MurphyA/hacker-news huggingface dataset:
by JimDabell | 2025-11-10 10:20:20+00:00
> Full of security issues is similarly overly dramatic

It doesn’t seem dramatic at all:

> Finding and exploiting 20-year-old bugs in web browsers

> Although XSLT in web browsers has been a known attack surface for some time, there are still plenty of bugs to be found in it, when viewing it through the lens of modern vulnerability discovery techniques. In this presentation, we will talk about how we found multiple vulnerabilities in XSLT implementations across all major web browsers. We will showcase vulnerabilities that remained undiscovered for 20+ years, difficult to fix bug classes with many variants as well as instances of less well-known bug classes that break memory safety in unexpected ways. We will show a working exploit against at least one web browser using these bugs.

— https://www.offensivecon.org/speakers/2025/ivan-fratric.html

— https://www.youtube.com/watch?v=U1kc7fcF5Ao

> libxslt -- unmaintained, with multiple unfixed vulnerabilities

— https://vuxml.freebsd.org/freebsd/b0a3466f-5efc-11f0-ae84-99...
by pjc50 | 2025-11-10 10:21:52+00:00
There's a book on this subject by someone I follow which I must get round to reading: https://www.waterstones.com/book/the-brompton/will-butler-ad...

It goes into a lot of detail on exactly how the process modernization happened in Brompton, with the sorts of challenges that you and the replies are talking about. The process and the workers need to adapt, in ways that the workers appreciate and fit the actual process of manufacture. Too often modernizations fail because they look at the "on paper" process, which isn't what the workers are actually doing.
by ggm | 2025-11-10 10:22:19+00:00
Not a chemist or a biochemist, but I would love to know if different pathways to synthesis make different shaped molecules with different "oh that's irrelevant" extras and salts and chirality.

Because I've taken a drug which I am told was just an isomer of the old now generic drug, but more effective. Which suggests small differences can have big effects. And, i assume not always positive ones.

One for Derek Lowe maybe.
by pydry | 2025-11-10 10:23:12+00:00
oh yeah ive no doubt not being slavishly pro Israel enough was part of if not most of the reason why the establishment cracked down here.

(accusations of being pro hamas for providing an honest account of the situation is the racist's calling card of 2025...)

the bbc journalists have been in near open revolt about being told to misrepresent and lie on behalf of Israel: https://www.financialexpress.com/world-news/forced-to-do-pr-...

The current leadership relented a little on the crackdown on their journalists in the last ~6 months ever since the UN declared it a genocide and allowed slightly more honest reporting of the genocide. Im pretty sure that recent glimmer of honesty will stop under new leadership.

>Do you actually watch BBC?

Yes, and I know people who work there too. Which is why found the journalists' revolt over management's orders to push racist Israeli tropes about "avoiding being too pro hamas" to be entirely unsurprising.
by cassianoleal | 2025-11-10 10:24:12+00:00
I can see a few differences.

Pushing Keepass vault to cloud storage:

* No per-item synchronisation

* Full control over encryption of the database

* Choice of cloud storage to trust with vault

* Free as in beer if no using cloud (or using a free/already paid for offering)

1Password:

* Per-item sync and collaboration

* Full trust on the (closed-source) client apps over encryption of vault

* No choice of cloud

* No choice of encryption

* Mandatory paying subscription
by jll29 | 2025-11-10 10:24:19+00:00
Google says:

> Similar to the severe security issues in libxslt, severe security issues were recently reported against libxml2 which is used in Chromium for parsing, serialization and testing the well-formedness of XML. To address future security issues with XML parsing In Chromium we plan to phase out the usage of libxml2 and replace XML parsing with a memory-safe XML parsing library written in Rust

Perhaps there are some Rust gurus out there that can deliver a XSLT crate in a similar fashion, which other folks can then integrate?

The problem seems to be that the current libxslt library is buggy due to the use of C++, an unsafe language (use after free etc.).

[BTW, Chris Hanson's old book "C: Interfaces and Implementations" demonstrated how to code in C in a way that avoids use after free: use pointers to pointers instead of pointers and set them to zero upon free-ing memory blocks; e.g.

/* source: https://github.com/drh/cii/blob/master/src/arena.c */ void Arena_dispose(T *ap) { assert(ap && *ap); Arena_free(*ap); free(*ap); *ap = NULL; /* avoid use after free */ } ]
by init1 | 2025-11-10 10:24:21+00:00
What useless drivel. If you already have property rights then you have the right to own and operate computers.

The main thrust of the law is directly self contradictory.

"Government actions that restrict the ability to privately own or make use of computational resources for lawful purposes..."

OK then just make the usage you don't like unlawful and you are allowed to violate this "protection".
by elric | 2025-11-10 10:25:05+00:00
> They're picking the weirdest purity test hills to die on.

There is no "purity test" hill. There are simple reporters who are trying to use words that are inclusive. You're turning this into a "purity" discussion about who is or isn't a "real woman".

> What people want from media is to poke politicians on how are they gonna fix: the economy, their jobs market, their housing market, their public health system, inflation, immigration, public school and childcare spots, rising CoL, not to focus on making pregnancy more inclusive.

These things are not mutually exclusive, and I'm not sure why you seem to think they are.
by fxtentacle | 2025-11-10 10:25:26+00:00
https://github.com/DeutscheKI/jetbrains-mini-agent

Fully offline LLM coding agent plug-in for JetBrains IDEs. Use with Qwen3-Coder-30B-A3B-Instruct-UD-Q4_K_XL.gguf on an RTX 3090 or up. The source code is pretty short to make sure it can be audited, if needed.
by joeturki | 2025-11-10 10:25:35+00:00
This is unfortunate and sad but understandable. Slightly off-topic: a friend dared me to look for a sandbox CSP bypass and I discovered one using XSLT. I reported it to Mozilla few months ago, CVE-2025-8032. https://www.mozilla.org/en-US/security/advisories/mfsa2025-5...
by 1718627440 | 2025-11-10 10:25:36+00:00
With source address verification (and server validation) it is guaranteed that the mail comes from the server that controls the senders mail address and that this address does indeed exist. With symmetric I mean that both servers then resolve each other the same, both check whether their side of mailbox exists and they share the time during which this happens, so you can't use it for DOS, since it takes your time as well.
by blazingbanana | 2025-11-10 10:25:54+00:00
> The animations cost $0.32 ( 32) each.

Not sure if you just added this in or I overlooked it, but exactly the kind of transparency I love. Will give this a try.

--

EDIT - Did an image generation using the OpenAI 4o model, then ran through the lowest quality animation. This is awesome and first pass is very strong and usable (around 100 diamonds used).

I look forward to seeing prices drop more and the asset pack area fill up. Keep going man, really awesome stuff.
by raxxorraxor | 2025-11-10 10:26:07+00:00
Usually 5 - 10 years later the industry will cry because of lacking competence and being left behind by new companies from nations that can produce cheaper and themselves.

It turns out there is little value in management alone. It will be cut loose like the rest. Perhaps these companies can become patent trolls.

Also they have a very hard time to find new talent since word gets around. Sometimes it works for industries like textile, but not always, and it doesn't work for engineering.

It mostly works for low budget or high volume products. It is still a bad long term strategy. Still, outsourcing didn't just start yesterday.
by francelwebdev | 2025-11-10 10:26:15+00:00
I’m working on a platform that makes it easy for people in West Africa to buy and sell cryptocurrencies (like USDT, USDC, ETH, BNB, POL, AVAX, etc.) directly with mobile money — the most popular payment method in the region.

The goal is to bridge crypptocurrencies and local mobile wallets to make crypto useful in everyday life — not just for trading, but also for online payments.

A few key features:

Mobile money integration (MTN, Moov, Orange, etc.)

Instant buy/sell of USDT, USDC, ETH, and other assets

Crypto payment gateway — businesses can now accept stablecoin payments directly on their websites

I’m currently focused on improving liquidity and expanding to more countries.

Would love feedback from the community — especially around :

- Liquidity and Marketing to find the first users.

Happy to share more details or collaborate with anyone working on similar problems.

Website : https://ciexchange.xyz/
by gambiting | 2025-11-10 10:26:17+00:00
>>I always got the feeling as a child that I was growing up in the ruins of a once strong nation

I live in the UK and not in London either, and it constantly feels like everything is just decaying and the country lives in the past not the present. Everything is just dilapidated, falling apart, or shut down. The streets are full of rubbish, dirty and local infrastructure doesn't get fixed up for months if someone damages it. Local councils are saying they will shut down care homes soon because there is no money for anything. And it's not even a private vs state funded issue - our local pharmacy literally looks like something out of afganistan, you walk in and there is actual dirty carpet on the floor, the shelves are 50% empty and there are several broken lights in the ceiling - with 4 people working behind the counter packing prescriptions. And that's operated by a private company! Which I believe is only doing it because they are required by an NHS contract, otherwise they would have shut the place down. And don't even get me started on the NHS - a friend with suicidal thoughts was told he needs to see a psychiatrist, the current wait time for one is 260 weeks(just short of 5 years). Honestly if I were cynical I'd say the system prefers if he kills himself, less of a burden.

Honestly, I feel so weird. One one hand, I work from home on a tech worker salary and I'm very comfortable financially - but I take a step out of my house and you don't feel like the 5th wealthiest nation in the world. Our local library had to be closed due to lack of funding recently. A library. What kind of 3rd world behaviour is that? And honestly I don't think even 3rd world countries are closing down libraries, it's just unthinkable.

I'm very jaded about it, I keep trying to find positives and there are some but generally I've learnt to expect that things are broken, forgotten or just in poor state in some way or another, because there is never any money to do anything. It's a poor country cosplaying as a superpower.
by KurSix | 2025-11-10 10:26:21+00:00
AI-generated commits are useful, as long as they act as a post-processor rather than the author. If the history is already a mess, the tool can structure it chronologically, restore the connections between changes, and describe what they mean. The main thing is that it must not change public SHAs, it needs to mark its own entries as machine-generated, and it should keep the original messages saved somewhere nearby
by avianlyric | 2025-11-10 10:27:23+00:00
Not quite the conclusions of the article. As it points out the UK nationalised its shipbuilding industry in the 70s in a last ditch effort to turn it around, and despite operating it at a significant loss for a decade failed to make it even slightly competitive. In the 90s the industry was then privatised again once it was clear there was no saving it anymore.

For the vast majority of its history the UK shipbuilding industry was completely private, and dominated by many small shipbuilders. Consolidation only started after the UK government stepped in to provide some kind of sensible strategy to improve the competitiveness of the industry, via government loans tied to longer term strategic goals to improve productivity.

Ultimately it seems that the UK shipbuilding industry was kill by the thing that once made it so dominant. It was a highly distributed, extremely flat, high skilled industry, with little to no management. It made it easy for the industry to rapidly grow and shrink, and made it extremely effective at producing bespoke products. But as the world moved towards standardisation, those strengths became weaknesses.

The lack of management structure made it impossible for the industry to properly recognise the issues, or effect change to fix the issues. And the world moved towards standardisation, which gave a huge advantage to shipbuilders that built up capital intensive infrastructure that allowed the use of lower skilled labour to produce standard design quick, cheaper, and to a higher quality, than the UK distributed, high skill, labour force.
by DrScientist | 2025-11-10 10:29:16+00:00
For US people who think Tim Davie is some sort of leftie. When he was younger he ran for political office for the conservative party and before the BBC he was a VP marketing and finance for Pepsi.

Sadly over recent years the BBC has become a political football in the UK and wider, with pretty much all sides complaining about bias. This is just the latest chapter.

I'd argue that most of this complaining is done by people who are frustrated that they can't buy or commercially bully the BBC to take their side.

The way I read this episode is that the US poltical pressure over the Trump speech editing, created the required pressure for the current government to get rid of Davie. Now all sides are trying to use this crisis to further their ends.

For what's it's worth, my view is that the BBC is made up of a range of people with a range of views - some of which I agree with and some of which I don't, and the only bias is a tendency for a pro-establishment lens ( whatever that is at the time ).
by throwway1922 | 2025-11-10 10:29:50+00:00
It is so rare. Often people want to self-justify their complex, painful homesetup for this kind of rare thing. If any of the cloud like Google was that bad with lost accounts then it would get less popular eventually.

Breaking nextcloud or failing a disk or lost phone is more likely. (Nitpick - Yes, most people have SIM based 2FA - so no problem with lost SIM - and most people are not >100K paid HN bros - that travel constantly around the world. so Google is good.).
by lm28469 | 2025-11-10 10:30:33+00:00
> This sounds like a modern version of Golden Age nostalgia.

When France built their nuclear programs, or railways, it was a massive investment, the people in charge when these decisions were taken were long gone by the time the projects were completed. It wasn't seen as a cost but as a national interest, now we're cutting everything down because everything is seen as a short term cost regardless of the long term benefits.

> I am not at all sure that people had longer visions; some probably did, but the entire nations? Not so sure.

Nations don't matter, the 10 or so people truly in charge do, when they have a spine at least, now that we have business men thinking about the next quarter it's more complicated.

> Second, there is a certain wisdom in accepting that you don't know how the world will look in 50+ years

History doesn't just happen... countries with long term visions make history, of course if you check out of the race you're at the mercy of whatever other people decide for you. China didn't automagically get where it is today, the planned economy helps in that regard.
by actionfromafar | 2025-11-10 10:31:05+00:00
Mine broke after a decade, or I would use it too I think. Just so neat to bring everywhere, I even got used to code on that thing. Albeit it was the later model with more normal keys, the original 701 was not great to type on, not because of the size (I got used to it) but it was something about the layout which was weird.
Show HN: My wife got me a GPU for birthday, so I upgraded my image generator
by harperhuang | 2025-11-10 10:31:13+00:00
For my birthday, my wife surprised me with a GPU!

I immediately deployed an AI text-to-image model on it and upgraded https://girlgenerator.online

Now it can generate images in various styles - people, scenes, different art styles, you name it.

The GPU isn't high-end, but it's more than enough to run a text-to-image model smoothly. Really grateful for my wife's support!

The site is still completely free with unlimited generations.
by blacksharkAI | 2025-11-10 10:32:28+00:00
Blackshark AI | Software Engineer & Senior DevOps Engineer | Full-time | Austria or Remote EU | VISA sponsorship available

Satellite and drone imagery access is on the rise, and traditional image processing methods are struggling to keep up. Our scalable AI platform enables custom model training on global features, providing real-time, on-demand geospatial insights with impressive speed and accuracy. We are turning months of manual work into mere minutes, and with much better results. We work with customers from various domains, from intelligence and defence, local and federal governments, to small and large enterprise enterprises, which requires us to have a lot of flexibility on how we deploy and maintain our services.

We kicked off in 2020 and have secured $35 million in series A funding from a lineup of top US and European investors, among which Microsoft M12, Point72 Ventures, Maxar, In-Q-Tel, SAFRAN, and ISAI/Capgemini.

Tech Stack: Python, Fast API, PyTorch, Postgres, Redis

Infrastructure: Kubernetes & Docker, Linux, AWS & Azure, Azure DevOps, Terraform, ELK, Prometheus & Grafana, ArgoCD & Helm

Roles:

Senior Software Engineer - Data Plane Team: https://jobs.eu.lever.co/blackshark/17fbf310-ea37-435f-a198-...

Senior DevOps Engineer - Deployment Team: https://jobs.eu.lever.co/blackshark/b8997cb0-532e-444c-b18d-...
by luqman-kodaq | 2025-11-10 10:33:04+00:00
I built a full-stack Auth Kit with NestJS and Next.js, and found myself stuck in the usual JWT vs Sessions debate.

After testing both under real-world conditions — logout, refresh rotation, and device tracking — I realized neither model was enough on its own.

This post shares what I learned about blending them into a hybrid approach.

Curious to hear how others are handling this balance in production systems.
by cubefox | 2025-11-10 10:33:14+00:00
Setting aside the the elephant in the room (modern coding LLMs are in some sense indeed compilers for natural language -- except they still "compile to" ordinary programming languages) it nonetheless seems to me that even conventional programming languages use too little, not too much, natural language.

Example:

- "&&" rather than "and",

- "||" rather than "or",

- "if (A) B" rather than "if A then B"

This only makes the code harder to read for beginners without apparent benefit. I'm not sure whether Dijkstra would have agreed.

Thankfully though, programming languages already use mostly explicit (English) language in function names. Which is a much better situation than in mathematics, where almost every function or operator is described by a single nondescript letter or symbol, often even in Greek or in a weird font style.

There is a tradeoff between conciseness and readability. Mathematics has decided long ago to exclusivly focus on the former, and I'm glad this didn't happen with programming. If we read Dijkstra as arguing that only focusing on readability (i.e., natural language) is a bad tradeoff, then he is right.
by scott_w | 2025-11-10 10:33:43+00:00
If you think the British Empire was ever competent then I strongly recommend you listen to the episodes of the Empire podcast that cover the British Empire (there’s a lot of different episodes across the series).

With the exception of the Royal Navy, the British Empire was spectacularly incompetent. It’s a running joke that the British stumbled into being the largest empire in history.

That said, I don’t think it’s unique to Britain. The Roman Empire has many tales of staggering incompetence and wild idiocy throughout its expansion. If you have the time, The History of Rome is an excellent podcast that covers the entire time period.

I suspect it’s the truth of human nature that it isn’t possible for such large organisations to be competent throughout, just by virtue of how many people they take to operate.
by jack_tripper | 2025-11-10 10:33:49+00:00
Discussion was about the made up pregnancy "inclusivity" bs, when only owners of a functioning uterus can get pregnant, and those would be biological women by an overwhelming majority.

You are free to call yourself whatever made up gender you want in public and social life, but to the doctor treating you at the ER or to the forensic specialist examining your skeletal remains, you are still a biological woman according to science.
by ReptileMan | 2025-11-10 10:34:05+00:00
>The US (and maybe the EU) are currently in the process of destroying their knowledge-based economy in the pursuit of dust manufacturing. The reason China is willing to negotiating with the US or the EU is because of massive leverages these countries have when it comes to the monopoly of the knowledge and information economy.

Except that we don't have monopoly on that. Assembled in China, designed in California worked for a while because of the inertia of the previous times when the whole pyramid was located in the US. For a lot of stuff it mutated into designed in China, assembled in China.

Guess what - we moved the bottom layers of the industrial pyramid and we are acting surprised that the top layers are also organically happening there. We are probably somewhat ahead, but if we get wiped out of existence tomorrow the progress in China won't slow down.
by b-kuiper | 2025-11-10 10:34:06+00:00
we are working on Aye Chat: an AI development tool for the terminal. It will make changes directly and let you revert changes through our snapshot feature, all while you can stay in the terminal to execute your favorite (terminal) editor and what not.

If allows the use of different models, no need to sign-up at the moment and at no cost. We released our beta just last week.

We were getting annoyed by all the additional confirmation questions by other AI assistants, and having to switch between consoles to use a editor and/or revert changes.

Check out our repo at: https://github.com/acrotron/aye-chat

or just install it:

# pip install ayechat
by formichunter | 2025-11-10 10:35:01+00:00
Genetically, I've dealt with myopia on the -2.x range most of my life till I had lasik around 20 years ago. However, now my eyes have diverged in the weirdest of ways. I have 20/20 in my right eye but can't read up close - due to being in my late 40's - and my left eye can read up close but I have around 20/80 for near-sightedness. I guess it's "good" I can handle any situation with one of the eyes but playing pool with depth perception sucks! Anyway, I have a new problem this article never mentioned. Floaters. My left eye is full of them and reading anything with these blobs blocking my vision is a game of moving my eye so it "shakes" things up so I can read where it was blocked. I have not found a therapy for it. Floaters is protein waste broken off in the eye and mine never settle to bottom of the eye. Don't take your vision for granted.
by VMG | 2025-11-10 10:35:06+00:00
> by the time you've written a JSON parser that beats that you could've equally produced an equally improved XML system while retaining the much greater functionality it already had.

Here is where you lose me

The JSON spec fits on two screen pages https://www.json.org/json-en.html

The XML spec is a book https://www.w3.org/TR/xml/