MurphyA/hacker-news huggingface dataset:
by Capricorn2481 | 2025-11-25 12:24:34+00:00
My whole comment here is that safe code has to care about how it uses data from unsafe code. That's pretty evident from my example and from reading from_raw_parts. How would you fix this by only editing the code inside the unsafe block? Because you said the problem is the lifetime. That's outside of the unsafe block.

> The unsafe code is not fulfilling the contract of "unsafe", which requires the coder to uphold the memory safety rules as seen from outside

It's the exact opposite. From the Rust docs. [1]

> By calling an unsafe function within an unsafe block, we’re saying that we’ve read this function’s documentation and we take responsibility for upholding the function’s contracts

The caller here is what is violating the contract. It's not the unsafe code's job to do that. How could it? It's just making a slice, it doesn't know what from. It can't guarantee a slice it makes is ANY kind of lifetime. If it could, it wouldn't require unsafe.

We don't have to use a static lifetime to have this bug:

// still broken // basically says it has SOME kind of lifetime fn make_slice<'a>(ptr: *const i32, len: usize) -> &'a [i32] {

Lifetime annotations are just annotations for the compiler, but they mean very little when using unsafe. I wrote a bad lifetime to illustrate that Rust doesn't care. Normally, the compiler would make sure your lifetimes make sense, but not with unsafe. Because it's the calling code that has to care.

Yes, if you change the function signature and require it to receive the vec so you can see the lifetime, you could technically fix it from this function. That's the only way to get the right lifetime.

fn make_slice<'a>(ptr: *const i32, len: usize, _lifetime: &'a Vec<i32>) -> &'a [i32] {

So yes, as long as you change your function so much you can basically remove unsafe, you can fix it from the function.

But you can't do this in scenarios where you'd actually want unsafe, like FFI, custom data structures, etc. You don't have the same lifetime information available to you.

[1] https://doc.rust-lang.org/book/ch20-01-unsafe-rust.html#call...
by jlouis | 2025-11-25 12:26:00+00:00
It's not. The fragments you can execute are limited if you do it right. A client isn't allowed to just execute anything it wants, because the valid operations are pre-determined. The client sends a reference which executes a specific pre-planned fragment of code.

In development, you let clients roam free, so you have access to the API in a full manner. Deployments then lock-down the API. If you just let a client execute anything it wants in production, you get into performance-trouble very easily once a given client decides to be adventurous.

GraphQL is an execution semantics. It's very close to a lambda calculus, but I don't think that was by design. I think that came about by accident. A client is really sending a small fragment of code to the server, which the server then executes. The closest thing you have is probably SQL queries: the client sends a query to the server, which the server then executes.

It's fundamental to the idea of GraphQL as well. You want to put power into the hands of the client, because that's what allows a top-down approach to UX design. If you always have to manipulate the server-side whenever a client wants to change call structure, you've lost.
by esrauch | 2025-11-25 12:27:18+00:00
I know a number of people who pay very little taxes and enjoy tht benefit of government services, many of them are vocally against government spending despite that they would be personally harmed if they stopped

If what you are saying is true then Democrats would smash every election, "government spending too high" is demonstrably a fairly popular opinion with both low and high income based on voting.
by MrBuddyCasino | 2025-11-25 12:28:02+00:00
- OpenAI triggered the DRAM crisis via their October 1st deal: https://openai.com/index/samsung-and-sk-join-stargate/

- contract guarantees 900.000 wafers per month, which is ~40% global capacity

- this starts the stockpiling race, everyone buys DRAM even if they don't need it right now, because they expect a shortage
by cogogo | 2025-11-25 12:29:39+00:00
It was also developed “iteratively” under extremely harsh selection criteria over a time scale that is so long it is almost impossible to reason about. An old geology textbook I had used the analogy of a geologic timeline that stretched from LA to NYC. Life appears really early (in CA somewhere IIRC) and human existence is about the width of a crack in the pavement just before you hit the Atlantic Ocean.
by TinkersW | 2025-11-25 12:31:21+00:00
I my experience you absolutely must have type checking for anything that prints, because eventually some never previously triggered log/assertion statement is hit, attempts to print, and has an incorrect format string.

I would not use iostreams, but neither would I use printf.

At the very least if you can't use std::format, wrap your printf in a macro that parses the format string using a constexpr function, and verifies it matches the arguments.
by javcasas | 2025-11-25 12:31:42+00:00
> it has to go somewhere

Yes, but going as a static method into a class that goes into a module is overkill vs just putting it in the module.

> Having a huge number of things globally is just confusing pollution.

I don't know what language you use, but modern programming languages allow specifying what to import when importing a module. You don't have to import everything from every module.
by skeledrew | 2025-11-25 12:32:05+00:00
Definitely, with the primary issue in this case being that the PRer didn't discuss with the maintainers before going to work. Things could've gone very differently if that discussion was had, especially disclosing the intent to use generated code. Though of course there's the risk that disclosure could've led to a preemptive shutdown of the discussion, as there are those who simply don't want to consider it at all.
by JKCalhoun | 2025-11-25 12:32:24+00:00
The Sedan test [1], part of Project Plowshare, was an underground test in Nevada that sent fallout across a large swath of the U.S. Midwaste, sorry, Midwest.

The wife's family lived in Omaha, Nebraska at the time. A lot of cancer in her family. But then a lot of smokers as well. So who knows.

Regardless, that one was a major fuck-up that seems to have kind of put the kibosh on "underground" testing of that sort.

[1] https://en.wikipedia.org/wiki/Sedan_(nuclear_test)
by CableNinja | 2025-11-25 12:33:31+00:00
The upside was that it was 100% customizable, there were tons of themes that redesigned the entire look of the desktop, and lots of resources for it.

Naturally, all mine looked like hot garbage, but it taught me about texture and image editing, and how transparencies worked in rendering (though xp themes were a special hell of using neon pink because transparent pixels werent usable yet)
by pjmlp | 2025-11-25 12:33:38+00:00
As someone that had the option to choose between C and C++, coming from compiled BASIC and Object Pascal backgrounds, back in the early 1990's.

What makes C++ valueable is being a TypeScript for C, born in the same UNIX and Bell Labs farm (so to speak), allowing me to tap into the same ecosystem, while allowing me to enjoy the high level abstractions of programming languages like Smalltalk, Lisp, or even Haskell.

Thus I can program on MS-DOS limited with 640 KB, an ESP32, Arduino, a CUDA card, or a distributed system cluster with TB of memory, selecting which parts are more convinient for the specific application.

Naturally I would like in 2025 to be able to exercise such workflows with a compiled managed language instead of C++, however I keep being in the minority, thus language XYZ + C++ it is.
by splix | 2025-11-25 12:33:49+00:00
We made a script to avoid such situations. It checks the dependencies, just by parsing the package.json (or the lock file), checking the relevant time on npm registry, and returns error if it finds a too fresh package added.

We run it on CI for each commit/PR, and if a developer tries to commit a change that updates a JS dependency to a too recent it prevents the build from running, and so on. Basically we expect that a Supply Chain attacks on NPM would be noticed in a couple of week, and we enforce this time window to our code.

See https://github.com/emeraldpay/paranoid.js
by leo_e | 2025-11-25 12:33:56+00:00
I admit PSI wasn't on our radar for this specific issue. We've been staring at RSS and page fault counters, but they are indeed too noisy in an mmap-heavy workload.

Checking /proc/pressure/memory to distinguish between 'healthy caching' and 'thrashing' sounds exactly like the signal we are missing. We will try to incorporate some pressure metrics into the node's health report. Thanks for the pointer.

But still, too many metrics for us to balance
by mrspuratic | 2025-11-25 12:34:26+00:00
CD storage has an interesting take, the available sector size varies by use, i.e. audio or MPEG1 video (VideoCD) at 2352 data octets per sector (with two media level ECCs), actual data at 2048 octets per sector where the extra EDC/ECC can be exposed by reading "raw". I learned this the hard way with VideoPack's malformed VCD images, I wrote a tool to post-process the images to recreate the correct EDC/ECC per sector. Fun fact, ISO9660 stores file metadata simultaneously in big-endian and little form (AFAIR VP used to fluff that up too).
by tremon | 2025-11-25 12:34:57+00:00
C-levels love the "shut it down and wait until someone cries up" method because it gives easy results on some arbitrary KPI metric without exposing them to the actual fallout

It's not in the C-level's job description to manage the daily operations of the company, they have business managers to do that. If there's an expensive asset in the company that's not (actively) owned by any business manager, that's a liability -- and it is in the C-level's job description to manage liabilities.

said C-level exec will defend themselves with "we gave X months of advance warning AND 10 months after the fact no one had complained"

And that's a perfectly valid defense, they're acting true to their role. The failure lies with the business/operations manager not being in control of their process tooling.
by nottorp | 2025-11-25 12:37:17+00:00
I have a 4 with a huge ass passive heatsink on at home. It's my minecraft server when I feel like it.

The heatsink is uncomfortable to touch (it's not in a case). Pretty sure it would downclock if i removed it. So it works without a fan, but not without a heatsink (I bet the keyboards have a heatsink for the Pis built in.).

A 3 would have worked fine without any heatsink at all. At least at normal room temperature.
by anuramat | 2025-11-25 12:38:38+00:00
Are you taking something for ADHD?

I think I had a somewhat similar experience: before antidepressants, I was practically non-verbal; later, I had the typical brain fog/emotional blunting -- still unable to communicate with the therapist; after adjusting to meds, by the time that I can put the problem into a coherent sentence, I can usually fix it anyway, so what is the therapist for? Is it really just rubber duck debugging, where the duck has a medical degree?

One thing I wasn't able to figure out was ADHD -- I didn't really believe I had it, as my psychiatrist was sure it's not the problem -- everything was explained with depression/anxiety/geniune lack of motivation. Now that I finally have a prescription for stims, seems like it was the other way around: most of the time I would have a feedback loop where my typical fuckups would trigger a downward spiral, and it's almost not a thing anymore; being able to get shit done is just generally such a pleasant experience!

TLDR My depression also wasn't a "true depression" in a sense, but you still need to fix some underlying issue, which is much easier when your thoughts are not all "I'm a failure" shaped
by Workaccount2 | 2025-11-25 12:38:42+00:00
Literally every person who took up smoking in the last 50 years was fully aware of the danger.

People smoke because it's relaxing and feels great. I loved it and still miss it 15 years out. I knew from day one all the bad stuff, everyone tells you that repeatedly. Then you try it yourself and learn all the good stuff that no one tells you (except maybe those ads from the 1940's).

At some point it has to be accepted that people have agency and wilfully make poor decisions for themselves.
by Yizahi | 2025-11-25 12:38:53+00:00
We don't need to primarily focus on any single "problem name", even if it's very very bad. We need to focus on having the instruments to easily pick such problems later, regardless of the specifics. Meaning that the most important problem is representation. People must have fair protected elections for all levels of power structure, without feudal systems which throw votes into a dumpster. People must have a clear and easy path to participate in said elections if they so chose, and votes for them should not be discarded. People should be able to vote on the local rules directly, with proposals coming directly from the citizens and if passed made law (see Switzerland). The whole process should be heavily restricted from being bought with money, meaning restriction on the campaigns, on the ad expenses, fair representation in mass media etc. People should be able to vote out an incompetent politician too, and fundamental checks needs to be protected, like for example a parliament not folding to the autocrat's pressure and relinquishing legislative power to add to the autocrat's executive. And many other improvements.

Having instruments like that, people can decide themselves, what is more important - LLMs or healthcare or housing or something else, or all of that even. Not having instruments like that would just mean hitting a brick wall with our heads for the whole office duration, and then starting from scratch again, not getting even a single issue solved due to rampant populism and corruption by wealthy.
by pjmlp | 2025-11-25 12:39:14+00:00
We can easily complain, because there were attempts to improve in the past like Energize C++ and Visual Age for C++ v4, or systems like Live++.

However too many folks are stuck in the UNIX command line compiler mindset.

I keep bumping into people that have no idea about the IDE based compilation workflows from C++ Builder and Visual C++, their multihreaded compilation, incremental compilation and linking, pre-compiled headers that actually work, hot code reloading, and many other improvments.

Or the CERN C++ interpreters for that matter.

Many don't seem to ever have ventured beyond calling gcc or clang with Makefiles, and nothing else.
by Libidinalecon | 2025-11-25 12:39:23+00:00
To me, it all comes down to the level of accuracy and trust.

It is one thing to vibe code and deal with the errors but I think chemistry is a better subject to test this on.

"Vibe chemistry" would be a better measure of how much we actually trust the models. Cause chemical reactions based on what the model tells you to do starting from zero knowledge of chemistry yourself. In that context, we don't trust the models at all and for good reason.
by leo_e | 2025-11-25 12:40:27+00:00
The trouble with mmap is the performance cliff. A node goes from 'fine' to 'dead' almost instantly, which breaks our balancing logic.

You are right that we need better backpressure. Instead of a smarter coordinator, we probably need 'dumber' nodes that aggressively shed load (return 429s) the moment local pressure spikes, rather than waiting for a re-balance.
by polyrand | 2025-11-25 12:40:29+00:00
There is too much focus on students cheating with AI and not enough on the other side of the equation: teachers.

I've seen assignments that were clearly graded by ChatGPT. The signs are obvious: suggestions that are unrelated to the topic or corrections for points the student actually included. But of course, you can't 100% prove it. It's creating a strange feedback loop: students use an LLM to write the essay, and teachers use an LLM to grade it. It ends up being just one LLM talking to another, with no human intelligence in the middle.

However, we can't just blame the teachers. This requires a systemic rethink, not just personal responsibility. Evaluating students based on this new technology requires time, probably much more time than teachers currently have. If we want teachers to move away from shortcuts and adapt to a new paradigm of grading, that effort needs to be compensated. Otherwise, teachers will inevitably use the same tools as the students to cope with the workload.

Education seemed slow to adapt to the internet and mobile phones, usually treating them as threats rather than tools. Given the current incentive structure and the lack of understanding of how LLMs work, I'm not optimistic this will be solved anytime soon.

I guess the advantage will be for those that know how to use LLMs to learn on their own instead of just as a shortcut. And teachers who can deliver real value beyond what an LLM can provide will (or should) be highly valued.
by 0manrho | 2025-11-25 12:41:08+00:00
Npm has been a shit show from day 1. Unfortunately, Industry momentum and vc funded "fail fast, fail often" is a hell of a drug.

EDIT: Coffee hasnt kicked in yet, that was harsher than I intended. For what it's worth, it's not specifically/solely NPM/nodes fault, more of a convergance of the above and the ecosystem/users just as much as any of the Node/NPM devs/maintainers in combination with it having such a large attack cross section. Even if it had a reputation for being bulletproof and secure as fuck there's still such a large userbase with huge potential if exploited that'd it'd almost assuredly inevitably be compromised from time to time regardless.

While I feel we could use a whole lot less javascript on the web (client and server side both), without a competitor or something, it's shear size ensures any such expliot/issue gets amplified 1000x versus nearly any other project save for maybe major OS's and Browsers themselves.
by mrkeen | 2025-11-25 12:41:43+00:00
But OOP needs something to distinguish it from the rest, otherwise it's just P.

Do people honestly think other languages don't do whatever definition OOP has today? Encapsulation & polymorphism? Message-passing & late-binding?

Inheritance is the one thing that the other languages took a look at and said 'nope' to.

(Also, the OOP texts say to prefer composition anyway)
by thfuran | 2025-11-25 12:41:43+00:00
You’re never going to make a nontrivial statement in English that you couldn’t find two people who wouldn’t perfectly agree on its meaning. Or probably even a trivial one. Sure, at some point you can say “no, you’re clearly misinterpreting what I’ve said” or “you’re inferring something that wasn’t implied”, but English doesn’t have a formal spec or a reference implementation, so that’s kind of meaningless.
by bonaldi | 2025-11-25 12:41:44+00:00
Because we exist within a market, where the choices of others end up affecting us - if the market "votes" for a competing thing, that might affect the market for the things you care about.

Your car analogy isn't great, but we see a similar dynamic playing out with EV vs combustion, and we did with film-vs-digital cameras. "Don't buy a digital camera if you like film" sure didn't help the film photographers.
by tensility | 2025-11-25 12:42:02+00:00
There are also expensive high-grade SLC NAND flash chips available that offer significantly higher retention time than the cheaper commodity channel TLC NAND (i.e. 10 years versus 3 years).

In general, though, whether NAND or NOR, the fundamental way that flash works is by creating an isolated voltage charge for each bit (or several bits, for TLC), making it effectively a vast grid of very tiny batteries.

Like all batteries, no matter how well-stored, they will eventually leak energy to the point where the voltage levels change enough to matter.

Further, it's not enough to simply make power available to this grid since the refresh of the cells requires active management by a nand controller chip and its associated software stack.
by flakiness | 2025-11-25 12:43:15+00:00
In this case the PR author (either LLM or person) is "honest" enough to leave the generated copyright header that includes the LLM's source material. It' not hard to imagine that more selfish people tweak the code to hide the origin. The same situation as the AI-generated homework essays.

I generally like AI coding using CC etc, but this forced me to remember that these generated code ultimately came from these stolen (spiritually, not necessarily legally) pieces.
by xnorswap | 2025-11-25 12:44:00+00:00
I agree with your conclusion that this stuff will get locked down again over time.

I think there's also another major reason people don't like to ship desktop software, and that's the cost of support of dealing with outdated tools, it can be immense.

Ticket as raised, "Why is my <Product> broken?"

After several rounds of clarification, it's established they're using a 6-year old version that's hitting API endpoints that were first deprecated 3 years ago and finally now removed...

It's incredibly expensive to support multiple versions of products. On-prem / self host means you have to support several, but at least with web products it's expected they'll phone-home and nag to be updated and that there'll be someone qualified to do that update.

When you add runnable executable tooling, it magnifies the issue of how old that tooling gets.

Even with a support policy of not supporting versions older than <X>, you'll waste a lot of customer support time dealing with issues only for it to emerge it's out-dated software.
by jstimpfle | 2025-11-25 12:45:19+00:00
_Any_ code that was never previously exercised could be wrong. printf() calls are typically typechecked. If you write wrappers you can also have the compiler type check them, at least with GCC. printf() code is quite low risk. That's not to say I've never passed the wrong arguments. It has happened, but a very low number of times. There is much more risky code.

So such a strong "at the very least" is misapplied. All this template crap, I've done it before. All but the thinnest template abstraction layers typically end up in the garbage can after trying to use them for anything serious.
by st_goliath | 2025-11-25 12:46:18+00:00
You can use `git format-patch` to export a range of commits from your local git tree as a set of patches. You can then use `git send-email` to send that patch set out to the appropriate mailing list and maintainers (or just do it in one step, send-email accepts a similar commit range instead of patch files). It talks directly to an SMTP server you have configured in your `.gitconfig` and sends out e-mail.

Of course, `git send-email` has a plethora of options, e.g. you'd typically add a cover letter for a patch set.

Also, in the Linux kernel tree, there are some additional helper scripts that you might want to run first, like `checkpatch.pl` for some basic sanity checks and `get_maintainer.pl` that tells you the relevant maintainers for the code your patch set touches, so you can add them to `--cc`.

The patches are reviewed/discussed on the mailing list that you sent them to.

On the receiving side, as a maintainer, you'd use `git am` (apply mail) that can import the commits from a set of mbox files into your local git tree.
by majkinetor | 2025-11-25 12:46:50+00:00
I love this.

Post: What is 2+2 (https://news.ysimulator.run/item/2531)

This is why we can't have nice things. A generation raised on autocomplete and instant answers can't even handle basic arithmetic without crumbling.

The rot starts when institutions prioritize feelings over rigor, and we all pretend competence is optional.

Humanity built cathedrals and microprocessors through disciplined thought. Now we celebrate helplessness as if it's virtuous.

Enjoy your AI overlords – they at least know math.