MurphyA/hacker-news huggingface dataset:
by Cthulhu_ | 2025-11-24 12:48:14+00:00
Node is fine, the issue lies in its package model and culture:

* Many dependencies, so much you don't know (and stop caring) what is being used.

* Automatic and regular updates, new patch versions for minor changes, and a generally accepted best practice of staying up to date on the latest versions of things, due to trauma from old security breaches or big migrations after not updating for a while.

* No review, trust based self-publishing of packages and instant availability

* untransparent pre/postinstall scripts

The fix is both cultural and technological:

* Stop releasing for every fart; once a week is enough, only exception being critical security reasons.

* Stop updating immediately whenever there's an update; once a week is enough.

* Review your updates

* Pay for a package repository that actually reviews changes before making them widely available. Actually I think the organization between NPM should set that up, there's trillion dollar companies using the Node ecosystem who would be willing and able to pay for some security guarantees.
by throwaway0352 | 2025-11-24 12:50:19+00:00
I think you’re viewing the issue from an office worker’s perspective. For us, downtime might just mean heading to the coffee machine and taking a break.

But if a restaurant loses access to its POS system (which has happened), or you’re unable to purchase a train ticket, the consequences are very real. Outages like these have tangible impacts on everyday life. That’s why there’s definitely room for competitors who can offer reliable backup strategies to keep services running.
by Cthulhu_ | 2025-11-24 12:50:31+00:00
We did a bug hunt once at a previous employer, just stop regular work, open the website, and look for issues. We found over a hundred in a day. Stopping your regular work and actively work with your product is a healthy practice. Facebook did (does?) do a thing where once a week they'd throttle the internet so everyone had to experience what things are like for their average users.
by vorticalbox | 2025-11-24 12:50:31+00:00
the issue is not that devs don't know what they are its that they don't pin packages

if you run `npm i ramda` it will set this to "ramda": "^0.32.0" (as of comment)

that ^ means install any version that is a feature or patch.

so when a package is released with malware they bump version 0.32.1 and everyone just installs it on next npm i.

pinning your deps "ramda": "0.32.0" completely removes the risk assuming the version you listed is not infected.

the trade off is you don't get new features/patches without manually changing the version bump.
by throw0101a | 2025-11-24 12:50:46+00:00
> I read an old study that claimed driving a mile cost society 20 cents and cycling a mile had 20 cents of societal benefits.

"The Social Cost of Automobility, Cycling and Walking in the European Union":

* https://www.sciencedirect.com/science/article/abs/pii/S09218...

* https://doi.org/10.1016/j.ecolecon.2018.12.016

* Via: https://medium.com/strava-metro/whats-the-cost-of-choosing-t...
by woodruffw | 2025-11-24 12:50:50+00:00
Given that less than half of NYC residents are born in NYC, the null hypothesis would be that the average homeless person is also born outside of the city[1].

(Maybe this demographic skews more towards natives in the case of homeless addicts, but I can’t find a statistic to support that.)

[1]: https://popfactfinder.planning.nyc.gov/explorer/cities/New%2...
by ants_everywhere | 2025-11-24 12:51:36+00:00
D. J. Bernstein is very well respected and for very good reason. And I don't have firsthand knowledge of the background here, but the blog posts about the incident have been written in a kind of weird voice that make me feel like I'm reading about the US Government suppressing evidence of Bigfoot or something.

Stuff like this

> Wow, look at that: "due process".... Could it possibly be that the people writing the law were thinking through how standardization processes could be abused?"

is both accusing the other party of bad faith and also heavily using sarcasm, which is a sort of performative bad faith.

Sarcasm can be really effective when used well. But when a post is dripping with sarcasm and accusing others of bad faith it comes off as hiding a weak position behind contempt. I don't know if this is just how DJB writes, or if he's adopting this voice because he thinks it's what the internet wants to see right now.

Personally, I would prefer a style where he says only what he means without irony and expresses his feelings directly. If showing contempt is essential to the piece, then the Linus Torvalds style of explicit theatrical contempt is probably preferable, at least to me.

I understand others may feel differently. The style just gives me crackpot vibes and that may color reception of the blog posts to people who don't know DJT's reputation.
by nagisa | 2025-11-24 12:51:44+00:00
I would say that npm likely has easier solutions here compared to Cargo.

Well before the npm attacks were a thing, we within the Rust project, have discussed a lot of using wasm sandboxing for build-time code execution (and also precompiled wasm for procedural macros, but that's its own thing.) However the way build scripts are used in the Rust ecosystem makes it quite difficult enforce sandbox while also enabling packages to build foreign code (C, C++ invoke make, cmake, etc.) The sandbox could still expose methods to e.g. "run the C compiler" to the build scripts, but once that's done they have an arbitrary access to a very non-trivial piece of code running in a privileged environment.

Whereas for Javascript rarely does a package invoke anything but other javascript code during the build time. Introduce a stringent sandbox for that code (kinda deno style perhaps?) and a large majority of the packages are suddenly safe by default.
by mschuster91 | 2025-11-24 12:52:21+00:00
> I think the Macbook does some more advanced beamforming stuff to filter out sound coming from other directions.

It does, and that also gave the Asahi Linux team some serious headache when trying to get the microphones working on the ARM MacBooks - the team involved in that had to delve deep into DSP black magic to get usable sound working out of the three microphones [1].

[1] https://news.ycombinator.com/item?id=43461701
by lan321 | 2025-11-24 12:52:35+00:00
This sounds incorrect. You didn't find it but you're gaining domain knowledge and excluding options, hopefully narrowing down the cause. It's not like you're just chucking random garbage at Jenkins.

Of course, if it's a difficult bug and you can just say 'fuck it' and bury it in the backlog forever that's fine, but in my experience the very complex ones don't get discovered or worked on at all unless it's absolutely critical or a customer complains.
by freespirt | 2025-11-24 12:52:48+00:00
That's worth celebrating. Not because these programmes solve everything, but because they solve something real for people who desperately need solutions. And they do it whilst preserving what matters most: the ability to choose lettuce for a salad, to smile whilst announcing dinner plans, to remain independent in one's own home for as long as possible.

In that wheelbarrow journey from doorstep to mobile market and back again lies a small but genuine triumph of human ingenuity and compassion.
by ChrisMarshallNY | 2025-11-24 12:52:57+00:00
More than some places. Every place I've worked, has been a place where you estimate at your own peril. Even when the manager says "Don't worry. I won't hold you to it. Just give me a ballpark.", you are screwed.

I used to work for a Japanese company. When we'd have review meetings, each manager would have a small notebook on the table, in front of them.

Whenever a date was mentioned, they'd quickly write something down.

Those dates were never forgotten.
by jgalt212 | 2025-11-24 12:52:57+00:00
> Copyright is a very weak tool for protecting creators' interests, because copyright only gives us something to bargain with, without giving us any bargaining power,

This is drivel written by someone who doesn't understand the mechanism of supply and demand. If you don't like the price, don't sell. If you don't like the terms, propose alternative ones. The real risk to creators is artificially suppressed demand through industry consolidation, not nuances to copyright law.
by mschuster91 | 2025-11-24 12:53:06+00:00
> It hits different when it's the senior expert that everyone revere's that invented everything the company depends on that does it, vs a summer intern vs Elon Musk bought your company (Twitter). Hate the man for doing it messily and ungraciously, but you can't argue with the fact that it gets results.

You can only say with a straight face that if you're not the one responsible to clean up after Musk or whatever CTO sharted across the chess board.

C-levels love the "shut it down and wait until someone cries up" method because it gives easy results on some arbitrary KPI metric without exposing them to the actual fallout. In the worst case the loss is catastrophic, requiring weeks worth of ad-hoc emergency mode cleanup across multiple teams - say, some thing in finance depends on that server doing a report at the end of the year and the C-level exec's decision was made in January... but by that time, if you're in real bad luck, the physical hardware got sold off and the backup retention has expired. But when someone tries to blame the C-level exec, said C-level exec will defend themselves with "we gave X months of advance warning AND 10 months after the fact no one had complained".
by lalitmaganti | 2025-11-24 12:53:38+00:00
Author here! Really glad to have sparked a lively discussion in the comments. Since there is so many threads since I last looked at this post, making one top level comment to provide some thoughts:

1) I agree that estimating a bug's complexity upfront is an error prone process. This is exactly why I say in the post that we encourage everyone to "feel out" non trivial issues and if it feels like the scope is expanding too much (after a few hours of investigation), to just pick something else after writing up their findings on the bug.

2) I use the word "bug" to refer to more traditional bugs ("X is wrong in product") but also feature requests ("I wish X feature worked differently"). This is just a companyism that maybe I should have called out in the post!

3) There's definitely a risk the fixit week turns into just "let's wait to fix bugs until that week". This is why our fixits are especially for small bugs which won't be fixed otherwise - it's not a replacement for technical hygiene (i.e. refactoring code, removing dead code, improving abstractions) nor a replacement for fixing big/important issues in a timely manner.
by panick21_ | 2025-11-24 12:53:59+00:00
Yes, the scientific methods suggest that 99.9% of all systems and almost all of the very best highest performing systems have fares. 'Light rail' in the US are barley even transportation systems. At best they are property value plays by cities. Running a single line in a city full of cars isn't really interesting data.

And in other places they had light year that gets paid that had effects that were much the same.

Once you are talking about an actual working transportation system and not the occasional line here and there. Where it is actually real then there is a clear scientific question. Lets assume 500M to operate the system:

Should you A: Invest 500M in service improvements every year

Should you B: Invest 500M in giving away free transport

And the science on this is perfectly clear.
by halayli | 2025-11-24 12:54:12+00:00
This is not a good idea. You're venturing in the unspecified/non-portable behavior territory.

https://pubs.opengroup.org/onlinepubs/7908799/xsh/brk.html

> The behaviour of brk() and sbrk() is unspecified if an application also uses any other memory functions (such as malloc(), mmap(), free()). Other functions may use these other memory functions silently.
by lotsofpulp | 2025-11-24 12:54:17+00:00
> then they don't need to buy as much new content to satisfy their customers, and total spending on content will go down.

Why would they have customers in the first place if all they offer is reruns, which everyone else also offers? Streaming only old content will be a very, very low profit margin business.

> Nobody is picking Spotify over Apple Music or Youtube Music due to exclusives, because there are none; so putting the content into the public domain is hardly going to change things.

Creating and streaming audio is not a comparable business to creating and streaming video, due to the vastly different sums of money, and hence risk, involved.

But, also, people have to pick only Spotify/Apple/Amazon/Alphabet and a couple others because of excess copyright terms. All the old hits people want are controlled by Universal, Sony, and Warner, and so if your audio streaming business does not contract with those 3, then you’re dead in the water. Which means every audio streaming business, and hence every audio streaming customer, is always paying rent to those 3 businesses that own copyrights.

That means there is less money available for new audio creators. And this holds true for all rent seeking. If it weren’t for excessive copyright, there could be much more variety in audio streaming.
by naishoya | 2025-11-24 12:54:25+00:00
We may be entering into a new zero trust model for software development; one which for every necessary functionality the safer path includes 'roll your own' and building suites without externalizing the long term support of these functions to third parties.

It's a scary thought, and very much requires intense effort to build reliability from the ground up. In-house, on-premesis and private models will require significant investment (not just infra but also real design and engineering skill-sets) to move away from the 'build it fast and break things' approach.

The days of much work being done by junior programmers in a constant burnout, replace them at-will, lay-off whenever possible mindset which seems to have been the drive behind NPM and the java(script) world for the last several decades may be winding down. Layoff trends in commercial software appear to show ownership's perspective that historic workloads can now be accomplished by a few remaining programmers and an LLM budget.

Using 'Chat-Oriented Programming' (Steve Yegge's term), if done with an effective approach to technical and operational debt, may enable software development teams to absorb the extensive private function library burden. It may be that the potential n-times productivity available through codegen LLM is necessary leverage to provide a supportable silo of in-house functions, and the 'public repository' approach becomes only safe in an environment with isolation between trusted and untrusted-and-thus-disposable instances of features/functions/applications.

These conditions may again require fully staffed development shoppes. Lets hope the reversal happens before the current talent pool is lost to whatever work they find, or before they learn to farm sustainably and lose the desire to sit at a terminal all day.

On thing is certain; we are experiencing some truly interesting history.
by throw0101a | 2025-11-24 12:54:41+00:00
> Charging more for publicity transit during peak hours won’t make people use it less, there’s a reason why so many people commute during peak hours

You don't necessarily need all people to use it during peak hours, just "enough" people. There are people who do have flexible schedules, but they may simply may not have had enough motivation to change old habits (yet).
by rock_artist | 2025-11-24 12:54:41+00:00
Using C++ daily, whenever I do js/ts are some javascript variant, since I don't use it daily, and update becomes a very complex task. frameworks and deps change APIs very frequently.

It's also very confusing (and I think those attack vectors benefit exactly from that), since you have a dependency but the dep itself dependent on another dep version.

Building basic CapacitorJS / Svelte app as an example, results many deps.

It might be a newbie question, but, Is there any solution or workflow where you don't end up with this dependency hell?
by serf | 2025-11-24 12:54:54+00:00
>Buying things takes infinitely less time than building things from scratch.

> financial suicide.

man i'm sick of exaggeration.

anyway , generally speaking I don't try to hyperoptimize for producing cash. I'm not a machine. I appreciate security more than I do squeezing the last penny out of someone. I'm frugal, and it works out okay for me because the time I dont save by not paying people is spent doing things I already enjoy.

what's the point here? why would you bother with producing your own business instead of buying one? It takes infinite time or something -- I don't know, I didn't pay attention in econ.

I don't know if it matters, or if you'll ever see things this way, but value isn't cash. similarly, but not exactly : cash isn't value. Some of us prefer to produce value over cash -- and that confuses the hell out of some people.
by qart | 2025-11-24 12:55:27+00:00
I have had my hearing tested at an audiologist. My hearing curves are identical with air conduction and bone conduction. There are very few cases where bone conduction might be better, like when something is obstructing air conduction. But with most people, bone conduction headphones will not help. I have been a regular user of Shokz for around 4 years now. They have other advantages (and disadvantages).
by atwrk | 2025-11-24 12:55:41+00:00
This is about international relations. You won't get any insight into it if you reduce any point you don't like to argumentative metaphors.

Even within the framework of (structural) realism so popular in contemporary US politics there's this well-known problem that the buildup of defense capabilities of party A looks like aggression to party B - and vice versa. See the seminal work Perception and Misperception in International Politics. Or the relations of Britain and Germany before WW1 and WW2.

The FP article I mentioned, "Trump’s Trade War May Make Elite Young Chinese More Nationalistic" [1], illustrates the argument. You have actual empirical data, changing over time, after exposure to the "treatment". So at least a hint of causality.

[1] https://foreignpolicy.com/2025/05/21/trump-tariffs-china-tra...
by jurgemaister | 2025-11-24 12:55:45+00:00
I dropped my Oticon Opn1 for Airpods Pro. I have moderate to severe hearing loss on one ear and struggle with conversations in noisy environments.

The Airpods are perfect for lowering the background noise and elevating the speech.

And since I use them anyway for music and podcasts, I don't have to remove my aid to listen to music and vice versa.
by phantasmish | 2025-11-24 12:55:52+00:00
It’s something I keep meaning to play. My wife got a decent headset for free through work about three or four years ago, and after we both played a collective 15 minutes of Beat Saber it’s been gathering dust on the top shelf of a closet ever since. We used to play tons of DDR and Wii Sports so we like moving-around games but the thing just didn’t interest either of us, at all.

Alyx just hasn’t been quite enough motivation for me to take on the project of figuring out how to get it hooked up and working, though I did at one point do the few minutes of googling to confirm it might work (I think it’s one of those Facebook ones, and as I recall it is supposed to work for Alyx but I’ll need some cable or other). Especially since it’s a fairly short side-story, it’s just not enough juice to be worth the squeeze.

The conclusion of the series (until it’s not the conclusion any more—yeah, I know how franchises work, lol) though? That’d do it.

If I already had it out and used it regularly I’m sure I’d have played Alyx by now, but with that being the only thing I have any interest in doing with it, just not enough to get me to set the thing up for that alone.
by zamadatix | 2025-11-24 12:55:54+00:00
Not that I doubt examples exist (I've yet to be at a large place with 0 failures on responding to such issues over the years), but it'd be nice if you'd share the specific examples you have in mind if you're going to bother commenting about it. It helps people understand how much is a systemic problem to be interested in vs having a comment which more easily falls into many other buckets instead. I'd try to build trust off the user profile as well, but it proclaims you're shadowbanned for two different reasons - despite me seeing your comment.

One related topic I've seen brought up is Workers abuse https://www.fortra.com/blog/cloudflare-pages-workers-domains..., but that goes against this claim they do nothing when reported.
by amiga386 | 2025-11-24 12:56:31+00:00
Static scanning won't help. You can write this["eval"]() instead of eval(), therefore you can write this["e" + "v" + "a" + "l"](), and you can substitute (!![]+[])[!+[]+!+[]+!+[]] for "e", (![]+[])[+!+[]] for "a" (and so on: https://jsfuck.com/)

In this Turing-equivalent world, you can only know what actually executes (e.g. eval, fetch) by actually executing all code in the package and then see what functions got executed. Then the problem is the same as virus analysis; the virus can be written to only act under certain conditions, it will probe (e.g. look at what intepreter fingerprints, get the time of day, try to look at innocuous places in filesystem or network, measure network connection times, etc), so that it can determine it is in a VM being scanned, and go dormant for that time.

So the only thing that actually works is if node and other JS evaluators have a perfect sandbox, where nothing in a module is allowed (no network, no filesystem) except to explicit locations declared in the module's manifest, and this is perfectly tracked by the language, so if the module hands back a function for some other code to run, that function doesn't inherit the other code's network/fs access permissions. This means that, if a location is not declared, the code can't get to it at scanning time nor install time nor any time in the future.

This still leaves open the door for things like a module defining GetGoogleAnalyticsURL(params) that occasionally returns "https://badsite.com/copyandredirect?ga=...", to get some other module to eventually make a credential-exfiltrating network call, even if it's banned from making it directly or indirectly...
by fsniper | 2025-11-24 12:56:40+00:00
With so many hearing aid users around, this may be the perfect time for me to ask what it is like to wear one, and how it improves dayly life.

I have some hearing loss (suppose moderate) only in my left ear. As this is only on single one I think I am coping enough with the right for now. With regular "ha , sorry, what?" moments.

In your experience should I be investing in one immediately or trying my best with current coping situation for now?
by biophysboy | 2025-11-24 12:57:10+00:00
I “blame” it only in the sense that it’s part of the negative cash flow, even if it has its own dedicated pool of cash. I don’t use the term “entitlement” pejoratively.

But I am not a “panic about the deficit” guy. There’s a lot of trivial things we could do: rethink fee for service, negotiate more w/ providers, raise taxes, etc
by panick21_ | 2025-11-24 12:58:10+00:00
That ignores the massive amount of parking and highway subsidies that make the car-first model in the US viable at all. The absurd amount of space given away for free (or below value) in the city to support cars is actually insane. Its just not properly account for.

In a sane world you would either not have any public parking spots, or parking spots that cost so much that about 10-20% of them are empty, and you would have a road use tax (like Singapore).

And American transit systems are uniquely bad at fare recovery because they are just uniquely bad at everything.