MurphyA/hacker-news huggingface dataset:
by dfabulich | 2025-11-05 17:49:03+00:00
If you would RTFA, they're removing XSLT specifically for security reasons. They provide the following links:

https://www.offensivecon.org/speakers/2025/ivan-fratric.html

> Although XSLT in web browsers has been a known attack surface for some time, there are still plenty of bugs to be found in it, when viewing it through the lens of modern vulnerability discovery techniques. In this presentation, we will talk about how we found multiple vulnerabilities in XSLT implementations across all major web browsers. We will showcase vulnerabilities that remained undiscovered for 20+ years, difficult to fix bug classes with many variants as well as instances of less well-known bug classes that break memory safety in unexpected ways. We will show a working exploit against at least one web browser using these bugs.

https://nvd.nist.gov/vuln/detail/CVE-2025-7425

https://nvd.nist.gov/vuln/detail/CVE-2022-22834

(And, for the record, XSL is Turing-complete. It has xsl:variable, xsl:if, xsl:for-each, and xsl:apply-template function calls.)
by ryandrake | 2025-11-05 17:49:29+00:00
Believe me, I've tried that, too. Even after giving detailed instructions on how to validate its work, it often fails to do it, or it follows those instructions and still gets it wrong.

Don't get me wrong: Claude seems to be very useful if it's on a well-trodden train track and never has to go off the tracks. But it struggles when its output is incorrect.

The worst behavior is this "try things over and over" behavior, which is also very common among junior developers and is one of the habits I try to break from real humans, too. I've gone so far as to put into the root CLAUDE.md system prompt:

--NEVER-- try fixes that you are not sure will work.

--ALWAYS-- prove that something is expected to work and is the correct fix, before implementing it, and then verify the expected output after applying the fix.

...which is a fundamental thing I'd ask of a real software engineer, too. Problem is, as an LLM, it's just spitting out probabilistic sentences: it is always 100% confident of its next few words. Which makes it a poor investigator.
by stevesunderland | 2025-11-05 17:49:40+00:00
SEEKING WORK | USA | Remote

Developer + Designer

I'm a graphic designer and web developer who creates websites, brand identities and marketing material for a variety of companies including startups, agencies and non-profit organizations. In addition to my design skills, I am also a full-stack web developer.

DESIGN: websites, apps, UI/UX, mobile, logos, marketing material, trade show displays, packaging, photo retouching, book covers, etc.

DEVELOPMENT: HTML, CSS, JavaScript, Vue, Angular, Python, Django, SQL, PHP, Bootstrap, Foundation, REST APIs, Wordpress, Webpack, Jekyll, Hugo, etc.

PORTFOLIO: https://sunderland.studio

LINKEDIN: http://linkedin.com/in/stevesunderland

CONTACT: stevesunderland@gmail.com
by wat10000 | 2025-11-05 17:49:52+00:00
Sorry, but this annoys me. The claim might be false if I had made it after seeing your screenshot. But you don't know what I've seen in my life up to that point. The claim that all calculators are infallible would be false, but that's not the claim I made.

When a personal experience is cited, a valid counterargument would be "your experience is not representative," not "you are incorrect about your own experience."
by jvanderbot | 2025-11-05 17:50:32+00:00
There are some truths though that are worth showing.

1. plotting in this way shows areas that are nearly solutions which is really cool.

2. Not mentioned, but this shows gradient around the solution as well, which helps understand attractor/repulsor a bit intuitively

I mean I have generated these plots before to visualize things like error or sensitivity, but this is clean and very cool. So, credit where credit is due for spreading the idea.
Show HN: I scraped 3B Goodreads reviews to train a better recommendation model
by costco | 2025-11-05 17:50:45+00:00
Hi everyone,

For the past couple months I've been working on a website with two main features:

- https://book.sv - put in a list of books and get recommendations on what to read next from a model trained on over a billion reviews

- https://book.sv/intersect - put in a list of books and find the users on Goodreads who have read them all (if you don't want to be included in these results, you can opt-out here: https://book.sv/remove-my-data)

Technical info available here: https://book.sv/how-it-works

Note 1: If you only provide one or two books, the model doesn't have a lot to work with and may include a handful of somewhat unrelated popular books in the results. If you want recommendations based on just one book, click the "Similar" button next to the book after adding it to the input book list on the recommendations page.

Note 2: This is uncommon, but if you get an unexpected non-English titled book in the results, it is probably not a mistake and it very likely has an English edition. The "canonical" edition of a book I use for display is whatever one is the most popular, which is usually the English version, but this is not the case for all books, especially those by famous French or Russian authors.
by davisr | 2025-11-05 17:50:52+00:00
Did I say abandon? No. I said it should not be required. JavaScript should be supplementary to a page, but not necessary to view it. This was its original intent.

> JS is what has allowed websites to replace desktop apps in many cases.

Horribly at that, with poorer accessibility features, worse latency, abused visual style that doesn't match the host operating system, unusable during times of net outages, etc, etc.
Bankrank.io is accepting signups for their Q1 2026 Alpha
by calderarrow | 2025-11-05 17:51:48+00:00
Hey! I'm Anthony, one of the creators of Bank Rank. We're building a fully-automated bank account that continuously optimizes your yield to guarantee the best rates.

Behind the scenes, our system tracks thousands of deposit products across U.S. banks and credit unions and automatically redistributes your money whenever you deposit or withdraw money, or in response to product changes. No matter where your funds are, you'll have complete access through a single Bank Rank app.

We’re launching an Alpha test of our premium, fully-managed accounts in Q1 2026, and signups are open now. You can join by emailing us at bankrank.alpha@gmail.com or submitting your email on this form: https://bankrank.io/waitlist

We’re also launching a free tier of the product towards the end of November for users who want to manage their own finances. It will be an installable, cross-platform tool that lets you run queries and receive proactive notifications when products change that meet your criteria — no login or account required. Send us an email if you want to get notified when this releases.

In the meantime, I’ll be around for the next few hours to answer questions or discuss suggestions. You can also try a demo at bankrank.io or reach out anytime at bankrank.alpha@gmail.com
by yalestar | 2025-11-05 17:52:06+00:00
This really reminded me of a colleague who had a part-time night job flying cancelled checks from Centennial Airport (KAPA, south of Denver) to SLC. A bunch of us went out to lunch on a Friday in December 2005. That night, on his return to KAPA, he crashed his Mitsubishi MU-2 about a mile short of the runway. He and his co-pilot were gone, just like that. On Monday you could see the wreckage and cleanup from our office which was near the airport. It was so surreal.
by refp | 2025-11-05 17:52:08+00:00
The TLDR is that I back in 2015 published some C++ related posts that got way more traction than I originally anticipated, and given the subscriptions to the RSS-feed I felt like I could not live up to the contents people perhaps expected.

On the other hand, I have no idea what people _actually_ expected to be published, but in my head I have for what it's worth created this nightmare scenario where I post something not related to C++, and all those readers would be /pinged and disappointed.

Impressions and clicks are a confident booster, though the fear of disappointing or letting people down because they expect "better" content is something I for sure struggle with
by com2kid | 2025-11-05 17:52:45+00:00
> Let's say that you visit a government office for a driving license. Should you pay a bribe to the official?

We formalized it! It is called an application fee, and it is set high enough so they the government employee doesn't need to take bribes outside of their salary.

Other countries set application fees so low that government employees barely earn enough money to eat, so they take bribes.

NYC solves a huge part of their police corruption problem by just paying officers more.

> When politicians debate public policy, the only criterion should be the public interests

I agree much of lobbying is corrupt, but the concept is that lobbying is how politicians discover the public interest. It is also how they get input on the effects of proposed laws. I want my local small business lobbying group to let my city know if a proposed tax increase will bankrupt my favorite local stores!

The fact is, what the EFF and ACLU do to protect our rights is also a form of lobbying.
by Jamesbeam | 2025-11-05 17:53:10+00:00
Someone in the Pentagon should quickly get the presidential crayon kit and send the Secretary of War a pretty hand-drawn picture why this is bad on the PC Venezuela Signal Group.

I am not sure the Secretary knows the difference between Warrior Spirit and Warrior Spirits, which is, probably to his surprise no hard liquor brand,but the soul that leaves the body after your soldiers starved to death or died from embarrassment, having to fight over scraps with Ukrainian refugees and poor and/or old German people at a local food bank.

For the old KGB Russians like Putin, this must be amazingly joyful to see. American Soldiers are advised to go to Food Banks, while the Commander-in-Chief could easily feed the whole army steak dinner for two months straight, flown in in his newly gifted private 747, with what he made in Crypto only during the first half of 2025.
by arnav3 | 2025-11-05 17:53:28+00:00
Today MCP is the closest we have for Agents executing business logic. It's very well known MCPs dont scale well beyond 50 tools. This solves the scale of having 1000+ tools/API calls, and allows service owners to contextualize how these tools must be called, and in what context. Imagine an Agent ordering for you on Amazon, and it attempts to checkout with no items in the cart. Concierge ensures that an Agent can call 1000+ APIs/tools extremely reliably, and allows service owners to define how to call the service.
by MarsIronPI | 2025-11-05 17:53:36+00:00
For me at least, Emacs' pure GTK port isn't enough! You'll have to pry EXWM[0] from my cold, dead hands, so until Emacs can act as a Wayland compositor I'm staying on X. That and also Wayland still doesn't seem to support Hyper as an independent modifier.

[0]: https://github.com/emacs-exwm/exwm
by johnnyanmac | 2025-11-05 17:53:40+00:00
There's two vectors here and people seem to not realize that, isolated from the short term suffering going on right now.

Rental control is short term relief. Obviously, using short term solutions long term is bad. This shouldn't be an enigma.

Building housing is long term. We cannot build new houses in a year. At least, not that I know of. But new houses in 4 years does not help the citizens knocked onto the streets in those times.

You need to relive those people while also securing the future. That's why rent control fails without a proper housing reform.

You can't be mad at a pipe bursting that you used duct tape to cover. But maybe that duct tape buys you time to find a plumber, who needs time to find the right size pipes. So duct tape is still really useful, just not the end all be all.
by samus | 2025-11-05 17:53:49+00:00
> it's complex to generate correct machine code, but we trust compilers to do it all the time.

Generating correct machine code is actually pretty simple. It gets complicated if you want efficient machine code.

> So, then - why don't people embrace AI with thinking mode as an acceptable form of automation? Can't the C-suite in this case follow its thought process and step in when it messes up?

> I think people still find AI repugnant in that case. There's still a sense of "I don't know why you did this and it scares me", despite the debuggability, and it comes from the autonomy without guardrails. People want to be able to stop bad things before they happen, but with AI you often only seem to do so after the fact.

> Narrow AI, AI with guardrails, AI with multiple safety redundancies - these don't elicit the same reaction. They seem to be valid, acceptable forms of automation. Perhaps that's what the ecosystem will eventually tend to, hopefully.

We have not reached AGI yet; by definition its results cannot be trusted unless it's a domain where it has gotten pretty good already (classification, OCR, speech, text mining). For more advanced use cases, if I still have to validate what the AI does because its "thinking" process cannot be trusted in way, what's the point? The AI doesn't think; we just choose to interpret it as such, and we should rightly be concerned about people who turn their brain off and blindly trust AI.
by majoe | 2025-11-05 17:54:25+00:00
> Thing is that you need a complex JIT like Julia's or stuff like https://github.com/marcoheisig/fast-generic-functions to offset the cost of constant dynamic dispatch.

Julia is always the odd one out, when talking about dynamic vs. static dispatch, because its JIT compiler acts more like an Ahead-of-Time compiler in many regards.

In the best case, types are statically decidable and Julia's compiler just produces a static dispatch and native code like e.g. a C compiler would.

In the worst case, there are a big (or unlimited) number of type candidates.

The grey area in between, where there are a limited number of type candidates, is interesting. As far as I understand, Julia does something similar to the link you provided. Based on some heuristics it will compile instances for a "sealed" number of candidates and fallback to a fully dynamic dispatch, if there are two many type candidates.

At JuliaCon 2025 there was an interesting talk about this topic: https://m.youtube.com/watch?v=iuq534UDvR4&list=PLP8iPy9hna6S...

For the worst case scenario, Julia chooses what's in my regard the nuclear option: If the types are not decidable, it just ships the whole compiler with your code and tries again at runtime. But I guess, that's not the only possible solution. Presumably, it would also be possible to fallback to a Julia interpreter for dynamic code. That would be more similar to what JavaScript is doing, just the other way around. Instead of interpreting the majority if the code and optimising hot paths with a JIT, our alternative Julia would compile most code statically and use the interpreter for the dynamic parts.
by lotsofpulp | 2025-11-05 17:54:40+00:00
Aldi is a limited service grocer that doesn't have to deal with employee unions and costly departments like meat/deli/bakery/etc.

That is the underlying story, is that fewer Americans can afford the full service grocer (or maybe don't want to patronize due to smaller household sizes and less cooking). Also, Aldi has successfully fended off unions, which are mostly a thing legacy grocers like Albertsons and Kroger have to deal with.
by mateo411 | 2025-11-05 17:54:56+00:00
There were some interesting algorithms that came out of the contest. There was a matrix factorization algorithm that worked pretty well. Another "guy in a garage" tried to incorporate the anchoring effect into their models.

I don't think Netflix used any of the algorithms. I suspect they have more data on the user and movies than was presented in the contest.

I agree, if all of the content is garbage, then you don't need a model, you could simply pick something at random.
by OkayPhysicist | 2025-11-05 17:55:00+00:00
They're really not a permanent minority, though. Obama's campaign promises (not to be confused with his actual politics once in office) demonstrate that positive, progressive change is a perfectly popular political position.

And frankly, that's all besides the point: The reason exciting candidates do so well (Trump, Obama) is because voter turnout in the US is abysmal. It's gotten better (because the Fascists are excited for Trump, and everyone else is at least a bit energized by "oh god we can't have the fascists win"), but it's still very true that if you could convince at a quarter of the nonvoters (half of the half that might vote for you) to show up to the polls, you'd have a blowout victory the likes of which haven't been seen since the Bill Clinton campaigns.

The Democrats have been playing a strategy that tries to win over the rational fringe of the Republican party, but it's becoming increasingly obvious to apparently everyone but the DNC that those people don't exist. The kind of person who can be convinced to vote for Trump (ESPECIALLY TWICE) are not the kinds of people the Democrats will ever win over without royally pissing off most of their voter base.
by testing22321 | 2025-11-05 17:55:12+00:00
My last job at a telco I was in charge of a system that billed ~5 million dollars monthly. When the machine was built, the guy that did it didn’t record the root password. He added me to sudoers before he left. I left a few years later, nobody took ownership.

Looking at the web interface, I can tell it’s still running, doing its thing. I’m sure its still running Linux from 2008.
by IAmBroom | 2025-11-05 17:55:28+00:00
100% false.

For obvious reasons, non-CBTC trains are not remotely controllable (CBTC essentially means "remotely driven"). It's all or nothing; either a safety system that inherently accepts the risk, or no way to remotely control the speed, short of fully stopping the train.

If modern cars have been fully remotely controllable for years, why can't police stop often-deadly car chases?

Ditto on air traffic control and small planes; many don't even have in-plane automatic pilots. AFAIK no ultralights ever do.

Most boats are not remotely controllable; even the large container ship that recently damaged a major US bridge didn't.
by mikepurvis | 2025-11-05 17:55:31+00:00
From TFA:

"Unfortunately, no matter how hard you try, there is a certain percentage of nodes for whom hole punching will never work. This is because their NAT behaves in an unpredictable way. While most NATs are well-behaved, some aren’t. This is one of the sad facts of life that network engineers have to deal with."

In this scenario, the article goes on to describe a convention relay-based approach.

I would guess that most consumer routers are very cooperative as far as hole punching because it's pretty critical functionality for bittorrent and many online games. Corporate firewalls wouldn't be as motivated to care about those use-cases or may want to actively block them.
by array_key_first | 2025-11-05 17:55:42+00:00
I think the builder builds if you pay them. I don't think they care about what the rent will be because they just build stuff.

So, just pay them, and figure it out later.

The alternative is what we're currently doing, and have been doing for the past few decades: nothing. This does not work. Our current housing situation is simply not sustainable.
by duxup | 2025-11-05 17:56:00+00:00
I miss the days when American conservatives actually seemed to car a little about the idea of libertarian-ism ... even a little.

But no, now when they're in power its a complete abandonment of any libertarian ideals.

I'll take a few local occurrences / defectors from the proposed autocracy as a good-ish sign if only because there are are few.
by weavermarquez | 2025-11-05 17:56:09+00:00
Thanks for posting erhuve!

Sadly, a third of American adults do not understand fractions. A big part of this isn't just the particulars of the educational system -- it is also caused by the way we conceive of and teach mathematics as disembodied, symbolic manipulation.

James Algebra (by Jeffrey James and William Bricken, one of the O.G. researchers in virtual reality) is an 'iconic' notation for K-12 mathematics -- it makes numbers look like what they mean.

I'm working on a mobile puzzle game to publicize this. Check out my WIP at https://house.valeriekim.ca -- though I need to get it to a self-demoing state.
by com2kid | 2025-11-05 17:56:32+00:00
Discovery on mp3.com was horrible, I basically had to browse a list of artists by poorly defined genres. Back then not as many genre labels existed and tagging wasn't quite a thing so much as now since the #tag syntax hadn't been invented yet.

As a result I spent hours wandering around through the site finding music I liked. I don't have the time to do that anymore, so what made the site wonderful back then (being forced to dig deep) just wouldn't work for me now. :(
by bawolff | 2025-11-05 17:57:12+00:00
My understanding is that contrary to popular opinion it is firefox not chrome that originally pushed for the removal, so i dont know how relavent that is. It seems like all browser vendors are in agreement on xslt.

that said, xslt is a bit of a weird api in how it interacts with everything. Not all apis are equally risky and i suspect xslt is pretty high up there on the risk vs reward ratio.
by burningChrome | 2025-11-05 17:58:07+00:00
Similar story.

I worked for a medium sized company who did work with Toro. We supplied many of their lubricants and they had TUI they still used on one of their machines to enter the orders from our company. It was the last of their legacy products, but worked incredibly well. We had very little issues ever with the system. Our Oracle ERP Net Suite? Had three people dedicated to making sure it ran smoothly. I still remember some of the guys I used to talk to at Toro were "lifers" who were always talking about how easier things were before all the SAAS and ERP software came on the scene.

The stories they had were pretty entertaining.
by DonHopkins | 2025-11-05 17:58:23+00:00
You should really try some of the modern alternatives. Don't let Angular and React's templating systems poison you, give Svelte a try!

Even just plain JavaScript is much better and more powerful and easier to use than XSLT. There are many JavaScript libraries to help you with templates. Is there even any such thing as an XSLT library?

Is there some reason you would prefer to use XSLT than JavaScript? You can much more easily get a job yourself or hire developers who know JavaScript. Can you say the same thing for XSLT, and would anyone in their right mind hire somebody who knows XSLT but refuses to use JavaScript?

XSLT is so clumsy and hard to modularize, only good for messy spaghetti monoliths, no good for components and libraries and modules and frameworks, or any form of abstraction.

And then there's debugging. Does a good XSLT debugger even exist? Can it hold a candle to all the off-the-shelf built-in JavaScript debuggers that every browser includes? How do you even debug and trace through your XSLT?
by buildsjets | 2025-11-05 17:58:28+00:00
I go to many metal and other shows a year. A 3-day outdoor festival in the woods with hundreds of tripping manchildren moshing in the rain resulted in a very muddy shallow depression, not a landslide. I have brief cameo in the video below. Want to see a hundred hippies sitting in the mud pretending to row ancient Roman galley?

https://youtu.be/X-BtJBDi8OA?si=Gtzeibmuokx39KhP
by com2kid | 2025-11-05 17:58:47+00:00
Yeah the last CLI app I used was actually a TUI. It routed std out and std err from scripts and programs it'd call out to into separate windows. It had animations and effects and a help system built in. It also had theming support because the library I used for the TUI happened to have that and came with some default themes! It was a bit beyond a simple CLI tool.

If I'm farfing around with the console I'm going to have fun.