MurphyA/hacker-news huggingface dataset:
by tranq_cassowary | 2025-11-01 03:46:27+00:00
Those honeypot phones clearly use marketing aimed at criminals and make all sort of false promises and clearly aren't technical and transparent projects like GrapheneOS. GrapheneOS community doesn't tolerate discussion of crime or implying you are a criminal on their official community chat rooms and forum. Doesn't make sense for it to be a project aimed at luring in criminals.

Anyway, GrapheneOS ships security patches very quickly, often bumps kernel versions quicker than the stock OS etc. Security isnt only reactive, also proactive. Some features like MTE even outrule entire classes of vulnerabilities.
by mikepurvis | 2025-11-01 03:47:16+00:00
A lot of things are cheap to taste — a second hand bike and some $200 running shoes and you’re training for a triathlon. Or a makerspace membership and you’re now sewing or doing 3d printing.

It’s once you get “serious” and need to have your own equipment that all these things get real. Or in the case of things like social dance, you want to take time off with and travel further and further away to attend pricey exchanges and camps.
by Twirrim | 2025-11-01 03:47:42+00:00
I've been using active listening approaches for about 6 years now, when I interview candidates, to great effect.

I give a head's up to the candidate of what I'm going to do, right at the top after introducing myself. During the interview proper, I'll ask a question, and while the candidate is speaking, I'll make notes about what they've said. Then I read back to the candidates the notes I've written, asking clarifying questions, and seeing if there's anything that I've misunderstood or anything they'd like to expand on. I make it clear at the outset, and usually mention later on, that any mistake in the notes is on my part and that they should feel free to correct me. I've been surprised about how comfortable people have been to correct my misunderstandings. From time to time, I've even shared my screen so they can see what notes I've made. Once the interview is complete, I flesh out the notes with any impressions above and beyond the content, while I consider if I see them as a hire or no hire, and at what level.

This has resulted in much more positive experiences all round in interviews. Candidates seem to relax quicker, and get into the flow of things more readily. They're able to talk more freely without fear of being misunderstood, knowing they've got a chance to correct any misunderstanding later on in the loop.
by bdcravens | 2025-11-01 03:48:27+00:00
Recent right-wing ideology in the US would fight back against this. JD Vance made a comment a few years ago saying that votes should tied to the number of children one has. Elon Musk has several posts on X decrying birth rates in the US, sounding alarms about the need to counter. Perhaps these are little more than bad ideas that will fade away, but that's less certain in today's policy climate.
by picture | 2025-11-01 03:49:14+00:00
I completely agree. I can't handle watching his videos for long, for similar reasons.

However besides the personal dislike, I think its worthwhile to stop giving so much merit based on advertising "open source" or "effort" or "presentation" etc, because frankly many of these YouTube "makers" and the "maker community" are misguiding a lot of people to make bad designs and waste time and resources. People ought to value correctness and quality a bit more, lest our things become even more enshittified than they are now. One would think that hobbies would be a refuge from disposable low quality shit... yet we get RPi Pico et al (which are arguably getting less shitty but still laughable compared to actually good MCU products) and the people who claim to "out do the big corp" by using a Raspberry Pi with an SDR dongle and saying they achieved $50000 of capability with $60 in parts..

Case in point, the Opulo PNP systems are significantly overpriced and have amateurish mechanical as well as circuit design that are worse than cheaper systems like Pandaplacer in terms of reliability and performance.
by ranger_danger | 2025-11-01 03:51:13+00:00
Since nobody else has mentioned it... "vulnerable to hacking" is doing a lot of heavy lifting here. It's "vulnerable" about as much as my LUKS desktop system is vulnerable.

These charts have been available for years and don't tell us anything particularly scary IMO.

This "hacking" especially for BFU/turned-off Pixel devices, at best would amount to brute-forcing your password, either on-device or after copying the flash elsewhere.

Short of using top-secret multi-million dollar 0days or something, there is no inherent Pixel flaw that lets them bypass the device's encryption or anything crazy like people are thinking. They still have to get your password somehow, just like anyone else.
by rmunn | 2025-11-01 03:52:20+00:00
Apple wasn't a name change, though: that was its name from the beginning. Slightly different situation. (Yes, they changed their name from Apple Computer Company to Apple Inc. once they started making smartphones, but that's not the same because the part of their name that everyone called them, Apple, was kept unchanged). Their logo was always an apple with a bite out of it, their first computer was the Apple I (first one of theirs I ever used was the Apple II)... they really leaned into the name, and made it part of their identity. Which isn't the case with Alphabet or Wise.
by ninetyninenine | 2025-11-01 03:54:29+00:00
You’re arguing as though reality cares about your word boundaries. Saying “exceptions are not bugs” because one is a concept and the other is a data structure is like saying a flat tire isn’t a car problem because the air is outside the vehicle. It’s technically true in the same way “rain is just water, not weather” is true. Nobody outside the argument needs a whiteboard to see what’s gone wrong.

An exception is what happens when a bug hits the runtime. The program trips, falls, and throws a message about it. Calling that “not a bug” is like saying your toaster catching fire isn’t a malfunction because combustion is a physical process, not an electrical one. Or saying a sinking ship isn’t in trouble because “leak” is a noun and “disaster” is a category.

In practice, exceptions are how bugs announce their presence. You can keep redrawing the philosophical fence around which one counts as which, but it’s the same as a child insisting the spilled milk isn’t a mess because it’s just “liquid on the table.” Everyone else has already grabbed the paper towels.
by tranq_cassowary | 2025-11-01 03:54:50+00:00
Fingerprint is present in GrapheneOS. Face unlock and pattern unlock are left out because insecure. Patterns unlock is insecure in design. You start at a certain point and the next points you can go to are very limited (not the same point again and you have to be able to reach it). This makes it hard to make a strong lock. Face unlock is insecure because lack of proper hardware for it on the supported phones. Fingerprint is secure. Coercion can be worked around via 2FA feature (fingerprint + pass/PIN).
by throwaway173738 | 2025-11-01 03:57:11+00:00
Linux shells, and that was an exaggeration. The shell is about as general purpose as it gets, but it’s hard to know a priori how to do a certain use case. But if you can explain it in plain language the LLM can do that for you. And at that point maybe you don’t need a gui except to present and manipulate visual output of the shell.
by ggm | 2025-11-01 03:57:34+00:00
Spain? Seem pretty entrenched to me. Same in Sweden and the Netherlands and Norway.

The French axed theirs but the French magazine press love a royal, preferably topeless, either in San Tropez or some night club. Peccadilloes sell papers.

People paid thousands for a shot of Lady di on a boat, some commoner reprobate sucking a duchesses toe, seems like hereditary caste system is loved to be hated to be loved.
by zdc1 | 2025-11-01 03:57:43+00:00
I've been using an eSim on my iPhone and it's been wonderful because:

1. migrating between iPhones also transfers the eSim

2. if I get a tourist sim card at an airport, I don't have to worry about taking out or losing my main sim

3. the ability to have multiple sims is also ideal: I currently have phone plans in AU and SG, in addition to any tourist sim cards I pick up
by AuryGlenz | 2025-11-01 03:58:26+00:00
We have parents nearby and they go there sometimes, but our oldest is quite the handful so we feel bad about doing it too much. She's just...very active, and always wants to play with someone. Always. At least kid #2 is easy. Regardless, it doesn't make it any easier to set up time with friends, just each other, and half of the time we do it just so we can get stuff done around the house.

You're right about the marriage stress. I've definitely seen the light at the end of the tunnel with friends/family that are further along in their kid's ages, though to be fair they haven't really hit peak teenage years either. At least there seems to be something of a lull.
by mathieuh | 2025-11-01 04:00:10+00:00
The southeast of England is well-off, everywhere else is less so. It has basically always been like this. There have also obviously been repeated hammerblows since 2008, with austerity (which is still happening), Brexit (a remarkable self-own), and then covid (an unprecedented upwards transfer of wealth). The political and economic establishment is also essentially monopolar, a process begun with Blair and now approaching culmination.

People just don’t have the money to spend on things. Wage growth is non-existent and prices have risen dramatically. For my own part I have get a real “we’ve tried nothing and we’re all out of ideas” feeling. All we ever hear on the news is how spending will have to be cut yet again and taxes will have to go up.

Being from Northern Ireland I personally hope for unification with Ireland, although without significant changes I worry nothing much will change as Ireland has its own very similar issues.
by timenotwasted | 2025-11-01 04:00:38+00:00
It's really great to see the shift that has been taking place away from unicorns, growth for the sake of growth, and all the chaos that drove throughout. Maybe it's my own personal bias but I feel that these stories of low, slow growth; small teams, small wins but consistency are becoming more norm. While I realize there is still plenty of froth, it's inspiring and makes me hopeful for an industry shift in that direction.

"And when we launched after a year in private beta, almost all of our 100 beta users converted to paid customers." — That's a neat stat and one I'd be extremely proud of.
by alephnerd | 2025-11-01 04:01:13+00:00
> 3 BEDROOM APARTMENTS DO NOT EXIST so, there will be fewer children

Idk where you are, but I grew up in a 3 bedroom apartment as a kid in the Bay Area in the 1990s and 2000s - we couldn't afford a house until I entered HS (nor did my parents want to take the risk until they had a GC, which itself took 12 years).

I also had friends who grew up in 4 person households with 2 bedrooms (also fairly common).

There were a lot of apartment complexes filled with us 1.5 gen immigrants, as our parents came from India, China, Japan, Korea, Taiwan, Israel, and Russia on H1Bs, L1s, and EB1s.

Growing up in an apartment was a fairly common story for a large segment of us Californians of 1st and 1.5 gen immigrant descent.
by csande17 | 2025-11-01 04:02:34+00:00
In case anyone else was confused: the link/quote in this comment are from the previous "async cancellation issue" write-up, which describes a situation where you "drop" a future: the code in the async function stops running, and all the destructors on its local variables are executed.

The new write-up from OP is that you can "forget" a future (or just hold onto it longer than you meant to), in which case the code in the async function stops running but the destructors are NOT executed.

Both of these behaviors are allowed by Rust's fairly narrow definition of "safety" (which allows memory leaks, deadlocks, infinite loops, and, obviously, logic bugs), but I can see why you'd be disappointed if you bought into the broader philosophy of Rust making it easier to write correct software. Even the Rust team themselves aren't immune -- see the "leakpocalypse" from before 1.0.
by bigiain | 2025-11-01 04:03:17+00:00
I don't think these images have this, but there are people working on that problem.

The Coalition for Content Provenance and Authenticity https://c2pa.org/

"The Coalition for Content Provenance and Authenticity, or C2PA, provides an open technical standard for publishers, creators and consumers to establish the origin and edits of digital content. It’s called Content Credentials, and it ensures content complies with standards as the digital ecosystem evolves."

I first heard about this here, which provides a good overview of how t works right now: https://www.tbray.org/ongoing/When/202x/2025/09/18/C2PA-Inve...
by jesterson | 2025-11-01 04:06:50+00:00
> Can you provide any sources for this?

Thats common knowledge for everyone even tangentially related to finance industry and likely for anyone who ever did international business with cross border payments . Not sure what kind of "sources" you expect to see here.

> Ukraine had very strict banking rules for at least a decade

Perhaps for it's own populace, but not for it's rulers and those who they work with.
by srvmshr | 2025-11-01 04:07:27+00:00
Coincidentally enough, I dug out my 11th grade CS project on generating fractals from 2002 & modernized it using SFML graphics lib just this week.

https://github.com/gradientwolf/fractals_SFML

Your post gives me so much joy. These tiny little things take me back to teenage years, simpler times & when interests were different. (I put a little note as "why" in my GH repo readme)
by clarkmcc | 2025-11-01 04:11:12+00:00
I can’t say whether it was rushed out, but it’s clearly not everything it was advertised to be. Early on, the big talking point was that the async implementation was so modular you could swap runtimes like Lego bricks. In reality, that’s nowhere near true. Changing runtimes means changing every I/O dependency (mutexes, networking, fs), because everything is tightly coupled to the runtime. I raised this in a Reddit thread some time ago, and the feedback there reinforced that I'm not the only one with a sour Rust async taste in my mouth. https://www.reddit.com/r/rust/comments/1f4z84r/is_it_fair_to...
by jesterson | 2025-11-01 04:12:47+00:00
> Russia invaded Ukraine, inflicting untold horror, and Russia is a threat to Europe.

Realistically it is way more nuanced than that. Its a juvenile worldview to think in black and white.

Not willing to start any discussion on the matter, but you may want to know about massacres ukraine did in it's eastern side. After all, the russian invasion wasnt that unprovoked at all (albeit as any force causing many to suffer, it's hard to justify it).

The bottomline is - reality is way more nuanced than just black and white.
by alganet | 2025-11-01 04:14:26+00:00
The article says "By default, the model correctly states that it doesn’t detect any injected concept.", which is a vague statement.

That's why I decided to comment on the paper instead, which is supposed to outline how that conclusion was estabilished.

I could not find that in the actual paper. Can you point me to the part that explains this control experiment in more detail?
by 9rx | 2025-11-01 04:14:38+00:00
> An exception is what happens when a bug hits the runtime.

Remember, "exception" is short for "exceptional event". "An exceptional event is what happens when a bug hits the runtime." means... what, exactly? And let's not forget that you said that not all exceptions are bugs so it seems we also have "An exceptional event is what happens when a bug does not hit the runtime." What is that supposed to mean?

Returning us from la-la land, an exceptional event, or exception, refers to encountering a fundamental flaw in the instruction. Something like divide by zero or accessing an out of bounds index in an array. Things that you would never have reason to carry out and that a more advanced compiler could have reasonably alerted you to before execution.

Bugs are different. They can only be determined under the watchful eye of a human deciding that something isn't behaving correctly. Perhaps your program has a button that is expected to turn on an LED, but instead it launches a nuclear missile. While that is reasonably considered programmer error, that's not a fundamental flaw — that's just not properly capturing the human intent. In another universe that button launching nuclear missiles very well could be the intended behaviour. There is no universe where accessing an out of bounds index is intended.

> exceptions are how bugs announce their presence

Bugs aren't announceable, fundamentally. They can be noticed by a human who understands the intent of the software, but it is impossible for the machine to determine what is and what isn't a bug. The machine can determine what is an exception, though, and that's why exceptions often get special data structures and control flows in programming languages while bugs don't.
by spankibalt | 2025-11-01 04:14:41+00:00
> "Note that I've said 'anti-woke content', not 'anti-woke media'."

In the context of my argument a distinction without difference.

> "I am including the occasional "course correction" opeds and actually well-researched longreads you're seeing in places like NYT, Atlantic and such."

Well, that's the crux: There is no such thing for me as "actually well-researched anti-woke content". That's just a pathetic, and ultimately tragic, hallucination in the same vein as "actually well-researched" pieces of flat earthers, pushing their trash. Et cetera.

> "Elon's personality isn't of importance here [...]"

I can tell you're one of those guys who paid "actually a lot of" attention when The Cult of Personality was negotiated in the classroom.
by mleonhard | 2025-11-01 04:14:43+00:00
> // Start a background task that takes the lock and holds it for a few seconds.

Holding a lock while waiting for IO can destroy a system's performance. With async Rust, we can prevent this by making the MutexGuard !Send, so it cannot be held across an await. Specifically, because it is !Send, it cannot be stored in the Future [2], so it must be dropped immediately, freeing the lock. This also prevents Futurelock deadlock.

This is how I wrote safina::sync::Mutex [0]. I did try to make it Send, like Tokio's MutexGuard, but stopped when I realized that it would become very complicated or require unsafe.

> You could imagine an unfair Mutex that always woke up all waiters and let them race to grab the lock again. That would not suffer from risk of futurelock, but it would have the thundering herd problem plus all the liveness issues associated with unfair synchronization primitives.

Thundering herd is when clients overload servers. This simple Mutex has O(n^2) runtime: every task must acquire and release the mutex, which adds all waiting tasks to the scheduler queue. In practice, scheduling a task is very fast (~600ns). As long as polling the lock-mutex-future is fast and you have <500 waiting tasks, then the O(n^2) runtime is fine.

Performance is hard to predict. I wrote Safina using the simplest possible implementations and assumed they would be slow. Then I wrote some micro-benchmarks and found that some parts (like the async Mutex) actually outperform Tokio's complicated versions [1]. I spent days coding optimizations that did not improve performance (work stealing) or even reduced performance (thread affinity). Now I'm hesitant to believe assumptions and predictions about performance, even if they are based on profiling data.

[0] https://docs.rs/safina/latest/safina/sync/struct.MutexGuard....

[1] https://docs.rs/safina/latest/safina/index.html#benchmark

[2] Multi-threaded async executors require futures to be Send.
by strcat | 2025-11-01 04:17:26+00:00
GrapheneOS is an open source project which was started in 2014 by people with an existing history working on open source projects. It has existed for over 11 years. It resisted a takeover attempt by a company sponsoring it. It's entirely funded by donations with no strong ties to any company, no government grants, etc. We don't accept strings attached funding, only donations. The core people working on the project have all been involved for years.

GrapheneOS has much faster patching than the stock OS. It's many months ahead on Linux kernel LTS patches. It ships the latest GKI LTS revisions from Greg KH which don't lag far behind the kernel.org LTS releases. It also updates other software such as SQLite to newer LTS versions earlier. GrapheneOS also develops downstream patches for many serious Android vulnerabilities before those get fixed upstream.

There are currently a bunch of downstream fixes for Android vulnerabilities in GrapheneOS including fixes for a severe tapjacking vulnerability (https://taptrap.click/), 5 outbound VPN leaks, a leak of contacts data to Bluetooth devices and more serious issues which may be remotely exploitable.

GrapheneOS already provides the November 2025, December 2025 and January 2026 Android Security Bulletin patches for AOSP in the security preview releases:

https://discuss.grapheneos.org/d/27068-grapheneos-security-p...

Galaxy and Pixel devices ship a small subset of these patches early, but not most of them. Shipping them early is permitted. There's 1 to 3 month gap between Google disclosing patches to OEMs and those patches getting shipped as part of the Android security patch level. Shipping the patches early is allowed, but is a lot of extra ongoing work requiring a much faster release cycle to do it well.

GrapheneOS mainly focuses on systemic protections for vulnerability classes either wiping those out or making them much harder to exploit. The systemic protections are what makes it stand up much better to Cellebrite rather than patching known vulnerabilities earlier. Patching known vulnerabilities earlier does help in the real world, but the systemic protections help much more due to severe vulnerabilities being quite common in the current era of widespread use of memory unsafe code and to a lesser extent (for Android, definitely not the web platform) dynamic code loading, both of which are heavily addressed by GrapheneOS. I posted about several of the systemic protections relevant to this in my reply at https://news.ycombinator.com/item?id=45779157.

GrapheneOS has reproducible builds which will eventually be usable to enforce that updates are signed off by other parties as matching the code where they can define their own system for approving releases. Delayed patches are a serious security issue and this needs to be approached carefully with groups which can be depended on to have the necessary resources and skills to manage approving releases properly.
by strcat | 2025-11-01 04:20:19+00:00
That's definitely not trivial and it's a small fraction of the security features GrapheneOS provides. https://news.ycombinator.com/item?id=45779157 explains several of the relevant features. Using hardware memory tagging for the whole base OS is definitely not trivial, and neither is implementing a much more hardened memory allocator. Our USB protection is not a trivial feature and is much more advanced than the USB protection features available in standard Android via the device admin API and Android 16 Advanced Protection mode.
by schiffern | 2025-11-01 04:20:20+00:00
Yeah, it's just a software change to the existing machine. If you generate a target scrambled state it's literally the solver algorithm in reverse too.

It would be neat if it offered to scramble when you insert an already solved cube (demoed in the video), and maybe have options for the amount of randomness.

Is there an unbiased scrambling (or random generation) algorithm, or is it enough to just generate N random moves?