MurphyA/hacker-news huggingface dataset:
by zwnow | 2025-11-24 14:46:49+00:00
7.0 added scalar type declarations and a mechanism for strong typing. PHP 8.0 added union types and mixed types. PHP enforces types at runtime, Javascript/Typescript do not. PHP typesystem is built into the language, with Js u either need jsdoc or Typescript both of which wont enforce runtime type checks, Typescript even adds a buildstep. php-fpm allows u to not care about concurrency too much because of an isolated process execution model, with js based apps you need to be extremely careful about concurrency because of how easy you can create and access global stuff. PHP also added a lot of syntax sugar over the time especially with 8.5 my beloved pipe operator. And the ecosystem is not as fragile as Javascripts.
by abhisek | 2025-11-24 14:46:55+00:00
Documenting technical details and payload analysis here: https://safedep.io/shai-hulud-second-coming-supply-chain-att...

Like previous variant, it has credential harvesting, self-replication and GitHub public repository based exfiltration.

Double base64 encoded credentials being exposed using GitHub repositories: https://github.com/search?q=%22Sha1-Hulud%3A%20The%20Second%...
by Aurornis | 2025-11-24 14:47:03+00:00
> Why are North Korean hackers even allowed to connect to the service,

Asking why some group is “allowed” to use the internet is equivalent to demanding either strict verification or that we cut off some entire country where they reside from the entire internet.

Either that, or someone doesn’t understand basic fundamentals of networking and thinks there’s some magic solution to this problem.

A common variation of this comment is “why do we allow kids to access <insert topic here>” with demands that something be done about it. Then when something is done about it, there is shock and outrage upon realizing that you can’t filter out children without forcing identity verification upon everyone. Similar vibes here, just replace age with demographic.
by pu_pe | 2025-11-24 14:47:39+00:00
I don't see it so bleakly. Using your analogy, it would simply mean that if the program underperforms compared to humans and starts making a large amount of errors, the human who set up the pipeline will be held accountable. If the program is responsible for a critical task (ie the animal will be shot depending on the classification) then yes, a human should validate every output or be held accountable in case of a mistake.
by jwr | 2025-11-24 14:48:33+00:00
Signal doesn't share your contact list. WhatsApp does, and this will not get "fixed", because it is done on purpose. It's the reason why Facebook paid $19 billion or so to buy WhatsApp, and from what I understand it's the main reason why Facebook/Meta keeps maintaining and developing the app.

That contact list is a huge deal if you consider how, connected to other data leaked by people using Facebook, Facebook Messenger, Instagram or other Facebook properties, it lets Meta know so much about you. For example, do some of your contacts use Messenger with location information? Do they often travel to the same location, which is a school? You likely have kid(s) in the same school as they do. It's scary if you consider the implications.
by jackconsidine | 2025-11-24 14:49:06+00:00
Used the following script to see if I had any affected packages:

https://gist.github.com/considine/2098a0426b212f27feb6fb3b4d...

It checks yarn.lock for any of the above. Maybe needs a tweak or two but you should be able to run from a directory with yarn.lock
Show HN: Numr – A Vim-style TUI calculator for natural language math expressions
by nasedkinpv | 2025-11-24 14:49:14+00:00
Features:

Natural language math: percentages, units, currencies Live exchange rates (152 currencies + BTC) Vim keybindings (Normal/Insert modes, hjkl, dd, etc.) Variables and running totals Syntax highlighting

Stack: Ratatui + Pest (PEG parser) + Tokio Install: # macOS brew tap nasedkinpv/tap && brew install numr

# Arch yay -S numr GitHub: https://github.com/nasedkinpv/numr Would love feedback on the code structure—it's a workspace with separate crates for core, editor, TUI, and CLI.
by datadrivenangel | 2025-11-24 14:49:52+00:00
AT $250 an hour and 8 hours per day / 2000 hours per year, that's almost ~50 people years, which likely means a team of 10-12 devs working on it over 18 months with another 1-3 design and product and project people in the way making things look good until the bill arrived. Accenture is good at that. [0]

0 - https://australiatimes.com/australia-s-bureau-of-meteorology...
by potato3732842 | 2025-11-24 14:50:12+00:00
Going through the hassle of getting a title for stuff you'll scrap is, ugh, an ill advised use of time unless your goal is to tell everyone at the cocktail party how law abiding you are or the vehicles are interesting enough for the title to have baseline value or something like that.

Scrapyards will take fractions of cars without asking questions. People who part out cars or deal in scrap metal know this and will take anything off your hands for free as long as the work vs what they're getting pencils out.
by tantalor | 2025-11-24 14:50:19+00:00
> The company says the cancellation was approved under its standard policy permitting properties to void bookings in "rare cases where a property identifies a clear rate error." Following Go Public's questions, Booking.com told Mann it would honour her original booking and cover the price difference — allowing her to keep the same four bedroom unit at no additional cost.

Sounds like booking.com made a mistake in applying the wrong policy, and is trying to cover up for it instead of admitting their liability.
by LoganDark | 2025-11-24 14:51:08+00:00
I'm not as interested in news from 40 years ago, but for years I've been wanting a news website that only talks about things that have already happened and not just things that are so promising or going to change the world or definitely absolutely going to come out eventually but that never actually do. I get so fed up of hearing for so long about promising exciting new stuff that never actually happens. And even of the stuff that does happen, the wait kills me. I'm so tired of getting excited and having to wait. Hacker News is practically my only source of any current events because of how everything else is full of hype and speculation and just exhaustion.
by dotancohen | 2025-11-24 14:51:29+00:00
This comment seems to address users intentionally installing malware. I mean to address cracking, the situation where an attacker gains root or installs software that the user does not know about.

Preventing the user from installing something that they want to install is another issue completely. I'm hesitant to call it exactly security, though I agree that it falls under the auspices of security.
by smallmancontrov | 2025-11-24 14:51:55+00:00
It's funny how trolls think NATO is supposed to be accountable to an unwritten informal "promise" that must be removed from its context to seem relevant while the same people never seem to hold Russia accountable for violating its direct written promises in the Budapest memorandum -- a violation that gets worse when you add the context that Ukraine gave up its nukes for the security guarantees that Russia obliterated in 2022.
by saalweachter | 2025-11-24 14:51:55+00:00
Pardon me, you have gotten yourself dragged into a tu quoque defense of Russia.

It is best not to engage in these arguments, because they are almost never conducted in good faith.

The goal is partially to make the claim that "the US is just as bad/worse, therefore, Russia is acting morally/logically/blamelessly", but primarily to simply turn the conversation into one where you are defending everything the US has ever done wrong, instead of discussing whatever Russia is currently doing, which is where the bad faith comes in.

If you do feel compelled to engage, I recommend at most acknowledging whatever the US did previously, before pivoting back to discussing the actual current situation. Otherwise, you're playing into the strategy.
by jwr | 2025-11-24 14:52:12+00:00
This is a good moment to remind everyone of this excellent guide: https://github.com/drduh/YubiKey-Guide

it describes how to use your YubiKeys (please always use at least two, so that you have a backup) for GnuPG keys and SSH.

I've been using this setup since 2018 and it is brilliant. I know GnuPG is not in fashion these days, but thanks to this setup I have SSH logins using YubiKeys, encrypted backups using GnuPG, and 2-factor authentication for a number of sites that support Webauthn. All with backup keys, which is IMPORTANT: do not get locked into using a single device, because sooner or later you will lose that device or it will suddenly die.
by mapt | 2025-11-24 14:53:06+00:00
That sounds awkward.

The tech for isolating a speaker at conversational distances exists. You use half a dozen microphone transducers (minimum; Crappy microphone transducers are cheap and quality is expensive, so just use a bunch of them), and through a combination of phase and intensity they decode relative location, and amplify that phase expectation while suppressing everything that isn't phased like that. Sound is slow, and readily susceptible to real-time triangulation. The math/processing is much easier if the parallaxes are fixed (eg the microphones are arranged in a line array on the top band of a rigid pair of smart glasses), but with a little latency it's not prohibitive for a deformable array to solve for its own relative position as well.
by alistairSH | 2025-11-24 14:53:10+00:00
That might be the goal, but that implies the US should have low-skill labor, sweatshops, etc. And that enriching the owners of such factories is a good thing.

It's a net gain for everybody for low-skill products to be produced in regions with lower wages, like China, Vietnam, etc.

Super simple example... socks. Due to lower wages, China can produce socks with a retail price of $1/pair. A US-made equivalent costs $1.10/pair.

Trump placed a 20% tariff on Chinese goods, leading to Chinese socks having a retail price of $1.20.

US sock producer can now charge $1.19 and take 100% of the market. That's an additional, unearned $0.09 cents flowing to the owner of that sock business.

If the tariff had been set at 10%, creating equal retail prices, that might be good, as it would tend to shift more of the market to US-made socks.

Or, leave the prices alone, let us buy Chinese socks, and use that extra 10-20 cents for consuming something else.
by mafribe | 2025-11-24 14:53:30+00:00
Exactly.

Taiwan has spent the approx 120 years on a very different political, economic, cultural track from the mainland. Taiwan diverged from the other subject of the Qing dynasty before Han nationalists began their century long project to forge a united Chinese nation. In particular, Taiwan did not go through decades of communist terror, but did experience the fruit of democracy.
by insane_dreamer | 2025-11-24 14:53:34+00:00
Elon's legacy:

Destroyed a bunch of services to the American people in an extremely haphazard way with little thought to the consequences.

Destroyed morale in the Federal workforce through mass firings which caused hardship to thousands, with little thought to the consequences.

Literally killed thousands in Africa/Asia by removing aid with little thought to the consequences. (Even if USAID was a soft-power/CIA tool, the actual aid was real.)

Accomplished little to nothing.

I never again want to hear how "smart" Elon is.
by Eingrand1978 | 2025-11-24 14:53:34+00:00
Cloud NAC technology is revolutionizing how businesses approach network security. Combining the principles of ZeroTrust Security with cloud-based infrastructure provides a robust framework to address the challenges of cloud security in large-scale environments. This article will explore the hurdles faced by global enterprises in securing their networks, the importance of adopting a Zero Trust approach, and how cloud-based NAC enhances security across distributed locations. Additionally, it will discuss best practices for implementing these solutions to maximize their effectiveness in today's complex digital ecosystem.
by phantasmish | 2025-11-24 14:54:09+00:00
I dunno. American nicer-clothes brands were already consolidating, selling to foreign buyers (J. Press, now Japanese-owned), or moving down-market and shifting manufacturing overseas (Brooks Brothers, Hickey Freeman). This certainly hasn’t reversed any of that.

I don’t have any particular insight into their operations, but all the ones that still manufacture in the US that I pay attention to seem to be showing signs of distress more this year than ever. Shrinking product lines, steep sales, desperate-looking promotions, shifting more of their catalog to imported lower-quality products (despite the tariffs!). My current concern is that tariffs are going to cut the legs out from under what remains of that sector, and there’ll soon be way fewer US-made clothing options.

I think broad prosperity is a ton more important to their health than tariffs. When people don’t have much disposable income they’re not going to buy American-made leather shoes and wool shirts and suits and fine cotton shirts, they’re going to pay the 100% (or whatever) tariffs on a $50 (pre-tariff) Chinese outfit made mostly of petroleum and still pay way less than for a hypothetical similar outfit made in the US.

US labor only makes sense for pretty-decent or better goods (it’s the reason it’s an alright signal of quality, doesn’t make sense to spend up for American labor then use shit materials to save a penny, if you’re using US labor you’re already priced out of the lower half or more of the market) and those markets are getting fucked as prosperity concentrates to the top.

I expect the next shock to what’s left of the middle class is going to kill a bunch of these companies, and tariff chaos is rushing us into that. Plus almost all of them use foreign goods or labor in parts of their processes, so this shit’s forcing them to raise prices or eat reduced profit. Pendleton? The cloth is made in a US mill, but the shirts are assembled in the DR or wherever. Rochester suit makers? The cloth is Italian or maybe British, obviously, or why bother. Can you even get US-made linen? LOL.
by anonym29 | 2025-11-24 14:54:35+00:00
Name calling, bullying (forms of systematic harassment) and attempting to instill feelings of social isolation in a target are documented techniques employed by intelligence agencies in both online and offline discourse manipulation / information warfare.

You can read up more here if you are curious: https://www.statewatch.org/media/documents/news/2015/jun/beh...

Many of the attacks against djb line up quite nicely with "discredit" operational objectives.
by threetonesun | 2025-11-24 14:55:01+00:00
Don't use a framework? Loading a JS script on a page that says "when a update b" hasn't changed much in about 20 years.

Maybe I'm being a bit trite but the world of JavaScript is not some mysterious place separate from all other web programming, you can make bad decisions on either side of the stack. These comments always read like devs suddenly realizing the world of user interactions is more complicated and has more edge cases than they think.
by embedding-shape | 2025-11-24 14:55:20+00:00
> Specifically, the ones from [Captify][1].

Looks and seems great, always felt like a no-brainer use case for the smart glasses. But considering the kind of hardware they most likely are using, how is the captioning actually happening? I'm really scared of getting hardware that is 100% cloud dependent, as eventually the company gets bought or shut down, and then you end up having to repeat the process of figuring out what to buy next, and sometimes that just one or two years in the future.

They are not making it clear how the captioning is happening, but since they don't claim it'll continue working even if the company disappears/shuts down, one can be safe to assume it's a cloud product, meaning it won't actually be a good fit for most people out there with a limited amount of money to spend on things like these.

Edit: I realize now this product is not at all for people like me, "Boost caption accuracy up to 98%" and "More accurate translations" are locked behind a $15/month subscription, kind of disgusting how they hide making the product work as it should behind a subscription.

I just want some simple glasses that can caption what people are saying without ripping me off, I guess we're too late into capitalism for that to actually be made for consumer.
by mschuster91 | 2025-11-24 14:55:21+00:00
> how hard is it to add a few methods that split a string or pad it?

Well, if you're in C/C++, you always risk dealing with null pointers, buffer overruns, or you end up with use-after-free issues. Particularly everything working with strings is nasty and error-prone if one does not take care of proper testing - which many "homegrown" libraries don't.

And that's before taking the subtleties of character set encodings between platforms into account. Or locale. Or any other of the myriad ways that C/C++ and even Java offer you to shoot yourself in the foot with a shotgun.

And no, hoping for the best and saying "my users won't ever use Unicode" or similar falls apart on the first person copying something from Outlook into a multi-line paste box. Or someone typing in their non-Latin name. Oh, and right-to-left languages, don't forget about these. What does "pad from left" even mean there? Is the intent of the user still "at the beginning of the string itself?" Or does the user rather want "pad at the beginning of the word/sentence", which in turn means padding at the end of the string?

There's so much stuff that can go horribly horribly wrong when dealing with strings, and I've seen more than my fair share just reading e-mail templates from supposed "enterprise" software.
Show HN: Scan any codebase in seconds with clear fixes and no setup
by MaPla | 2025-11-24 14:56:22+00:00
I have been working in tech for almost three decades and spent a large part of that time in environments where teams struggled with large and messy codebases. Security audits took days, sometimes weeks, and most tools required complex setup, pipelines, or config files before you could even start.

LegacyMind is my attempt to fix this. You upload your code as a single archive and get a complete security report within minutes. The platform detects vulnerabilities, outdated libraries, licenses, secrets, and other risks, and it highlights the exact lines along with clear mitigation guidance. Everything runs inside EU infrastructure and the code is deleted right after the scan.

I built this because I saw how much time teams lose when they inherit old systems or switch between modern and legacy stacks. I wanted a tool that simply works and gives teams a fast and honest picture of their code.

I would really appreciate feedback from the HN community, especially from anyone who deals with security, SRE work, or on boarding to unfamiliar codebases.
by falcor84 | 2025-11-24 14:56:35+00:00
I don't think that this Kantian argument is relevant in tech. We've had LTS versions of software for decades and it's not like every single person in the industry is just waiting for code to hit LTS before trying it. There are a lot of people and (mostly smaller) companies who pride themselves on being close to the "bleeding edge", where they're participating more fully in discovering issues and steering the direction.
by SmirkingRevenge | 2025-11-24 14:56:36+00:00
Interesting. Maybe gps location data snapshots factor into it. You could probably defeat that with app permissions though. GPS spoofing is also possible, but a lot more friction for troll accounts.

Or maybe they are able to link carrier-sourced cellphone location datasets to particular twitter accounts. Those aren't going to be real-time though, so something like that could explain the lag.
by ArcHound | 2025-11-24 14:57:12+00:00
Let's take a look at incentives. Booking.com has an incentive to cancel. The hotel itself has an incentive to cancel. The laws in place don't prevent this, especially when some contractual fine print is involved.

Will this public case result in flood of people away from booking.com? Probably not.

This is just a simple abuse of power, most easily identified by the question: "What are you going to do about it?"

It seems the play is to tell the world. Congrats to this lady for getting her money/booking back.
by deltaburnt | 2025-11-24 14:57:53+00:00
Does Taiwan not have healthcare? Verbatim from Wikipedia:

> According to the Numbeo Health Care Index in 2025, Taiwan has the best healthcare system in the world, scoring 86.5 out of 100,[6] a slight increase from 86 the previous year.[7] This marked the seventh consecutive year that Taiwan has ranked first in the Numbeo Health Care Index.[8]
by philipswood | 2025-11-24 14:57:58+00:00
Agreed, but a check of superficial details you've read and a detailed discussion grounded in the text can really help to cement the book in your mind.

I've experimented with sessions that start with prompts like:

> Hi, Please act as a tutor. I will act as a student. I’m working through the following text of X by Y - trying to engage with it more deeply. I'm specifically trying to let active recall clarify and consolidate my long term memory of it. I also want to make sure the ideas are connected in my memory with my existing concepts and concept maps. So please ask me questions from the text given. Present me with just the questions and then allow me to give answers. Discuss my answer - justify your responses from the text.

and found it generally helpful.
by CharlieDigital | 2025-11-24 14:58:32+00:00
This is too logical, practical, and pragmatic. Which product owner/project manager would approve such a thing!?

Being able to think of simple, practical solutions like this is one of the hardest skills to develop as a team, IMO. Not everything needs to be perfect and not everything needs a product-level fix. Sometimes a "here's the workaround" is good enough and if enough people complain or your metrics show use friction in some journey, then prioritize the fix.

GP's example is so niche that it isn't worth fixing without evidence that the impact is significant.
by eldaisfish | 2025-11-24 14:58:36+00:00
the #1 problem with the EU's administrative structure is that its power comes from below, i.e. from the member states. Any of them could pull a Brexit and the entire union could be in jeopardy.

The #2 problem is language. Despite what many on HN think, European borders very much exist. They exist via language and bureaucracy.

These two combine to create many problems the EU and Europe in general has. The lack of vision, the excruciatingly slow bureaucracy, both are symptoms of the same underlying problems.
by vorticalbox | 2025-11-24 14:58:49+00:00
me too but a lot of people see it as massive overhead they don't want to deal with.

personally i pin all mine because if you don't a version could be deployed during a pipeline and this makes your local version not the same as the one in docker etc.

pinning versions is the only way to be sure that the version I am running is the same as everyone elses
by jeroenhd | 2025-11-24 14:58:56+00:00
They're paying out to cut back on the negative the media attention.

The underlying problem, that hotels are capable of canceling bookings so they can ask for extortionate rates when events nearby take place, still remains.

I'm not sure whose fault this is, really. The person buying the reservation knew this deal was too good to be true, the hotel should've fixed their prices if they want to charge 12k extra for a weekend, and booking should probably kick hotels that do this off their website.

Booking.com is an absolute hell site for various reasons, but I'm sure the same conflict would've happened had the room been booked through the hotel's website.