That 'optimization' is actually "let's make sure you bought all the CALs you were supposed to, and when you inevitably didn't, because we make our licensing confusing, we'll charge you extra and threaten legal action for non-compliance"

Better to find a reputable VAR and get your licensing through them and don't ever deal with Microsoft directly.
by greycol | 2025-11-11 20:18:35+00:00
If you believe the AI bubble will pop in the same way as the dotcom bubble and feel you can pick winners it makes sense. It would be like selling cisco stock for google. You can still invest in cisco later if you believe they'll grow but you might expect a stagnant period and definitely expect a drop as they don't have as much demand. NVidia is a safe bet to continue exisitng and being profitable but by being so central to the market you could almost guarantee a large drop in stock price while other companies are a gamble.
by PaulHoule | 2025-11-11 20:18:41+00:00
There is so much to unpack here but I'd start with:

(1) If companies spent 90% of their time thinking about how to use devs when they get them instead of spending 90% on their time thinking about getting devs it would be different

(2) you can't trust celebrity software developers like Spolsky or Atwood or Graham or Hansson. Usually these people are successful at developing and marketing tools for developers or get into VC which involves similar skills. They cultivate being a celebrity as part of the marketing.

That sort of person is certainly successful at developing and marketing a product but I'd say that kind of person doesn't have particularly useful or transferrable information for others who develop and market software. The person whose advice I want to hear is the one who worked for a company like IBM over 30 years in 45 cities in 12 countries managing team who worked on a huge number of projects some of which succeeded and some of which failed.
by walletdrainer | 2025-11-11 20:19:01+00:00
Well not really, I do my grocery shopping a few minutes away in Monaco where nobody pays taxes. I could move less than a kilometre and save loads of money, despite the outrageous real estate costs.

I just kind of like where I am now so don’t care enough to do that, and at least try to assume that the government does a relatively good job of directing my donation to good causes.
by BrandoElFollito | 2025-11-11 20:19:29+00:00
I think it is going to be difficult for you to get advice outside of the herbal "find a job you like, live a full life"

I am working for 30+ years, a combination of academia, then tech until today, where I have a very senior position in a company you know.

The world changed drasically over these 30 years and my path to an arguably successful career is absolutely not what I am suggesting to my children.

My generation built the Internet from a state of nothingness. This meant that whatever clever you were doing was new and recounting, and was bringing money. You had z limited set of technologies so you could be a master in many of them, and good in the rest.

Today this is not possible, you need to specialize, and often early.

I know that this not help, what I am probably trying to say it's that there are immutable truths (having fun, having friends and/or family, having hobbies, ...), then there is luck and maybe a statistical relevance in some jobs more than others.
by rawling | 2025-11-11 20:19:43+00:00
I've noticed it seems windows aren't allowed to foreground themselves/each other anymore, which seems reasonable (anti click jacking?), but this includes VS not being able to foreground my diff tool when I diff something, and Outlook not being able to foreground itself when I double click the new mail envelope in the notification area.

I also enjoy going to grab a maximised window by its title bar and somehow grabbing the window behind it.
by noir_lord | 2025-11-11 20:19:54+00:00
AWS MediaConvert as well which is a huge API (in surface it covers) which is under Elemental but is kinda it's own thing - willing to bet (though I don't know) that that is ffmpeg somewhere underneath.

The API manual for it is nearly 4000 pages and it can do insane stuff[1].

I had to use it at last job(TM), it's not terrible API wise.

[1] https://docs.aws.amazon.com/pdfs/mediaconvert/latest/apirefe... CAUTION: big PDF.
by StopDisinfo910 | 2025-11-11 20:20:22+00:00
They are not published in project bug trackers and are managed completely differently so no, personally, I don't view CVE as bug reports. Also, please, don't distrort what I say and omit part of my comment, thank you.

Some of them are not even bugs in the traditional sense of the world but expected behaviours which can lead to unsecure side effects.
by godelski | 2025-11-11 20:20:49+00:00
This is pretty handy and I've been using it for years[0].

I like the idea of Brave but we have a bigger fight that requires us to have no chromium. Chromium winning is Google winning, allowing them to control the Internet. I don't want that power in any single entity's hands. So I do ask that more people switch to Firefox or Safari as those are the best options to fight back and have decent market shares (even if small). If we lose the internet we'll lose our privacy too

[0] https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...
by esrauch | 2025-11-11 20:21:00+00:00
One problem here is that CVE scoring is basically entirely bugged, something scored 8.7 could be an RCE exploit or a "may be able to waste CPU" issue.

That's the difference between "it may or may not be that there's someone who cares" versus "no one should be running this software anywhere in the general vicinity of untrusted inputs".
by tzs | 2025-11-11 20:21:08+00:00
That might be an arguably plausible explanation for people to be skeptical of recently developed vaccines.

But most of the vaccines that are recommended for all preschool children in the US are not recent, long predating the opioid crisis.

The MMR vaccine became recommended in 1971, replacing separate vaccines for measles, mumps, and rubella.

Pertussis, diphtheria, and tetanus vaccination become recommended in 1914, 1926, and 1938, respectively and were combined into the DTP combo vaccine in the '40s.

Polio vaccination became recommended in 1955.

There is no good reason to be skeptical of any of those or other similar ones I've left off. We've got 60-100+ years of widespread use which has generated a ton of data spanning multiple generations showing they are safe and effective.
by johnnyanmac | 2025-11-11 20:21:17+00:00
>Anything else you read into this is going to be fraught with your own coloring based on a hundred words written in text (a notoriously difficult medium to establish emotional communication over).

It's colored based on environmental and experience. And my experience suggests that there's no transparency these days nor real progress.

This kind of dismissal is the exact kind of gsaslighting that makes me Cynical. "they just want to talk". Yeah, that's all they ever want to do.
by kube-system | 2025-11-11 20:21:25+00:00
> if another Firefox user comes they are indistinguishable from each other,

Even if every Firefox browser gave off the exact same fingerprint, that wouldn't make the network traffic indistinguishable between Firefox users. There is a lot of entropy that is provided by your network stack of your device, the networks you connect to in order to get to the end website, the behavior of your requests, etc.

Now, most websites aren't doing this kind of analysis. But it isn't unheard of or impossible. There are major websites that are known to do TLS fingerprinting.
by tpmoney | 2025-11-11 20:22:57+00:00
“Core performance” only matters relative to what the company is selling you though. For example let’s say a company sells 2 tiers of switch. One does 10G and the other 1G. For whatever reason when they start selling these, it’s cheapest for them to sell the same internal hardware, but with the internals underclocked in software. Some hardware hackers discover this and start unlocking the 10G capabilities of the 1G units. Later down the road, the company finds a cheaper implementation of hardware for the 1G that still can do 1G but even if up-clocked can now only do 2.5 at best. That’s a change to “core performance” but it’s also not fraud. They didn’t advertise or sell you a “switch that starts at 1G but can be unlocked for 10G”, they sold you a “switch that can do 1G”. As long as that’s what they’re still selling you, everything else is ancillary.
by MichaelNolan | 2025-11-11 20:23:05+00:00
The difference is scale and intent. A mom and pop store owner “remembering” my face versus big tech tracking is like comparing a nosy neighbor to the CIA.

One of them might peer out their window, the other will infiltrate every aspect of your life. One of them is bored, the other has no qualms about doing significant harm to you if it serves their interests.
by thewebguyd | 2025-11-11 20:23:13+00:00
Yeah, windows is pretty aggressive with the focus stealing prevention (I believe GNOME on Linux is also working on something similar, hopefully with a better implementation).

It seems to struggle with differentiating between what's a user initiated focus-steal and what's automated/originating from the app without user action.

I'll take that over what existed before, which was any app could just open a window and give itself focus at any time.
by iscoelho | 2025-11-11 20:23:19+00:00
It’s a reproducible use-after-free in a codec that ships by default with most desktop and server distributions.

The recent iOS zero-day (CVE-2025-43300) targeted the rarely used DNG image format. How long before this FFMPEG vulnerability is exploited to compromise legacy devices in the wild, I wonder?

I’m not a fan of this grandstanding for arguably questionable funding. (I surely would not fund those who believe these issues are slop.) I’d like to think most contributors already understand the severity and genuinely care about keeping FFMPEG secure.
by glenstein | 2025-11-11 20:23:28+00:00
It's automated data processing at scale rather than a local mom and pop country general store. The profit seeking, decision making, management culture driving decisions is a fundamentally different relationship. Also I don't think store owners do that?

Rather than presupposing an analogy to something importantly different, I would propose that the steelman would be along the lines of noting that ads and hyperpersonalization are effective at meeting and predicting your needs, and steering you towards an interpretation of your own needs that finds their fulfillment in deepening a consumer relationship. And if you get steered into lock-in with one company's ecosystem, you get the convenience of a stack of vertically integrated services.