MurphyA/hacker-news huggingface dataset:
by dtech | 2025-11-01 08:21:23+00:00
There's an extremely large difference in that a JSON deserialization vulnerability is almost always a bug in the library. JSON is not an inherently insecure format.

XML is so complex that a 100% bug-free compliant library is inherently insecure, and the vulnerability is a "user is holding it wrong" siutation, they should have disabled specific XML features etc. That means XML is an inherently much more insecure format.

There's a reason there's name for vulnerabilities like XML External Entity (XXE) injection [1] and they're named after XML, and not "bug in lib/software X". JSON and most other data formats don't have that.

[1] https://portswigger.net/web-security/xxe
by PhilipRoman | 2025-11-01 08:21:46+00:00
I believe refresh rate/FPS is one of those things where it doesn't really matter but human eyes get spoiled by the higher standard, making it hard to go back. I never saw issues with 30 FPS until going to 60, etc. Hopefully I never get a glimpse of 120 or 144Hz, which would require me to throw out all existing devices.
by zyphera | 2025-11-01 08:22:21+00:00
Hey everyone

I’m Clinton, the creator of this Dynamic Portfolio System.

I built it to help students, freelancers, and creatives easily showcase their work online without needing to code.

You can add, edit, or delete your projects and skills anytime. Each user gets a personal admin dashboard to manage their portfolio. There’s a one-time unlock fee of 999 KES for lifetime access (no subscriptions).

I’d really appreciate your feedback — especially on: - The user experience (is it simple enough?) - The pricing - What features you’d like to see next (maybe custom domains or analytics?)

You can try it here: https://portfolio-frontend-clinton.onrender.com/register

Thanks for checking it out
by businessmate | 2025-11-01 08:22:40+00:00
AI assistants already influence brand consideration, product recommendations, and narrative formation. Many enterprise teams now monitor assistant outputs through visibility dashboards. That is healthy. Observation is always the first phase.

A second phase has now begun. Visibility data enters planning cycles, messaging reviews, and executive briefings. Once information reaches governance surfaces, the requirement shifts from monitoring to verification. Senior leaders must ensure that signals shaping decisions are supported by evidence rather than untested volatility.
by rhdunn | 2025-11-01 08:22:44+00:00
It's used a lot in the publishing industry, which stores the content in JATS and other similar XML markup. It's also used by the US government for bills, etc.

Typically, these use XSLT on the backend to transform the content to HTML to be sent to the web browser.

And there's RSS which was mentioned in the previous discussions. Podcasts will typically have HTML renderings of that data, but if you opened the RSS in a web browser you could use XSLT to provide a user-friendly view of the content.

XSLT can also be used to provide fallback rendering for unsupported content, such as converting MathML to HTML for browsers without support. -- Chrome as of 109 supports MathML Core, but doesn't support the content markup (used for more semantic markup of common constructs like N-ary sum, integrals, etc.), so would still need something like XSLT to convert that markup to the presentation markup supported by Chrome.
by gofreddygo | 2025-11-01 08:23:00+00:00
1. dont ask for advice. observe.

2. dont be what others want you to be. be what you want to be.

3. stay away from anything that can kill you or make you poor. especially those that work slowly.

4. backups are a good idea, almost everywhere in life.

5. No doesn't always mean no. Yes doesn't always mean yes. People change. Things change.

6. worst kind of failure is when you try and don't know why you failed. every failure teaches you, learn to learn.

7. copy first. be original second.

8. praise, dont flatter.

9. take risks early. before 35.

10. make someone happy.
by mwhudson | 2025-11-01 08:23:28+00:00
> Could this be used to address the pesky armel vs. armel+hardfloat vs. armhf issue

No, because those are different ABIs (and a debian architecture is really an ABI)

> the issue of i486 vs. i586 vs. i686 vs. the many varieties of MMX and SSE extensions for 32-bit?

It could be used for this but it's about 15 years too late to care surely?

> (There is some older text in the Debian Wiki https://wiki.debian.org/ArchitectureVariants but it's not clear if it's directly related to this effort)

Yeah that is a previous version of the same design. I need to get back to talking to Debian folks about this.
by whacked_new | 2025-11-01 08:24:47+00:00
Comparing nix style (hash head, package tail), and spack style (package head hash tail), and speaking from my own limited experience, the need arises in different cases, which also depends on the ease of tooling,

sometimes I'm grepping in /nix/store and you have (as shown earlier) a list of derivation paths like this

$ ls /nix/store | grep nodejs-2 | head | sed 's/^/ /'

0a9kkw6mh0f80jfq1nf9767hvg5gr71k-nodejs-22.18.0.drv 0pmximcv91ilgxcf9n11mmxivcwrczaa-nodejs-22.14.0-source.drv 0zzxnv3kap4r4c401micrsr3nrhf87pa-nodejs-20.18.1-fish-completions.drv 2a7y7d38x8kwa8hdj6p93izvrcl9bfga-nodejs-22.11.0-source.drv 2gcjb0dibjw8c1pp45593ykjqzq5sknm-nodejs-20.18.1-source.drv

and thus as designed, your eyes ignore the block of hashes and you see the "nodejs-..." stuff

You might ask why are you grepping? Because it's fast and familiar and I don't know the native tooling as easily (possibly a UX problem).

Then in spack (see https://spack.readthedocs.io/en/latest/package_fundamentals....) they have

$ spack find --paths

==> 74 installed packages. -- linux-debian7-x86_64 / gcc@4.4.7 -------------------------------- ImageMagick@6.8.9-10 ~/spack/opt/linux-debian7-x86_64/gcc@4.4.7/ImageMagick@6.8.9-10-4df950dd adept-utils@1.0 ~/spack/opt/linux-debian7-x86_64/gcc@4.4.7/adept-utils@1.0-5adef8da atk@2.14.0 ~/spack/opt/linux-debian7-x86_64/gcc@4.4.7/atk@2.14.0-3d09ac09

and

$ spack find --format "{name}-{version}-{hash}"

autoconf-2.69-icynozk7ti6h4ezzgonqe6jgw5f3ulx4 automake-1.16.1-o5v3tc77kesgonxjbmeqlwfmb5qzj7zy bzip2-1.0.6-syohzw57v2jfag5du2x4bowziw3m5p67 bzip2-1.0.8-zjny4jwfyvzbx6vii3uuekoxmtu6eyuj cmake-3.15.1-7cf6onn52gywnddbmgp7qkil4hdoxpcb

you get the package name immediately from the left, which is nice, and you can pipe that straight to `sort`, but where the hash starts is more jagged on the right so there's a bit more noise when you're looking at the numbers. In the end the information is identical and it's a UX difference.

Tradeoffs wise I think they both made the right choice. Because for nix, the packages are almost always in /nix/store, so the path length including the hash is almost always the same.

For spack you can place your packages anywhere so the base directories can be highly variable, and so it's sensible to have the package names immediately after the package directory.

Or, I'm just trying to rationalize the choices each designer made post-hoc. But after using both I appreciate the design considerations that went in. In the end, humans are inefficient. When I make name / version / hash identifiers in my own applications I end up using one or the either design.
by Flow | 2025-11-01 08:25:50+00:00
I started a SvelteKit project last year.

The compiler and preprocessors are very picky about accessibility issues like these.

It was annoying in the beginning, but I tried to follow the rules it set out. It feels very professional, and I’m thankful for the guidance.

What’s annoying now is when my coworkers thinks I’m making things unnecessarily complicated by trying to follow these rules and guidelines. A <div> with an onclick is so easy compared to a <button> with extra styling and sometimes calling preventDefault().
by TeMPOraL | 2025-11-01 08:26:07+00:00
YOLOable systems are built out of flexible pieces. That's why Excel "abuse" is a constant theme in enterprise :).

We should not be thinking about architecture at the business process level. This is just repeating the mistake that needs to be avoided here. This is, and will ever be, a pile of ad-hoc hacks. They're not meant to add up to a well-designed system in a bottom-up fashion, because there is no system to design. The structure we naturally seek, is constantly in flux.

The right architectural/design decisions to make here is to make it possible to assemble quick hacks out of robust parts that fulfill additional needs the people on the ground may not consider - logs/audit trail/telemetry, consistency for ergonomic reasons, error handling, efficient compute usage, tracking provenance, information access restrictions dictated by legal obligations, etc.

The most important change needed is in the mindset. Internal dev needs to stop thinking of itself as the most important part of the company, or as a well-defined team that should own products. To be useful, the opposite is needed - such devs need to basically become ChatGPT that works: always be there to rapidly respond to requests to tweak some software by people on the ground, and then to retweak is as needed. They need to do this work rapidly, without judgement, and never assume they know better.

Only then people will stop weaving ad-hoc Excel sheets into business-critical processes.
by bartread | 2025-11-01 08:26:46+00:00
Not a new idea. For years now, on the occasions I’ve needed to scrape, I’ve used a set of ViolentMonkey scripts. I’ve even considered creating an extension, but have never really needed it enough to do the extra work.

But this is why lots of sites implement captchas and other mechanisms to detect, frustrate, or trap automated activity - because plenty of bots run in browsers too.
by anon10484810573 | 2025-11-01 08:28:15+00:00
This mindset really baffles me. Just because it is not illegal doesn't mean one should do it. And for anything truly innovative there are bound to be gaps in the current law.

It's pretty obvious that there is an asymmetry in benefit between those creating the models and those creating the content. If that doesn't bother you consider the fact that this currently undermines the economic and social model for open content creation on the internet.

What happens when the content significantly decreases?

Should those who create content not have some say in how their content is used?
by LightBug1 | 2025-11-01 08:28:53+00:00
Israel is so detested, that the first thing I think of when I see the uptick in reporting on Sudan is that Israel knows it's reputational house is on fire, and now Sudan is being pushed as an alternative crisis to divert attention from their own horrendous, genocidal actions.

And low and behold, this article is from the Times of Israel ...

Where have the media been for the last how many months and years? ... Sudan isn't a new story but suddenly it's being pushed...
by mwhudson | 2025-11-01 08:29:36+00:00
No it's not using hwcaps. That would only allow optimization of code in shared libraries, would be irritating to implement in a way that didn't require touching each package that includes shared libraries and would (depending on details) waste a bunch of space on every users system. I think hwcaps would only make sense for a small number of shared libraries if at all, not a system wide thing.
by alephnerd | 2025-11-01 08:30:19+00:00
For our portfolio companies, we are fine paying for quality instead of quantity.

Giving a Rs 60-80 lakh TC offer in BLR or HYD makes it easier to identify and hire good talent, and ik peer security firms (private and public) that are product first are offering similar TC offers in BLR, HYD, and NCR.

On top of that, there has been a reverse brain drain going on since the COVID layoffs in early 2020, so if we want to poach good talent that returned to India from the US, we need to be able to offer Western salaries, otherwise they'd either decide to help their former employer open a GCC or they'd start their own startup.

Realistically, I'd say a $35k-60k TC offer gets you the 50 to 75th percentile in talent in much of India for security, but most product-first companies tend to hire for quality not quantity, and depending on size of FDI and the state, a company can get a $10k-20k per head subsidy which makes it easier to offer higher salaries without impacting our bottom line.

That said, if you are being hired to be a SOC, a generic pentester, or a "detection engineer" you'd be lucky to break the $20k TC mark tbh, but the SOC-to-SWE or Pentester-to-SWE conversions have been our most successful ones because it's easier to build a product for security teams when your engineers were former security practitioners.

That said, the salary pressures for getting good talent in India is high simply because we're competing with Google, Microsoft, Citadel, Nvidia, etc for similar kind of talent within India.

Earning $70k-90k TC in Hyderabad or Bangalore is doable with 10 YoE if you have the right profile (the right jobs, work experience, track record, and luck). Heck, this is why companies like Zscaler have been hiring in Tier 1.5/2 cities like Pune or Chandigarh instead because you can get away with paying $35k-50k TCs for the kind of talent that would demand a $70k-90k TC in BLR or HYD.
by TheCapeGreek | 2025-11-01 08:30:31+00:00
> Anyway, this is why I play MTG online

I think this depends on how you interact with your chosen game. To me, I play Yugioh as a hobby. If I'm "only" into the digital versions of the game, then it's no different to playing just about any other video game.

And even then, these live service TCGs (outside of unofficial simulators) can often have the same lootbox/pack gambling aspects as the real thing.

Personally that's not what I want. A good chunk of why I play paper is because of the physical community, in a space outside my home.
by sagarm | 2025-11-01 08:30:50+00:00
Mostly white probably means rural. These are undesirable hospital jobs. There are incentives for doctors to work in underserved areas, like rural hospitals, and those incentives are disproportionately used by J1s.

I'd like to point out that this commenter assumed these doctors did not earn their positions purely based on skin color. I don't see how this is functionally different than classic racism. "DEI" complaints often seem to fit this fact pattern. In particular, I've never heard a white man described as a DEI hire.
by chrysoprace | 2025-11-01 08:31:03+00:00
As with anything, people tend to get excited about something new (new-er, anyway) and go a bit overboard. At some point we'll find the ones that actually stick around. I quite like .app and .dev now that the future of .io is dubious, but I do not like the price. A YouTuber, CodingGarden, nabbed null.computer which I personally think is excellent.
by BrenBarn | 2025-11-01 08:31:54+00:00
I think I'm taking a more broad reading of causality than you. A lubricant can cause something to move, if the thing was previously stuck. Causality is not just "the" force, it is the totality of contributing factors to the event. If a dam bursts, then the weight of the water above it, the weakness of the sluice gate (or whatever), and the unseasonably warm weather that induced bolts to expand can all be causes.

> Start with the little things. Start where you can. If you have the chance to make something better or hold someone to higher standards, try that. If you see someone else trying to, lend them a hand.

I'm increasingly convinced that this isn't even close to sufficient. I mean, not to say it shouldn't be done, but I don't think that doing that is going to turn the tide against people doing the wrong thing. There needs to be more deliberate and forceful action to actually stop people doing the wrong things, not just encourage people doing the right things.
by dnel | 2025-11-01 08:32:27+00:00
I recently picked up a Threadripper 3960x, 256GB DDR4 and RTX2080ti 11GB running Debian 13 and open web-ui w/ ollama.

It runs well, not much difference to Claude etc but still learning the ropes and how to get the best out of it and local llms in general. Having tonnes of memory is nice for switching out models in ollama quickly since everything stays in cache.

The GPU memory is the weak point though so I'm mostly using models up to 18b parameters that can fit in the vram.
by bartread | 2025-11-01 08:32:43+00:00
Very fair point, and that cuts to the root of why I’m uncomfortable with it.

I mean, presumably they have the usage stats… except that plenty of enterprises deployed XSLT apps back in the day - it was on a massive portion of the job ads I was looking at in 2000 to 2002 - and I’d bet a chunk of those legacy systems are still running. I’d also bet a good chunk of those systems are running in the sort of orgs that won’t allow submission of telemetry to Google, so Google’s usage stats underreport real world usage.

To me it looks like zero effort has been made to engage with Mozilla, Apple, etc., on the right way forward here - just Google high-handedly making moves and abusing their position as per usual.
by esperent | 2025-11-01 08:34:15+00:00
I signed up for a Claude Teams account last week. File uploads were not working anywhere - web, desktop, Android app. As soon as I switched over to a personal account they worked again. Switch back to Team account, broken again with just a cryptic 404 error popping up.

They were broken for a week, I found several people talking about it on Reddit. But no word from Anthropic, no status page info.

I opened a support request, there was no response until 3 or 4 days later when someone messaged to say that it was fixed, and a status page related to it magically appeared.
by AnthonyMouse | 2025-11-01 08:34:17+00:00
> No one else even bothered to make a list.

That doesn't make the biased list good.

> Citation needed

Are you not aware of what SafetyNet is? It's the thing where Google certifies that the phone is running the software produced for it by the OEM. The problem, of course, being that the OEM stops issuing updates and then the certified version has known vulnerabilities. Which is a lot of the point of wanting to install a newer ROM on such a device, except that then it won't pass SafetyNet because you replaced the vulnerable but certified code with third party code that has the patch but not the certification.
by CartwheelLinux | 2025-11-01 08:38:30+00:00
The language is tough love, and I think it's important despite what the first respondent has said.

Much of the language used seems to stem from nauseating interactions that have occured in kernel world around rust usage.

I'm not a big fan of rust for reasons that were not brought up during the kernel discussions, but I'm also not an opponent of moving forward. I don't quite understand the pushback against memory safe languages and defensiveness against adopting modern tooling/languages
by Brian_K_White | 2025-11-01 08:38:46+00:00
They don't really compete on quality even. Quality is high in some ways. Their soldermask is tougher. But for instance alignment between drill/copper/mask/outline accuracy is no better. And all the chinese fully route the board outline, you have no cleanup to do. oshpark leaves panel tabs at random places all around the board that you have to grind down yourself. A big deal if the pcb is a special shape to fit into something else. I have one that is under 1/2" square with a funky dog bone or T shape. Not only do they allow it, they route the whole outline. idk how they can even hold onto the board physically to do it.

oshpark puts panelization tabs right in the middle of a row of castellated edge contacts.

And they often take longer to ship to me in NJ than Elecrow, a shop that's even cheaper than jlc or pcbway, without even using DHL, just the cheapest shipping.

Never mind the lack of features. I have a board that needs 1.2mm pcb. Well on oshpark I guess I can make 0.8mm work. 3d print a filler plate or something. But what I really need is 1.2, and all the chinese shops have it, not even special extra cost, or maybe barely.

15 years ago oshpark was great.
by littlestymaar | 2025-11-01 08:39:05+00:00
> It's important for the project as whole to be able to > move forward and rely on modern tools and technologies > and not be held back by trying to shoehorn modern software > on retro computing devices.

Rust is the present and the future and it's quite logical that it becomes a key requirement in Linux distributions, but I'm really not convinced by the wording here… This last sentence feels needlessly antagonistic.
by AnthonyMouse | 2025-11-01 08:39:29+00:00
Microsoft was convicted of monopolizing the market for IBM-compatible PCs, i.e. not Macs.

Which makes a lot of sense, because you couldn't run Windows on a Mac nor MacOS on PCs from the likes of Dell or IBM, and you couldn't run third party software for Macs on Windows or vice versa. By contrast, you could run various types of Unix on a Dell, and run Windows software on OS/2 or DOS software on DOS competitors other than MS-DOS.

That distinction seems like it might be relevant to the current situation.
by aalhijawi | 2025-11-01 08:40:51+00:00
My article raises some very timely concerns about AI-enhanced browsers like OpenAI's Atlas and Copilot.

The shift from passive browsing to “digital agent” browsing means our browser is no longer just rendering web pages, it’s interpreting intent, acting on our behalf, and in doing so, opening up new attack surfaces (prompt injections, agent-mode abuse, persistent memory leaks).

What stands out:

Prompt injections can hide malicious instructions in otherwise normal text, images, or webpages, which an AI browser may blindly execute.

The browser is increasingly a single point of failure, with access to calendars, emails, documents, history—everything.

The illusion of intelligence often leads users to trust the AI too easily, diminishing human critical judgement.

The proposed four-layer mitigation strategy (Awareness, Security Integration, Data Control, Transparency) is practical and necessary if we want to keep innovation from outpacing safety.

If we’re going to hand over more control to AI-powered browsers, we must demand built-in AI safety mechanisms, not just convenience features.

What do the community think: are we ready for this next wave of browsers, or are we racing ahead of our security and privacy practices?
by iberator | 2025-11-01 08:40:53+00:00
I never programmed assembly before 2025. For some reason i started tinkering with emulated 6502 cpu (same as in apple 2) and its FUN. In matters of weeks I managed to develop my own cpu architecture b, opcodes, wrote VM and assembler for it.

Bare metal programming with those old CPUs is WAY easier than learning new web stack IMO.
by ordu | 2025-11-01 08:42:00+00:00
It is an asocial state of mind. We have locks and security systems that prevent people from stealing. But if all people agreed to not steal, then we could save that efforts for something better. The ideal approach doesn't work with the stealing, and now it doesn't work with HTTP either. It just raises costs for a society with no lasting benefit for anyone: site owners just figure out ways to restrict access and no more scraping of pages that they do not want to be scraped.

A healthy society relies on a cooperation between members. It relies on them accepting some rules that limits their behavior. Like we agreed not to kill others, and now I can go outside without weapons and anti-bullet defenses.