MurphyA/hacker-news huggingface dataset:
by moebrowne | 2025-11-24 12:23:47+00:00
The point of the cooldown is to allow time for vendor scans to complete and for compromised packages to be pulled. It's not about waiting for an end user to notice they've been compromised.

> Meanwhile, the aforementioned vendors are scanning public indices as well as customer repositories for signs of compromise, and provide alerts upstream (e.g. to PyPI).

https://blog.yossarian.net/2025/11/21/We-should-all-be-using...
by imtringued | 2025-11-24 12:24:31+00:00
>We probably don't need the Rust though.

Uhm, I would have picked Rust just for shipping fast, iterating fast, better performance and compatibility. The security is a bonus that comes along for the ride. You probably haven't had the displeasure to work with C++ in combination with ROS. That experience really soured me on C++.
by darkwater | 2025-11-24 12:24:36+00:00
So you can know before starting to work on the ticket if it's a few minutes boring job, if it could take hours or days or if it's going to be something bigger.

I can understand the "I don't do estimates" mantra for bigger projects, but ballpark estimations for bugs - even if you can be wrong in the end - should not be labelled as 100% impossible all the times.
by keepamovin | 2025-11-24 12:25:06+00:00
This is more of a humorous take. We already have trouble with one chip nexus is right next to China, and now we build another one? "ha ha". We is humanity. The collective we probably doesn't want a lever of the future controlled by a totalitarian communist ehnostate.

But yes, I agree Japan, Indonesia (as was intended), etc should wise up.
by dkdcio | 2025-11-24 12:25:27+00:00
payment. exchange of goods or services worth $$$

it’s quite a simple definition of what is or is not advertisement. run it through real world examples, it’s trivial to say whether something is or isn’t an advertisement

as with any broad regulation there would be grey areas, continued cat and mouse games with bad actors, etc.

but it is not a remotely insurmountable obstacle to define what is and is not advertisement in relation to free speech

(as an aside it’s really funny to me anyone would consider being paid to say something free speech, but I get it)
by mono442 | 2025-11-24 12:25:37+00:00
High energy prices are a self-imposed problem. The price of electricity is heavily dependent on the price of the most expensive energy source. Electricity from fossil fuels is expensive in European Union due to emissions trading system. A coal-fired power plant pays around 2x more for the emissions than for the coal itself. I don't know how the maths work for a natural gas plant but gas is more expensive in Europe anyway compared to the US.
by lll-o-lll | 2025-11-24 12:26:20+00:00
I started life as an engineer. Try reverse engineering why an electrical device your company designed (industrial setting, so big power), occasionally and I mean, really really rarely, just explodes; burying its cover housing half way through the opposite wall.

Won’t fix doesn’t get accepted so well. Trying to work out what the hell happened from the charred remains isn’t so easy either.
by Theodores | 2025-11-24 12:26:26+00:00
What are the obstacles to making GM EV1 replicas, albeit with modern batteries? The design still has merit and would undoubtedly be long range with the lead acid batteries swapped out for something new.

You can get businesses making replicas in small numbers, for example, I am sure you could get a Lancia Stratos, however, would GM have a big copyright ban on such a venture?
by squigz | 2025-11-24 12:26:56+00:00
> Also, ADHD has a genetic component. Having a diagnose for myself would have been useful to have before I had my son, who turned to have hyperactive ADHD. I love him to bits and I would not change him, but he's a handful. When he's off-meds he's almost intolerable. I would have had him nevertheless, but I would have had the right expectations.

This seems like an underappreciated side-effect of awareness of these things. I can't imagine what some parents must feel - about themselves, and their kid - when raising a child with ADHD and not knowing much or anything about it.
by yourapostasy | 2025-11-24 12:27:07+00:00
GitHub back in September already published their roadmap of mitigations to NPM supply chain attacks:

https://github.blog/security/supply-chain-security/our-plan-...

I'm guessing no one yet wants to spend the money it takes for centralized, trusted testing where the test harnesses employ sandboxing and default-deny installs, Deterministic Simulated Testing (DST), or other techniques. And the sheer scale of NPM package modifications per week makes human in the loop-based defense daunting, to the point that only a small "gold standard" subset of packages that has a more reasonable volume of changes might be the only palatable alternative.

What are the thoughts of those deep inside the intersection of NPM and cybersecurity?
by Karliss | 2025-11-24 12:27:28+00:00
If you look hard enough almost any 4 way rotation symmetry will result in a variation of swastika like shape. You would have to almost completely ban 4 way rotation symmetry to avoid it.

I personally find it unhealthy to actively search, extend and strengthen the association of hate symbols based on vague similarity out of context. Sure remember the crimes they have done and avoid the exact specific shape, proportions, color commonly used by the hate groups, but also take context into account. Don't promote them by giving them credit for things they didn't do. Don't let the hate groups win by allowing few dozen years of years of activity destroy thousands of years of cultural and language history and future for wide category of symbols and simplest geometric patterns. Don't erase words from common language. Don't let them make your life worse by self inflicted excessive censorship. Grow the good associations not the bad ones, dilute and take away the strength from hate groups instead of letting them take away common language from you. If you look at thousand year old budhist or ancient greek stone carving which uses one of the few dozen swastika variations and think those time traveling Nazis plastering their symbols all over the place they win.

When looking at children playing with paper pinwheel, is your first thought also they must be Nazi? When you look at cardboard box with 4 flaps overlapped on top of each other do you think Nazi?

With regards to other people speculation how this happened I doubt they intentionally tried to create a swastika, it just happens naturally when you use rotational symmetry. Looking at this logo I personally see the overall cross and spinning shape formed by positive space first. The image of swastika formed by negative space is kind of weak and clunky due to thickness mismatch created by curved rhombus. If they had used 4 overlapping squares or circles it would be more problematic, at that point a logo designer would likely stop and try to mixup things to get rid of it.
by macleginn | 2025-11-24 12:27:33+00:00
It was not the Manchus who reconquered Tibet in the 1950s, after it had been an independent country for several decades.

And the general argument is not about whether there is something inherently imperialistc in the Han -- it is about whether the Han are so isolationist that this should somehow prevent China as a political entity from expanding. Well it has not prevented this before (cf. also the Tang period expansion, if we want to talk about more distant history), so I see no reason why it should prevent it now. Unless, say, the CCP cedes control to an openly Han-nationalist party, but then the last one was imperialist alright (https://en.wikipedia.org/wiki/White_Terror_(Taiwan)).
by thepuppet33r | 2025-11-24 12:28:00+00:00
This sort of thing has existed for a while, but it's not picked up in the mainstream for two main reasons (at least based on my anecdotal evidence).

1. The friction between a zipped file and an unzipped file isn't enough to make the majority of users take the time to build out an automation. This is especially true now that in Windows you can open a zip file by double-clicking it, peruse the files, and open them from within the zip into your temp storage. 2. It's a little bit of a security risk. Downloaders are (generally) less vulnerable to side channel attacks, but the unzip software people usually use (7-zip, Window's native utilize, WinRAR) are slightly more vulnerable. This risk goes up with any automation software as a) you aren't auditing what you're actually unzipping, and b) the automation can be compromised.

But if you want to try this out, just search for "auto unzip" software and you'll find plenty of tools. You could also set up a cronjob on your Linux machine to run every so often and just scan a folder for zip files and unzip them automatically, with the option to trigger via alias'd command.
by metalman | 2025-11-24 12:28:21+00:00
https://www.barnstormers.com/

Wana buy a bolt?(aircraft), or a fighter jet?

It's been stable since the internet.

It needs a few scripts for total functionality, but you can look at everything on site with just plain html, and it's fast.Internal search is good.And random external searches for aircraft stuff will land you there.
by throw0101a | 2025-11-24 12:28:29+00:00
> Agreed, anyone who just glanced at federal budget would know, it's Social Security/Medicare/Medicaid/Defense.

It's almost a trope/meme to label the US government as "an insurance company with an army":

> Think of the federal government as a gigantic insurance company (with a sideline business in national defense and homeland security), which does its accounting on a cash basis, only counting premiums and payouts as they go in and out the door. An insurance company with cash accounting . . . is an accident waiting to happen.

* Peter Fisher, 2003, Bust Treasury official; https://nsjonline.com/article/2017/08/hill-the-insurance-com...
by dailen | 2025-11-24 12:28:32+00:00
This is fantastic! Definitely bookmarking!

While I'm not one to suggest monetizing something that benefits a community I think you could reasonably monetize this by providing CaaS (ha! Coloring as a Service).

You could have weekly or monthly pdfs of generations emailed for particular themes like kids' school mascots, religious subjects like for Sunday school, curriculum subject correlating theme, etc.

Additionally, I would have it hide a signature somewhere in case someone starts scraping images and commercially selling them, or additionally license them to be able scrape them using Cloudflare.
by stevenjgarner | 2025-11-24 12:28:43+00:00
You definitely have a point there. The 3DME uses small MEMS microphones embedded in the faceplate of the earphone and has no physical windscreen or noise suppression like digital hearing aids and consumer buds which use aggressive software algorithms to detect wind and instantly cut the low frequencies to stop the rumble.

As a workaround, some artists performing outside wear a thin, acoustically transparent beanie or headband over the ears effectively acting as a pop-filter/windscreen. This breaks the wind before it hits the mic while still letting mid-to-high frequency sound (speech/music) pass through. Not exactly a hearing aid alternative.
by joshstrange | 2025-11-24 12:30:22+00:00
You are using the word differently than everyone else I think. I’ve never heard someone using that word to mean maintain private forks. Then again, even private forks don’t protect you much more than package lock files and they are way more overhead IMHO.

You still need some out-of-band process to pull upstream updates and aside from a built-in “cool down” (until you merge changes) I see that method as having a huge amount of downside.

Yes, you sidestep malicious versions pushed to npm but now you own the build process for all your dependencies and you have to find time to update (and fix builds if they break) all your dependencies.

Locking to a specific version and waiting some period of time (cool down) before updating is way easier and jus as safe IMHO.
by randomint64 | 2025-11-24 12:31:02+00:00
Indeed, Rust's supply chains story is an absolute horror, and there are countless articles explaining what should be done instead (e.g. https://kerkour.com/rust-stdx)

TL;DR: ditch crates.io and copy Go with decentralized packages based directly on and an extended standard library.

Centralized package managers only add a layer of obfuscation that attackers can use to their advantage.

On the other hand, C / C++ style dependency management is even worse than Rust's... Both in terms of development velocity and dependencies that never get updated.
by overflow897 | 2025-11-24 12:31:23+00:00
Most grocery stores in every place I have lived have security cameras so that if you did something illegal you'd be identified very quickly. At this point this is even true of small bodegas.

Also scammers can't waltz into my grocery store from the other side of the planet and wreak havoc.

Ultimately you can use privacy enhancing tools, just like servers can choose to block them. I wish there was a better system but that's what we've got.
by fathertimex | 2025-11-24 12:31:46+00:00
Thanks, Matt!

This is a difficult thing to talk about, and I’m glad you did.

I wish could say we age out of this through experience, but I feel like it goes this way: either people respect your experience or they don’t and either you respect your own ignorance or you don’t.

As I’ve gotten older, I forget shit all of the time, and don’t keep up with all of the latest. Then I do things and others do things that are terrible, and I don’t do or say anything about it. I can’t convince anyone anymore that what they’re doing is terrible, and I can’t stop the terrible behavior in myself as I get worse, because I can’t keep up.
by brainwad | 2025-11-24 12:32:27+00:00
> I don’t see how this can be true. Reduced copyright terms mean price for old stuff goes down (to however much hosting and bandwidth costs). This means more funds are available for new content.

Because this syllogism doesn't hold. There's not a fixed pot of money that must be spent on content. If now every streaming service has access to a bigger pool of old hits, then they don't need to buy as much new content to satisfy their customers, and total spending on content will go down.

> If everyone can sell the popular reruns and holiday movies, then they stop being exclusive to Disney and Comcast and Warner Bros and so the only thing they can compete with is new stuff, forcing then to invest in new stuff.

Each service will just become sameier and compete more on their UX than their exclusive content. You can see this in music, for instance, where the big streamers already have more or less identical catalogues. Nobody is picking Spotify over Apple Music or Youtube Music due to exclusives, because there are none; so putting the content into the public domain is hardly going to change things.
by jadamson | 2025-11-24 12:33:00+00:00
RuBep? As ever, the fastest way to get a correct answer on the internet is to post an incorrect one:

> The Institute of Electrical & Electronics Engineers Inc., the international governing group for such technology, has designated P1901.1 as the technical designation given to the RuBee technology, which was named RuBee by Visible Assets. "There is no real reason we named it RuBee," said Mr. Stevens. "It actually was named after the song 'Ruby Tuesday.' It just sounded good."

https://theproducenews.com/print/pdf/node/1355 (PDF)

I'd assume "ZigBee" was also an inspiration.
by phantasmish | 2025-11-24 12:33:08+00:00
There’s definitely something embarrassing going on, and it starts but does not end with confusing destruction of a state with destruction of… I’m not even sure what you had in mind. The land? The infrastructure?

Taiwan’s democracy is absolutely threatened with destruction by a totalitarian superpower, that wasn’t in any way incorrect or misleading, and that’s how the GP post phrased it. Its state is threatened with destruction. That’s entirely accurate.
by mlrtime | 2025-11-24 12:33:11+00:00
This is not pointing to the Russia government trying to influence the election to gain favoritism.

"For the most part, the people who run troll farms have financial rather than political motives; they post whatever receives the most engagement, with little regard to the actual content"

BuzzFeed News investigation "didn't find concrete evidence of a connection" and "Facebook said its investigations hadn't turned up a connection between the IRA and Macedonian troll farms either"
by aiibe | 2025-11-24 12:33:36+00:00
Let cc/codex do research by themselves. I usually ask claude to scan codebase about specific part for context, describe my issue or feature then ask it to suggest solutions. Example : Study <subject>, I want to <fix/add feature>. What do you suggest ? From there, I have 2-3 different strategies options. Pick one, refine then implement.
by throw0101a | 2025-11-24 12:34:13+00:00
> Isn’t essentially the entire US on CG-NAT for IPv4 on mobile data?

T-Mobile, for one, has had their handsets IPv6-only for a few years, so if your Android/iOS does a DNS lookup and gets an AAAA record back, it will skip CG-NAT. T-Mobile presenting at NANOG in 2018 on IPv6:

* https://www.youtube.com/watch?v=d6oBCYHzrTA

And Rocky Mountain IPv6 Taskforce in 2017:

* https://www.youtube.com/watch?v=nNMNglk_CvE

Further data:

> Chances are if you use the Internet on your smartphone, you are connecting via IPv6. According to the Internet Society’s 2018 State of IPv6 Deployment,[1] 80% of smartphones in the US on the major cellular network operators use IPv6 and major mobile networks are driving IPv6 adoption with Verizon Wireless at 84%, Sprint at 70%, T-Mobile USA at 93%, and AT&T Wireless at 57%. Plus, some mobile networks are taking the step to run IPv6-only to simplify network operations and reduce costs.

* https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-inte...

Though some folks aren't happy with the implementation:

> But from my own experience, neither T-Mobile nor AT&T allows inbound traffic to the phone's IPv6 address. This negates some of the advantages of having a globally routable IPv6 address.

* https://isc.sans.edu/diary/27814
by rawling | 2025-11-24 12:35:00+00:00
> A footman in his lordship's service stated he went into his master's bedroom [...]

isn't an example of the phrase "master bedroom".

I am also skeptical of "school house and master's bedroom". The main cottage has "four large bed rooms". Why would the "master bedroom", if it is meant to be read as it is today, be listed after the list of detached outbuildings?
by DrScientist | 2025-11-24 12:35:41+00:00
> Seems like the shareholders will be effected soon, so then maybe it starts to change.

With companies at least there is direct feedback via company performance - companies led by people who know what they are doing do better than those that aren't.

And well led companies tend to attract and retain more talent.

The feedback in politics is much much slower - in part because often the people you are voting for are not really the people setting policy - that's all done by the party machine ( 20 somethings with no real world experience working as advisors ) - so changing the 'leader' often doesn't make much of a difference.

ie one of the things that is really annoying the electorate is it's really difficult to actually vote in leaders or policies you want because of the way the party system works - leaders change yet everything stays the same.

I mean in the US - who really though Kamala was the best candidate to run against Trump?
by throwup238 | 2025-11-24 12:35:49+00:00
> That said, I've had a theory for a while now that when Rust projects end up suffering from long compile times, the most significant cause is unneeded code from dependencies getting compiled, and that the poor ergonomics around Cargo features have basically encouraged the opposite of the good behavior I described above.

Are you talking about clean builds or incremental builds? Rust developers care far more about the latter, and dependencies should only be monomorphized not rebuilt.
by danaris | 2025-11-24 12:36:02+00:00
The vast majority of money for any given copyrighted work comes within the first few years of its existence. (This is extra true for things like video games.)

Furthermore, current copyright terms are decades past the death of the creator.

You seem to be thinking of copyright purely in terms of vast media conglomerates, but it affects literally every work created by every human in the country. That includes these HN discussion posts!

Additionally, I find it hard to see how your second paragraph holds. If the amount of exclusive content a given entity holds affects their odds of being bought by a larger conglomerate, I would think it would be in the opposite direction: having more exclusive content would make them more likely to be a target for acquisition, so that the larger company could then hold all of that exclusively.

If everything older than, say, 35 years were suddenly in the public domain, available to be distributed by any of the distribution companies, and Hypothetical Media Corp had half the back catalogue that they used to, then surely that would make big conglomerates less interested in buying up Hypothetical Media Corp?
by Forgeties79 | 2025-11-24 12:36:57+00:00
We’re not just talking about that specific instance anymore - I agree that’s clearly not “slavery” - the scope has clearly expanded into a larger issue about the power dynamics between employers and employees and how it can (and does) lead to compulsion/abuse.

> We have created trade unions, works councils and labor laws to protect against the most egregious abuses of power. Many countries have a social safety net. All of these are good things.

You may have them where you live but we do not have nearly as robust systems in the US. All of these systems are notoriously weak here and are trending weaker with each year for the last 60 years or so. For some light context: less than 10% of the US workforce is unionized, I believe it’s closer to 4% in the private center but I would need to doublecheck. Most Americans don’t even know what a “work council” is and our current NLRB is a joke. Combined with our very weak social safety nets and it’s easy to see how precarious the situation is for many people here.

Depending on which article/study you want to believe, roughly between 35% and 50% of the US workforce fears retaliation in the workplace for speaking up. That is a very high percentage of people and is indicative to me of a very unhealthy workplace power dynamic.
by hyperpape | 2025-11-24 12:36:57+00:00
Supply chain attacks are scary because you do everything "right", but the ecosystem still compromises you.

But realistically, I think the sum total of compromises via package managers attacks is much smaller than the sum total of compromises caused by people rolling their own libraries in C and C++.

It's hard to separate from C/C++'s lack of memory safety, which causes a lot of attacks, but the fact that code reuse is harder is a real source of vulnerabilities.

Maybe if you're Firefox/Chromium, and you have a huge team and invest massive efforts to be safe, you're better off with the low-dependency model. But for the median project? Rolling your own is much more dangerous than NPM/Cargo.