MurphyA/hacker-news huggingface dataset:
by LeifCarrotson | 2025-11-24 16:55:57+00:00
I think the issue is more about what else has to go into or be connected to that container. Posthog isn't really useful if it's air-gapped. You're going to give it keys to access all kinds of juicy databases and analytics, and those NPM tokens, AWS/GCP/Azure credentials, and environment variables are exactly what it exfiltrates.

I don't run much on the root OS of my dev machine, basically everything is in a container or VM of some kind, but that's more so that I can reproduce my environment by copying a VMDK than in an effort to limit what the container can do to itself and data it has access to. Yeah, even with root access to a VM guest, an attacker they won't get my password manager, personal credit card, socials, etc. that I only use from the host OS... But they'll get everything that the container contains or has access to, which is often a lot of data!
by rtkwe | 2025-11-24 16:56:07+00:00
It's been known for a while this is just verification. Accounts give themselves away all the time accidentally through phrases or tells. eg: A tweet from an account claiming to be from the US talking about Texas succession that mentions 'warm water ports', very few people care or think about that because all the ports on the continental US don't freeze over in the winter. (In fact very few countries do because most have as many warm water ports as they need, one of the few with significant issues with this is... Russia)
Show HN: ProDisco – Progressive Disclosure Kubernetes MCP Server
by pharshal | 2025-11-24 16:56:21+00:00
ProDisco gives AI agents Kubernetes access that closely follows Anthropic’s Progressive Disclosure pattern [1]: the MCP server exposes search tools which in turn surface TypeScript modules, agents discover them to write code, and only the final console output returns to the agent.

ProDisco goes a step further: instead of exposing custom TypeScript modules, it provides a structured parameter search tool that returns the most suitable methods from the official Kubernetes client library, including the type definitions for their input and return values. This lets agents dynamically interact with the upstream Kubernetes library while avoiding any ongoing maintenance burden in this repository to mirror or wrap those APIs.

https://github.com/harche/ProDisco

[1] https://www.anthropic.com/engineering/code-execution-with-mc...
GhostBin A lightweight pastebin, built with Go and Redis
by sanaf | 2025-11-24 16:56:59+00:00
Hi HN,

I built GhostBin, a lightweight pastebin designed to replace the simplicity and speed that services like ix.io used to offer. ix.io has been down for a long time, and most existing pastebins are either bloated, slow, or not CLI-friendly. I needed something minimal that “just works,” especially for piping logs and command outputs during debugging or writing content. So I made my own.

GhostBin focuses on:

Simplicity: Clean interface and a straightforward API.

Performance: Go + Redis for fast reads/writes.

CLI-first workflow: curl and shell pipelines work out of the box.

Privacy & control: Self-hostable with Docker; no vendor lock-in.

Burn-after-read + expiration: Useful for ephemeral snippets.

Optional deletion secret: Allows secure deletion via API.

Demo: https://www.youtube.com/shorts/RINJI_Q5048

Source: https://github.com/0x30c4/GhostBin

CLI script: https://raw.githubusercontent.com/0x30c4/GhostBin/main/gbin.sh

``` $ curl -F "f=@file.txt" gbin.me ```

``` dmesg | curl -F "f=@-" gbin.me ```
by brabel | 2025-11-24 16:57:11+00:00
Where are you from? Did you know Taiwan is not recognized as a state independent of China by Europe, the USA, Japan and nearly every other country with the exception of 12 small countries?

https://worldpopulationreview.com/country-rankings/countries...

You want it to be a state but your own country says it’s not one most likely. Stop embarrassing yourself.
by Giuseppe_Coco | 2025-11-24 16:57:42+00:00
Is anyone interested in contributing?

I am looking for either someone who wants to help me integrate maps from OpenStreetMap into FireShow, or someone who is experienced in building real softwares, especially in C++ and wants to reorganize better the code architecture. Despite all ideas/features are mine, because I don't have much experience in building real softwares, the architecture is mainly decided by AI, but I feel like it is a bit of a mess, and I'd love if it was better ;)
by mlmonkey | 2025-11-24 16:58:21+00:00
If you had access to the twitter feed (and I did at one point, as our company got the firehose from Twitter), it showed the Lat/Long of where it was posted from IIRC.

I still remember looking at that tweet when the helos went in for OBL, from someone in Abottabad PK, saying something like "helicopters hovering at 2AM... this is a rare occurrence" (or something like that).
by AlexandrB | 2025-11-24 16:59:00+00:00
They're absolutely different. IP rights are a creating of artificial scarcity for what would otherwise be an infinitely-copyable work. Physical property rights are a codification of rights to a naturally scarce item.

IP rights require specific limitations on speech for everyone who is not the owner of an IP. It's walling off some expression as "copyrighted" so that no one other than the "owner" can express them (in a commercial way at least). Compare this to traditional property rights that merely prevent you from walking up to the owner and taking their (non copyable stuff) - a much lesser restriction.

This is why IP rights need to have limitations like a time limit, but I don't see why other limits like non-transferability are out of the question.
by nis0s | 2025-11-24 16:59:07+00:00
I think you fundamentally misunderstood any aspect of society, civility and community building if you adhere to such ideas. The issue at hand is bad governance and resource management, not that “immigrants should be kept out”.

Immigration is needed at different parts of a country’s economic timeline, and the levels of immigration needed can vary depending on your needs to balance labor supply and demand. This isn’t about racism, or cultural differences. This is about good governance.
by JumpCrisscross | 2025-11-24 16:59:26+00:00
> Is it worth it to unfairly limit one person's life in order to protect them and people around them from a short period of harmful behaviour? If that limitation was temporary, yes

I think the question turns on scale. If one person has the capacity to harm dozens, as one does in a city, the calculus may shift towards incapacitation. If it’s a small handful of non-violent interactions, on the other hand, as would be more likely somewhere less dense, then I agree with you. (Same turn on access to weapons.)
by estebank | 2025-11-24 16:59:40+00:00
There are at least three separate things that rustc and cargo could do to significantly improve compilation speed, but they are complex engineering efforts that require time and engineers being paid to work on full-time. They are: doing what zig does to compile only items that arr reachable, which requires making rustc reentrant to stop after name resolution and cargo more complex to pass used paths through subsequently, leveraging an incremental linker and have rustc only codegen the binary patch instead of the whole binary and have the linker calculate the patch, and caching proc-macros and treat them as idempotent (likely as opt-in). There are of course others, like pre-compiled distribution, better intra-rustc parallelism or feature cfg handling, but those have more open questions and require additional design work before I could claim they're attainable.
by nabakin | 2025-11-24 17:00:07+00:00
Google Translate link:

https://translate.google.com/translate?tl=en&hl=en&u=https:/...

Additional context:

https://grapheneos.social/deck/@GrapheneOS/11557599710445618... https://grapheneos.social/@GrapheneOS/115583866253016416 https://grapheneos.social/@LaQuadrature@mamot.fr/11558177594... https://grapheneos.social/@GrapheneOS/115589833471347871 https://grapheneos.social/@GrapheneOS/115594002434998739
Corvus Robotics (YC S18): Hiring Head of Mfg/Ops, Next Door to YC Mountain View
by robot_jackie | 2025-11-24 17:00:33+00:00
Corvus Robotics is scaling the largest autonomous logistics data capture fleet ever built. If you're allergic to leaded solder, actual revenue, spreadsheets, or ambiguity -- this role is not for you. More "cardboard boxes," less "Pelican cases."

Our fleet of flying warehouse drones is 5x-ing in 2026, and I'm looking for a generalist ex-founder or manufacturing leader in the SF Bay Area who wants to get their hands dirty massively scaling manufacturing operations in the US and overseas.

We need someone who has worked on hardware products (not just SaaS), communicates clearly, and is relentlessly resourceful. Mandarin proficiency and leading a product through EVT/DVT/PVT is an added bonus.

If this resonates with you, DM me, or send a super short email to a@ our url with: - why you’re interested - what was the biggest manufacturing fuckup you've recovered from - your target comp

PS - Please reshare our LinkedIn post! https://www.linkedin.com/posts/mhkabirr_at-corvus-robotics-w...

Thanks, Jackie
by jtemperton | 2025-11-24 17:00:43+00:00
Shopify salespeople exaggerated the value of deals they were closing in an apparent attempt to earn more commission, The Logic has learned. The sales fraud, which lasted more than a year, sparked an internal investigation that led to layoffs and a warning to staff who had faked sales numbers to own up or risk being found out and punished more severely, according to former staff and internal messages.
by cbenjumea | 2025-11-24 17:00:52+00:00
Very sorry for the late answer. Rigt now is only in spanish as we are getting first into this market.

And you are totally right. We are currently changing our landing to match our ICP. Thanks very much for the link, looks fantastic! Already bookmarked several links to dive in them.

Could we connect via LinkedIn? I appreciate very much your insights and would love to be in touch. This is my profile: https://www.linkedin.com/in/christianbenjumeaulfsparre/

Un abrazo!
by mcv | 2025-11-24 17:00:55+00:00
These are corporate subsidies to an industry that really doesn't need any further help. They're subsidies for pollution. Care for the environment is also often considered a left-wing issue.

The left is not in favour of market distortion, it's in favour of a fair market. Not one where profits are privatised while costs are socialised. Many people on the left want oil to be taxed rather than subsidised.
by johncolanduoni | 2025-11-24 17:00:58+00:00
No, the argument is that the algorithm (as specified in the standard) is difficult to implement correctly, so we should tweak it/find another one. This is a property of the algorithm being specified, not just an individual implementation, and we’ve seen it play out over and over again in cryptography.

I’d actually like to see more (non-cryptographic) standards take this into account. Many web standards are so complicated and/or ill-specified that trillion dollar market cap companies have trouble implementing them correctly/consistently. Standards shouldn’t just be thrown over the wall and have any problems blamed on the implementations.
by banana_giraffe | 2025-11-24 17:01:24+00:00
https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-...

The default Lambda quota for all accounts is 10240 MB. I've never seen it below that (in recent memory, at least), even on fresh accounts not connected to a big org.

I know I routinely use 10gb of RAM for my account that's never talked to support for the related CPU allocation.
by Tangurena2 | 2025-11-24 17:01:28+00:00
Something similar happened to one of the Dominos delivery vehicles (a DXP [0]). The purchaser got sued for trademark violations [1]. In this case, the car was totaled in an accident and the insurance company sold it.

[0] - https://ir.dominos.com/news-releases/news-release-details/do...

[1] - https://www.youtube.com/watch?v=qN-yLTDkAS4
by timgl | 2025-11-24 17:01:37+00:00
co-founder here. We mentioned it in the main thread about this: https://news.ycombinator.com/item?id=46032650 and on status.posthog.com

- posthog-node 4.18.1, 5.13.3 and 5.11.3

- posthog-js 1.297.3

- posthog-react-native 4.11.1

- posthog-docusaurus 2.0.6

If you make sure you're on the latest version you should be good.
Show HN: Bodge.app – μFaaS for hacked-together personal tools and small projects
by azdle | 2025-11-24 17:01:39+00:00
This is a little side project I've been working on for the last few months. It's a service hosting Lua scripts behind static HTTP endpoints. It's something I've built to scratch my own itch and now I'm launching a free public beta to see if it's something that anyone else also finds useful.

<backstory>

My first professional job was for a company building an industrial IoT platform who's most unique feature was their Lua-based scripting platform. I ended up loving Lua so much that at my next job, at SmartThings, I ended up being the main instigator who made the Lua-based Edge Drivers happen when we were forced to sunset the old Groovy-based DTHs, writing the initial PoC, laying out the architecture, and writing the core of the system.

This is basically my take on an old service that folded in 2017 called webscript.io, another tool that got me loving Lua. I used that service a whole bunch both for personal projects and little tools at work. I was really sad when it went down and I genuinely don't think a single week had gone by where I hadn't wished that it still existed. So, I finally decided that I needed to build my own version of it.

</backstory>

The whole idea behind Bodge is that it should be as simple as possible to hack something together. I've always had a bunch of small side projects that I want to do that aren't worth the overhead required to actually put them together & keep them maintained. So, I built Bodge as a way to make each individual project less work whenever inspiration strikes. So far I've built:

* A current-time API for some hacked-together IoT devices: https://time.bodge.app/

* A script for my wife that checks her commute time and emails her before it's about to get bad.

* An email notification to myself if my Matrix server goes down.

* A 'randomly choose a thing' page. https://rand.bodge.app/choose?head&tails

* A "work" phone number voicemail, where the script converts the webhook into an alert to myself.

* An email notification any time a new version is released for a few semi-public self-hosted services.

* Scrapers for a few companies' job listings that notify me whenever a new job is posted matching some filters.

* A WebPush server that I eventually want to use for custom notifications to myself.

* And just for fun, an SVG hit counter: https://hits.bodge.link/

Scripts can be as simple as:

return "Hello, world!"

Or as complicated as you're willing to make them within the confines of a single Lua file.

Currently I provide Lua modules for: making HTTP requests, handling json, sending alerts to yourself, simple string/string key/value storage, cross-script mutexes, and a few other basic things.

Accounts are free, but you don't even need to make one to just play around with writing scripts. There's a demo on the homepage that lets you run real scripts for yourself, though with a few extra limitations.

I'd love to hear what anyone thinks!
by pron | 2025-11-24 17:02:34+00:00
I think that the aesthetic dislike of "everything is a set" is misplaced, because it misses a crucial point that people unfamiliar with formal untyped set theories often miss: Not every proposition in a logic needs to be (or, indeed, can be) provable. The specific encoding of, say, the integers need not be an axiom. It's enough to state that an encoding of the integers as sets exists, but the propositions `1 ∈ 2` or `1 ∩ 2 ≠ ∅` can remain unprovable. Whether they're true or false remains unknown and uninteresting (or, put another way, "nonsensical").

The advantage is, then, that we can use a simple first order logic, where all objects in the logic are of the same type. This makes certain things easier and more pleasant. That the proposition `1 ∈ 2` can be written (i.e. that it is not a syntax error, though it's value is unknowable) should not bother us, just as that the English proposition "the sky is Thursday" is not a grammatical error and yet is nonsensical, doesn't bother us. It is no more or less bothersome than being able to write the proposition `1/x = 13`, with its result remaining equally "undefined" (i.e. unknowable and uninteresting) if x is 0. If `1/x = 13` isn't a syntax error, there's no reason `1 ∈ 2` must be a syntax error, either.

That a proposition is nonsensical (for all assignments of variables or for some specific ones, as in x = 0 in 1/x) need not be encoded in the grammar of the logic at all, and defining nonsense as "unknowable and uninteresting" is both convenient and elegant. I think that some logicians overlook this because they're attracted to intuitionist theories, where the notion of provability is more reified, whereas in classical theories every proposition is either true or false. They're bothered perhaps less by the ability to write 1 ∈ 2 and more by the idea that 1 ∈ 2 has a truth value. But while the notion of provability itself is not reified in classical logics, unprovable propositions are natural and common. 1 ∈ 2 has a meaning only in a very abstract sense; the theory can make that statement valid yet practically nonsensical by not offering axioms that can prove or disprove it. Things can be "undefined" in a precise way: the axioms do not allow you to come to any definition.

Indeed, this is exactly how the formal set theory in TLA+ is defined: https://pron.github.io/posts/tlaplus_part2
by ImPostingOnHN | 2025-11-24 17:03:52+00:00
Sunlight is the best disinfectant. I see one group of people shining it and another shading the first group.

Someone who wants to be seen as acting in good faith (and cryptography standards folks should want this), should be addressing the substance of what he said.

Consensus doesn't mean "majority rule", it requires good-faith resolutions (read: not merely responses like 'nuh-uh') to the voiced concerns.
by tayo42 | 2025-11-24 17:04:28+00:00
In a large organization their more efficient to run on VMS. You can colocate services that fit together on one machine.

And in reality no one sizes their machines correctly. They always do some handwavey thing like we need 4 cores, but maybe well burst and maybe there will be an outage so lets double it. Now all that utilization can be watched and you can take advantage of over subscription.
by lo_zamoyski | 2025-11-24 17:04:49+00:00
> it absolutely is used in sexual contexts in Latin, e.g. in Augustine's Confessions

How is it used, and are you referring to the original Latin, or a translation? Since seduction includes sexual seduction by virtue of its generality, he could have used the word to mean sexual seduction specifically. If the context is clear, you can omit the adjective. Given that Augustine does talk about his sexual decadence prior to his conversion, I can imagine him using the unqualified "seduce" to mean the specifically sexual, which would be apparent from context.
by BLKNSLVR | 2025-11-24 17:04:53+00:00
Is it safe to assume, then, that Google and Apple already have backdoors in their operating systems as likely requested by many governments around the world (not least of which the one from their home country)?

Or is GrapheneOS the only one built securely enough to need to be leaned upon?

Either way, makes Google and Apple look bad and/or incompetent and GrapheneOS look like some kind of beacon of user protection / privacy rights / other things that are the opposite of the direction the world seems to be moving.
by aw1621107 | 2025-11-24 17:04:53+00:00
> And since then we have an NSA employee co-authoring the paper which led to Heartbleed

I'm confused as to what "the paper which led to Heartbleed" means. A paper proposing/describing the heartbeat extension? A paper proposing its implementation in OpenSSL? A paper describing the bug/exploit? Something else?

And in addition to that, is there any connection between that author and the people who actually wrote the relevant (buggy) OpenSSL code? If the people who wrote the bug were entirely unrelated to the people authoring the paper then it's not clear to me why any blame should be placed on the paper authors.
by jamil7 | 2025-11-24 17:05:03+00:00
Yes, it's a leadership failure and probably time to go, it only gets worse. In my experience. It's a vicious cycle where, as velocity slows, inexperienced leadership gets more and more panicked and starts frantically rearranging projects, features and people in desperate attempts to fix the problem, obviously exacerbating the communication breakdown and gridlock further. It also builds resentment and can turn pretty toxic as everyone starts just looking out for themselves.
by pjmlp | 2025-11-24 17:05:28+00:00
Back when C++ was becoming famous, my favourite programming language was Object Pascal, in the form of Turbo Pascal, having been introduced to it via TP 5.5 OOP mini booklet.

Shortly thereafter Turbo Pascal 6 was released, and I got into Turbo Vision, followed by Turbo Pascal 1.5 for Windows 3.1, the year thereafter.

I was a big Borland fan, thus when you got the whole stuff it was Object Pascal/C++, naturally C was there just because all C++ vendors started as C vendors.

On Windows and OS/2 land, C++ IDEs shared a lot with Smalltalk and Xerox PARC ideas in developer experience, it wasn't the vi + command line + debuggers are for the weak kind of experience.

See Energize C++, as Lucid was pivoting away from Common Lisp, with Cadillac what we would call a LSP nowadays, where you could do incrementatl compilation on method level and hot reload

"Lucid Energize Demo VHS 1993"

https://www.youtube.com/watch?v=pQQTScuApWk

https://dreamsongs.com/Cadillac.html

Or the Visual Age for C++ version 4, which introduced a database, image like system for doing C++ in workflows similar to Smalltalk.

https://www.edm2.com/index.php/A_Review_of_VisualAge_C%2B%2B...

https://www.edm2.com/index.php/VisualAge_C%2B%2B_4.0_Review

Then there is C++ Builder, still going on, even though the way Borland went down spoiled its market mindshare,

https://www.embarcadero.com/products/cbuilder

You're right altougth C++ was born on UNIX at Bell Labs there is that point of view, and also a reason why I always had much more fun with C++ across Mac OS, OS/2, Windows, BeOS, and Symbian, with their full stack frameworks and IDE tooling.

However with time I moved into managed languages, application languages, where it is enough to make use of a couple of native libraries, if really required, which is where I still reach for C++.
by burninhell | 2025-11-24 17:05:32+00:00
I wish everyone here would read https://en.wikipedia.org/wiki/Capability-based_security and then realize that maybe, JUST MAYBE, THE PROGRAMMING LANGUAGES WE USE SHOULD NOT ALLOW IMPORTED PACKAGES TO ACCESS EVERYTHING, AND THEIR LACK OF SECURITY GUARANTEES AND ACCESS RESTRICTION MECHANISMS MAKES THEM DANGEROUS!

The number and range of affected devices may be reduced with any number of package manager level workarounds, but NOT the impact of attacks once any succeeds. For this, you NEED the above.
by crazygringo | 2025-11-24 17:05:46+00:00
> It should never be possible for someone to sign away their rights. If you can sign them away, you can be swindled of them.

What are you talking about? These aren't human rights we're talking about, it's copyright we're talking about.

Of course you should be able to sell your copyright to something. That's a major way you can make money, and a major way to get funding to create something in the first place. Every day you go to work and write code, you're selling your copyright to that code in exchange for your salary. You're saying you don't think that transaction should be legal...?

Yes you can be swindled. Guess what -- you can be swindled when selling a house or a car too, if you don't check the market rate and sell it for too little. Do your research, your due diligence, and if something looks like a swindle, then don't do it.