MurphyA/hacker-news huggingface dataset:
Show HN: OpenBotAuth – Open-Source Web Bot Auth with Social Registry
by gauravguitara | 2025-11-20 16:10:03+00:00
We're building an open source implementation for Web Bot Auth, which is an IETF draft for signed agent authentication over HTTP, without CDN lock-in.

We've built a social registry, using Github login, where you can host your Signature Agent card/JWKS over a dedicated link. This saves you buying a domain and self-hosting your card. Please try it out : https://openbotauth.org/login

We've also built a Wordpress plugin, which works in signed and unsigned mode. Unsigned mode gives you a preview and Signed mode gives you all access. Websites can point their origin server to our registry or use other registries to block unverified traffic.

Demo: https://www.youtube.com/watch?v=8W5tScru5Us Docs: https://docs.openbotauth.org

The next step is to build the delegation as discussed here: https://thibmeu.github.io/http-message-signatures-directory/...

We'd love your feedback on our social registry and how we can improve it. :)
by WesolyKubeczek | 2025-11-20 16:10:15+00:00
I dunno, but torrenting sites gladly use networks that use malicious redirects, especially on mobile. I also saw ads specifically for gambling companies that were known bad actors, at least to me, given what people were behind them. Won't give you examples, it was years ago. It was like that, you go to a site to get your Linux ISOs, and it's plastered in certain company's ads. Wham, in a month you get investigative articles about that very company's owners and who they are tied to.

It's also of note that on Facebook I don't get many online casino ads, I get mostly reMarkable ads, there was one from Roli when they launched their new instrument, and others were mostly advertising stuff to me that I already bought elsewhere. I think it might be because I had banned the first dozen of such ads, and they stopped coming.
by swatcoder | 2025-11-20 16:10:35+00:00
The incentive for commercial providers to apply watermarks is so that they can safely route and classify generated content when it gets piped back in as training or reference data from the wild. That it's something that some users want is mostly secondary, although it is something they can earn some social credit for by advertising.

You're right that there will existed generated content without these watermarks, but you can bet that all the commercial providers burning $$$$ on state of the art models will gradually coalesce around some means of widespread by-default/non-optional watermarking for content they let the public generate so that they can all avoid drowning in their own filth.
by hansent | 2025-11-20 16:10:42+00:00
p50 latency on roboflow serverless api is 300~400ms roundtrip for sam3 image with text prompt.

You can get an easy to use api endpoint by creating a workflow in roboflow with just the sam3 block in it (and hook up an input parameter to forward prompt to the model), which is then available as an HTTP endpoint. You can use the sam3 template and remove the visualization block if you need just json response for a bit faster latency and smaller payload.

Internally we are getting to run approx ~200ms http roundtrip, but our user facing API currently has some additional latency because we have to proxy a bit to hit a different cluster where we have more GPU capacity for this model allocated than we can currently get on GCP.
by Enk1du | 2025-11-20 16:10:50+00:00
Not mentioned is that there are _many_ BBC's which became clear when watching the difference in coverage between the local and national broadcasts during Covid. The national editorial team spared the government's blushes at every turn, whereas the local teams reported what was actually happening in their communities, to the point where you were getting more real news from a smaller, underfunded news service.

They each have their own agendas.
by smilliken | 2025-11-20 16:11:02+00:00
Practically speaking, it's impossible to roll 6 one hundred times in a row on fair dice. Not technically impossible, but we each get to calibrate our skepticism based on how far out the probabilities are.

In this case we can be sure the dice aren't fair because there's significant motivation for them not to be, or at least it's easy to imagine a manufacturing defect in the dice.
by zelphirkalt | 2025-11-20 16:11:22+00:00
This is why am glad to live in a country with comparatively good employee protections. In other countries, where people can be fired at will, this might be more problematic. But at least in this country, it would be a very clear cut case, if your employer asks you to do something illegal, that they will not be able to legally fire you. Of course you might have to go to court to get your right.
by einpoklum | 2025-11-20 16:11:27+00:00
I actually find it is pretty easy to get confused between the different kinds of versions. For example:

"The CUDA "driver version" looks like the CUDA runtime version - so what's the difference?" https://stackoverflow.com/q/40589814/1593077

or consider the version you get when you run nvidia-smi, versus the version you get when you run nvcc --version. Those are very different numbers...

The compatibility between different versions of the driver and the toolkit is also a cause for some headaches in my experience.
by pavel_lishin | 2025-11-20 16:11:40+00:00
"This guys is an asshole" is pretty clearly a subjective opinion I hold about a person, one that others might disagree with.

"That diver is a pedophile" is pretty clearly a factual statement, implying that the person abuses kids, or has been convicted of such. (I know that, uh, the original statement was basically just an insult, but: it does posit a fact.)
by elsjaako | 2025-11-20 16:11:44+00:00
Yes, but to make it worthwhile you need a lot of data and the price scales linearly.

Let's say my phone gets $10 cheaper because of all this crap ware. If you have the aggregate of 1000 people that cost someone $10000. Is that really worth it? Is 100000 people worth $1000000? Is there some point at which the aggregate data becomes so valuable it overtakes the per-user cost?

That's what I mean - the marginal value of one person needs to be quite big for this whole thing to make sense.
by Someone | 2025-11-20 16:12:39+00:00
> which is essentially just copying files to the new directory and then deleting the previous directory if the copy was successful

And deleting the partially copied data if the copy wasn’t successful, and making sure “just copying files to the new directory” didn’t overwrite data, and probably a few more tricky scenarios, e.g. ones involving access rights.

Also, if you think it could be a directory rename, there are tricky corners there, too. How do you determine whether source and target are on the same disk, for example?

It _is_ possible, but doing it robustly is far from trivial.
by iLemming | 2025-11-20 16:12:43+00:00
> you're not very good at computers.

Yup, I guess I am not. Been coding for over 20 years, went through over a dozen different PLs and only Python - the best fucking friend who doesn't sugar coat it, tells you without stuttering - "you suck at this, buddy"

# PEP 9001: Constructive Computing Feedback ## Abstract This PEP proposes a standardized error message for situations where Python interpreters shall inform the user of insufficient computational competence. ## Specification When a user attempts to execute Python code that supposedly should work but it doesn't, the interpreter shall emit: You're suck at computers
by epolanski | 2025-11-20 16:13:23+00:00
Few things.

1. We really have no realistic threat on our borders. Russia can't even cope with Ukraine alone in conventional warfare. Who do we have to defend from? And there are way bigger militaries than Ukraine in EU alone, let alone as a coalition, such as Poland.

2. Would like to remind you that article 5 has only been invoked by US and we lost many lives on something that wasn't even relevant to us, let alone the other wars in africa or central asia that we joined. So far, it's been Italian and Polish blood falling to comply with our North American ally, it hasn't been the opposite case for decades.

3. I think the European commission is simply corrupted, and when it comes to this data stuff, please notice how many dozens times Thorn and Palantir and many other US security companies have lobbied EU commission members, and those are just the registered meetings, you don't need to record phone calls or out-of-office encounters:

https://transparency-register.europa.eu/search-register-or-u...

I'm quite convinced Ursula von Der Leyen is corrupt and is selling out Europe and keeps engaging in anti European policies.

4. EU would be fine, if it was able to pursue a coherent foreign policy. Instead you have 20+ countries where the occasional Hungary can veto anything. It should be given more power on many fronts. We shouldn't have 20+ privacy agencies, 20+ ways to register a company, 20+ different legislations on this and that.

5. There are politicians with the right vision, such as Macron, but most politicians have to live election by election, so it's very hard to pursue long term strategies. To be fair though, US is showing the same symptoms with one executive undoing what the previous has done from a bit.
by latexr | 2025-11-20 16:13:28+00:00
> What do you think of this movie idea?

I think a movie is putting the cart before the horse. What you have is a rough outline. Can you make it into an interesting short story first?

> UBI

The point of UBI is to be a guaranteed minimal (enough to cover basic needs) independent income; you are allowed and encouraged to earn more if you want. If you can’t earn more because robots are doing everything, it doesn’t make sense to have UBI because it doesn’t make sense to need money.

> People no longer work for survival, but they still carry emotional patterns from the old era: test anxiety, fear of being fired, pressure to constantly achieve, guilt about resting.

Unless the change just happened (which is unrealistic, it would need to be gradual), most would have adjusted. An alternative take is to have people depressed because they no longer have a sense of purpose, are bored, have no idea what to do, are questioning their own existence…

> medication that eases fear of death and even fear of whatever might come after death.

> That becomes the breaking point.

Why? It’s not like human doctors wouldn’t prescribe those too.

> A cultural backlash erupts.

That should’ve started way back, with the precursors to Androids therapists acting horribly and having people kill themselves. Like today.

> by the belief that AI is crossing into the final protected territory of human experience.

Death? People have an uprising because Androids are attempting to remove the fear of death with medication? I don’t buy it. Those pills would be best sellers.

> trying to understand how helping humans heal could lead to war.

War? Who exactly are they fighting against?
by devsda | 2025-11-20 16:13:44+00:00
> that does mean the app is more risky since it's not monitored by Google.

Why is Google the arbitrator of risk here ?

As a user I'm capable of assessing the risk directly or indirectly by delegating that responsibility to another store or another program a.k.a anti-virus programs, its my choice in the end.

I want Google to build software like Windows Defender and allow others to build similar software. I want the ability to chose my security provider or not have one. I don't want Google to play nanny.
by vunderba | 2025-11-20 16:13:45+00:00
I'd be curious about how well the inline verification works - an easy example is to have it generate a 9-pointed star, a classic example that many SOTA models have difficulties with.

In the past, I've deliberately stuck a Vision-language model in a REPL with a loop running against generative models to try to have it verify/try again because of this exact issue.

EDIT: Just tested it in Gemini - it either didn't use a VLM to actually look at the finished image or the VLM itself failed.

Output:

I have finished cross-referencing the image against the user's specific requests. The primary focus was on confirming that the number of points on the star precisely matched the requested nine. I observed a clear visual representation of a gold-colored star with the exact point count that the user specified, confirming a complete and precise match.

Result:

Bog standard star with *TEN POINTS*.
by NohatCoder | 2025-11-20 16:13:56+00:00
TL;DR:

Defendants Roy and Rianne Schestowitz were the targets of online harassment. They decided that claimant Matthew Garrett was behind it, and initiated their own hate campaign against him, in particular using their websites www.techrights.org and news.tuxmachines.org to do so.

The defendants did a very poor job of going to court, even by the standards of amateurs representing themselves, producing almost no evidence, none of which the judge found to be relevant.

Damages of £70K were awarded.
by Hussell | 2025-11-20 16:13:56+00:00
The maximum IQ score anyone can get depends on the total number of people who have taken IQ tests so far. Even if every single person alive today took an IQ test (which is absurd in itself), the maximum IQ achievable would be between 190-197. In practice, I'd guess the maximum is somewhere between 170 and 185 (millions to tens of millions of IQ test results which were recorded).

Even then, you need special tests to distinguish between anyone with IQ higher than about 160 - all those people get the same (perfect) score on regular IQ tests.

So: claiming to have an IQ of 276? Bullshit. The guy whose parents claimed he scored 210 on an IQ test? Also bullshit. To get 210, there would have to have been ~500 billion IQ test results recorded.
by jeroenhd | 2025-11-20 16:14:35+00:00
The paragraphs under "truth defence" do seem to indicate that there was some kind of proof shown to the judge (https://caselaw.nationalarchives.gov.uk/ewhc/kb/2025/3063#pa...) though it's not directly posted there.

The entire situation is an awful mess. I don't really understand why TR/TM didn't have a solicitor in this case. The moment they showed up without legal representation, they pretty much lost the case. I can only guess at their reasons, but two counter suits failing probably cost them a decent chunk of change that would leave anyone short on cash.
by HiroProtagonist | 2025-11-20 16:14:35+00:00
The story you’re recalling is “Just Deserts,” a short story by M. T. Anderson. It appears in The Chronicles of Harris Burdick (2011), an anthology edited by Chris Van Allsburg where various authors wrote tales to match Van Allsburg’s mysterious illustrations. In “Just Deserts,” a lone child is raised in a simulated town after an apocalyptic event (implied nuclear war). He attends “school” and interacts with other children via screens, only to discover – in a scene involving a hollow pumpkin – that his parents and classmates are all artificial constructs created to keep him company. This twist reveals he is the last real child on Earth. The story was first published in The Chronicles of Harris Burdick (Houghton Mifflin, 2011).
by palmotea | 2025-11-20 16:14:50+00:00
> Scientists Reveal How The Maya Predicted Eclipses For Centuries

It sounds like scientists actually revealed how to read a table of predictions in a document:

> Juteson and Lowry reject the long-standing assumption that the table was reset at its final position (that is, that it was intended to be used on a continuous loop, returning to month 1 after reaching month 405).

> The trouble is, using the table in this way doesn't actually work.

> ...Instead, they propose that a new table is begun in the 358th month of the current table. With this approach, the table's predictions are only about 2 hours and 20 minutes early for both Sun and Moon alignment.
Show HN: Rapid-rs – Zero-config web framework for Rust
by ashish_sharda | 2025-11-20 16:15:00+00:00
I built rapid-rs to eliminate the hours of boilerplate when starting a new Rust web service.

One command gets you: - Auto-configured DB, logging, CORS - OpenAPI/Swagger UI at /docs - Request validation - Production-ready observability

Built on Axum. Early benchmarks show ~50K req/s with 10-20MB RAM.

This is v0.1 - feedback welcome!

Crates: https://crates.io/crates/rapid-rs
by leejoramo | 2025-11-20 16:15:22+00:00
My all time favorite laptop was the 1994 Apple PowerBook DUO 280 with active greyscale screen. These screens actually looked the best in direct sunlight with no backlighting

The battery life was listed as 2-4 hours. Normally it was under 3 hours. However, with no backlighting and booting a stripped down Mac OS and apps off a RAM disk, I could get close to 6 hours in BBedit or WriteNow. I would spin up the HD to save data and turn it off again.

https://everymac.com/systems/apple/powerbook_duo/specs/mac_p...
by neilv | 2025-11-20 16:15:54+00:00
> This assumes that the students are untrustworthy and the faculty/institution are ultimately trusted.

True. This proposal requires expecting and requiring the faculty to have integrity.

And you really need the college/university as a whole to commit to this, not just isolated professors, partly so that there can be no confusion by students.

(Some battle-scarred faculty and grad students could tell speak of entire departments that need to be shut down completely, because the administration and faculty are too far gone. I think you could never do this with one of those departments. You'd only get posturing, and the same arrogant and underhanded behaviors as before, and students would briefly be a little confused, but quickly realize that the old sketchy game-playing is still fully on.)
by v3lmx | 2025-11-20 16:15:55+00:00
hi, I don't use debian based linux so I can't test this, but I had some nits for the website: 1. I would specify the OS dependencies (apt and systemd), and 2. I would display the actual script under the install command to make it easier to review what's going on (faster that clicking the small github link and then opening the relevant file)
by andrepd | 2025-11-20 16:16:02+00:00
Lord on high help me. When on earth did I say that??

I open any video unrelated to politics and I have shoved down my throat a rant about immigrants or about how everyone is corrupt except $far_right_guy, or clips of a "debate" that shows them "DEMOLISHING THE COMMUNIST ATHEIST LEFT", cropping all the opponent's responses.

Curiously I'm never shown any video from the boring centre party talking about the execution of the budget for 2022-2026 (yawn), or the left wing parties talking about labour law for shift workers (yawn), sensible cycling infrastructure to decrease automobile congestion (yawn), or tax incentives to ameliorate the teacher shortage in certain regions (yaaaaaaawn), despite the fact that those parties have a comparable or much greater voting base, publish videos at the same rate, etc.

I don't think even the most obtuse person can deny, in the year 2025, that algorithmic social media and its relentless peddling of whatever it deems "most engaging" is not a problem.
by runjake | 2025-11-20 16:16:03+00:00
Minor but important correction: The BSSID is almost never the AP MAC address.

The BSSID is unique per SSID, per AP. The BSSID is usually derived (usually by incrementing the last octet) from the AP MAC address, however.

So an AP MAC might be 77:99:44:EE:C4:11.

It has a wireless network called "Bob's SSID". It will have a BSSID of something like 77:99:44:EE:C4:12.

Then, the AP may be broadcasting another called "Mary's SSID", and it will have a BSSID of something like 77:99:44:EE:C4:13.

Edit: More not-well-written info on BSSIDs: https://en.wikipedia.org/wiki/Service_set_(802.11_network)

Looks like the BSSID is derived from the AP serial number by some vendors. Never seen that myself.
by ux266478 | 2025-11-20 16:16:04+00:00
I'm wondering how a $4T company got away with shipping the absolute state of the toolchain to begin with. They have total and complete sovereignty on everything on the outside of the OS and PCIe boundaries with a bottomless pool of top class labor. There's no reason it has to be cruftier or more fragile than any other low latency networked computation... and yet here we are. AMD isn't any better. I'm almost interested to see if Intel has done any better with L0, but I highly suspect it suffers from the exact same ecosystem hell problems that plague the other two.

The idea that getting a PCIe FPGA board to crunch numbers is less headache prone than a GPU is laughable, but that's the absurd reality we live in.
by mortarion | 2025-11-20 16:16:11+00:00
No one needs to deduplicate over a longer period than a few minutes, or a single session. If you need that, then you're doing something shady. If a user visits your site, clicks a few things, leaves and comes back two hours later, you don't need know if it's the same person or not. The goal of analytics is to see how people in general use your website, not how an individual person use your website.

So just take IP address, browser details, your domain name, and a random ID you stick in a 30 minute session cookie. Hash it together. Now you have token valid for 30 minutes you can use for deduplication but no way of tying it back to particular user (after 30 minutes). And yes, if the user changes browser preferences, then they will get a new hash, but who cares?

Not rocket science.
by idoubtit | 2025-11-20 16:16:27+00:00
Adding new functions and alternative syntax has a long-term cost for PHP and the projects that use the language. I don't see much value in the new features of PHP5 announced on https://www.php.net/releases/8.5/en.php

- URI extension: there was already the internal `parse_url()` which was imperfect, and alternative libraries that were RFC 3986 compliant. An official extension will bring speed, but now there will be 2 official ways to parse URLs.

- The pipe operator is a matter of taste. In the release notes, the new code is more verbose, because it defines anonymous functions. This alternative syntax means keeping a consistent code style will be harder.

- The update of "clone" replaces 2 lines of code in some cases. Unless I misunderstood, it's a very minor change.

- The #Discard/void will replace the similar feature from static analyzers.

- Closures in constants is one of the 2 features that bring more than an alternative syntax. It's one more little step toward a preprocessor. But I'm not thrilled about the future #attributes assigned with complex closures.

- cURL persistent handles are a real performance feature, because curl_init() is costly.

- array_first() is a minor syntax-sugar. In a project of 100k+ lines of PHP, I probably could use it twice or thrice. Was it worth a global function?
by erikerikson | 2025-11-20 16:17:09+00:00
If I could choose for myself and family, I'd suggest something more like 120, maybe 125. More IQ is frequently worse for well being. The benefits from correlations with positive factors get overwhelmed by emergent negative factors. Consider the stupid statement many smart people make "people are so stupid" (when in fact they are normal and the smart person is saying that they are on the upper end of the distribution). It reflects a fact of aloneness; a lack of peers; exclusion from socially controlled circles of success; endlessly watching struggle and underperformance; being stuck in a world that is dysfunctional because making it more functional is "too hard" for others; unlocking "because you're smart you have to do it for them"; and so many more little tortures and asynchronous social bullshit.
by Macha | 2025-11-20 16:17:23+00:00
From the complaint, the claim seems to be that he used to use different names on IRC 10 years ago, which they claimed showed he used suckpuppets regularly, that once a netsplit disconnected him and a sockpuppet, and that a harasser had a similar writing style. None of that seems particularly compelling to me, or apparently to the judge