MurphyA/hacker-news huggingface dataset:
by nosianu | 2025-11-01 15:03:00+00:00
> This company might remember their history.

For the record: Apparently they helped the original Nazis. One link of many: https://time.com/archive/6931688/ibm-haunted-by-nazi-era-act...

> IBM, according to Black’s book and the lawsuit, was responsible for punch card technology used by Nazi demographers in the years leading up to World War II — and eventually by the SS, which was charged with rounding up Europe’s Jews. Although it has long been known that IBM’s German arm, which was taken over by the Nazis, had cooperated with the regime — and, indeed, was in a consortium of companies making payments to survivors and victims’ families — Black says that the American parent was fully aware of the use to which the technology was put. And after the Germans surrendered, Black says, IBM’s U.S. office was quick to collect profits made during the war by the subsidiary, called Dehomag.

> The punch cards and counting machines, says Black, were provided to Hitler’s government as early as 1933, and were probably used in the Nazis’ first official census that year. The technology came in handy again in 1939 when the government conducted another census, this time with the explicit goal of identifying and locating German Jews — and finally, Black alleges, in tracking records at Nazi concentration camps.

> It’s this specificity of purpose, says William Seltzer, an expert in demographic statistics at Fordham University, that provides the most damning evidence. “Microsoft is not responsible for every spreadsheet made with Excel,” Seltzer told TIME.com. “But if someone is doing custom designing of a database, they have to know what’s going on. With these punch cards, Dehomag had to design a card for every piece of new information that the government wanted.”
by filoeleven | 2025-11-01 15:04:03+00:00
Yeah, I clearly remember the day when bitcoin hit 37 cents. I thought, “this is interesting enough to make a $50 bet on.” I started looking into how to make a wallet and actually acquire s the BTC, and decided it wasn’t worth the time effort. That would have been about 3 hours, including a round trip to the closest bitcoin ATM.

The first big regret I thought of is kind of related: I wish I’d learned more about investing. I have a retirement account but that’s it, and when I had more disposable income I had no idea how to go about getting started.
by cellular | 2025-11-01 15:04:08+00:00
This looks like a good place to ask HN:

I've started with a solved cube, then turned 2 sides sharing an edge, alternatively (same direction) expecting the cube to get messed up but then returning to its solved state.

It never got solved! Maybe i didn't do it enough (i did it hundreds of times i think). Has anyone got an explanation?
by Levitz | 2025-11-01 15:04:10+00:00
And yet often this is not what happens. Why?

People don't do stuff poorly on purpose. There's also nobody out there for which button elements are some arcane and obscure thing, we all know they exist, so what is happening?

I'm not arguing for using divs instead of buttons, I'm arguing that if that happens there's a reason for it, and we ought to look at that reason and attempt to deal with it rather than admonishing developers in general.
by anon291 | 2025-11-01 15:04:15+00:00
It's totally fine to not want kids. I'm a 'younger folk' having kids right now. It's a choice. If you want kids have them. If you don't, don't. The data are pretty clear that no amount of material wealth makes people who don't want kids suddenly have kids.

In America, most of the people without kids don't want them and blame external factors instead of being honest.
by kator | 2025-11-01 15:04:28+00:00
Bigger challenge is games that die because the back-end servers are turned off and the assets are discarded. I'm on a team reverse engineering an old MMO from 2011. We've spent years rebuilding the server from packet captures and disassembly because everything official got nuked. This is just one of many examples where the customer "buys" a thing in their mind only later to find out they really didn't buy anything.

The legal situation is a mess too. We're not competing with anyone (game's been dead over a decade), we're not selling anything, but we still operate in this gray area wondering what's fair use versus what crosses a line. Copyright law wasn't written with "what if the company abandons it and erases it from existence" in mind.

Meanwhile every day that passes, more of these games just vanish permanently because preservation is treated as piracy.
by IshKebab | 2025-11-01 15:04:34+00:00
I can think of dozens. Running, dance, knitting, painting, woodworking (you can go very far for much less than $3k), archery, chess, board games, drawing, painting, brewing, darts, cycling, etc. etc.

Obviously you can spend pretty much any amount of money on those if you want (if you are "serious" about it) but you don't have to and most people don't. Also he said this $3k expenditure wasn't for serious work.
by jhbadger | 2025-11-01 15:05:06+00:00
I don't think you can say that -- I paid about that for my 2021 M1 Max with 64GB and I'm still using it four years later as my main machine. There's an argument to be made to buy an expensive computer every 5 years or so rather than a cheaper one that you need to replace every 2 years because it's become unbearably slow.
by mirashii | 2025-11-01 15:05:11+00:00
> I think this is the wrong way to promote rust

This is entirely the wrong lens. This is someone who wants to use Rust for a particular purpose, not some sort of publicity stunt.

> I know nobody that programms or even thinks about rust. I’m from the embedded world a there c is still king.

Now’s a good time to look outside of your bubble instead of pretending that your bubble is the world.

> as long as the real money is made in c it is not ready

Arguably, the real money is made in JavaScript and Python for the last decade. Embedded roles generally have fewer postings with lower pay than webdev. Until C catches back up, is it also not ready?
by egorfine | 2025-11-01 15:05:28+00:00
> advocates for pornography that's illegal in my country, without being held accountable by the community

If some form of speech is illegal in your country it does automatically mean it should be illegal for the whole world or that it is wrong or that the world-wide community should adhere to standards specific to your country. Even if that country is USA.

In other words, nobody should give a flying f about open source developers porn preferences.
by mwcampbell | 2025-11-01 15:05:57+00:00
In the spirit of "every non-trivial program will expand until ...", I think preemptively choosing async for anything much more complex than a throwaway script might be justified. In this case, the relevant thing isn't performance or expected number of concurrent users/connections, but whether the program is likely to become or include a non-trivial state machine. My primary influence on this topic is this post from @sunshowers: https://sunshowers.io/posts/nextest-and-tokio/
by SebastianFarts | 2025-11-01 15:06:05+00:00
The biggest problem I see with OIDC for agents is delegation—specifically, how one agent delegates authority to another agent acting on its behalf.

The microservice identity model breaks down when you have chains of agents, each potentially operating with different levels of autonomy and trust. OIDC was designed for human-to-service flows, not for dynamic agent-to-agent delegation where the context, scope, and risk profile can shift rapidly. I've been thinking we might need something closer to capability-based security or macaroons—where delegation is explicit, scoped, and auditable at each step. The key difference: instead of "who is this agent?" we should be asking "what specific action is this agent authorized to perform right now, and who in the chain vouches for it?"

I have been experimented with SPIFFE/SPIRE for agent identity or explored using verifiable credentials for delegation chains.
by ignoramous | 2025-11-01 15:06:46+00:00
So, I decided on three locking strategies: No-Lock Optimistic locking Pessimistic locking As a default, the no-lock behavior does exactly what the name implies. Nothing. This is the default because my research shows that for 99% all of this is not an issue and every interaction at this level will slow down the whole application.

Aren't the mutexes in the more modern implementations (like Cosmo [0]) & runtimes (like Go [1]) already optimized so applications can use mutexes fearlessly?

[0] https://justine.lol/mutex/

[1] https://victoriametrics.com/blog/go-sync-mutex/
by kstrauser | 2025-11-01 15:06:46+00:00
Different person, but here’s what I moved to: https://honeypot.net/2024/05/31/retiring-devonthink.html

TL;DR I migrated back to the filesystem, with several smaller, more focused tools to replace DT’d functions in better ways.

I’d still be on DT but their pricing model is insane today. A $200 license gets you two computers. Have a work laptop, personal laptop, and an iMac in your home office? Too bad! Pick the one you don’t want to access your data on, or buy another license! LOL, no. They say this is to have pricing that’s “fair to everyone”, but apparently by being universally crummy.
by embedding-shape | 2025-11-01 15:07:00+00:00
> Is that bad?

As long as you think about semantics and accessibility and does the extra work to add those things, then not really.

But why add those extra things when we already get those for free by doing <h1> and then customizing the style? Everything you'd need to manually add, automatically works fine then, so seems like a no-brainer to avoid putting more work on your table.
by oddsockmachine | 2025-11-01 15:07:18+00:00
Your point about orphaned records resonates with me, but for a much simpler (or stupider) "use case". I took a domestic flight earlier this year and foolishly showed my British passport as ID. I had returned to the country the day before, it just happened to be in my pocket. My green card was clipped to the front of it. After checking the identification page, the TSA agent flipped through the pages of entry stamps, visas, etc. There, they found all my old US work visas, which have long since expired. The agent was convinced that, since I have expired visas, I must be here illegally and would have to "come with [her]". I pointed out that I have a valid green card, so I'm here legally, and that of course every visa in the book has expired because - well that's what they do. It took 30 minutes, multiple staff being called over, supervisors, etc before I was allowed to continue. At every step, the presence of the expired visas was a mark against me. Never got an apology or recognition that they were wrong, just eventually told I could be on my way. I truly fear that overzealous thugs will use any "evidence" to prove their presuppositions, like your orphaned records. (I've naturalized since then, and carry my passport card around religiously, for all the good it may do...)
by esrauch | 2025-11-01 15:07:29+00:00
That doesn't sound right to me; its legitimate topic that a package where the core use-case is X, that package has obscure feature Y, and the mere existence of Y can cause security issues for a user even when the user never intended to use it.

Very concrete example, the whole Log4j vulnerability issue was basically just a direct implication of a feature that allowed for arbitrary code execution. Nearly no user of Log4j intentionally used that feature, they were all vulnerable because Log4j had that feature.

The fix to the CVE was effectively to remove the feature. If someone had the foresight to try to reduce Log4j to only the features that ~everyone actually used, and publish a separate Log4j-maximal for the fringe users that intentionally use that feature, it would have prevented what was arguably the worst vulnerability that has ever happened.

In the case this thread is about, no one seems to be deny that there should be a 'minimal' and 'full' versions and that the 'minimal' version is going to be more secure. The entire flame war seems to be over whether its better to take a preexisting package name and have it be a minimal one or the full one.

That is simply a tradeoff between "make preexisting users who don't use ancillary features be as secure as possible by default going forward" or "make preexisting users who do use ancillary features not broken by upgrades".
by ozim | 2025-11-01 15:07:58+00:00
Just this year Microsoft removed 300 NuGet packages by mistake as they were trying to automate defenses. They got pretty bad press after that so you will get bad comments one way or the other.

NPM ecosystem is very open it is not a bug it is a feature. There are of course issues from being open but NPM already has a lot of security features in place.
by ghaff | 2025-11-01 15:08:08+00:00
Which is true for a lot of things around the house. Although I got the whole house painted a bit ago because insurance was paying for it after a fire, there are some things I have experience with because I've done them a bunch of times--and often do them myself--there are others that I've never done. And may not have the right tools for and YouTube notwithstanding will probably take me a long time to do a very imperfect job.
by davemp | 2025-11-01 15:08:18+00:00
Rust technically isn’t a memory safe language the second you use “unsafe”. Rust advocates tend to pretend the can have their cake and eat it too when comparing it to other low level languages. No, just because you have the word unsafe next to the scary parts doesn’t make it okay.

I’ve written a good chunk of low level/bare metal rust—unsafe was everywhere and extremely unergonomic. The safety guarantees of Rust are also much weaker in such situations so that’s why I find Zig very interesting.

No oob access, no wacky type coercion, no nullptrs solves such a huge portion of my issues with C. All I have to do is prove my code doesn’t have UAF (or not if the program isn’t critical) and I’m basically on par with Rust with much less complexity.
by maccard | 2025-11-01 15:08:52+00:00
I’ve never done this and I’ve never told my team to do it.

What we have done though, and I will continue to do, js force us to leave things we want a decision on in a clearly broken/prototype state. The number of times I’ve gone into meetings to unblock a team only to have the whole thing derailed by a nothingburger bug that was hard to not see was the inspiration.

if you leave the UI element magenta with cyan font instead of default application style then you’ll actually get a discussion on your UI element.
by UniverseHacker | 2025-11-01 15:09:00+00:00
It’s a doable common hobby for middle class Americans. I grew up in a rural area with a dirt airstrip and everyone owned planes- even people that could barely afford a reliable used car. You can sometimes find something like an old Cessna for about $20k, and if you’re willing to do “experimental” planes that you fix yourself, sometimes just a few $k. Like anything, if you’re an insider in the community you can get good deals, sometimes even free from friends that age out, etc.

Many universities in rural areas have student clubs that offer lessons and rent club owned planes for cheap.
by jerojero | 2025-11-01 15:09:16+00:00
i like using computers until they break on me, i've never really felt (for the usage i give my macbook) that it is lacking in power. Even after, what, 5 years?

i think i'll be upgrading in the next 2 or maybe 3 years if apple puts OLED screens on their new machines as it is rumored.
by branon | 2025-11-01 15:09:17+00:00
Pedantic pet peeve: it'd be S.A.R.C.A.S.M. or SARCASM but not S.A.R.C.A.S.M

You are missing the last full stop, unless your project is actually meant to be called "S.A.R.C.A.S. M"

An initialism either uses full stops after all letters or none of them.
by grayhatter | 2025-11-01 15:09:49+00:00
> A server returning HTML for Chrome but not cURL seems like a bug, no?

tell me you've never heard of https://wttr.in/ without telling me. :P

It would absolutely be a bug iff this site returned html to curl.

> This is why there are so many libraries to make requests that look like they came from browser, to work around buggy servers or server operators with wrong assumptions.

This is a shallow take, the best counter example is how googlebot has no problem identifying it itself both in and out of thue user agent. Do note user agent packing, is distinctly different from a fake user agent selected randomly from the list of most common.

The existence of many libraries with the intent to help conceal the truth about a request doesn't feel like proof that's what everyone should be doing. It feels more like proof that most people only want to serve traffic to browsers and real users. And it's the bots and scripts that are the fuckups.
by ajdixbd | 2025-11-01 15:09:56+00:00
Everyone is saying it’s about pay, but India is a low trust country (so far as large datasets saying as much can be trusted). Anecdotally I have heard the same from my expat friends as well.

I’m not saying pay has no influence, but saying culture has no influence makes no sense. Even if it was all about pay, wealthy Indians choosing to horde their wealth instead of distribute it (caste system, etc) is a cultural root for the pay problem. The two are so intertwined that it’s impossible to claim it’s black and white.

The current western trend of outsourcing and/or importing labor is the real source of this issue. Western businesses care only for profit, so they employ cheap labor. Western culture is currently much more low trust than it was 50 years ago, and trending worse. If anything, I think culture is the more defining factor - pay is downstream of it.
by johng | 2025-11-01 15:10:12+00:00
Some people believe (myself included) simply that the government is/was involved in too much stuff, spends too much money and is involved in way too many things that they shouldn't be involved in.

Some of us want a smaller, leaner government. That means it's going to have to get it's fingers out of a lot of pies.

It is possible that may be the only way for us to survive long term as a country.
by ls612 | 2025-11-01 15:10:15+00:00
My mental model of this is “Apple releases new iOS with security patches -> time passes before cellebrite develops an AFU exploit -> Eventually Apple patches the exploit -> go to step 1”. By adding auto reboot Apple ensured that since lots of the time is spent in the stage where the latest iOS has no AFU exploit and AFU becomes BFU before that changes, and thus they are stuck with only extracting whatever is unencrypted at boot time at best. The leaked matrices even for September 2024 had no BFU listed for any remotely recent versions.
by bluGill | 2025-11-01 15:10:22+00:00
There needs to be a limit for each project. Debian is a large project so it needs to have more options than smaller projects. Rust is getting popular enough it is reasonable for Debian to say it is an approved option.

Note that I'm not saying Debian should, I'm saying it is reasonable that they would. I am not a Debian maintainer and so I should not have an opinion on what tools they use, only that adding Rust isn't unreasonable. It may be reasonable to take away a different tool to get Rust in - again this is something I should not have an opinion on but Debian maintainers should.
by stackskipton | 2025-11-01 15:10:36+00:00
>Today, OpenAI (and other AI startups) are losing billions and expect to lose more billions in the upcoming years even though the current interest rate is ~4%.

AI stuff is little different. If OpenAI and others hit AGI or anything remotely near it, the money is in theory massively endless. So investing when you could get 4% in a company that would return 10000% makes sense.

However, 4% in a company growing 15% in their field with profit margin of 10% means if only 1 in 5 survive, you have lost money so investors pull back.
by Rusky | 2025-11-01 15:10:37+00:00
"Not inert" does not at all imply "a single runtime within std+compiler." You've jumped way too far in the opposite direction there.

The problem is that the particular interface Rust chose for controlling dispatch is not granular enough. When you are doing your own dispatch, you only get access to separate tasks, but for individual futures you are at the mercy of combinators like `select!` or `FuturesUnordered` that only have a narrow view of the system.

A better design would continue to avoid heap allocations and allow you to do your own dispatch, but operate in terms of individual suspended leaf futures. Combinators like `join!`/`select!`/etc. would be implemented more like they are in thread-based systems, waiting for sub-tasks to complete, rather than being responsible for driving them.
by rasjani | 2025-11-01 15:11:08+00:00
> when did people forget how to run a baremetal server ?

My opinion on this: docker sort of changed the game here. It sort of enabled a lot of people to get a "new and fresh" level of abstraction to not bother about bare metal.

As an example, I work in company where most consultants are doing DevOps and k8 is big part of that.

What made me consider that? I've been told multiple times that "you know your stuff" when I mention some kernel or userland feature that container approach provides.
by lsaferite | 2025-11-01 15:11:14+00:00
I don't normally upvote snark, but... Bravo.

Elitism is it's own form of bullying and needs to be treated as such.

I don't particularly like large swaths of humanity, but I also try hard not to be elitist towards them either. I'm not always successful, but I make a strong effort as my family raised me to be respectful to everyone, even if you don't personally like them.
by yesfitz | 2025-11-01 15:11:15+00:00
The lack of large apartments in the US is at least partially caused by building codes requiring two means of fire egress (meaning two separate stairwells in taller buildings) which limits the size and layout of individual apartments.

Here’s a video on the subject: https://youtube.com/watch?v=iRdwXQb7CfM

Long story short though, modern fire mitigation techniques (materials, sprinklers, fire doors) greatly reduce the risk posed by having just one staircase, which would open up a wide array of apartment layouts.
by mbo | 2025-11-01 15:12:14+00:00
This is why I've needed to use XLST, to style my personal RSS feed. Great guide for this: https://andrewstiefel.com/style-atom-xsl/ Looks like it's been raised on the whatwg issue too: https://github.com/whatwg/html/issues/11523#issuecomment-315...
by aleph_minus_one | 2025-11-01 15:12:25+00:00
> I'd argue sports ruined their own product with ad insertion at every available opportunity (and even creating new opportunities to shove ads at you).

Side remark: I love to ridicule that of all things producers of very unhealthy food and beverages (or to put it more directly: producers of foods and drinks that make you fat and thus unathletic) love to sponsor sports events. :-)
by egorfine | 2025-11-01 15:12:30+00:00
I'm happy for all developers programming in their favorite programming languages. Programming for over 30 years I have seen entire ecosystems come and go.

What I don't get is the burning need for Rust developers to insult others. Kind of the same vibes that we get from systemd folks and LP. Does it mean they have psychological issues and deep down in their heart they know they need to compensate?

I remember C vs Pascal flame back in the day but that wasn't serious. Like, at all. C/C++ developers today don't have any need to prove anything to anyone. It would be weird for a C developer to walk around and insult Rust devs, but the opposite is prevalent somehow.
by specproc | 2025-11-01 15:12:50+00:00
I had a few sessions on it decades back as part of a conflict resolution course.

I don't think I've ever applied it as described in the article or those sessions, but there were a few things from then that I've found to improve how I engage with people (when I remember).

- ask questions regularly

- make sure your questions are open-ended and can't be answered with a yes/no

- avoid saying stuff like "you are like this" or "this is like that". It's safer to say things, particularly difficult things, from one's own perspective, e.g. "I think that".