MurphyA/hacker-news huggingface dataset:
by nirui | 2025-11-24 10:55:36+00:00
The "final" or "canonical" argument can only indicates that the word "master" has multiple meanings, which is not a really special. Tho, "Master Degree" really means teaching, my bad.

> Just as teachers pass on knowledge to students, data is copied from the master.

In the Git context, the "canonical" way to use git is that you merge/copy data _from_ other branches, such as `wip` or `dev`, _back to_ `master` or `main`, not the other way around.

All and all, it's done, OK? Don't like it? Hey, you can still use "master", just customize it. But you'll probably piss some people if you do, and then you have to dig out your dictionary again and again. Choice wisely.
by latexr | 2025-11-24 10:55:58+00:00
> "Exploitation" isn't an objective term.

It means “the action or fact of treating someone unfairly in order to benefit from their work”. If you’re having someone reject their rights in a contract because that benefits you, that’s a form of exploitation. You’re making someone worse explicitly so you benefit.

> It often just means "I don't like what I signed up for freely".

From my first post:

> If you can sign them away, you can be swindled of them.

If you’re swindled, you’re not given them away freely.
by inglor_cz | 2025-11-24 10:56:04+00:00
Again, context matters and we are likely not talking in a "let us decide whom to invade" context.

BTW "Declaring your neighbor "politically unstable" and presenting yourself as its savior was the clearest way in the 20th Century to declare war without any casus belli" is not really true, sometimes this happened, but wars have been declared for all sorts of putative reasons, like "our particular minority is being oppressed" or "the neighbouring government plotted against the life of our sovereign" or "they are infidels, go get them".

Anyway I don't really see what you propose. Binning expressions because someone someday used them in bad faith, in the belief that this will stop future invasions from happening?

This seems to be somewhat futile to me. Invasions aren't fundamentally caused by words. Words only work as a cloak and one cloak can be easily substituted by another, and it will, depending on the current state of politics in the invader and invadee country.

Note that the Russians explained their invasion into Ukraine by calling them "fascists". Should the Western civilization drop the word forever because of that?
by sph | 2025-11-24 10:57:00+00:00
On that I agree. I run Fedora Atomic and I'm not switching to any other non-atomic distro ever again. Once you get used to the papercuts, the old model of overwriting system files and hoping for the best is antiquated to say the least. (And no, I don't care for NixOS, sorry)

I'm still wishing very hard for a serious and battle-tested Arch-based atomic distro, so I can chuck Fedora and its RPM packaging model into the flaming sun.
by timgl | 2025-11-24 10:57:08+00:00
co-founder of PostHog here. We were a victim of this attack. We had a bunch of packages published a couple of hours ago. The main packages/versions affected were:

- posthog-node 4.18.1, 5.13.3 and 5.11.3

- posthog-js 1.297.3

- posthog-react-native 4.11.1

- posthog-docusaurus 2.0.6

We've rotated keys and passwords, unpublished all affected packages and have pushed new versions, so make sure you're on the latest version of our SDKs.

We're still figuring out how this key got compromised, and we'll follow up with a post-mortem. We'll update status.posthog.com with more updates as well.
by lazide | 2025-11-24 10:57:10+00:00
In all (realistic) interplanetary space travel - not to mention interstellar - the difference between the largest bomb/death ray anyone has ever experienced and a better drive, is purely a matter of where you aim it and when/how you throttle it up.

The most hilarious part of the expanse for instance is how they didn’t really use their actual drives as weapons even in CQB, which is quite a waste!

Not actually that different for rockets now, frankly, we just usually don’t operate direct nuclear fission/fusion drives right now for this very reason and our own sense of self preservation.

There certainly are plans on the drawing board!

It would take 23 grams of antimatter to produce the effect of a 1 megaton nuclear bomb, and the biggest factor stopping someone is both production of the matter itself (improving) and actual shielding technology (magnetic bottles good enough to effectively trap that much antimatter are huge and extremely energy consuming right now - much bigger than a fusion bomb of equivalent power).

Theoretically, it should be possible to store that much in a thermos bottle, however. We just need better superconductor technology.
by LarsKrimi | 2025-11-24 10:57:56+00:00
For IDE you are mixing up 2 separate concepts. The addressing primary/secondary is purely addressing, I don't recall seeing "Master/Slave" in relation to that. Labeling on HDDs I've seen always used primary/secondary

Where the master terminology comes in is that a certain version of ATA added bus mastering DMA from the drive. Maybe some harddisks had a jumper to disable or enable that
by imtringued | 2025-11-24 10:58:08+00:00
It's honestly mind boggling how people react to this. Rust turns unknown failures in C and C++ into known failures and suddenly the C/C++ people start caring about the failures, but attribute the failure to the new language, even though the same failures are secretly lurking in their C/C++ code bases. It's kind of like trying to silence a whistleblower.

>Please read the whole article. If the unwrap hadn't caused an exit, the process would've run out of memory, leading to a much less deterministic behavior which is much harder to diagnose and fix. I always prefer an early exit with a clear error instead of getting killed by the OOM reaper.

I am running into an undiagnosable CUDA "illegal memory access" problem in vLLM, a code base that is a mix of python and CUDA (via pytorch). At a certain load something appears to either overflow or corrupt the memory and vLLM restarts, which takes a minute, because it has to reload several dozens of GBs into memory and then rerun the CUDA graph optimizations.

The pacemaker argument is complete nonsense, because the pacemaker must keep working even if it crashes. You can forcibly induce crashes into the pacemaker during testing and engineer it to restart fast enough that it hits its timing deadline anyway. Meanwhile a silent memory corruption could cause the pacemaker to enter an unknown state where the code that runs the pacemaker algorithm is overwritten and it simply stops working altogether. Having a known failure state is a thousand times more preferrable to an unknown number of unknown failure states. Critical sections (mutexes) and unsafe code has to be panic free (or at least panic safe) in Rust, so the concept of writing code without panics isn't exactly a niche concept in Rust. For every panic based feature, there is usually a panic free equivalent.
by alanbernstein | 2025-11-24 10:58:23+00:00
I have a lot of experience with openscad. I design a lot of small, simple-to-moderate parts. I want to use something like fusion instead, but the GUI learning curve is a huge blocker for me.

I'm not a CAD professional, I can't seem to find the time to watch hours of video to get the basics down. With code based CAD, the way to start is usually obvious. When I run into a blocker, I search online, find examples, and try them out. Then, crucially, I copy and paste code snippets into my design, and modify them, to solve my problem.

In a GUI cad tool, I find that I spend most of my time hunting for buttons in the UI, often finding UI layout discrepancies between my version and whatever video I found.

In code, I do have to repeatedly solve little trig or geometry problems, and I'm always aware that a constraint based GUI tool would eliminate that completely. But I always know that I can just spend five minutes with pencil and paper and get it done, whereas switching to fusion means adding an hour or more of work to multiple designs.

I really want to design more effectively, with better fillet flexibility. But for my simple tasks, the barrier to becoming productive in a GUI is just too high.

I believe the "command palette" in e.g. VS code solves this well, perhaps a GUI cad with that would be workable for me.

Maybe what would really help me, is a larger more complex project which I can develop over a longer time in fusion while I learn to use it. Too bad I don't have anything that naturally fits that bill.
by throwup238 | 2025-11-24 10:59:05+00:00
It takes half a day to implement proper hot reload in QtQuick, which also has all the reactive features. Even less now that AI can just write it for you, and it’ll be more performant than Vite dev builds.

Coming to desktop app development from the web, I’ve got most of the same conveniences I’m used to like GammaRay as the inspector. The only real difference is I’m willing to wade through cmake and linking errors.

Even QWidgets is still super fast to develop with if you’re using PySide (although hot reload is a bit more difficult to implement and distribution becomes the nightmare).
by Kelteseth | 2025-11-24 10:59:20+00:00
We are using it for our apps, but I can see why people do not use it for new projects:

1. The state of C++ is not great. Few developers, C++ footguns, complicated build systems, and generally slow progress, see my https://arewemodulesyet.org/

2. How Qt presents and licenses itself. Either you go LGPL or you have to pay big money for a commercial license, which will then infect all other apps as well. For example, when you have two Qt apps that talk to each other you must license _both_ commercially.

3. The split of Widgets and QML makes the ecosystem fragmented, because Widgets will never die. Even the Qt devs themselves are split about this. You can see this when example code for a new feature uses Widgets. QtCreator is also a nice example, where they reverted some new QML code quite a while ago and have not substantially added any new QML code since then.

4. Tooling: We use QML for everything and the tooling is not great. The language server is still super flaky and breaks, and developer tooling like the Chrome Dev Tools is virtually nonexistent.

5. Packaging is still also not great but has gotten better in the last few versions where Qt creates a deployment cmake script for you, but you still need logic for your own (vcpkg) packages.
by arghwhat | 2025-11-24 10:59:32+00:00
> When we profiled it, we found that the GC essentially gave up under load

Hmm, the Go GC is really quite capable, so I wonder what kind of pathological load it was being presented with. Even then, when the GC "fails" it means elevated CPU load from collection.

The main thing I can think of would be the application "leaking" by having unintentional references (or worse, actually leaking through cgo bindings), or trashing the allocator to cause temporary spikes in between cleanups.

However, while I don't think Go was actually to blame here, I would never use native UI bindings to a language that isn't 1:1 compatible with the original design and memory management principles, as such bindings get disproportionaly large and complex. It just sets you up for a bad time.
by metalman | 2025-11-24 10:59:36+00:00
Hey! that reminds me that the copy of the anarchists cook book that I previously liberated, had liberated from me, and now back in my possesion, giot me a vaugley worded warning from ebay, but that there are copy's for sale on abe books

but ya a bunch of people demonstrating against masked armed thugs abducting and killing people on the streets of america, are are afraid of paper. sounds about right.
by constantcrying | 2025-11-24 10:59:46+00:00
Exactly. For the past decades much of the world was entirely dependent on European products. This gave the EU and European countries enormous leverage in setting standards and enforcing their own regulations across the world. This is very clearly changing, in many areas European companies are depending on Chinese technology (e.g. EV batteries).

I am sure that some part of the EU establishment is aware of this, but the measure taken are practically laughable compared to the magnitude of the problem. At some future point in time dealing with the EU will just not be worth it, as competitive companies outside the EU, not weighed down by EU regulations, will fill the gaps and entering the EU market will be seen as too toxic.
by logicprog | 2025-11-24 10:59:58+00:00
For LLM scrapers, it doesn't even matter if LLMs would be able to understand the raw text or not because it's extremely easy to just strip junk unicode characters. It's literally a single regex, and, like, that kind of sanitization regex is something they should already be using, and that I'd use by default if I were writing one.
by sph | 2025-11-24 11:00:09+00:00
It's not "node" or "Javascript" the problem, it's this convenient packaging model.

This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself.

The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a cambrian explosion of dependencies to be a very good idea security-wise. Ambivalent about Go: they have a semblance of packaging system, but nothing so reckless like allowing third-party tarballs uploaded in the cloud to effectively run code on the dev's machine.
by dkdbejwi383 | 2025-11-24 11:00:12+00:00
Node itself is still fine and you can do a lot these days without needing tons of library. No need for axios when we have fetch, there's a built-in test runner and assertion library.

There are some things that kind of suck (working with time - will be fixed by the Temporal API eventually), but you can get a lot done without needing lots of dependencies.
by n4r9 | 2025-11-24 11:00:17+00:00
> I sincerely wonder if the people who live there agree ... I wonder if voluntary unification is on the table

One of the benefits of a free democratic society is that you can ask; and people vote according to their preferences. A recent study suggests ~13% of the public support unification with China: https://www.tpof.org/wp-content/uploads/2025/02/20250214-TPO... . Taiwan's politics are dominated by the KMT and DPP parties, both of which oppose unification.

> I sure as hell wouldn't put up much fight if china tried to invade my country

Perhaps you have an unusual opinion?
by inglor_cz | 2025-11-24 11:00:29+00:00
Now, but we're talking 2040, and the situation may look a lot different.

India has been doing some incredible things lately. They just electrified their entire rail network in some five years. That is actually impressive - you need a lot of qualified people and coordination for that.

If they keep up, they will become a strategic adversary of China in Indochina (see the name?) quite soon.
by Klaster_1 | 2025-11-24 11:00:29+00:00
Moved away from ST to VSCode a couple of years ago for similar reasons too.

Sublime Merge, though - I tried a couple of alternative solutions, but none of those felt like an improvement, so I still rely on it, but it has all the same drawbacks as ST, the most severe being glacial pace of changes (or total lack thereof). It's as if the dev team lacks capacity to deal with basic UX issues, year over year.
by TurboSkyline | 2025-11-24 11:01:11+00:00
I also think about this sometimes. On the one hand, I have a natural instinct to give away as little personal data as I can, and it intuitively makes sense to me that it’s in your favour to keep as much private as possible; I assume many of us here feel the same way. But on the other hand, it takes a lot of energy to keep track of all the data that you leak, and often you have to give up better tools or workflows for a small perceived privacy gain.

Does this matter? Even if I do everything “right”, nobody around me does it. I can try to keep my shopping preferences and my searches private, but there is so much to gather from everyone else who doesn’t care about this that my efforts are very likely in vain. Even without my cookies, if you have as much data as a big tracker does, you can definitely make pretty good assumptions about what I like.

The response I usually see to this is that if everybody cared about privacy, then the picture would be different. But I’ve been reading exactly the same argument about using Firefox for the last ~15 years, and look where the Firefox share of the market is now…
by vintagedave | 2025-11-24 11:02:02+00:00
The list of packages looks like these are not just tiny solo-person dependencies-of-dependencies. I see AsyncAPI and Zapier there. Am I right that this seems quite a significant event?

AsyncAPI is used as the example in the post. It says the Github repo was not affected, but NPM was.

What I don't understand from the article is how this happened. Were the credentials for each project leaked? Given the wide range of packages, was it a hack on npm? Or...?
by AmbroseBierce | 2025-11-24 11:02:31+00:00
Obviously the rescuers should have just used a stick and push them back until they are de-deformed by undergoing the reverse process, on a serious note I think the author should have gone further, one is that it should show a pregnant lady going into one of the holes, just to put that mental image in the readers, and second, it should have a bonus page where we are shown that the bodies melt into the ground once they make it out, and then when they seem like they are dead they make a strange sound until the rescuers conclude that are trying to say "kill me"
by burnt-resistor | 2025-11-24 11:02:36+00:00
Counterexample to give stark contrast, but in the field of aviation:

The Most DISTURBING Pilot I've Ever Investigated! https://youtu.be/DyY4AtpQLy8

https://en.wikipedia.org/wiki/Northwest_Airlink_Flight_5719

PSA: Please don't be like Marvin.
by beAbU | 2025-11-24 11:04:07+00:00
This is how it works on the Gautrain in Pretoria/Johannesburg in South Africa.

You scan when you enter the system, and you scan when you exit. Your fare is calculated based on where you enter and exit. If you stay in the system longer than some define period of time, you are automatically charged the maximum fare, regardless of where you got on and off.

You can either scan with a dedicated train fare card, your debit/credit card and also NFC mobile payment.

The buses linked to the train service and the parking uses the same payment system, so you get automatic discounted bus fares and parking fees if you actually use the train as well, but you can park and use the bus without taking the train.

It works quite well.
by sublinear | 2025-11-24 11:04:33+00:00
Not sure if you're serious, but if so I agree that people should take the time to set up their own package mirrors. Not just for npm but all other package managers as well.

This is why it's so important to get to know what you're actually building instead of just "vibing" all the time. Before all the AI slop of this decade we just called it being responsible.
by kace91 | 2025-11-24 11:04:40+00:00
Exactly.

I spent decades hoping for the ability to invoke those bursts. Days of unexplainable block until a deadline was really close, so the anxiety spike could trigger a few hours of focus. I then did the work of a week in an evening/night, and back to square one.

It REALLY wasn't fun continuously worrying that people will think I'm slacking off while an invisible barrier kept me from working.
by xnorswap | 2025-11-24 11:04:57+00:00
Did you reply to the wrong comment, I'm not sure it follows from what I posted?

You can't force a collision for the function f(x) = x, by definition it has no collisions. It's not just collision-resistant, it's actually collision proof!

hash(x) = x is of course not a cryptographic hash, but it also has the advantage that it's unlikely to be confused for one if anyone looks at the output.
by pjc50 | 2025-11-24 11:05:05+00:00
I'm no Raymond Chen, but sometimes I wish I'd kept notes on interesting bugs that I could take with me when I moved jobs. I've often been the go-to guy for weird shit that is happening that nobody else understands and requires cross-disciplinary insight.

Other favourites include "Microsoft Structured Exception Handling sometimes doesn't catch segfaults", and "any two of these network devices work together but all three combined freak out".
by noduerme | 2025-11-24 11:05:15+00:00
The cloak of words has always been needed, for some reason, to convince a population to make the sacrifices necessary to go to war.

Yes, there have been other spoken reasons for invading a peaceful sovereign country. This does not change the fact that Russia is the belligerent party against Ukraine, or that China is the belligerent against a completely harmless and peaceful Taiwan.

Taiwan's situation right now is very similar to Czechoslovakia's in 1938. There is no international treaty with teeth to protect it. There is every reason for China to create a rationale for invading it. The people there have a decent life and don't want to live under occupation. And the reasons for invasion look similar; taking over industrial capacity under the guise of saving people from their confused political state.
by darkamaul | 2025-11-24 11:05:26+00:00
The "use cooldown" [0] blog post looks particularly relevant today.

I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies.

[0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...
by sandruso | 2025-11-24 11:05:26+00:00
You can go very far with just node alone (accepts typescript without tsc, has testing framework,...). Include pg library that has no dependencies. Build a thin layer above node and you can have pretty stable setup. I got burnt so many times that I think it is simply impossible to build something that won't break within 3 months if you start including batteries.

When it comes to frontend, well I don't have answers yet.
by atwrk | 2025-11-24 11:05:45+00:00
Both points are not really true.

For the China part: Yes, the "by force" part certainly exists as a position, in competition to the peaceful unification approach. It's important to keep in mind, though, that the confrontative position of the first Trump administration and afterwards the Biden administration significantly helped the "by force" faction. There was an interesting piece in Foreign Policy about that, a social scientist from the US was questioning Chinese students at an elite university on this very topic and thus had the chance to do a time series observing the attitude change following US actions.

Secondly, in Taiwanese politics, Unification is actually a big topic and even has its own party, the New Party, advocating for it (plus the fringe CUPP). Not popular right now, but certainly existing - and evidently falsifying the notion that the all of "Taiwan doesn't want to be part of Beijing's China".
by dotancohen | 2025-11-24 11:05:49+00:00
Historically, arguments of "it's popular so that's why it's attacked" have not held up. Notable among them was addressing Windows desktop security vulnerabilities. As Linux and Mac machines became more popular, not to mention Android, the security vulnerabilities in those burgeoning platforms never manifested to the extent that they were in Windows. Nor does cargo or pip seem to be infected with these problems to the extent that npm is.