MurphyA/hacker-news huggingface dataset:
by 0xbadcafebee | 2025-11-24 14:40:06+00:00
tl;dr DJB is trying to stop the NSA railroading bad crypto into TLS standards, the objections deadline is in two days, and they're stonewalling him

This /. story fills in the backstory: https://it.slashdot.org/story/25/11/23/226258/cryptologist-d...

Normal practice in deploying post-quantum cryptography is to deploy ECC+PQ. IETF's TLS working group is standardizing ECC+PQ. But IETF management is also non-consensually ramming a particular NSA-driven document through the IETF process, a "non-hybrid" document that adds just PQ as another TLS option.
by Semaphor | 2025-11-24 14:40:12+00:00
Sadly I can’t afford high end HAs. And from what I’ve read, you don’t really get HA prescriptions for stuff like APD with no hearing loss.

But it’s cool that this stuff is now integrated, hopefully those advancements will eventually trickle down further, from what I’ve now read, the AirPod Pro feature is a bit of that trickle.
Ask HN: Should pharmacies dispense C64s for nostalgia therapy prescriptions?
by amichail | 2025-11-24 14:40:14+00:00
Key idea: The new Commodore should embrace nostalgia based therapy by supplying its Commodore 64 Ultimate systems at a reduced price to hospitals, nursing homes, and even pharmacies.

If the new Commodore wants a meaningful niche, one powerful market is nostalgia based therapy. Many people respond strongly to objects that bring them back to a happier time in their lives. A device like the Commodore 64 Ultimate is perfect for this kind of emotional support because it is both familiar and simple enough to use in care settings.

Hospitals and nursing homes could use these systems in curated retro rooms designed to help patients feel grounded and comforted. The goal would not be to create a tech exhibit but to give people an easy way to revisit a part of their life that felt hopeful and stable. This can reduce anxiety, spark memories, and help families interact more naturally with loved ones.

How these devices could be used:

• In dementia care, familiar sounds, visuals, and simple games can help reduce agitation.

• In long term recovery, engaging with a beloved old system can encourage gentle routine and positive emotion.

• Families can use the device to share memories with a patient who grew up using machines like it.

• Even for younger patients, retro computing offers a relaxing escape from a stressful clinical environment.

There is also room for a new concept. Pharmacies could offer nostalgia based kits that include a Commodore device for patients who receive a lifestyle oriented prescription from a clinician. The idea is not to treat illness with a computer but to help someone reconnect with a version of themselves that felt more grounded and joyful.

This gives the new Commodore a unique purpose. Instead of competing only in the consumer hobbyist space, the company could position the Commodore 64 Ultimate as a therapeutic tool that supports emotional wellbeing in healthcare environments.

What do you think? Would this be a meaningful direction for the new Commodore?
by takoid | 2025-11-24 14:40:24+00:00
I have yet to see any definitive proof that this is real.

The screenshot in this post appears fabricated (specifically, the 'July 2008 in Israel' is misaligned): https://x.com/astrrals/status/1991942287128199433

The video evidence, which is the only video evidence that seems to exist, is equally unconvincing: https://x.com/AdameMedia/status/1992288673887343014

Additionally, Nikita Bier has gone on record stating that "Location was not available on any gray check account at any point." https://x.com/nikitabier/status/1992382852328255743
by meesles | 2025-11-24 14:40:25+00:00
As a user of Posthog, this statement is absurd: > Or safer again not to use software this vulnerable.

Nearly all software you use is susceptible to vulnerabilities, whether it's malicious or enterprise taking away your rights. It's in bad taste to make a comment about "not using software this vulnerable" when the issue was widespread in the ecosystem and the vendor is already being transparent about it. The alternative is you shame them into not sharing this information, and we're all worse for it.
by DrScientist | 2025-11-24 14:40:33+00:00
Is it to distract from a scandal or is it an escalation of a long pursued strategy to gain control of Venezuelan oil?

Feels like the latter. Remember during his first term Trump had John Bolton try various coup schemes.

https://archive.ph/C7lrm

Also Trump on the same subject: https://x.com/Acyn/status/1667682589333659648
by bellamoon544 | 2025-11-24 14:40:42+00:00
Vibe Coded Apps is a dynamic platform designed for app developers and entrepreneurs to buy, sell, or promote their unique applications. With a focus on transparency and verification, it provides a specialized network that showcases projects with proven results and revenue potential. Whether you're looking to list your creation, find a new app to enhance your business, or connect with a community of like-minded individuals, Vibe Coded Apps offers the tools and support you need to succeed in the app marketplace. Join us to turn your innovative ideas into successful ventures.
by badlibrarian | 2025-11-24 14:40:57+00:00
His book "Why None Of My Books Are Available On Audible: And why Amazon owes me $3,218.55" captures the soul, heart, nuance (and grammar) that he repeatedly brings to these issues.

He once sat in his basement for an entire month "playing the DRM off" his record collection. Resulting in twice compressed 128k MP3s and innumerable blog posts.
by lchoquel | 2025-11-24 14:41:28+00:00
This is a viewpoint on how we represent know-how in AI systems: not just what an organization knows (knowledge graphs, RAG, etc.), but how it does repeatable cognitive work.

Web version: <https://knowhowgraph.com/> — TL;DR below. Feedback from people building agents / AI workflow tooling especially welcome.

# Viewpoint: The Know-How Graph

Declarative, Repeatable AI Workflows as Shared Infrastructure

TL;DR

Agents are great at solving new problems, terrible at doing the same thing twice.

We argue that repeatable AI workflows should complement agents: written in a declarative language that both humans and agents can understand, reuse, and compose. These workflows become tools that agents can build, invoke, and share to turn repeatable cognitive work into reliable infrastructure.

At scale, this forms a Know-How Graph: a network of reusable methods that become shared infrastructure.
by slightwinder | 2025-11-24 14:41:31+00:00
There is also a modern continuation from the original Creator, called "Pioneers of Pagonia"[1]. It's Early Access at the moment, but v1.0 is planned for release in some weeks (11.12.2025). And so far it looks promising, seems to be a pretty good game for Settler-Fans. As I remember, it's a reaction on the catastrophic fail of the latest official Setter-Game, which is not with Ubisoft, so I guess serving the old fans is one of the goal.

[1] https://pioneersofpagonia.com
by Mtinie | 2025-11-24 14:41:35+00:00
If it’s done in a controlled manner with the ability to revert quickly, you’ve just instituted a “scream test[0].”

____

[0] https://open.substack.com/pub/lunduke/p/the-scream-test

(Obviously not the first description of the technique as you’ll read, but I like it as a clear example of how it works)
by xmcqdpt2 | 2025-11-24 14:42:11+00:00
I found the original source (the letter written by the judge) here

https://www.union-syndicale-magistrats.org/sanctions-america...

In it he specifically mentions that family cannot buy stuff for you because that is a crime if they are in the US or are US nationals, and that your direct family is banned from entering the US (p 4). He does not specifically state whether his family are sanctioned or not but he says that is a risk when he talks in general terms on page 7 about the impacts of the sanctions regime for other judges. Perhaps he is simply not married himself.

Either way, for some reason the news coverage didn’t include these parts of the letter, maybe they didn’t read the whole thing.
by jajuuka | 2025-11-24 14:42:26+00:00
Yeah the Roger Rabbit is a miracle where multiple major studios came together and allowed their IP to be in the same work. Disney, Warner Bros, Fleischer Studios, Harvey Comics, King Features Syndicate, Felix the Cat Productions, Turner Entertainment, and Universal Pictures/Walter Lantz Productions all agreed to share their characters. One of Steven Spielbergs great accomplishments was negotiating this. With how protective these studios are about their IP anymore I doubt we'd see anything close to the Roger Rabbit movie sadly.

Not to mention some of the actors have passed like Paul Reuben who really sold the cartoon aspect of Roger Rabbit.
by dijksterhuis | 2025-11-24 14:42:34+00:00
i got lucky at my last shop. b2b place for like 2x other customer companies. eng manager person (who was also like 3x other managers :/ ) let everything get super broken and unstable.

when i took lead of eng it was quite an easy path to making it clear stability was critical. slow everything down and actually do QA. customer became super happy because basically 3x releases went out with minimal bugs/tweaks required. “users don’t want broken changes immediately, they want working changes every so often” was my spiel etc etc.

unfortunately it was impossible to convince people about that until they screwed it all up. i still struggle to let things “get bad so they can get good”, but am aware of the lesson today at least.

tl;dr sometimes you gotta let people break things so badly that they become open to another way
by ecshafer | 2025-11-24 14:42:43+00:00
China has been dumping massive amounts of resources in this for at least 20 years, this (Making chips domestically with local tech) has been a long term goal for a very long time. The chip ban is relatively recent. IF it had an effect it was merely expediting a process that was going to happen regardless. China was NEVER going to be content importing Western chips or western machines to make chips indefinitely.
by JeremyNT | 2025-11-24 14:43:38+00:00
> Rust (and really, any but JS) ecosystem have a bit more "due dilligence" applied everywhere; I don't doubt someone will try to namesquat but chance of success are far smaller

I really agree, and I feel like it's a culture difference. Javascript was (and remains) an appealing programming language for tinkerers and hobbyists, people who don't really have a lot of engineering experience. Node and npm rose to prominence as a wild west with lots of new developers unfamiliar with good practices, stuck with a programming environment that had few "batteries included," and at a time when supply chain attacks weren't yet on everybody's minds. The barriers to entry were low and, well, the ecosystem sort of reflected that. You can't wash that legacy away overnight.

Rust in contrast attracts a different audience because of the language's own design objectives.

Obviously none of this makes it immune, and you can YOLO install random dependencies in any programming language, but I don't think any language is ever going to suffer from this in quite the same way and to the same extent that JS has simply due to when and how the ecosystem evolved.

And really, even JS today is not JS of yesteryear. Sure there are lots of bad actors and these bad NPM packages sneak in, but also... how widely are all of them used? The maturation of and standardization on certain "batteries included" frameworks rather than ad hoc piecing stuff together has reduced the liklihood of going astray.
by Ntrails | 2025-11-24 14:43:53+00:00
> You have to wait half a lifetime?!

Yeah, I cannot quite believe the term on that thing. Somewhere between 10 and 20 feels far more reasonable since businesses do need time to work plan around and develop property.

I'm not sure how I feel about auto-reversion as a concept. I can see real problems with it conceptually (creating a deadzone around expiry etc)
by QuiEgo | 2025-11-24 14:44:18+00:00
Random example: I once worked on a debug where you were not allowed to send zero length packets due to a known HW bug. Okay fine, work around in SW. Turns out there was an HW eviction timer that was disabled. It was connected to a counter that counted sys clk ticks. Turns out it was not disabled entirely properly due to SW bug, so once every 2^32 ticks, it would trigger an evection, and if the queue happened to be empty, it would send a ZLP, which triggered the first bug (hard hang the system in a way that breaks the debugger). There were dozens of ways that could hard hang the system, this was just one. Good luck debugging that in two days.
by mark_l_watson | 2025-11-24 14:44:28+00:00
Good guidelines. My primary principle for using AI is that it should be used as a tool under my control to make me better by making it easier to learn new things, offer alternative viewpoints. Sadly, AI training seems headed towards producing ‘averaged behaviors’ while in my career the best I had to offer employers was an ability to think outside the box, have different perspectives.

How can we train and create AIs with diverse creative viewpoints? The flexibility and creativity of AIs, or lack of, guides proper principles of using AI.
A deal with a public bank has put us into trouble
by startup_guyy | 2025-11-24 14:44:33+00:00
We recently began working through a consultant, with a public bank that has a strong presence in both South and North America. This consultant already had a history of not paying us for our work over the past two years, yet we still supported him even during personal difficulties, such as when his mother was ill. When this new deal came along, he assured us that if we were able to convert it, he would compensate us for all the losses we had incurred over those two years. We thought that if deploying our solution could finally make up for our losses, it might be worth trusting him one last time.

For the last eight months, we worked intensively on this project. The understanding was that there would be a long testing period, during which we would cover all costs, and once the project went live, we would recoup our investment. We built and deployed the entire solution. The bank conducted QA testing for nearly eight months. I personally got on a call with the bank’s representative, gave them access to the dashboard, and walked them through the entire system.

The consultant then asked us to share the final agreement, write detailed instruction manuals in both English and Spanish, and explain the end-to-end functionality. But here’s what he did next:

He handed over the entire manual we created to another vendor and instructed them to replicate our product exactly, same appearance and functionality, so the bank wouldn’t realize that the solution being deployed was not the one they had tested and approved.

Here’s why this situation is extremely serious:

We have signed an NDA with the bank, and the bank believes they are using our product. In reality, the consultant has replaced it with someone else’s product. If a data breach occurs, the responsibility will fall entirely on us.

To undercut us, the consultant has exposed sensitive bank data to this third-party vendor, who has no NDA with the bank.

The replacement service frequently returns errors such as “Server not working.” The bank will assume it is our system that is malfunctioning.

The consultant collected payment from the bank according to the agreement we prepared, but has not paid us a single penny.

Regarding the potential misuse of public funds, it is concerning that the bank president is a friend of this consultant, which may explain how carelessly this entire project was awarded.

What do you think we should do? Should we take legal action against this consultant?
by zahllos | 2025-11-24 14:44:50+00:00
"The government" already have. That's what CNSA 2.0 means - this is the commercial crypto NSA recommend for the US Government and what will be in FIPS/CAVP/CMVP. ML-KEM-only for most key exchange.

In this context, it is largely irrelevant whether the IETF chooses or not to have a single-standard draft. There's a code point from IANA to do this in TLS already and it will happen for US Government systems.

I'd also add that personally I consider NIST P-Curves to be absolutely fine crypto. Complete formula exist, so it's possible to have failure-free ops, although point-on-curve needs to be checked. They don't come with the small-order subgroup problem of any Montgomery curve. ECDSA isn't great alone, the hedged variants from RFC 6979 and later drafts should be used.

Since ML-KEM is key exchange, X25519 is very widely used in TLS unless you need to turn it off for FIPS. For the certificate side, the actual WebPKI, I'm going to say RSA wins out (still) (I think).
by Kim_Bruning | 2025-11-24 14:45:13+00:00
I was replying to a post that has since been deleted, but I'll leave my reply here anyway, for posterity:

> Synthesizers are regular musical instruments.

That's what people think now, yes. But I remember when the attitude was: "Synthesizers are electronic and controlled by a computer — it's not really an instrument, there's no creativity to it." . The Uk Musicians Union even discussed banning them [1] [2]

I'm not saying Suno is exactly the same. Of course history doesn't repeat itself exactly, but it does tend to rhyme.

I'd note that AI tools have this quality where they look almost usable right out of the gate, which fools people. It might resemble something, but it's not necessarily your vision. The gap between "this sounds like music" and "this is what I heard in my head" is where actual craft lives.

Still, our track record for predicting where the "real music" line falls is pretty poor. Maybe some humility is warranted.

[1] https://www.muhistory.com/contact-us/1971-1980/ "A meeting of the Central London Branch in May 1982 passed a motion for an outright ban on synthesisers" (was never official policy ... but did get voted on)

[2] https://www.musicradar.com/news/the-union-passed-a-motion-to... Terrible writeup, but lists sources at least.
by alistairSH | 2025-11-24 14:45:13+00:00
Huh, true enough. I linked one summary.

$200k urban vs $205k rural median offers to new doctors overall. But, in surgical practices, that flips well in favor of urban offers. But, that's just for new MDs. Career numbers skew even more to rural doctors

https://resources.nejmcareercenter.org/article/demystifying-...
by alephnerd | 2025-11-24 14:45:17+00:00
Actively disrespecting other countries who worked hard on developing such capabilities and assuming European nations should be on the "big boys table" is what is so jarring.

Nothing stopped European nations like Belgium, Germany, Netherlands, France, Italy, etc from continuing to invest in domestic capacity 20 years ago, but most of their IP is now developed in American, Indian, or other Asian subsidiaries or JVs.

Just becuase Europe was historically the richest and most powerful continent doesn't mean it will be forever.
by poulpy123 | 2025-11-24 14:45:20+00:00
> The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a cambrian explosion of dependencies to be a very good idea security-wise.

The safest code is the code that is not run. There is no lack of attacks targeting C/C++ code, and odin is just a hobby language for now.
by lalitmaganti | 2025-11-24 14:45:44+00:00
> this is not care when the priority system is so broken that it requires a full suspension

I'm not sure I understand this line. The whole point of the fixit is to address the bugs which are considered "low priority" because they only appear in a edge case or are not quite 100% perfectly polished but still matter over the long tail of people using the product.

Or do you propose that every issue like this needs to be fixed before doing anything else?
Show HN: A video editor for social media managers
by spider853 | 2025-11-24 14:45:50+00:00
Hi HN,

Over the last few months, my team and I have been building a video editor for social media managers, and we just launched it last week. We’ve talked to dozens of professionals, and even though there are tons of video tools out there, the same problems kept coming up: captions that don’t line up, hours wasted cutting silences, managing multiple brands is hard, having to resize content for different platforms takes a lot of time, starting projects from scratch every time, and more.

Rendley was built specifically for these people, and we made it our goal to help them create better content, faster.

Speaking of features, we’ve got: - An advanced video editor that is easy to use and works directly in your browser - Captions that actually match the timing, so everything aligns with the right moment - A silence remover that cuts all the empty parts - AI integrations for generating videos, images, voiceovers, and avatars. We’ve got popular models, including Nano Banana, Sora 2, Veo 3, Heygen Avatars, and more.

There’s also a generous free tier that doesn’t apply any watermark to your videos, so even if you’re editing casually, you can use Rendley without limitations.

Would love to hear your feedback and how we can make the product better!
Ask HN: Whats the last thing you saw gain market share due to true innovation?
by AbstractH24 | 2025-11-24 14:45:59+00:00
Something that's succeeding because of it used technology in a really impressive way.

Not something that's successful because it took a already proven out idea and rebranded it or had a really good GTM-strategy.

(and if your answer is ChatGPT, then see yourself out )
by iluxonchik | 2025-11-24 14:46:20+00:00
Gold as a percentage of balance sheet size in Central Banks (ranked):

+ Japan (MoF + BoJ): ≈2.4%

+ China (PBoC): ≈4.5%

+ U.S. (Fed gold certificates): ≈15.9%

+ European Union (ECB + Eurosystem): ≈19.4%

+ Russia (BoR): ≈36.1%

Conclusions you can take from here:

- China's current gold reserves are small relative to its central bank balance sheet and ambitions for the renminbi, so the PBoC is likely to keep buying gold for years to move closer to a gold-backed reserve-currency profile.

- Russia has accumulated large reserves that will allow a strong expansion of ruble credit once trade normalizes, likely triggering a rally in Russian capital markets.

- The EU is relatively well-positioned but should both grow its gold reserves and deepen its capital markets (e.g., via CMU) to strengthen the euro’s appeal as a reserve currency.
by wkjagt | 2025-11-24 14:46:24+00:00
I recently started looking for a new(er) laptop, because it often felt slow. But I started looking at when it was slow, and it was mostly when using things like GMail. I guess my feeling was "if my laptop isn't even fast enough for email, it's time to upgrade". But doing things I actually care about (coding, compiling) it's actually totally fine, so I'm going to hold on to it a bit longer.
by wizee | 2025-11-24 14:46:43+00:00
JPEG-XL provides the best migration path for image conversion from JPEG, with lossless recompression. It also supports arbitrary HDR bit depths (up to 32 bits per channel) unlike AVIF, and generally its HDR support is much better than AVIF. Other operating systems and applications were making strides towards adopting this format, but Google was up till now stubbornly holding the web back in their refusal to support JPEG-XL in favour of AVIF which they were pushing. I’m glad to hear they’re finally reconsidering. Let’s hope this leads to resources being dedicated to help build and maintain a performant and memory safe decoder (in Rust?).