MurphyA/hacker-news huggingface dataset:
by vintagedave | 2025-11-24 11:06:10+00:00
I believe you, in that package management with dependencies without security mitigation is both convenient and dangerous. And I certainly agree this could happen for other package managers as well.

My real worry, for myself re the parent comment is, it's just a web frontend. There are a million other ways to develop it. Sober, cold risk assessment is: should we, or should we have, and should anyone else, choose something npm-based for new development?

Ie not a question about potential risk for other technologies, but a question about risk and impact for this specific technology.
by ACCount37 | 2025-11-24 11:07:01+00:00
That looks like something that can be solved by autoregressive models of today, no architectural changes needed.

What you need is: good image understanding, at least GPT-5 tier, general purpose reasoning over images training, and then some domain-specific training, or at least some few-shot guidance to get it to adopt the correct reasoning patterns.

If I had to guess which model would be able to do it best out of the box, few-shot, I'd say Gemini 3 Pro.

There is nothing preventing an autoregressive LLM from revisiting images and rewriting the texts as new clues come in. This is how they can solve puzzles like sudoku.
by potato3732842 | 2025-11-24 11:07:03+00:00
Impound/tow/lien -> title has always been the easy button for getting legit title to a vehicle that was never supposed to be sold (UPS vans, Uhaul trailers, etc), so long as it was never reported stolen.

Absolutely hilarious that he managed to work the "doesn't work it if pops up as stolen" angle in the opposite direction to make the car impossible to really do anything with (i.e. no junkyard can take it whole, no subsequent changes of title can happen) and live in various sorts of limbo for 20yr.
by merelysounds | 2025-11-24 11:07:59+00:00
There is an explanation in the article:

> it modifies package.json based on the current environment's npm configuration, injects [malicious] setup_bun.js and bun_environment.js, repacks the component, and executes npm publish using stolen tokens, thereby achieving worm-like propagation.

This is the second time an attack like this happens, others may be familiar with this context already and share fewer details and explanations than usual.

Previous discussions: https://news.ycombinator.com/item?id=45260741
by otikik | 2025-11-24 11:08:02+00:00
I "muddled through life" until I got diagnosed at 42 with inattentive ADHD.

At that age the brain has already developed and meds are less helpful than when you are young. Even taking meds out of the picture, a diagnosis would have helped me a lot and not being diagnosed had very negative consequences.

I was told to "brighten up" my whole life while growing up. My parents well not abusive - it's just that I had good grades at school, so they didn't understand why I struggled with tasks that were "simpler than school". I also struggled with social interactions. I ended up with very low self-esteem, thinking I was just "slower" or "more stupid" than others. Most teenagers try to find and define the final shape of their mind. I though the "real me" was an embarrassment that needed to be hidden. So during my teenage years I built a "mask" instead. ("Masking" is a psychological phenomenon, I have now learned)

I am very good at "faking" not having ADHD now. Most of my friends and coworkers don't know. I can't mask all of my symptoms, though, nor all of the time. I can't "fake" not forgetting my car keys, or doing my taxes. I still wear my mask most of the time.

Sometimes I don't know whether my wife got in love with me, or with the image I project of myself. I don't know if there's a "myself" any more.

Also, ADHD has a genetic component. Having a diagnose for myself would have been useful before I had my son, who turned to have hyperactive ADHD. I love him to bits and I would not change him, but he's a handful. When he's off-meds he's almost intolerable. I would have had him nevertheless, but I would have had the right expectations.
by pjmlp | 2025-11-24 11:08:35+00:00
C++ is one of my favourite languages, and I got into a few cool jobs because of my C++ knowledge.

However, given the option I would mostly reach for managed compiled languages as first choice, and only if really, really required, to something like C++, and even then, probably to a native library that gets consumed, instead of 100% pure C++.
by zwnow | 2025-11-24 11:08:37+00:00
Just keep the number of packages you use to a minimum. If some package itself has like 200 deps uninstall that and look for an alternative with less deps or think if you really need said package.

I also switched to Phoenix using Js only when absolutely necessary. Would do the same on Laravel at work if switching to SSR would be feasible...

I do not trust the whole js ecosystem anymore.
by inglor_cz | 2025-11-24 11:08:58+00:00
It is indeed somewhat similar (though the sea is a better barrier + they don't have a major fifth column on their territory). And I would smell rat if it was a Chinese CCP official uttering the words about "political instability", but that would exactly be the change of context necessary.

If a HW/SW engineer speaks about "political instability", they simply acknowledge that there is no way to tell what will happen in context of their own jobs.
by umpox | 2025-11-24 11:09:09+00:00
You can also give the LLM hidden messages with a small bit of prompting, e.g. https://umpox.com/zero-width-detection

It’s technically possible to prompt inject like this. I actually reported this to OpenAI back in April 2023 but it was auto-closed. (I mean, I guess it’s not a true vulnerability but kinda funny it was closed within 5 mins)
by monerozcash | 2025-11-24 11:09:22+00:00
Airpods might be totally applicable here:

>When your AirPods Pro are connected to your device, you can use Conversation Boost to focus on the person talking in front of you. This makes it easier to hear in a face-to-face conversation.

https://support.apple.com/guide/airpods/use-and-customize-tr...

librepods appears to support this feature
by rvz | 2025-11-24 11:09:27+00:00
> Serious question: should someone develop new technologies using Node any more?

I think we have given the Typescript / Javascript communities enough time. These sort of problems will continue to happen regardless of the runtime.

Adding one more library increases the risk of a supply-chain attack like this.

As long as you're using npm or any npm-compatible runtime, then it remains to be an unsolved recurring issue in the npm ecosystem.
by hhx | 2025-11-24 11:09:52+00:00
"Complexity can be managed, though, and guess what’s really great for managing complexity — a programming language."

Lately it feels like marketing is still selling me a dream of AI simplicity. Yet behind the curtain is all the stuff (tech) that still makes the widget work. It is still an abstraction - another framework even.

It's not replacing any old layers that matter like the computers itself. At most it got rid of one of my IDEs and placed mme in another prompt-based one.
by amano-kenji | 2025-11-24 11:10:55+00:00
I think it's much better to become rich and then buy security and privacy than to implement them with your manual labor.

Your time is a lot more valuable than your money if you actually spend your time correctly.

You can be a 6 million dollar race horse if you drive it well.

I don't think people actually want privacy and security over everything else. It's better to focus on earning a lot of money from what you really want to do and buy security and privacy.
by kasey_junk | 2025-11-24 11:11:18+00:00
Percentage of budget is naturally inflation adjusted…

The census owner % methodology is by respondent address. So if those are 3 addresses then that’s 33% owner occupied building. If you are all sharing an address and the landlord is the respondent then its 100% owner occupied. But importantly the methodology has been largely the same across measurement periods back to the 70s.

It gets harder before that because the census didn’t track the data.
by pjmlp | 2025-11-24 11:11:33+00:00
People always point out this as a failure, when it is the contrary.

A programming language being managed doesn't mean we need to close the door to any other kind of resource management.

Unless it is something hard real time, and there are options there as well, we get to enjoy the productivity of high level programming, while at the same time having the tools at our disposal to do low level systems stuff, without having to mix languages.
by TurboSkyline | 2025-11-24 11:11:46+00:00
> It is just, that I also don't trust that with those toggles now everything is switched off, or if there is a hidden other toggle or there will be one shipped with the next update.

But you can apply the same argument to everything, right? Any piece of software could be taking actions that it doesn’t disclose. Any toggle could assure the user that their settings are respected but not actually change anything. So how do you then trust running _any_ code on your computer?
Show HN: Go Memory Visualizer, real-time struct layout and auto optimization
by 1rhino2 | 2025-11-24 11:12:15+00:00
Hey HN! I built a VS Code extension that shows you exactly how Go lays out your structs in memory and automatically fixes padding waste.

What it does:

Inline annotations showing byte offsets, sizes, and padding as you type One-click optimization that reorders fields to eliminate waste Diverse-architecture support (amd64, arm64, 386) Hover for detailed memory layout info Why it matters: Poor field ordering in Go structs commonly wastes 10-30% of memory due to alignment padding. For example, a careless 56-byte struct can become 40 bytes just by reordering fields. At scale, this adds up — both in memory costs and cache performance.

Demo: Before: 56 bytes

After auto-optimization: 40 bytes (-29%)

The extension highlights wasteful padding in real-time and offers a CodeLens button to fix it automatically.

Try it: VS Code Marketplace: https://marketplace.visualstudio.com/items?itemName=RhinoSof... GitHub: https://github.com/1rhino2/go-memory-visualizer

Built this after repeatedly optimizing structs manually in production code. Figured others might find it useful too.

Would love feedback on what other memory-related features would be helpful!
by noduerme | 2025-11-24 11:12:20+00:00
Come again? Tibet was absolutely a sovereign nation. I guess it depends what you mean by "recent", but the colonization is still underway, daily.

https://en.wikipedia.org/wiki/Annexation_of_Tibet_by_China

https://en.wikipedia.org/wiki/Sino-Vietnamese_War

https://en.wikipedia.org/wiki/Sino-Indian_War
by jacquesm | 2025-11-24 11:12:51+00:00
Yes, and you can code in assembly as well if you want it. But: that's not how 99% of the people using node is using it so that it is theoretically possible to code up every last bit yourself is true but it does not contribute to the discussion at all.

An eco-system, if it insists on slapping on a package manager (see also: Rust, Go) should always properly evaluate the resulting risks and put proper safeguards in place or you're going to end up with a massive supply chain headache.
by lossyalgo | 2025-11-24 11:13:14+00:00
I totally agree, however, (to wax slightly philosophical) things will change, that's just the nature of tech (and the world at large). To play Devil's Advocate: at least MacOS provides these settings, unlike Windows, which does provide some settings, but many things you are just stuck with unless you install some nerd's github project which tweaks low-level settings and hopefully isn't doxxing you to some gov't. I resisted as long as possible moving from Win10->11 because the UI/UX is such an abomination, similarly bad as the new Liquid (Gl)Ass, but at least MacOS is mostly just changing the color scheme, whereas Windows is constantly changing the position of everythign, what happens when you jiggle the mouse, auto-docking, and pretty much everything that can be changed, they have changed - multiple times! Just as soon as I get comfortable with some UX change, they change it again, because I guess the UX department needs to get paid? Every time I re-install Win11 (4 times in the last 12 months due to new PCs, forced upgrades, etc.) I have needed a full week before everything is to my (near) satisfaction, whereas with MacOS it's just these 5 toggles and bam, I can read things again.
by DrScientist | 2025-11-24 11:13:16+00:00
Funny you should mention that - amid the general log4j panic the mere presence of old version on disk would send IT security into a frenzy, irrespective of whether the old version was vulnerable or was deployed in a way where the vulnerability could be accessed.

I had to point out it was because we hadn't updated was the reason our stuff wasn't vulnerable.
by tjpnz | 2025-11-24 11:13:58+00:00
In the early days the Node ecosystem adopted (from Unix) the notion that everything has to be its own micro package. Not only was there a failure to understand what it was actually talking about, but it was never a good fit for package management to begin with.

I understand that there's been some course correction recently (zero dependency and minimal dependency libs), but there are still many devs who think that the only answer to their problem is another package, or that they have to split a perfectly fine package into five more. You don't find this pattern of behavior outside of Node.
by Rochus | 2025-11-24 11:14:39+00:00
Programmers using high-level languages develop models about how programming works, particularly around memory management, type safety, and abstractions. These models don't transfer to C, so they must be "unlearned" to some degree, which research shows is often harder than learning from scratch. Programmers accustomed to Python, TypeScript, or C# face specific conceptual "paradigm shifts" when switching to C such as manual memory management (as you said), pointer discipline and lack of abstraction (you have to take care of many things which the high-level language offered or took care of).

Programming beginners (to whom my statement applied) lack preconceived notions about what programming "should" be like. They build their mental models around C's paradigms from the start, avoiding the cognitive dissonance experienced by those expecting automatic memory management or rich standard libraries and integrated build systems.
by daimajia | 2025-11-24 11:14:47+00:00
Thanks! I use Gemini's Imagen 3 API with specific prompts emphasizing "black and white line art, coloring book style, simple clean outlines, no shading".

Key is being very explicit about:

- Line art only, no shading/gradients - Age-appropriate complexity - Theme-specific keywords

Biggest challenge was consistency - took many iterations to dial in the prompts. I also manually filter out images with unwanted shading (working on automating this).

Happy to discuss more if you're exploring similar ideas!
by hutchpd | 2025-11-24 11:15:26+00:00
I built QuantumSuperposition, a strongly typed multiverse/superposition engine for .NET, plus PositronicVariables, a higher-level framework for reversible temporal logic. It's all open source and released under the Unlicense.

It lets you treat variables as collections of possible values (for example QuBit<int> containing {0,1,5}), build multi-qubit systems with complex amplitudes, and write code that reasons over possibilities without forcing early collapse. The positronic layer lets variables converge across hypothetical timelines. Everything is deterministic-test friendly via seeded collapse replay.

Repo + docs: https://github.com/hutchpd/QuantumSuperposition NuGet: https://www.nuget.org/packages/QuantumSuperposition

I'd love feedback on examples people would like to see, and any suggestions on making the API feel more idiomatic for C#.
by ret2plt | 2025-11-24 11:15:26+00:00
Eh, that's some interesting historical trivia, but I don't see how that matters tbh. If everybody is fine with the word because they (quite reasonably) assume it was inspired by master record or something similar, and you bring up some 25 year old history (20 years when the debate got started) about not even git but a precursor, does that really help with anything? I am sure there are other innocuous seeming words that have a dark etymology, should we go search for them so we can update the language?
by corimaith | 2025-11-24 11:15:55+00:00
>Taiwan today is culturally much more similar to the PRC than it is to the West

The cultural distance between Taiwan and Japan, Korea and Hong Kong is less than the distance from mainland China. Aka Asian liberal democracies (or at least with strong political plurality and civil society). You're mistaking a regional difference with a commonality with the PRC, when in reality the PRC's epistemic worldview is highly distorted in comparison to virtually every other actor in the region. They don't speak for the region.
by sofixa | 2025-11-24 11:16:00+00:00
You're saying that like the two are at odds. France is a military superpower with almost entirely France, worst case scenario western EU, based supply chain. Italy, Spain, to a lesser extent Germany are too. Manufacturing is also pretty strong across (most) of the EU. Automotive is struggling in Germany, but booming in France (Renault are killing it). Leading in Aeronautics too. It's just mostly high value manufacturing. In the EU, 25% of the economy is in manufacturing. Compare with 10% in the US.

And those regulations are, more often than not, for everyone's benefit - at least EU, but often the Brussels effect applies so a lot of the rest of the world benefits too.
by Ygg2 | 2025-11-24 11:17:08+00:00
I don't buy this line of reasoning. There are zero/one day vulnerabilities that will get extra time to spread. Also, if everyone switches to the same cooldown, wouldn't this just postpone the discovery of future Shai-Huluds?

I guess the latter point depends on how are Shai-Huluds detected. If they are discovered by downstreams of libraries, or worse users, then it will do nothing.
by ffsm8 | 2025-11-24 11:19:01+00:00
Take a deep breath and reread my comment please, you're interpreting things into it that I never said, and I'm not sure how you could've gotten the impression were in there - I merely pointed out that this behavior is core to capitalism, because the people with money own said money - and are in no way responsible to create a "fair" (from the perspective of the person receiving money) playing field
by belter | 2025-11-24 11:19:05+00:00
> Every major city that tries free transit at scale will eventually snap back to it, because it is the only configuration that does not implode under feedback loops.

Less Jevons Paradox and more Theory of Constraints...

Five million people are not going to descend on Iowa City because buses are free. Luxembourg has full free public transport from buses to trains, with no feedback loops. Same in Tallinn, Estonia capital where is free for residents.
by keepamovin | 2025-11-24 11:19:12+00:00
That's a fair point if you only start the clock in 1949, but it's not scaremongering. It's pattern recognition over 3,000 years.

The territory we now call "China" is the product of relentless expansion and assimilation. Tibet, Xinjiang, Inner Mongolia,d , Manchuria, much of the southwest... none were historically Han or Mandarin-speaking. Beijing's own justification is usually "they were Chinese all along" (because "genetics" -- or because they once paid tribute). That's the same logic every empire has ever used.

Modern Han Chinese themsleves carry heavy Mongol (Yuan) and other steppe ancestry, descendants of the single most successful conquest dynasty in human history.

For centuries the Chinese court literally styled itself the center of the world and demanded tribute from "barbarians" on every side. Zheng He's fleets in the 15th century were larger and reached farther than anything Europe fielded for another 80 years. China stopped because the court lost interest, not because it lacked capability or ambition.

Today's Nine-Dash Line, wolf-warrior diplomacy, and the "century of humiliation" narrative are all framed as restoring China's "rightful place." Xi's favorite phrase is "the great rejuvenation of the Chinese nation," and the classical concept behind it is tianxia: "all under heaven" belongs, ultimately, under one orderly hierarchy (guess whose "manifest destiny" it is to sit at the top??).

So when people say "China doesn't invade," what they usually mean is "China prefers to win without fighting," which is straight out of Sun Tzu and exactly the current playbook. Pretending otherwise is how you lose the game before it even starts.
by matt_kantor | 2025-11-24 11:19:28+00:00
> if you're a junior engineer, then I have maybe 1 hour with you per week and I probably shouldn't spend that time being your English teacher

It's not important enough to make a big deal out of, but if I see it over and over from the same person I might mention it during code review ("your commit messages are a bit wordy; for example instead of '…', consider '…'") or write down as part of a style guide (e.g. if we're tagging commits like in your examples, wherever we wrote down the rules for that). It's the same for other unimportant things that it's nice to agree on (e.g. capitalization of initialisms in code—is it `.toJson()` or `.toJSON()`?).
by testdelacc1 | 2025-11-24 11:21:12+00:00
I hate to be the guy saying AI will solve it, but this is a case where AI can help. I think in the next couple of years we’ll see people writing small functions with Claude/codex/whatever instead of pulling in a dependency. We might or might not like the quality of software we see, but it will be more resistant to supply chain attacks.
by anonymous908213 | 2025-11-24 11:21:18+00:00
Writing code yourself so as not to cultivate 1000 dependencies you can't possibly ensure the security of is not the same as writing assembly. That you even reach for that comparison is indicative of the deep rot in Javascript culture. Writing your own code is perceived as a completely unreasonable thing to be doing to 99% of JS-devs and that's why the web performs like trash and has breaches every other day, but it's actually a very reasonable thing to be doing and people who write most any other language typically engage in the writing of own code on a daily basis. At any rate, JS the language itself is fine, Node is fine, and it is possible to adopt better practices without forsaking the language/ecosystem completely.
by input_sh | 2025-11-24 11:21:42+00:00
No, that's just one of those made-up lies people repeat often enough online to become "true" because it's the top search result and because it makes them feel good about continuing to use that term.

Here it is for example in an Australian newspaper ad from 1844: https://trove.nla.gov.au/newspaper/article/31742822

> TO LET, Westmoeath Cottage and Garden, situated near to Cook's River, only three miles from the city. the cottage contains parlour and drawing room,and four large bed rooms ; detached kitchen, bakehouse, landry, storeroom, four stall stable and double coach-house, servants' rooms neatly fitted up, together with hay-loft and granary, school house and master's bed-room. A cottage containing four separate rooms for overseer and workmen ; two excellent wells of water on the premises, about six acres of garden neatly laid out and planted with the best vines and fruit trees, 'This property is fit for a family of the first respectability.

Or here it is in London-based The Examiner from 1845: https://upload.wikimedia.org/wikipedia/commons/0/08/The_Exam... (page 523, middle row, a couple of lines below the "Police" headline)

I'm sure I could find more examples, but I think two will sufface.