MurphyA/hacker-news huggingface dataset:
by acheong08 | 2025-11-02 23:07:17+00:00
A startup! Which is quite surprising to myself as a very risk adverse person. I'm currently in my final year of university and have been given permission to commercialize my dissertation/coursework.

The idea is quite simple: improve supply chain security by having a validated mirror of NPM, PyPI, Cargo, etc.

There's a lot of static and runtime behavioral analysis that can be done as a baseline but it will always be possible to bypass since it's a cat and mouse game. I'm therefore also looking into how tooling and maybe LLMs would be able to assist humans in reviews and allow better scaling.

Currently on the more academic stage of the project (research, talking to professors and connections in industry, etc.) to hopefully start off with a good design to iterate off of.

My reference for the project stems from what I saw in Huawei during my internship as they had quite a bureaucratic system to review dependencies and an internal "secure" mirror. The goal is to hopefully generalize it such that supply chain security is accessible to small/medium companies or even individuals.
by vindarel | 2025-11-02 23:07:24+00:00
Old Lisp posts are cool, then if you want a refresher of what's happening in the CL ecosystem (tools, libraries, compilers…) here's an overview of the last two years (shameless plug): https://lisp-journey.gitlab.io/blog/these-years-in-common-li... and very cool new projects appeared in 2025.
by pvankessel | 2025-11-02 23:07:49+00:00
I used MTurk heavily in its hey-day for data annotation - it was an invaluable tool for collecting training data for large-scale research projects, I honestly have to credit it with enabling most of my early career triumphs. We labeled and classified hundreds of thousands of tweets, Facebook posts, news articles, YouTube videos - you name it. Sure, there were bad actors who gave us fake data, but with the right qualifications and timing checks, and if you assigned multiple Turkers (3-5) to each task, you could get very reliable results with high inter-rater reliability that matched that of experts. Wisdom of the crowd, or the law of averages, I suppose. Paying a living wage also helped - the community always got extremely excited when our HITs dropped and was very engaged, I loved getting thank yous and insightful clarifying questions in our inbox. For most of this kind of work, I now use AI and get comparable results, but back in the day, MTurk was pure magic if you knew how to use it to its full potential. Truthfully I really miss it - hitting a button to launch 50k HITs and seeing the results slowly pour in overnight (and frantically spot-checking it to make sure you weren't setting $20k on fire) was about as much of a rush as you can get in the social science research world.
by avhception | 2025-11-02 23:08:05+00:00
I run FreeBSD in my homelab, too! One reason is the stellar ZFS support, but the simple fun of doing stuff differently is definitely a thing, too. And I like FreeBSD jails.

For me, the balance between all the overhead of the "cattle, not pets" approach and the manual way is the a README.md file for basic setup, and then having Ansible stand up the rest of the configuration. The host is configured as a Jail host, then individual services live inside the jails. Creating and configuring the jails is also done through Ansible. Overall, I really like the setup. I can individually SSH into each jail to allow easy debugging, I can snapshot the jails, and data lives on a special ZFS subvolume that I mount into each jail at "/bucket". This way, I can throw away the jail at any time, fire up Ansible, and have everything up and running again in no time.
by anthk | 2025-11-02 23:08:17+00:00
On conio.h under GNU/Linux or Unix, it might be mimicked with trivial functions and escape codes.

I did similar stuff with TCL and some at-xy lookalike from Forth or 'print at' from the old Basic.

And rewritting these Basic games into C, TCL or whatever it's really fun (and you can defnitively kill the spaghetti code):

https://github.com/GReaperEx/bcg

You can just run BW Basic for FreeDOS, but that's no challenge...
by davik20 | 2025-11-02 23:08:20+00:00
Beyond the conversational LLM, we've built:

(1) Investor persona engine maintaining consistent VC behavior across multi-turn conversations,

(2) Beyond conversation, we've built specialized analysis that evaluates pitch answers for clarity, specificity, confidence, and directness, identifying exact problems like "you avoided the metric question" or "your answer was too vague" with actionable improvement suggestions

(3) Conversation orchestration with stage-appropriate and vertical-specific questioning,

(4) Progress tracking showing measurable improvement trajectories

(5) Feedback systems trained
by sigseg1v | 2025-11-02 23:08:44+00:00
>You can't trust anything "will resolve in time period X"

As is, this statement just means you can't trust anything. You still need to choose a time period at some point.

My (pedantic) argument is that timestamps/dates/counters have a range based on the number of bits storage they consume and the tick resolution. These can be exceeded, and it's not reasonable for every piece of software in the chain to invent a new way to store time, or counters, etc.

I've seen a fair share of issues resulting from processes with uptime of over 1 year and some with uptime of 5 years. Of course the wisdom there is just "don't do that, you should restart for maintenance at some point anyway" which is true, but it still means we are living with a system that theoretically will break after a certain period of time, and we are sidestepping that by restarting the process for other purposes.
by moritzwarhier | 2025-11-02 23:10:08+00:00
Modern urban car infrastructure is neither space- nor energy-efficient, but urban planning is long-term, and decisions shift all efficiency considerations in the long-term in a way that's hard to undo.

For example, transportation of people with the modern extensive net of streets would be most convenient and efficient if there was some kind of public transportation in small buses, available on demand and price being determined by regular market mechanisms. The difference between what I imagine and things like Uber would be a strong integration with existing train and bus lines, and public funding and legislation. Maybe self-driving will get us there, but there are also many political hurdles that make the less efficient option (high coefficient of cars pp) more attractive than the alternative that could provide better efficiency (and, ideally, also great user experience).
by RustSupremacist | 2025-11-02 23:10:28+00:00
Rust is #16 on TIOBE, down from #13.

GitHub also just published Octoverse 2025 and Rust still hasn't cracked the top 10: https://github.blog/news-insights/octoverse/octoverse-a-new-...

Meanwhile, C++ is steadfast and even C is on the edges.

Looking at these lists, Go is an interesting option. It's rising in popularity and there is also a young community interested in it. It also integrates much better with existing C projects. Are there requirements for manual memory management? Would porting to Go instead of Rust have noticeable impacts on performance? Thinking about it now, Go seems like a more prudent option than Rust that achieves all of the publicly stated goals.
by pas | 2025-11-02 23:11:21+00:00
As far as I understand ChatGPT is not capable of self-improvement, so EY's argument is not applicable to it. (At least based on this https://intelligence.org/files/IEM.pdf from 2013.)

The FOOM argument starts with some kind of goal-directed agent (that escapes and then it) starts building a more capable version of itself (and then goal drift might set in might not)

If you tell ChatGPT to build ChatGPT++ and leave currently there's no time horizon within it would accomplish either that or escape, or anything, because now it gives you tokens rendered on some website.

The argument is not that AI is a magic box.

- The argument is that if there's a process that improves AI. [1]

- And if during that process AI becomes so capable that it can materially contribute to the process, and eventually continue (un)supervised. [2]

- Then eventually it'll escape and do whatever it wants, and then eventually the smallest misalignment means we become expendable resources.

I think the argument might be valid logically, but the constant factors are very important to the actual meaning and obviously we don't know them. (But the upper and lower estimates are far. Hence the whole debate.)

[1] Look around, we have a process that's like that. However gamed and flawed we have METR scores and ARC-AGI benchmarks, and thousands of really determined and skillful people working on it, hundreds of billions of capital deployed to keep this process going.

[2] We are not there yet, but decades after peak oil arguments we are very good at drawing various hockey stick curves.
by mrandish | 2025-11-02 23:11:39+00:00
> You'd think they'd just redact.

Maybe that's driven by the long and embarrassing track record of lawyers, court clerks and admins somehow failing to properly redact text from PDFs again and again (eg only covering text with black boxes while leaving the text metadata intact). This despite it now being an infamous recurring mistake in a common yet crucial part of their jobs.
by SoftTalker | 2025-11-02 23:11:49+00:00
Even so, normally anything like a crash or fatal error is going to give you a log message somewhere with a stack dump that will indicate generally where the error happened if not the exact line of code.

For more subtle bugs, where there's no hard error but something isn't doing the right thing, yes bisect might be more helpful especially if there is a known old version where the thing works, and somewhere between that and the current version it was broken.
by chrneu | 2025-11-02 23:12:46+00:00
nvidia 4080 here. I dont have any issues on Pop OS!. Drivers install and update just fine. Games just work. Bazzite is another popular gaming OS.

My steam library is like 120 games with several pretty popular ones. Again, no issues outside of anti-cheat but I'll uninstall those games so i dont care.

nvidia's drivers have gotten a lot better and their support docs are pretty decent. i had a mild issue a few months ago getting ollama running properly. All i had to do was update the nvidia toolkit, worked fine after that.
by morganherlocker | 2025-11-02 23:12:46+00:00
"Everything" is another that puts the default search to shame. I've also seen people who just have a script that pumps all new files into a txt file every so often and runs bruteforce ripgrep on it, which gives instant interactive results. It's really hard to imagine coming up with a search routine that is as slow and unreliable as what ships with mainstream OS file managers.
by 1vuio0pswjnm7 | 2025-11-02 23:12:47+00:00
It's only recently, within the last three months IIRC, that Wikipedia started requiring a UA header

I know because as a matter of practice I do not send one. Like I do with most www sites, I used Wikipedia for many years without ever sending a UA header. Never had a problem

I read the www text-only, no graphical browser, no Javascript
by michtzik | 2025-11-02 23:14:49+00:00
Previously in the United States, schools taught "all men are created equal" to people that could see that they weren't being treated that way.

Similarly, today we teach the importance of "universal suffrage" to kids, an entirely disenfranchised class.

Apparently you think there are some characteristics of children that should disqualify them from voting. Others think similarly of other groups.
by kjs3 | 2025-11-02 23:15:02+00:00
Yes, we got the "you're just a luddite that hates progress" sophistry from you guys in the IE days (and before). "We're doing the same thing as Apple" isn't a particularly persuasive counter. I always appreciated Balmer in that that he didn't waste time bullshitting anyone that he was trying to create walled gardens for M$ products by cooping standards.
by ryukoposting | 2025-11-02 23:15:44+00:00
As someone who finally recently escaped bluetooth firmware development: yes, Bluetooth is leaking secrets and it doesn't even require any silly RF shenanigans. Almost nothing actually implements LESC. Apple refuses to implement OOB pairing, so no peripherals can force you to use it, so everything is subject to MITM attacks. The entire ecosystem is a mess of consultants and underpaid devs copy-pasting Nordic sample code, with no time or financial incentive to do more than the bare minumum. Never trust any product that moves sensitive data through Bluetooth.
by chc4 | 2025-11-02 23:16:31+00:00
The human brain is just really bad at evaluating risk, especially over long periods of time. A lot of people are wanted overseas for years or even decades without anything happening, which makes it hard to maintain the mindset of being at risk without falling back to "eh, I've been fine this long"; a lot of them do foreign travel anyway and get away with it, which makes it hard to not fall into "what's one more vacation to a extradition-friendly country".
by lacker | 2025-11-02 23:16:56+00:00
Yeah, I just meant proposition-as-types. Sloppy terminology by me. I meant to complain about the general conflation of the "proving system" and the "typechecking system".

Generally in dependent type systems you are limited in some way in what sort of values a type can refer to. The fancy type checking happens at compile time, and then at run time some or most of the type information is erased. The implementation is tricky but the more difficult problem IMO is the developer experience; it involves a lot of extra work to express dependent types and help the compiler verify them.
by brucehoult | 2025-11-02 23:17:10+00:00
And, fairly uniquely, LLVM has a LLVM_PARALLEL_LINK_JOBS setting that is distinct from the number of parallel jobs for everything else. I think I was using that 15 years ago.

I wish GCC had it. I have a quad core machine with 16 GB RAM that OOMs on building recent GCC -- 15 and HEAD for sure, can't remember whether 14 is affected. Enabling even 1 GB of swap makes it work. The culprit is four parallel link jobs needing ~4 GB each.

There are only four of them, so a -j8 build (e.g., with HT) is no worse.
by strken | 2025-11-02 23:17:30+00:00
The problem with taking one step north and leaving the border of Postgres is what you lose, not the direct ops burden.

Postgres land is a comfy place filled with transactions across all your data at once, one backup solution that you (hopefully) have had running for months or years and has been thoroughly tested, and ACID compliance. You have a single host, probably, which means that you are neither Available nor Partion-tolerant, but at least you are Consistent.

The moment you expand beyond a single database host you now have a distributed system, and woe unto you if you don't understand what that means.
by vacuity | 2025-11-02 23:17:47+00:00
Having only two major options, X and Wayland, doesn't mean either one is correct. It is generally true that X needs to be replaced, but Wayland is not necessarily the replacement we need. It would be good to have more competition.

On a separate note, I think it's probably true that Wayland has significant drawbacks that preclude it from being an obvious replacement.
by bryanrasmussen | 2025-11-02 23:18:39+00:00
somehow it seems not as magic as setting the mathematically verifiable acceptance criteria that fails 99% of the time. (percentage chosen to show absurdity of claiming that mathematically verifiable acceptance criteria is inherently superior)

no I don't think humans are trustworthy, I think the procedures discussed are more secure than the alternative on offer which an expert in that technology described as being untrustworthy, implying that it was less trustworthy than the processes it was offered as an alternative to, and then gave technical reasons why which basically boiled down to the reasons why I expected that alternative would be untrustworthy
by bplr | 2025-11-02 23:18:52+00:00
A powerful, stealthy website cloner/scraper built with TypeScript that downloads entire websites for offline use. Supports HTTP proxy authentication, comprehensive asset downloading (CSS, JS, images, SVG sprites, fonts, etc.), and intelligent URL rewriting.

Features Complete Website Cloning - Downloads HTML, CSS, JavaScript, images, fonts, and all other assets HTTP Proxy Support - Connect through HTTP proxies with username/password authentication SVG Sprite Support - Properly handles SVG sprites with xlink:href references Smart URL Rewriting - Converts all URLs to relative local paths for offline browsing Stealthy Crawling - Configurable delays, random user agents, and realistic headers Asset Discovery - Extracts assets from: HTML tags (img, script, link, etc.) CSS files (background images, fonts, etc.) Inline styles SVG sprites and references srcset attributes Data attributes (data-src, data-lazy-src) CSS Processing - Parses CSS files to download referenced assets External Link Handling - Optional following of external links Progress Tracking - Real-time statistics and detailed logging Highly Configurable - Control depth, patterns, delays, and more
by card_zero | 2025-11-02 23:20:03+00:00
Hand-colored, "photochromes". One of them is in Commons category "1900 black and white photographs". Check out "autochromes", though:

https://commons.wikimedia.org/wiki/Category:Autochromes

Leonid Andreev's moody selfie poses amuse me. (Circa 1910.)

https://commons.wikimedia.org/wiki/Category:Autochromes_by_L...
by strcat | 2025-11-02 23:20:07+00:00
The stock OS doesn't use it for any of the kernel or most of userspace. It only uses it for specific processes where they're explicitly enabling it in that mode and apps explicitly opting into it. Nearly no apps are explicitly opting into MTE. On GrapheneOS, we dealt with third party apps by always using MTE with apps opting in, apps with no native code of their own and apps in our compatibility database. For the remaining apps with native code and no MTE opt-in, we have a per-app toggle and a global toggle to change it to opt-out instead of opt-in. We have user-facing MTE crash notifications providing a traceback to report to developers. We plan to significantly expand our compatibility database to always enable it for more apps like Signal but we're being cautious about that due to the potential for apps to ship a memory corruption bug occurring in regular use which not prioritizing fixing it. WhatsApp is an example of a widely used app which mostly works with our MTE integration but sometimes crashes in regular use and Facebook hasn't taken the issue seriously despite MTE not having any false positives.
by brailsafe | 2025-11-02 23:21:23+00:00
I'd argue it's a bit of both. In my case, I have an iPad 3, which runs iOS 9 compatible apps, but iOS itself doesn't backup the app files, so when various developers pulled their files off the app store for those old iOS versions, I lost access to the old software that did work, which really doesn't make want to buy another iOS device. Less of a problem on mac though.
by scheeseman486 | 2025-11-02 23:21:52+00:00
Games on Mac are a multifaceted problem, but IMO the main issue stems from Apple treating games like they do apps. They expect developers to continue to support them, to update them as APIs get depreciated.

Apple can spend all the resources they want, but they'll never be able to convince enough developers to foster a gaming ecosystem that could ever be taken seriously when there's other platforms that have 20+ years of back catalogue titles available. This has largely been enabled on Linux through wrapping D3D to Vulkan and if Apple put in the work to support Vulkan all that work could be used for free. Or if they more permissively licensed GPTK's D3D>Metal wrapper, but as it stands it's still not as good as DXVK/VKD3D. Practically speaking Steam on Mac would be considerably more useful if there was native Vulkan support.

Of course, Apple wouldn't want that given their desire for vertical control of software distribution, though notably they don't do the same for video or audio. I mean they support MP3s right? That's what games should be treated as, a piece of media. MP3 might not be the best quality, most would prefer AAC or FLAC, but sometimes an MP3 is all a user might have, so they should let users play it. But they can't seem to break free from this delusion that game software should be treated the same as Uber Eats.
by mort96 | 2025-11-02 23:22:14+00:00
For 90+ percent of Windows-only games I wanna play, the process for getting them to work on Linux is the following:

1. Hit the download button in Steam

2. Wait for it to download

3. Hit the play button

Granted, my taste in games doesn't include things like generic AAA first person military shooters, which are the ones which tend to be the most difficult to get to work due to stuff like anti cheat. But it sounds like your taste doesn't include those either,
by 1vuio0pswjnm7 | 2025-11-02 23:23:07+00:00
Whether intentional or not, there is an obvious benefit to the website operator in forcing users to expose themselves to images and Javascript by requiring the use of particular software. e.g., a popular graphical browser from a company providing advertising services (Google, Apple, etc.) or partnering with one (Mozilla):

It makes (a) visual advertising and (b) tracking viable

I read the www text-only, no auto-loading of resources (images, etc.), and I see no ads
by cyberax | 2025-11-02 23:23:15+00:00
> Parking lots are horrible. They're butt ugly heat islands that take up way too much space.

Wait until you hear about public transit...

> Generally the problem with carpark solar is the mounting solutions are low volume niche products that cost way more than traditional ground mounts.

Not really. You don't need anything unusual, just regular flat panels. The main expense is building the canopy itself to conform to all the requirements for hurricane/seismic resistance.
by strcat | 2025-11-02 23:23:16+00:00
It's a statement directly based on the regularly updated Cellebrite Premium documentation from the past 2 years. At a bare minimum, the April 2024, July 2024 and February 2025 documentation was posted publicly and even that subset shows what's said above. Do you think Cellebrite's documentation isn't accurate or that the leaked documentation was tampered? We aren't posting it publicly ourselves, but we do have a source providing it to us and can compare it over time. Only Pixels and iPhones are successfully stopping brute force but neither is successfully stopping exploiting the OS whether they're BFU or AFU.
by kjs3 | 2025-11-02 23:23:33+00:00
I wasn't here to 'provide proof'. Just pointing out that any conflict beyond a certain size almost certainly has some weapon from every large arms producer deployed in the field. I can't image how many tons of small arms we left laying around in Iraq, Afghanistan and the rest that are now being recirculated around the worlds conflict zones. I remember after the Soviets pulled out of Afghanistan if you were in the right place and knew the right people you could get cases of NIB AKs for like $25 a rifle (no, I didn't). It's not politics...it's logistics.
by defrost | 2025-11-02 23:24:27+00:00
An interesting tangent here from the article:

This is the first study on human axillary odour to sample a large number of subjects, and our findings are relevant to understanding the chemical nature of human odour, and efforts to design electronic sensors (e-nose) for biometric fingerprinting and disease diagnoses.

Individual and gender fingerprints in human body odour (2006)

~ https://royalsocietypublishing.org/doi/abs/10.1098/rsif.2006...

Any updates on how that's panned out in the past decade; robustness in the face of diet change, application in the field, overt or covert, marketing sales of magicTech to LEO adjacent bodies, etc. ?