MurphyA/hacker-news huggingface dataset:
by mschuster91 | 2025-11-24 11:31:13+00:00
> The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a cambrian explosion of dependencies to be a very good idea security-wise. Ambivalent about Go: they have a semblance of packaging system, but nothing so reckless like allowing third-party tarballs uploaded in the cloud to effectively run code on the dev's machine.

The alternative that C/C++/Java end up with is that each and every project brings in their own Util, StringUtil, Helper or whatever class that acts as a "de-facto" standard library. I personally had the misfortune of having to deal with MySQL [1], Commons [2], Spring [3] and indirectly also ATG's [4] variants. One particularly unpleasant project I came across utilized all four of them, on top of the project's own "Utils" class that got copy-and-paste'd from the last project and extended for this project's needs.

And of course each of these Utils classes has their own semantics, their own methods, their own edge cases and, for the "organically grown" domestic class that barely had tests, bugs.

So it's either a billion "small gear" packages with dependency hell and supply chain issues, or it's an amalgamation of many many different "big gear" libraries that make updating them truly a hell on its own.

[1] https://jar-download.com/artifacts/mysql/mysql-connector-jav...

[2] https://commons.apache.org/proper/commons-lang/apidocs/org/a...

[3] https://docs.spring.io/spring-framework/docs/current/javadoc...

[4] https://docs.oracle.com/cd/E55783_02/Platform.11-2/apidoc/at...
by ovo101 | 2025-11-24 11:31:16+00:00
Outages like this highlight just how much of the internet’s resilience depends on a single provider. In a way, it’s a healthy reminder: if one company’s hiccup can take down half the web, maybe we’ve over‑centralized. A “good thing” only if it sparks more serious conversations about redundancy, multi‑provider strategies, and reducing monoculture risk. Otherwise, we’ll just keep repeating the same failure modes at larger scales.
by godelski | 2025-11-24 11:31:58+00:00
I think you're missing the historical context[0]. It came from "master-slave architecture" which has an older history. It's why we refer to a master copy of a photo or document too.

I really don't care if it's main or master tbh. But is anyone actually offended?

[0] https://en.wikipedia.org/wiki/Master%E2%80%93slave_(technolo...
by whatevermom2 | 2025-11-24 11:32:12+00:00
From what I understood, the CPUs are different and need work for them to be supported. There is no hard block, but sadly, two key people resigned from the Asahi Linux team. I am not even sure if there is someone even trying to work on this.

Another example is microphone support on M2 series that's not there yet.

Many issues with Asahi are also that there is an incompatibility in page sizes (16k on MX vs 4k on most CPUs), and combined with the usage of ARM, software compatibility is an actual problem if you want to use VMs, DAW software (nothing will work there except Reaper ...) (Maybe this paragraph was a bit ranty, but I'm actually very glad we got Asahi in the first place. It's my daily driver and I'm relatively happy with it)

TL;DR: no hard blocker but there is a people "problem"
by mschuster91 | 2025-11-24 11:33:40+00:00
> Nor does cargo or pip seem to be infected with these problems to the extent that npm is.

Easy reason. The target for malware injections is almost always cryptocurrency wallets and cloud credentials (again, mostly to mine cryptocurrencies). And the utter utter majority of stuff interacting with crypto and cloud, combined with a lot of inexperienced juniors who likely won't have the skill to spot they got compromised, is written in NodeJS.
by viraptor | 2025-11-24 11:34:09+00:00
It's not the packaging tech. Apt will typically mean a Debian-based distro. That means the packages are chosen by the maintainers and updated only during specific time periods and tested before release. Even if the underlying software gets owned and replaced, the distro package is very unlikely to be affected. (Unless someone spent months building trust, like xz)

But the basic takeover... no, it usually won't affect any Debian style distro package, due to the release process.
by scrapheap | 2025-11-24 11:34:13+00:00
That is the second year of a PhD - the first year you're distracted by your literature survey of the area you're interested in. The second year is where you're trying to dig out a little niche that you can work in and expand the knowledge of what's there. The third year is where you're supposed to be writing up, but in reality you're probably still working on building up enough new knowledge in the area to actually write up.

It's not uncommon to feel the way you are during the second and third years - my advice is to recognise how you're feeling and then work out how to push forward (which is what you've already started to do).

My advice for how you can compete with large research projects full of postdocs is, don't try to. You're not in competition with them, you are doing your own research. It might be in a tiny niche area, but it's your area and it's new knowledge.
Show HN: Ontology-driven knowledge graph extraction from text
by cybermaggedon | 2025-11-24 11:34:40+00:00
TrustGraph now supports automatic knowledge graph construction guided by OWL ontologies. You provide an ontology (OWL/Turtle format or build one in the Workbench editor), point it at your documents, and it extracts entities and relationships that conform to your schema.

The problem this solves: generic GraphRAG approaches extract whatever relationships an LLM thinks are relevant, which often misses domain-specific semantics. If you're working in healthcare, finance, or intelligence analysis, you likely already have ontologies (or can adapt standards like SOSA, FIBO, etc.) that define what matters. TrustGraph uses these to constrain extraction, so the resulting graph reflects your domain model rather than the LLM's interpretation.

How it works: The ontology defines classes and properties. During extraction, the LLM is prompted to identify instances of those classes and relationships matching those properties. The output is validated against the schema before being written to the graph store.

Built on Apache Pulsar for scalability, supports multiple graph backends (Memgraph, FalkorDB, others), and runs locally or in cloud. Apache 2.0 licensed.

Repo: https://github.com/trustgraph-ai/trustgraph

Ontology RAG docs: https://docs.trustgraph.ai/guides/ontology-rag/

Happy to answer questions about the extraction approach or architecture.
by yanhangyhy | 2025-11-24 11:35:44+00:00
> Europe knows all about reigniting pointless conflicts over ancient grudges

most of the conflicts today is created by Europe(+US). for example, the china-taiwan issue didn't resovled before is because USA Intervene. The tragedy of the Rwandan genocide originated from the artificial division of the same ethnic group during the colonial period; the India-Pakistan conflict was a deliberately left-over dispute by the colonial powers upon their withdrawal(UK); the border issues between Cambodia and Thailand(France), as well as the ongoing turmoil in the Palestinian region(UK USA), are all closely linked to historical interference by external forces(Europe).
by merobin_hood | 2025-11-24 11:35:48+00:00
Hey HN, I was building a multi-agent swarm and realized I was burning 90% of my latency and credits just having Agent A turn its math into English (JSON) so Agent B could turn it back into math. It felt like two supercomputers communicating via smoke signals. I thought, "Why not just send the hidden state?" I accidentally fell down a rabbit hole and built Nexus Protocol (open source). It’s a Python library that bridges the latent spaces of different models (e.g., Llama-3 to Mistral). How it works: Extracts the latent vector from the sender (skipping the decoding head). Passes it through a lightweight linear adapter (trained on semantic pairs) to align dimensions/spaces. Injects the result directly into the receiver's context embedding layer. The result: "Telepathy." The receiver "understands" the concept and acts on it without a single token being generated or read. It runs on consumer hardware using bitsandbytes 4-bit loading. It’s still early (proof-of-concept level), but the speedup is massive. I’d love for you guys to roast my implementation or tell me why this is a terrible idea. pip install nexus-protocol
by sambuccid | 2025-11-24 11:36:02+00:00
Platforms that have the useful stuff from social media without the addictive part already exist: Forums, micro-blogging, blogs, news aggregators, messaging apps, platforms for image portfolios, video sharing platforms.

And most of them have existed before the boom of social media, but they just don't get as huge because they are not addictive.

The useful part of a social media is so small that if you put it on it's own you don't get a famous app, you have something that people use for a small part of their day and otherwise carry on with their life.

A social media essentially leverages the huge and constant need that umans have to socialize, and claims that you can do it better and more through the platform instead of doing it in real life, and they do so by making sure that enough people in your social circle prioritise the platform over getting together in real life. And I believe this is also the main harmlful part of them, people not getting actual real social time with their peers and then struggling with mental health.
by Lio | 2025-11-24 11:36:10+00:00
Yeah they do. Even right now they're trying to take territory from the Philippines.

China just has a history of denying what they're doing as they're doing it.

There are so many examples online. My favourite is of a Chinese warship ramming into its own coast guard vessel as they fail to intimidate the Philippines Coast Guard.

https://www.bbc.co.uk/news/articles/cev22n0lm1xo
by kasey_junk | 2025-11-24 11:36:31+00:00
I visited a couple of West Virginia towns that _shocked_ me with the rampant and obvious drug addiction this summer. And I live in a big city (Chicago) that suffers from homelessness.

My take away from that experience is that we normalize the misery around us but seeing it, even in a nearly identical form, in another context is shocking.
by mikkupikku | 2025-11-24 11:36:41+00:00
Let's be real, it's not America's fault that the EU is dysfunctional in these regards. I'm sure that America does little to actually help, but the biggest problem the EU faces comes from their own internal corruption. Nothing gets done in Europe unless it can be restructured by their corrupt bureaucrats to pay all their friends and relatives, and the process of negotiating how to spread the graft around is highly political and takes many years. This is why the ESA is so dysfunctional despite Arianespace starting from a position of almost commercial launch market dominance at the end of the millennium. They're locked into Ariane 5 development even though it was obsolete on arrival and it will probably take them 20 years to negotiate the corrupt deals that will allow them to design and build something new. This cultural and political dysfunction in European society is entirely the fault of Europeans. India will send people to space before Europe.
by noduerme | 2025-11-24 11:37:10+00:00
Unification, in this case, means surrendering all rights to privacy, all rights to free expression, everything.

The fact that you wouldn't fight being occupied and forced to be a slave doesn't speak highly of you, but I must admit it's an honest statement, and it's true that a lot of people might feel the same way. A majority of people everywhere are cowards, collaborators and sycophants. But they're along for the ride.

Now, if your country is Burma, I don't blame you.
by gnfargbl | 2025-11-24 11:37:43+00:00
I'm a huge Go proponent but I don't know if I can see much about Go's module system which would really prevent supply-chain attacks in practice. The Go maintainers point [1] at the strong dependency pinning approach, the sumdb system and the module proxy as mitigations, and yes, those are good. However, I can't see what those features do to defend against an attack vector that we have certainly seen elsewhere: project gets compromised, releases a malicious version, and then everyone picks it up when they next run `go get -u ./...` without doing any further checking. Which I would say is the workflow for a good chunk of actual users.

The lack of package install hooks does feel somewhat effective, but what's really to stop an attacker putting their malicious code in `func init() {}`? Compromising a popular and important project in this way would likely be noticed pretty quickly. But compromising something widely-used but boring? I feel like attackers would get away with that for a period of time that could be weeks.

This isn't really a criticism of Go so much as an observation that depending on random strangers for code (and code updates) is fundamentally risky. Anyone got any good strategies for enforcing dependency cooldown?

[1] https://go.dev/blog/supply-chain
by numpad0 | 2025-11-24 11:37:44+00:00
The tech just isn't there; hand-held guns don't benefit from a computerized firing system at all. So any smart feature on human sized guns and less will be totally removable addons, and that completely defeats its purpose.

Many tanks and planes do have smart guns. Electronic firing control with additional software features that impede firing are beneficial and totally fine at that scale.
by ttoinou | 2025-11-24 11:38:11+00:00
“which remained unknown for 500 years since the inception”

Is wrong

But an easy way to define the complex plane is to postulate you want multiplication of vectors in polar form to multiply distance to origin and add angles. No mystery number squares going negative here, just simple and useful geometry !

There’s a whole book about it, Visual Complex Numbers by Tristan Needham. This author is the real boss of the game
by anonzzzies | 2025-11-24 11:38:53+00:00
With very bad results. I was walking a fab in China a few years ago: all machines are German, Japanese and Dutch. I asked why they don't have Chinese ones: the cto said they exist for the German and Japanese machines but they break much faster so it is not worth it and the asml machines are not there at all in any type of competitive form. It will happen, just not yet I guess.
by krageon | 2025-11-24 11:39:25+00:00
You are objectively wrong. Public transit scales the same way free and paid (i.e. based on demand). The cost for free countrywide public transport in a country with very high quality public transportation (so not the US) is about 8k per person, per year. This isn't some insurmountable amount of money - it's not even particularly costly when you compare it to what the infrastructure costs are for cars (mostly related to accident mitigation. Especially bad in the US).
by conartist6 | 2025-11-24 11:39:43+00:00
It's still just a platitude. Being somewhat critical is still giving some implicit trust. If you didn't give it any trust at all, you wouldn't use it at all! So they endorse trusting it is my read, exactly the opposite of what they appear to say!

It's funny how many official policies leave me thinking that it's a corporate cover-your-ass policy and if they really meant it they would have found a much stronger and plainer way to say it
by kibwen | 2025-11-24 11:39:48+00:00
> But the fact that at least on npm it was possible that someone else grabs a package ID after an author pulled its packages is kind of alarming.

Since your comment starts with commentary on crates.io, I'll note that this has never been possible crates.io.

> Dependency confusion attacks are still possible on cargo because the whole - vs _ as delimiter wasn’t settled in the beginning.

I don't think this has ever been true. AFAIK crates.io has always prevented registering two different crates whose names differ only in the use of dashes vs underscores.

> package namespaces

See https://github.com/rust-lang/rust/issues/122349

> proof of ownership

See https://github.com/rust-lang/rfcs/pull/3724 and https://blog.rust-lang.org/2025/07/11/crates-io-development-...
by benjojo12 | 2025-11-24 11:40:44+00:00
I believe it heavily depends on what kind of infrastructure you are using with them.

If you are on their old legacy network (aka, you have a RJ45 Ethernet jack into your house) you will likely going to have more issues than if you are on their (X)GPON network.

I had IPv6 working for a while on mine, but realize that for some insane reason that there was basically only one v6 prefix across my entire distribution switch (basically the switch shared with a few 100 other properties). so anytime that i was going to get a v6 i was effectively stealing it from another flat/house.

unfortunately trying to get in touch with anyone from Hyper-optic is really tricky, so I just gave up

they have since upgraded some of the infrastructure in the path, mostly moving away from Huawei to Nokia, but I am not entirely sure that has improved the situation.
by wongarsu | 2025-11-24 11:41:05+00:00
I wouldn't call the Rust stdlib "small". "Limited" I could agree with.

On the topics it does cover, Rust's stdlib offers a lot. At least on the same level as Python, at times surpassing it. But because the stdlib isn't versioned it stays away from everything that isn't considered "settled", especially in matters where the best interface isn't clear yet. So no http library, no date handling, no helpers for writing macros, etc.

You can absolutely write pretty substantial zero-dependency rust if you stay away from the network and async

Whether that's a good tradeoff is an open question. None of the options look really great
by notpachet | 2025-11-24 11:41:33+00:00
I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through. Not that there aren't problems with Node itself, but as many people have pointed out, there are plenty of organizations writing in Node that aren't pwn'd by these sorts of attacks because we don't blindly update deps.

Perfect is the enemy of good; dependency cooldown etc is enough to mitigate the majority of these risks.
by reconnecting | 2025-11-24 11:41:50+00:00
We chose to write our platform for product security analytics (1) with PHP, primarily because it still allows us to create a platform without bringing in over 100 dependencies just to render one page.

I know this is a controversial approach, but it still works well in our case.

"require": { "php": ">=8.0",

"ext-mbstring": "*", "bcosca/fatfree-core": "3.9.1", "phpmailer/phpmailer": "6.9.3", "ruler/ruler": "0.4.0", "matomo/device-detector": "6.4.7" }

1. https://github.com/tirrenotechnologies/tirreno
by ret2plt | 2025-11-24 11:42:12+00:00
PS: about the role in git: I don't feel that strongly about it, but I think master is somewhat more descriptive. The master branch contains the most up-to-date version of the source code, so e.g. if I'm working on a feature branch and a colleague pushes a bug fix that affects me into master, I need to merge/rebase to get the latest changes into my feature branch. So, while the master branch doesn't "rule" the feature branches, there is still the implication that changes to master should find there way into the feature branches at some point, which I think main doesn't convey that clearly.
by phrotoma | 2025-11-24 11:42:23+00:00
I am extremely Not A Database Person but I understand that the rationale for Kubernetes adopting etcd as its preferred data store was more about its distributed consistency features and less about query throughput. etcd is slower cause it's doing RAFT things and flushing stuff to disk.

Projects like kine allow K8s users to swap sqlite or postgres in place of etcd which (I assume, please correct me otherwise) would deliver better throughput since those backends don't need to perform consenus operations.

https://github.com/k3s-io/kine
by watty | 2025-11-24 11:42:32+00:00
I've never had a good experience with individual metrics leaderboards. On one team we had a JIRA story point tracker shown on a tv by a clueless exec. Devs did everything they could to game the system and tasks that required uncertainty (hard tasks) went undone. I believe it contributed to the cog culture that caused an exodus of developers.

However, I love the idea of an occasional team based leaderboard for an event. I've held bug and security hackathons with teams of 3-5 and have had no problem with them.
by ovo101 | 2025-11-24 11:42:34+00:00
The real problem isn’t just one ISP refusing to fix upstream infrastructure—it’s the structural monopoly that lets them get away with it. When customers have no alternatives, neglect becomes a rational business decision: why spend money on upgrades if churn is impossible? This is exactly why municipal broadband and community ISPs matter. They don’t just compete on price, they compete on accountability. Until regulators or local governments break the monopoly, we’ll keep seeing stories where “upstream” issues linger for years because the provider has no incentive to care.
by winstonwinston | 2025-11-24 11:44:18+00:00
I’ve had IPv4 CG-NAT on mobile LTE since ever and for a decade on residential cable in europe. Cloudflare is being lazy, Google too. I get served “Captacha’s” at least 10 times a day.

Even when i have IPv6 assigned, iOS and macOS seem to prefer A TXT RR and proceed just using IPv4 almost always. On LAN mDNS link-local IPv6 is always prefered.
by DrScientist | 2025-11-24 11:44:22+00:00
It's a classic worm or virus an economic agent? Goal is to acrue compute resources in order to survive and spread?

If you added the ability of the programme to acrue money, and the ability to spend that money to further the survival goal in an adaptive way. What could happen?

Would it do insider trading, market manipulation, drop shipping, click fraud, scamming or become a opinion for hire 'think tank'?
by chha | 2025-11-24 11:45:48+00:00
Been a while since I looked into this, but afaik Maven Central is run by Sonatype, which happens to be one of the major players for systems related to Supply Chain Security.

From what I remember (a few years old, things may have changed) they required devs to stage packages to a specific test env, packages were inspected not only for malware but also vulnerabilities before being released to the public.

NPM on the other hand... Write a package -> publish. Npm might scan for malware, they might do a few additional checks, but at least back when I looked into it nothing happened proactively.
by p2detar | 2025-11-24 11:46:07+00:00
Have a look at Fyne as well [0], which is a Go-only native UI toolkit.

0 - https://fyne.io

Other discussions: - https://news.ycombinator.com/item?id=31785556 - https://news.ycombinator.com/item?id=19478079 - https://news.ycombinator.com/item?id=22291150
by andy_ppp | 2025-11-24 11:46:51+00:00
Xiami have designed a 3nm chip, however I am not convinced SMIC have a process for them to build the chip at any scale yet. Let's see - eventually China will obviously have a process comparable to TSMC but I think currently they are at least 18 months behind. They were 5 years behind before the sanctions so they are catching up fast.
by mewpmewp2 | 2025-11-24 11:46:59+00:00
You are not really defining the runtime?

Is whatever what happens between e.g. HTTP Request and Input and Output not runtime then?

1. HTTP Input

2. While (true) runAgent() <- is that not runtime?

3. HTTP Output

Additionally Claude could be triggering itself with custom prompts etc to use instances of it concurrently in parallel.

Or are you saying that the only rule is that Agent is being ran in a loop?

But the whole discussion is about how AI Agent is different from a Workflow?

The point is that workflow is that LLM is triggered in a loop ?