MurphyA/hacker-news huggingface dataset:
by worldfoodgood | 2025-11-06 20:48:45+00:00
> Oh - and 1.3 billion unique passwords, 625 million of which we'd never seen before either.

It's not just email addresses. It's address + password combos.

But also, how did 2 billion email addresses get exposed? Assuming I give an email address to a company (and only that company) if someone gets access to that email addresss they either got it from me or that company. Knowing the company has sold, lost, or poorly protected my email address tells me they are maybe not worth working with in the future.
by santiagobasulto | 2025-11-06 20:48:55+00:00
Could leave to massive impersonation attempts. All the folks here on HN are probably very tech savvy, so we’ll likely have a strong password + 2FA. But mom and pops that just got their email addresses leaked? Probably not. So they might start just trying out a rainbow table of common passwords and getting access to peoples emails. Once you’re there getting to home banking and other privileged resources is not hard.
by ssl-3 | 2025-11-06 20:49:02+00:00
Neither Matter nor Matter-over-Thread require Internet access.

We really should be yelling for advancements in simple-to-configure dedicated, restricted VLANs and SSIDs for IOT devices instead of yelling about how inappropriate we think that using IP is.

(Historically, IP wins in these conundrums anyway. IP has been succession of grand successes for decades.

Resistance is futile. We should work to prepare for the eventually of what is to come.)
by Noaidi | 2025-11-06 20:49:29+00:00
The gene is NAMPT (Nicotinamide phosphoribosyltransferase), which:

"Catalyzes the condensation of nicotinamide with 5-phosphoribosyl-1-pyrophosphate to yield nicotinamide mononucleotide, an intermediate in the biosynthesis of NAD. It is the rate limiting component in the mammalian NAD biosynthesis pathway."[1]

[1] https://www.uniprot.org/uniprotkb/P43490/entry

Full paper:

https://www.science.org/doi/10.1126/sciadv.adx2407
by galkk | 2025-11-06 20:49:42+00:00
The most surprising thing for me is that Toyota had such a big head start, but their hybrid trucks rather suck, comparing to f150 powerboost.

Abysmal power generation capabilities (I can use my as 7.2kw generator), small batteries. I really wanted Toyota, but they somehow don’t deliver, while ford is pushing hybrid f150 hard.
by manishsharan | 2025-11-06 20:50:49+00:00
Fine .. say your country has a several years of drought and bad harvest. What happens then ? Do you trade then ?

Or .. lets say due to weather, your farmers can not grow enough oranges or some fruit which drives up local prices. Should only the richest people in your country get to eat fruits ?

Or you discover lithium deposits that your national industry can not use . Should you let that just sit there knowing it could make your province prosperous if traded.
by shoo | 2025-11-06 20:50:50+00:00
I agree with this. People advocate for "pick a better algorithm", and sometimes that can help dramatically, but at times the best algorithm implemented in python is still too slow, but can be made 500x faster by reimplementing the exact same algorithm in cython or C or fortran or so on.

Python is a great language for rapidly bashing out algorithmic code, glue scripts, etc, unfortunately due to how dynamic it is, it is a language that fundamentally doesn't translate well to operations CPUs can perform efficiently. Hardly any python programs ever need to be as dynamic as what the language allows.

I've had very good experiences applying cython to python programs that need to do some kind of algorithmic number crunching, where numpy alone doesn't get the job done.

With cython you start with your python code and incrementally add static typing that reduces the layers of python interpreter abstractions and wrappings necessary. Cython has a very useful and amusing output where it spits out a html report of annotated cython source code, with lines highlighted in yellow in proportion to the amount of python overhead. you click on any line of python in that report and it expands to show how many Cpython API operations are required to implement it, and then you add more static type hints and recompile until the yellow goes away and the compute heavy kernel of your script is a C program that compiles to operations that real world CPUs can execute efficiently.

Downside of cython is the extra build toolchain and deployment concerns it drags in - if you previously had a pure python module, now you've got native modules so you need to bake platform specific wheels for each deployment target.

For Python that's being used as a glue scripting language, not number crunching, worth considering rewriting the script in something like Go. Go has a pretty good standard library to handle many tasks without needing to install many 3rd party packages, and the build, test, deploy story is very nice.
by water9 | 2025-11-06 20:50:57+00:00
Do you know what correlation versus causation is? How do you know that ozone holes don’t appear naturally? But let’s say we did cause it, then you acknowledge that humans also have the capability to fix it when we realize there’s a big enough problem. So the climate apocalypse scaremongering is never going to be a scenario anybody’s ever gonna have to deal with.

It’s either we can fix the problem or we cant. If we can’t fix the problem, then no solution that we’re doing now makes any sense. If we can fix this problem, again, no solution that we’re doing now. Makes any sense because the technology of tomorrow will be much better adapted when the problem gets worse enough to warrant spending $93 trillion a non-probable existential crisis that also conveniently can’t be disproven either. I feel like too many people don’t see that the average person is willing to steal cheat and lie to get ahead.
by gethly | 2025-11-06 20:51:31+00:00
I absolutely agree. I have designed the platform to use wallets, so I never involve a third party in my business or the business of the content creators and risk being financially deplatformed(famously often done by Stripe and Paypal). I wanted to give users a chance to use payment cards to deposit money into their wallets, as people are used to paying online with cards, but as the platform provides no service in return, this was incompatible with policies of payment processors and card providers. So users have to make a bank transfer. Thankfully European SEPA payments are nowadays wide-spread and can be instant. People have banking apps on their phones, so it is even faster than using a card. But the use of cards for online payments is seeded too deep for modern users to find this comfortable, yet. Anyhow, I think we are slowly moving away from cards and in time they will hopefully become a thing of the past as internet has been around for ages and cards fulfil absolutely no useful function that cannot be supplement by decentralised solution by modern banks.
by jacquesm | 2025-11-06 20:51:33+00:00
It is extremely rare for a C build environment to start downloading a massive number of unaudited dependencies from a poorly organized pile of endless layers of repositories. What you might have is a couple of dependencies and then you build the rest yourself. To have 800 unknown co-authors on your 'hello world' app would not happen in C.

There are of course still other vectors for supply chain attacks. The toolchain itself, for instance. But then you fairly quickly get into 'trusting trust' level issues (which are very real!) and you will want an OS that has been built with known clean tools as well.
by dpoloncsak | 2025-11-06 20:51:48+00:00
In theory, I agree.

In practice, anything that high-profile will be plastered all over every tech news site, twitter, reddit, probably even the news. It would be difficult for MasterCard/Visa to have dataleaks, even just email/pass, fly under the radar (I imagine...)

Oracle tried to cover up a data leak, and it didn't go great. Oracle touches nowhere near as many every-day people as MasterCard does
by JohnFen | 2025-11-06 20:52:28+00:00
> the obvious reason is that the military tends to involve killing sometimes

Your wording downplays it, but killing people is the entire reason militaries exist.

> People don't have similar disdain for working at advertising corps like Google and Facebook for the killings they do indirectly.

A whole lot of people do.

> My drone is for surveillance only—it has a self-detachment feature (SDA) that is activated when the drone is attacked, but other than that the drone is for surveillance only.

That makes it no less a weapon, though. Just sayin'.

As someone who has done work for the US military in the past, here's my take on the social implications of it. If you're working on an offensive (in the military sense) project, there are going to be a lot of people who find that ethically objectionable. Less so in times where the US is less belligerent, but we don't live in those times right now.

If you're working on basic research projects funded by the military (this is what I have done), there are far fewer people who would find that objectionable. If you're working on something purely defensive, that falls somewhere in the middle.

However, military work will always be polarizing to some degree.
by bluGill | 2025-11-06 20:53:38+00:00
Not so much that you are not clear - this is an area that is weird enough that I don't think it is possible to be clear, but you gave me some useful hints. I got some of what I want working.

Edit, I started writing and then realized that I need this to work on old gcc that doesn't support these tricks so I have to give up. (I can't wait until this old embedded hardware dies)

What I'm trying to do is #define(A, B) static int A ## _ ## B = register(MKSTRING(A ## _ ## B) take any number of arguments. I can get the register working, but my attempts are creating the variable name fail.
by zwnow | 2025-11-06 20:53:39+00:00
Yea a combo is more problemtic, I could see why thats an issue. Most important stuff in my life has 2FA with my phone thankfully. My banking password got breached like 3 years ago and i still didnt change it... nothing ever happened. I am guessing tech companies that could have huge negative influence on your life should have additional security measures in place, like not allowing a login from a different country unless some kinda mobile code is provided or stuff like that. I'm pretty naive with all that tbh.
by jacquesm | 2025-11-06 20:54:13+00:00
> The industry needs to stop being terrified of writing functionality that already exists elsewhere.

I think that like everything else this is about balance. Dependencies appear to be zero cost whereas writing something small (even 400 lines of code) costs time and appears to have a larger cost than pulling in that dependency (and it's dependencies, and so on). That cost is there, it is just much better hidden and so people fall for it. If you knew the real cost you probably would not pull in that dependency.
Show HN: Completely free Claude Sonnet 4.5, supported by contextual ads
by namanyayg | 2025-11-06 20:54:23+00:00
Hey HN, I'm Namanyay from https://gigamind.dev/.

One of the most empowering applications of LLMs is enabling non-technical people to build apps and products. This value is reflected in the revenues of companies like Lovable and Bolt. Many of Giga's paying customers are business executives building valuable automations and internal tools that increase efficiency.

But, the incumbents currently operate on pay-as-you-go pricing, which is a predatory business model that I ethically disagree with. I believe the future of vibe coding tool pricing needs to be outcome based vs PAYG. The latter often feels like being held "hostage" over time, when there's vendor lock-in, and especially when the marketing promises are not met.

One step towards that is providing free or low cost inference. The user can continue building till they reach the desired outcome for a longer duration, which is possible if we can somehow make the inference cost negligible. And, the most proven model for offering free stuff online has been ads.

That's why, I've combined the two. I'm offering completely free Claude Sonnet 4.5 for use in Claude Code to empower a new segment to start building with AI.

Launch video (420k+ views): https://twiiit.com/NamanyayG/status/1982939951571591438

How it works:

- We are backed by sponsors. - We inject ads in the responses (a mix of contextual and static). E.g., if you ask about the best AI agentic memory tools, we'll recommend our sponsor https://supermemory.com/ - We store conversations for training or sharing with partners (transparently we are not data sharing right now, but retain the right to do so in the future). - We rate limit dynamically to allow fair usage for all our users. - We are offering the best Claude models for now. Depending on sponsorship, we might have to transition to free or OSS models down the line (e.g. grok-fast-1 or gpt-oss). - Our business actually makes revenue from our premium tool, https://gigamind.dev/context, which creates AI rules file for your project like AGENTS.md automatically.

How to try:

- Register on https://free.gigamind.dev/ - We provide you with an API key and a Claude Code compatible proxy URL. - With a few lines of environment variable changes, you get to use Claude Code, for free. - We'll run out of money if we serve everyone from HN today, so only the first 2⁶ people with coupon code `1337HN` get auto-accepted immediately.

Excited to hear your thoughts!
by gretch | 2025-11-06 20:54:26+00:00
Given enough time, hashes are reversible via brute force.

If the attacker steals the entire password table undetected, they have a large amount of time to generate soft collisions. After all they don’t need to hack any particular account, just some 50% of the accounts.

The time can be increased by some coefficient via salting, but the principles remain the same.
by naet | 2025-11-06 20:55:09+00:00
There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even counting the "legal" big data /analytics collected from past social media, Internet browsing, and whatever else.

I now use strong passwords stored in bitwarden to try to at least keep on top of that one piece. I'm sure there are unfortunately random old accounts on services I don't use anymore with compromised passwords out there.

Not really sure what if anything can be done at this point. I wish my info wasn't out there but it is.
by jameslk | 2025-11-06 20:55:10+00:00
Are you Zuck's neighbor? (...just kidding)

At the individual level, I agree. Generally unfair to have some unzoned private school next to your house shuffling in people constantly. Though I doubt this would get much press if it weren't Zuck or the NIMBYs who can probably pull strings to get a story in the press about their harrowing plight and tormented lives (not saying that's what happened of course, and perhaps the neighbors aren't NIMBYs--who knows)

As a group though, I think Zuck and any NIMBYs deserve each other
by mikkupikku | 2025-11-06 20:55:51+00:00
I don't speak for everybody but personally I like applications experimenting with ways of using new technology instead of taking some sort of political stand against AI. Firefox's translation extension is based on such technology I believe, and works well enough, I like it. Going further, like Brave is doing, also seems interesting. I think people who get upset about ineptly implemented AI features are being a bit unreasonable. It's new technology so people still have to. figure out what does or doesn't work. Mozilla using funds to develop new browser features is something I want more of, not less.
by benzible | 2025-11-06 20:56:06+00:00
These weren't inherently $15M properties - obviously price is no object for him and once he started buying adjacent properties the prices went way up. Zuckerberg paid $14 million in 2013 for a 2,600 sq ft house that was valued at $3.17 million [1]

As far as whether they're "regular people", depends on perspective. Relative to the US / world, a net worth that includes equity in a $3M+ house is an outlier but most of these people live what would have been considered a typical "upper middle class" lifestyle a couple of decades ago [source: me, ex Palo Alto resident, still have friends there]. Putting a couple of kids through college has become insanely expensive. They don't have compounds in Hawaii or fly around on private jets.

[1] https://www.sfgate.com/tech/article/Zuckerberg-to-raze-4-hou...
by celsoazevedo | 2025-11-06 20:57:07+00:00
If you look at about:profiles and compare it to the new UI or to what Chromium has offered for years, then I think you'll understand that the new UI is much better for the average user. There are also improvements for operating systems like macOS, where profiles always worked, but switching between them wasn't exactly a nice experience.

You can still use the old profile manager. At the pace Mozilla moves, it will be there for years.
Unix v4 Tape Found
by greatquux | 2025-11-06 20:57:09+00:00
https://oldbytes.space/@bitsavers/115505135441862982

https://www.theregister.com/2025/11/07/unix_fourth_edition_t...

https://www.tuhs.org/pipermail/tuhs/2025-November/032758.htm...
by breve | 2025-11-06 20:57:10+00:00
> China has done the world collectively as a whole a major service

I doubt the Uyghurs would agree:

https://www.bbc.com/news/world-asia-china-57124636

https://www.business-humanrights.org/en/latest-news/in-broad...

https://sustainabilitymag.com/articles/gb-energy-blocks-use-...

https://www.greenmatch.co.uk/blog/solar-companies-linked-to-...
by alexjplant | 2025-11-06 20:57:49+00:00
I live in San Diego and can watch planes come and go from my apartment rooftop. I've also walked to and from the airport to stretch my legs before and after flights.

Somewhere I have a GoPro video of me on my motorcycle waiting for a freight train at a crossing in traffic while a 747 flies overhead ("Planes, Trains, and Automobiles"). It's a pretty transportation-dense area.
by Covenant0028 | 2025-11-06 20:58:05+00:00
Brenda's job involves being accountable for the output. In many types of jobs, posting false numbers would render her liable for a dismissal, lawsuit, or even jail.

I'd like to see the cost of a model where the model provider (Anthropic etc) can assume that kind of financial and legal accountability.

To the extent that this output is possible only when Anthropic is not held to the same standard as Brenda, we will need to conclude that the cost savings accrue due to the reduced liability standards than on the technical capabilities of the model
by bayindirh | 2025-11-06 20:58:24+00:00
IIUC Snowden sent complete trove to two publications only, and one of the computers containing the trove is destroyed through and through, disabling that publication for Snowden leaks.

Moreover, again as I understand, after a certain point the leaks are stopped, because the message was sent, and people now know the most important bits behind the curtain.
by oskarkk | 2025-11-06 20:58:46+00:00
I checked a random Kenyan address on starlink.com, and it would be around 386 USD for the dish there (with service for 50 USD/mo), so not cheap. In Poland I see that they're giving the dish for free with some 1-year contract (58 USD/mo). Maybe it'll become cheaper, they're making millions of them. And you could share it with neighbors - if you can get 300 Mb/s, you could connect like 5 families if the alternative is nothing.

I found a nice website with prices by country: https://www.starlink-prices.com/personal/residential/usd/low

But it may be outdated, because it shows $90/mo price in Poland, while it's much cheaper as I said, even with the free dish.

And some recent articles about Starlink prices in Africa:

https://techlabari.com/average-starlink-prices-across-all-af...

https://www.visualcapitalist.com/visualized-starlink-vs-lead...

Anyway, Starlink is mostly for places where you have no ISPs or cell service (or they are very bad), so not for 95% of Europe, and probably not for most of India, especially in the future.
by kccqzy | 2025-11-06 20:58:49+00:00
Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it.

Telephone number? There used to be phone books. And I still instinctively think they should be public.
by foobarqux | 2025-11-06 20:59:03+00:00
> Once you get the command suggested by the LLM, you can quickly copy and modify it, before running it.

Copying and pasting tends to be a very tedious operation in the shell, which usually requires moving your hands away from the keyboard to the mouse (there are terminals which allow you to quick-select and insert lines but they are still more tedious than simply pressing enter to have the command on the line editor). Maybe try using llm-cmd-comp for a while.

> I do not see how editing the command is a good tradeoff here in terms of complexity+UI.

I don't find it a tradeoff, I think it's strictly superior in every way including complexity. llm-cmd-comp is probably the way I most often interface with llms (maybe second to basic search-engine-replacement) and I almost always either 1. don't have the file glob or the file names themselves ready (they may not exist yet!) at the time when I want to start writing the command or they are easier to enter using a fuzzy selector like fzf 2. don't want the llm to do weird things with globs when I pass them directly and having the shell expand them is usually difficult because the prompt is not a command (so the completion system won't do the right thing).

But even in your own demo it is faster to use llm-cmd-comp and you also get the benefit that the command goes into the history and you can optionally edit it if you want or further revise the prompt! It does require pressing enter twice instead of "y" but I don't find that a huge inconvenience especially since I almost always edit the command anyway.

Again, try installing llm-cmd-comp and try out your demo case.
by hypeatei | 2025-11-06 20:59:21+00:00
Cynicism is everywhere these days but these events really don't register for me anymore. Companies aren't punished by the government for these leaks and they aren't punished by consumers either. What incentive is there to reduce this data collection in the first place or to lock down your databases?

Even if someone's security is awful as the consumer and their account gets hacked because of these leaks, what are the actual consequences of that? Oh bummer, they need to reset their password and make a few phone calls to their bank to reverse the fraudulent charges then life goes on. Techies view that as unacceptable but most don't really care.