MurphyA/hacker-news huggingface dataset:
by forgotoldacc | 2025-11-24 16:37:19+00:00
This completely ignores a lot of history. Okinawa went from being a tributary (trade partner) of China to vassal state (occupied and controlled) by Japan in 1609. [1] What would be modern day Afghanistan and Thailand paid tribute to China as well, but for some reason, those are ignored with the Chinese claim to territory. It's simply "well the Republic of China's victory in WW2 means we get land from countries we traded with in the 1600s!", which is bizarre view of history. Frankly, it's nothing more than trying to seed the ground for opportunism, because it's a guarantee those same arguments will be used to say Vietnam, Thailand, and Afghanistan aren't independent if those become valuable lands in the future and they seem as easily seizable as small Okinawan islands.

[1] https://en.wikipedia.org/wiki/Invasion_of_Ryukyu
by JyrkiAlakuijala | 2025-11-24 16:37:22+00:00
JPEG XL supports UltraHDR.

JPEG XL's normal HDR capabilities were not harmed in the process when UltraHDR was added.

It was added for reaching parity with JPEG1 and HEIF/AVIF for the needs of UltraHDR developers and believers.
by alexchantavy | 2025-11-24 16:37:53+00:00
Small plug for my open source project: you can use Cartography [https://github.com/cartography-cncf/cartography], to map your infra and then run this query (https://gist.github.com/achantavy/2cc7cc49919a8f761fea5e2d75...) to see if you're affected
by wrp | 2025-11-24 16:37:57+00:00
I was in Hokkaido many years ago for work and loved it. Compared to the rest of Japan, indoor/outdoor spaces are wider, food is better, and people are friendlier. I never could swing another work visit, so I dream about spending time there in retirement.

I could imagine, though, that companies might have trouble attracting quality talent to Hokkaido, because people see more opportunities in the big cities down south. I suppose it's like if you were trying to build a tech hub in Montana.
by TitaRusell | 2025-11-24 16:38:47+00:00
Long copyright also means that the estate can control the work- like how Tolkien's son guarded lord of the rings like a hawk.

And I also understand Disney's point of view. Imagine you invested a lot of money into a franchise and the original author suddenly goes crazy and makes Roger the Rabbit a Klansman.

Although personally I would put the protection at 10 years.
by HarHarVeryFunny | 2025-11-24 16:38:55+00:00
I guess it depends on what sort of monetary damage the typical Hokkaido earthquake would have on a fab - just result in a bad batch of chips perhaps, or also damage equipment? Obviously it's known that the region is very seismically active (159 earthquakes in Hokkaido so far this year!), but Japan are used to having to build to minimize earthquake damage.

https://earthquaketrack.com/p/japan/hokkaido/recent
by infinet | 2025-11-24 16:39:11+00:00
Agreed.

I really appreciate author’s effort and for releasing the PDF to the public. There are however areas I think could be made more helpful.

In the chapter on Trigonometric Functions, it begins with discussion of the derivative of the exponential function is itself, and then moves on to define sine and cosine via second degree derivatives. While interesting, this may not be the most helpful approach for intended readers.

The following chapter on Taylor Series also starts with a long discussion about the value of e. It is interesting, but it can feel a bit distracted from the main topic. The treatment of Taylor polynomials might benefit from a different approach similar to other texts.
by herpdyderp | 2025-11-24 16:39:22+00:00
> why does it help?

Because install scripts are being actively exploited, so blocking them will reduce your exposure. Install scripts will also run anywhere that runs npm ci, npm install, etc., including build pipelines.

> Can't they just jam the malware into the package itself

Yes. Disabling install scripts won't safeguard you from all attack vectors.
by blackcatsec | 2025-11-24 16:40:03+00:00
I mean, internet standards kept up. IPv6 is a thing, and some form of dynamic IPv6 stateful firewall hole punching a la UPnP would be useful here. Particularly if the application used the temporary address for the hole punch--because once the address lifetime ends, it's basically not going to get used again (64-bit address space). So that effectively nullifies any longer term concerns about security vulnerabilities.
by neonspark | 2025-11-24 16:40:20+00:00
> Debug builds should by default give .unwrap() and .expect() a tiny chance, like 0.1%, to trigger anyway, even when the Option is Some (opt out via configuration).

I'm trying to understand what you're proposing. Are you saying that normal debug builds should have artificial failures in them, or that there should be a special mode that tests these artificial failures?

Because some of these failures could cause errors to be shown to the user, that could be really confusing when testing a debug build.
by nabakin | 2025-11-24 16:40:22+00:00
This is a better link from a French privacy non-profit but I can't change it now: https://mamot.fr/@LaQuadrature/115581775965025042

@dang or other mods, could you change it?

Google Translated text:

> Two articles in Le Parisien yesterday, followed today by one in Le Figaro, have launched a shameful attack against GrapheneOS, a free and accessible open-source operating system for phones. At La Quadrature du Net, it's one of the tools we favor and regularly recommend for protecting against advertising tracking and spyware.

> Echoing the propaganda of the Ministry of the Interior, newspapers describe GrapheneOS as a "crime-related phone solution," and a police officer adds that its use is suspicious in itself because it indicates an "intention to conceal." By portraying GrapheneOS as a technology linked to drug trafficking, this attack aims to criminalize what is actually a secure privacy-preserving tool.

> In these articles, the head of the cybercrime section of the Paris prosecutor's office – who was behind the arrest of Pavel Durov – also threatens the developers of GrapheneOS. In an interview, she warns that she will "not hesitate to prosecute the publishers if links are discovered with a criminal organization and they do not cooperate with the justice system." https://archive.is/20251119110251/https://www.leparisien.fr/...

> The government regularly tries to link privacy technologies, particularly encryption, to criminal behavior in order to undermine them and justify surveillance policies. This was the case in the so-called "December 8th" case, where a police narrative was constructed around the (secure) digital practices of the accused to portray a "clandestine" and "conspiratorial" group. https://www.laquadrature.net/2023/06/05/affaire-du-8-decembr...

> Now, drug trafficking is being used to attack these technologies and justify the surveillance of communications. The so-called "Drug Trafficking" law was thus used as a pretext to try to legalize "backdoors" in encrypted applications like Signal or WhatsApp, without success. https://www.laquadrature.net/2025/03/18/le-gouvernement-pret...

> An article in Le Monde diplomatique from November extensively examines the history of the political exploitation of drug trafficking to justify security and surveillance policies. The police attack on GrapheneOS fits perfectly within this pattern. https://www.monde-diplomatique.fr/2025/11/BONELLI/68915

> In its response published yesterday, GrapheneOS points to the authoritarian tendencies of the French government, one of the most fervent supporters of the "ChatControl" regulation under discussion at the European level, one of whose goals is to put an end to end-to-end encryption. https://grapheneos.social/@GrapheneOS/115575997104456188

Additional context:

https://grapheneos.social/deck/@GrapheneOS/11557599710445618...

https://grapheneos.social/@GrapheneOS/115583866253016416

https://grapheneos.social/@LaQuadrature@mamot.fr/11558177594...

https://grapheneos.social/@GrapheneOS/115589833471347871

https://grapheneos.social/@GrapheneOS/115594002434998739
by codingdave | 2025-11-24 16:40:23+00:00
Is this product open source/free or for-profit?

I ask because if this is for-profit, help to devise a proprietary algorithm that will become a core part of it feels like something that should be done as a consulting engagement, not a HN post. And in that case, we are only about a week off of the monthly hiring posts, so I'd recommend reaching out to folks who post on the 'who wants to be hired' or the freelancer threads.

Different story if this is free and open source, of course.
by rtkwe | 2025-11-24 16:40:30+00:00
There's already pretty sophisticated setups to get fake live ID verifications where it's already a cat and mouse game between the tools to verify and the tools faking live verifications (sometimes including just scamming people into acting as the 'user' for verification). Ideally I'd also not have to provide my ID for yet another inane service and risk that ID getting leaked as seems to be inevitable.
by ekr____ | 2025-11-24 16:40:31+00:00
There were a number of things going on with TLS 1.3 and paring down the algorithm list.

First, we both wanted to get rid of static RSA and standardize on a DH-style exchange. This also allowed us to move the first encrypted message in 1-RTT mode to the first flight from the server. You'll note that while TLS 1.3 supports KEMs for PQ, they are run in the opposite direction from TLS 1.2, with the client supplying the public key and the server signing the transcript, just as with DH.

Second, TLS 1.3 made a number of changes to the negotiation which necessitated defining new code points, such as separating symmetric algorithm negotiation from asymmetric algorithm negotiation. When those new code points were defined, we just didn't register a lot of the older algorithms. In the specific case of symmetric algorithms, we also only. use AEAD-compatible encryption, which restricted the space further. Much of the motivation here was security, but it was also about implementation convenience because implementers didn't want to support a lot of algorithms for TLS 1.3.

It's worth noting that at roughly the same time, TLS relaxed the rules for registering new code points, so that you can register them without an RFC. This allows people to reserve code points for their own usage, but doesn't require the IETF to get involved and (hopefully) reduces pressure on other implementers to actually support those code points.
by mock-possum | 2025-11-24 16:40:32+00:00
Ditto on legacy of Windows use, and really ‘legacy’ is what it boils down to for me - it’s the devil I know, and you’re a fool if you don’t think MacOS is an angel here - or even whatever -nix flavour you prefer.

It’s been my experience that matter what OS you try to pick up, the most likely case is you mutter “why the fuck do people put up with this” and go back to the one you’re used to, because at least you mostly know the tricks and pitfalls and can get it to do what you want.
by xeeeeeeeeeeenu | 2025-11-24 16:40:38+00:00
>avif is just better for typical web image quality,

What does "typical web image quality" even mean? I see lots of benchmarks with very low BPPs, like 0.5 or even lower, and that's where video-based image codecs shine.

However, I just visited CNN.com and these are the BPPs of the first 10 images my browser loaded: 1.40, 2.29, 1.88, 18.03 (PNG "CNN headlines" logo), 1.19, 2.01, 2.21, 2.32, 1.14, 2.45.

I believe people are underestimating the BPP values that are actually used on the web. I'm not saying that low-BPP images don't exist, but clearly it isn't hard to find examples of higher-quality images in the wild.
by efortis | 2025-11-24 16:40:38+00:00
Yes, if the malware is injected in the application code this doesn’t prevent it.

But in some cases it could help for that. For instance, if the package runs in the browser and the payload requires file-system access, etc., then the attack can’t execute in the browser. And if in addition it was added to a life-cycle script, it would be mitigated.

At any rate, it’s worth having `ignore-scripts=true` because NPM life-cycle scripts are a common target (e.g., this one targets `preinstall`).
by hulud | 2025-11-24 16:41:03+00:00
4chan’s /pol/ has had the flag forever, and “show flag” is a typical callout.

Only the normies are surprised and the pearl clutching on HN is farcical. You should know better by now.

I guess the outrage must be manufactured so let’s all join hands and pretend we are shocked by this news and demand something be done, I guess. Slow news week.
by casey2 | 2025-11-24 16:41:32+00:00
>politically unpopular

You mean capitalists will stir up a shitfit if they aren't allowed to profit from someones misfortune. The proper amount of traffic on roads should be close to 0. All LA would have to do is offer more and free bus rides and charge for driving in the city and everyone would save hours of their life for no cost.
by tonyoconnell | 2025-11-24 16:41:40+00:00
You can make your website run fast as well with https://astro.build - it strips the Javascript and uses HTML until js is needed. You can get 300ms page loads for outcrop.app with Astro on Cloudflare Pages. Good luck with the project. I requested early access - You should use the response to the form submit requesting access better - I mean somebody who added their email expressed a lot of intent - why end the conversation with a toast notification? I hope life is going well in Dublin.
by dataflow | 2025-11-24 16:42:00+00:00
What exactly are you calling "rules-lawyering"? Is citing rules and pointing out their blatant violation "rules-lawyering"? If so, can you explain why it is better to avoid this, and what should be done instead?

As an outsider I'd understand it differently: reading rules and pointing out their lack of violation (perhaps in letter), when people feel like you violated it (perhaps in spirit), is what would be rules-lawyering. You're agreeing on what the written rules are, but interpreting actions as following vs. violating them.

That's quite different from an accusation of rules violation followed by silence or distortions or outright lies.

If someone is pointing out that you're violating the rules and you're lying or staying silent or distorting the facts, you simply don't get to dismiss or smear them with a label like "rules-lawyer". For rules to be followed, people have to be able to enforce them. Otherwise it's just theater.
by hbosch | 2025-11-24 16:42:02+00:00
The same head of product quoted in the sib comment admits that "for a small set of accounts the location data was incorrect". Given what we know about Twitter's relationship with the government and this administration in particular, you're simply left to do with that information what you will.

I personally do not trust Twitter, or the government, very much. I also would not be surprised if some government accounts were created at various embassies around the world or through strategic VPN networks, or if general business is conducted through a darknet-like node system which includes allied endpoints. To me those are more plausible.
by estimator7292 | 2025-11-24 16:42:06+00:00
There is zero reason for you to have a cookie banner taking up a third of the page.

At this point, everyone making websites should be well aware that there is no requirement for cookie banners and that implementing such is active disrespect towards your users. Your cookie banner does not tell me you care about my privacy, it tells me you're trying to collect some type of data about me and want to annoy me into letting you sell that data.

A cookie banner is exactly as much a red flag as an obviously AI generated hero image at the top of your page. Disrespectful.
by gostsamo | 2025-11-24 16:42:15+00:00
is "pretty much instant" true when jumping between buttons, partially saying what you are landing on while looking for something else? can it represent a gui in enough detail to navigate it, open combo boxes, multy selects and whatever? can it make a difference between an image of a button and the button itself? can it move fast enough so that you can edit text while moving back and forth? ocr with possible prefetch is not the same as object recognition and manipulation. screen readers are not text readers, they create a model of the screen which could be navigated and interacted with. modern screen readers have ocr capabilities. they have ai addons as well. still, having the information ready to serve in a manner that allows followup action is much better.
by ancorevard | 2025-11-24 16:42:46+00:00
This is incorrect.

The old Twitter and its API had "source" field which showed the client app a tweet was sent from.

{ "created_at": "Mon Nov 20 12:34:56 +0000 2023", "id_str": "1726578932412345678", "full_text": "Example tweet", "source": "<a href=\"http://twitter.com/download/iphone\" rel=\"nofollow\">Twitter for iPhone</a>", ... }
by ChrisArchitect | 2025-11-24 16:43:44+00:00
Related:

X's new country-of-origin feature reveals many 'US' accounts to be foreign-run

https://news.ycombinator.com/item?id=46028422

X begins rolling out 'About this account' location feature to users' profiles

https://news.ycombinator.com/item?id=46024417

Top MAGA Influencers on X/Twitter Accidentally Unmasked as Foreign Trolls

https://news.ycombinator.com/item?id=46024211
by estebank | 2025-11-24 16:43:57+00:00
When it comes to distributed services, unwrap is likely the behavior you do want, because the service is being run by a scheduler that detects failures, and a panic would be tied to a metric and page an sre. My read of the situation is that they were overwhelmed by their dashboards which made it harder to identify the root cause, but that is a common situation for these kind of events. I'm pretty sure that this exact sequence of events will never happen again to them because they will adjust their observability to be clearer, should this ever happen again.

For libraries and cli tools, you don't want panics except for things that are broken beyond any recovery. A cli tool should not panic directly, instead emitting human readable errors.
by masonmarker | 2025-11-24 16:44:40+00:00
Hey everyone,

I've traded, well, gambled, Solana memecoins for almost 3 years now, and I've began to realize the amount of factors at play in determining if a coin is worth buying. I've mostly dabbled in low market cap coins while keeping the vast majority of my crypto assets in high market cap coins, Bitcoin for example. After watching so many new coins with great narratives go straight to 0, I decided to start approaching this emotional game logically.

After a while searching, I couldn't find a dataset that provides the non-obvious features I was seeking. I ended up building a web scraper that detects new Solana coins, capturing snapshots every ~10 seconds, while simultaneously querying API data for socials, rugcheck data, token metadata, and a bunch of additional information. With this ingested data, I built a clean dataset for analyzing this large number of new features the scraper had extracted.

Each token snapshot includes tons of features such as:

- market cap - volume - holders - top 10 holder % - bot holding estimates - dev wallet behavior - social links - website analysis (title, HTML, text snippets, reputation, etc.) - rugcheck scores + risk - and plenty of other tokenomic-based fields

In total, I scraped thousands of early token charts, and picked out 140+ clean charts, each with nearly 300 datapoints on average.

Even with just a quick exploratory analysis, I started noticing small patterns, such as the correlation between the presence of social links and market cap ATH. I'm a data engineer, not a data scientist (yet), and I'm positive those with stronger ML backgrounds could find much deeper patterns and predictive signals than I can.

For the full dataset description/structure/schema, the Hugging Face Dataset Card can be found in the attached post URL.

I'm more than happy to answer any project-related questions about the scraper, the data ingested, or really anything else :)
by kmeisthax | 2025-11-24 16:44:45+00:00
The RIAA isn't opposed to AI as much as they're saying "join me, and together we can destroy indie music forever".

The RIAA is a cartel monopsony that demands songwriters and singers negotiate away all equity in their work as a condition of market entry. But there are alternative markets for music, and successful musicians that have navigated them. This is why, for example, mainstream music has been so strangely stagnant while the independent space is a lot more innovative. The labels don't pay good money for innovation; hell, they don't even want it. They want a sure hit saleable product every time.

As nerds, we're predisposed to look at generative AI through the framing of the Napster Wars. Except file sharing wasn't doing what generative AI does. P2P gave you a more or less faithful, if lossy, reproduction of a specific work. It might have missing or wrong metadata, but it was still clearly identifiable as that work. A generative AI system is instead producing legally distinct work - which is why all the AI training lawsuits are failing - using the creative input of the data the company scraped to train on. It infringes on the moral grounding of copyright but not the copyright itself.

The threat that generative AI systems pose to artists is twofold: spam and standardization. Generative AI makes it far easier to churn out samey-looking outputs, while losing utility as you try to get more interesting or innovative styles out of it. It's a slop machine. And, notably, these are exactly the sort of things the RIAA wants out of mainstream music:

- AI music is safe and approachable. If you ask it for jazz, you're getting a stereotype of the jazz genre.

- AI music can be mass-produced at scale without needing to advance an artist royalties. That means you can spam it on Spotify and destroy the discoverability of independent musicians.

- More importantly, generative AI turns the act of music production into ownable equity. The artist is cut out of the picture completely, there is not even the need to find a naive artist that will sign their life away in a 360 deal for peanuts.

The ideal world that the RIAA wants to live in is one where each label sues and then buys out an AI music company, and then has that company train a fully-owned "house model" on their back catalog only. No other entities will be allowed to train models, either through aggressive copyright litigation or through some new "AI safety law" that conveniently exempts them. They'll own the streaming sites and digital marketplaces, and any independent musician making real music will get crushed under the weight of AI slop.
by echelon | 2025-11-24 16:45:09+00:00
Really? It isn't obvious?

> The big publishers do provide utility, but there's also an incredible asymmetry (they have trivially made many more book deals than any of their authors)

Literally doesn't matter in today's meta for people making music, video, or games. A substack or podcast following will do the same for authors.

It's not that this isn't hard. I'd argue it's harder to get noticed today now that everyone can make content. It's just that the power asymmetry is disappearing because you can hold onto more of your rights.

Today it's about building a brand following. If you can do that, the publishers will chase you.

It wasn't available for Wolf because nobody realized this strategy yet. A lack of Internet made it more difficult, but not impossible. George Lucas kind of got it.

Now it's glaringly obvious. Just not easy.
by simonw | 2025-11-24 16:45:35+00:00
I doubt most of this is foreign government influence campaigns. I think it's more that Twitter will pay you to post clickbait, and if you are in Africa or many parts of Asia the amount you can earn is significant.

There was some great reporting about Macedonian teenagers doing this kind of thing back in 2016 - https://www.nbcnews.com/news/world/fake-news-how-partying-ma... - it was actually the origin of the term "fake news" before Trump redefined it to mean any mainstream media coverage that he didn't like.