MurphyA/hacker-news huggingface dataset:
by skydhash | 2025-11-24 12:59:14+00:00
It’s a good security model because everyone has the decency to follow a pull model. Like “hey, I have this thing, you can get it if you’re interested”. You decide the amount of trust you give to someone.

But NPM is more like “you’ve added me to your contact list, then it’s totally fine for me to enter your bedroom at night and wear your lingerie because we’re already BFF”. It’s “I’m doing whatever I want on your computer because I know best and you’re dumb” mentality that is very prevalent.

It’s like how zed (the editor) wants to install node.js and whatever just because they want to enable LSP. The sensible approach would have been to have a default config that relies on $PATH to find the language server.
by wiz21c | 2025-11-24 12:59:14+00:00
Once again, you cannot ask the open source world to provide you with free dependencies and security.

At some point, someone has to pay for an organisation whose job will be to review the contents of all of these modules.

Maybe one could split the ecosystem into "validated" and "non validated" stacks ? much like we have stable and dev branches ?

The people validating would of course give their own identity to build trust. And so, companies (moral person) should do that.
by tw04 | 2025-11-24 12:59:37+00:00
Imagine a government that considers its people more than tools for the wealthy to use and discard as they see fit! So many regulations meant to protect the plebes!

Universal healthcare? Vacation time you can actually use? Data privacy laws?

What a bunch of losers! Next you’ll tell me they actually give parents time off to raise their kids instead of dumping them into daycare after a month of drudgery and try to call it bonding !
by thworp | 2025-11-24 12:59:38+00:00
You simply cannot compare the experience of being conquered in a pre-modern society to being conquered by the PRC.

Premodern States simply couldn't afford the level of oppression and exploitation that is possible today. They usually just replaced the upper layers of the old hierarchy, put some small garrisons in a few places and left most local elites in charge, often with their local armies. If there was an organized rebellion, there would usually be a a few skirmishes and then a re-negotiation of the terms.

Today even Morocco could afford to turn Western Sahara into a territory with total surveillance, checkpoints everywhere and an impenetrable wall in the desert while slowly ethnically cleansing the native population.
by gorgoiler | 2025-11-24 12:59:40+00:00
And yet of course the world and their spouse import requests to fetch a URL and view the body of the response.

It would be lovely if Python shipped with even more things built in. I’d like cryptography, tabulate/rich, and some more featureful datetime bells and whistles a la arrow. And of course the reason why requests is so popular is that it does actually have a few more things and ergonomic improvements over the builtin HTTP machinery.

Something like a Debian Project model would have been cool: third party projects get adopted into the main software product by a sworn-in project member who who acts as quality control / a release manager. Each piece of software stays up to date but also doesn’t just get its main branch upstreamed directly onto everyone’s laps without a second pair of eyes going over what changed. The downside is it slows everything down, but that’s a side-effect of, or rather a synonym for stability, which is the problem we have with npm. (This looks sort of like what HelixGuard do, in the original article, though I’ve not heard of them before today.)
by jandrewrogers | 2025-11-24 13:01:02+00:00
A better example is the EUV lithography light sources used by ASML. They are manufactured in the US by a US company ASML acquired with technology licensed from US government labs. That critical part of the business is American in all but name.

It is possible that the EU could develop their own state-of-the-art lithography light sources but for now ASML is dependent on the US for it.
by heymijo | 2025-11-24 13:02:13+00:00
To get the reduced rate many municipalities will require you to visit an office, somewhere you likely have to take transportation to, during office hours (aka working hours), and provide documentation to prove this.

This isn't really unknown either. There's a very good story anyone can look up about Dr. V in India and what it took for him to actually get the eye care he wanted to provide to the people who needed it.

In the digital world many of us know you want to deeply understand your user and design with them in mind. Same thing here in the meat space.
by sdenton4 | 2025-11-24 13:03:01+00:00
Microorganism A is good at producing (say) insulin, but needs oxygen to do it. Microorganism B is good at ferrying oxygen around. Microorganism C is good at extracting oxygen from the air and attaching it to B.

Each of these cells has specialized tasks which they perform as part of the contract of getting to survive longer in the superorganism. Each has 'promises' (functions) to fulfill, and other organisms provide for their needs. The contract is set up on evolutionary timescales, rather than human timescales, but your requirements are met...
by boyanlevchev | 2025-11-24 13:04:24+00:00
If we take a simple definition of technology - such as “tool” or some external inanimate thing we use as an extension of ourselves - then I think all animals on Earth that we have deemed intelligent to some degree use “technology”. Crows using sticks to pick things out holes, chimps crafting spears for hunting, dolphins wearing “hats”, octopuses building stone fortresses, etc. So I guess it’s important to define the limit of the definition of technology.
by tdeck | 2025-11-24 13:04:51+00:00
Why are all the comments here so weird? It's like people saw (but didn't read) an article entitled "Man Opens a Taqueria in his Hometown" and the only responses are

1) Why didn't he open it in my hometown? This location isn't convenient for me.

2) Wouldn't it be better for someone else to open a taqueria instead? My cousin is looking for work. Shouldn't we be putting resources into helping him open a restaurant instead?

It's like people hear "X in Asian country" and all they can think about is their own geopolitical narrative fed to them by the US state department. Obviously Japan is going to want to develop lucrative manufacturing... within Japan.
by Newlaptop | 2025-11-24 13:06:01+00:00
Journalists really need to stop using "millionaires" when they mean billionaires, centi-millionaires and deca-millionaires.

About 1 in 5 American households are millionaires.

"Millionaire" as a label is mostly describing mundane middle-aged, middle-class people who have spent a few decades paying down a mortgage and saving 5-10% of their salary into their 401k. As a group, they pay both the highest percent of their income in taxes and their taxes are the largest share of the federal budget. It shouldn't be used to mean "rich" the way it would have in the 1960s.
by devttyeu | 2025-11-24 13:06:31+00:00
In Go you know exactly what code you’re building thanks to gosum, and it’s much easier to audit changed code after upgrading - just create vendor dirs before and after updating packages and diff them; send to AI for basic screening if the diff is >100k loc and/or review manually. My projects are massive codebases with 1000s of deps and >200MB stripped binaries of literally just code, and this is perfectly feasible. (And yes I do catch stuff occasionally, tho nothing actively adversarial so far)

I don’t believe I can do the same with Rust.
by galangalalgol | 2025-11-24 13:06:58+00:00
On your last note, I wish they would get on that signed crate subset. Having the same dependency tree as cargo, clippy, and rustc isn't increasing my risk.

Rust has already had a supply chain attack propagating via build.rs some years ago. It was noticed quickly, so staying pinned to the oldest thing that worked and had no cve pop in cargo audit is a decent strategy. The remaining risk is that some more niche dependency you use is and always has been compromised.
Show HN: Qalam - a CLI that remembers commands
by grandimam | 2025-11-24 13:08:02+00:00
I kept running into the same problem as a developer: I forget commands I’ve already figured out.

Docker cleanup sequences. Deployments with 15 flags. Test commands that finally worked. Every time, I ended up digging through bash history or Googling. It was wasting mental energy.

So I built Qalam, a CLI that actually remembers commands.

What it does:

- Ask in natural language: “How do I kill the process on port 3000?”

- Save commands with meaningful names: “deploy” instead of cryptic abbreviations

- Automate workflows: my 5-command morning setup is now one command

- Keep everything local: no cloud, no privacy worries

- Zero configuration: works immediately

I’ve been using it for weeks. Deployments are foolproof. Morning setup is one command. When something breaks, I ask my terminal instead of Googling.

https://docs.qalam.dev

I’d be curious what others do to remember complex commands or automate repeated workflows.
by JKCalhoun | 2025-11-24 13:08:43+00:00
The self-inflicted part is what really has left me reeling.

For Christmas wish lists, my daughters always have ways of surprising me with items from Africa retailers, Netherlands… I had to tell them this year to stick with U.S. only because of tariffs. I guess that's awesome for the U.S.?

(The political cartoon of Santa having to pay tariffs kind of draws itself at this point.)
by billy99k | 2025-11-24 13:09:04+00:00
"The IWGB refuted this, saying that workers only communicated in private and on legally protected trade union channels, and did not leak any information publicly."

I disagree with them here. If trade secrets are posted all over Discord, even if it's a private channel with 50 people, I would still consider this 'public'. It's outside of the company.
by hyperpape | 2025-11-24 13:09:38+00:00
I'm of two minds about this comment. A glance at the website suggests it has a lot of content and a full overhaul for 4.1m AUD (2.6m USD) might not be that that high of a price.

But the problem is with the assumption that the website needs a full overhaul. So often a full overhaul is where projects go to balloon in cost by 20x. An outside agency sells the leadership on a big picture full of fluff about "modernization" without any connection to real improvements.

A better approach would be to determine the most important weaknesses of the existing website, and incrementally improve them. But big organizations struggle with this. Government agencies are probably even worse than big corporations, but big corporations are terrible too.
by bestouff | 2025-11-24 13:09:41+00:00
This is my case. Undiagnosed, not knowing much about this condition (but with a great score at TFA's test), and struggling with one of my kids which has some symptoms I recognize. And I know why she struggles in the school system, and how she will struggle later in life, but I don't know how to help her.

I'm lucky enough to live somewhere where healthcare is a given and she's currently in the diagnostics phase (for the second time), but I'm still scared for her future. Even with help and meds and whatnot, life won't be easy I guess.
by brightball | 2025-11-24 13:10:50+00:00
In my experience, the vast majority of bugs are quick fixes that are easy to isolate or potentially even have a stack trace associated with them.

There will always be those “only happens on the 3rd Tuesday every 6 months” issues that are more complicated but…if you can get all the small stuff out of the way it’s much easier to dedicate some time to the more complicated ones.

Maximizing the value of time is the real key to focusing on quicker fixes. If nobody can make a case why one is more important than other, then the best use of your time is the fastest fix.
by dts-five | 2025-11-24 13:10:53+00:00
The newest HAs have AI that helps in noisy environments. The ones I have are the Phonak Audéo Sphere Infinio I90s. I've worn HAs for 40 years. It's truly unbelievable in noisy environments. I know it's easy to think it's all marketing garbage, but some great demos on YT of the technology. I keep them in AI mode all the time when I have them on, and charging them for an hour at lunch is enough to get me the necessary runtime.
by gorgoiler | 2025-11-24 13:11:24+00:00
Hot damn I’m a sucker for a good analogy…

”Giving creative workers more rights without addressing their market power is like giving your bullied kid more lunch money. You're just enriching the bullies.”

The big “5,4,3,2,1” is also a powerful piece of rhetoric. Who is this Doctorow person? He has my attention! :)
by potato3732842 | 2025-11-24 13:11:34+00:00
>There are such restaurants around here in Europe but they are super expensive, so you are better off doing it on your own at home.

There's a bougie breakfast/lunch place near me like that and it's wildly successful, seems like every year they open another location.

The joke conspiracy theory in my office is that the menu is made by a world class french chef who's mocking the median target/whole foods shopper who is the customer by making stuff that's objectively garbage and incompatible with the fundamentals of cooking and papering over it with sheer skill.

"haha ze dumb white wimmen want kale, I put kale in ze mac and cheese and I make them like it"

"Quinoa is trendy you say? I put quinoa in your motherfucking eggs".

Obviously I'm leaving out details but those are actual examples of combinations. Now the food doesn't suck per say, but it ain't great either. And yet the place is wildly successful.
by TrackerFF | 2025-11-24 13:12:13+00:00
Hopefully they'll go through all billed invoices with a microscope. My guess is that this will reveal outright fraud from the consulting firm(s), in the form of overbilling in hours.

Even if they bill $500/hr, and they billed 24 hours a day, that would come out to $4.38m / year for each consultant. That's a 11 member team billing 24 hours a day, all year round, for two years straight.

And if they billed more realistic hours, said team would blow up by many multiples. But of course, billed hours is not the only thing consulting firms will charge.

EDIT: For comparison, the website www.yr.no/en, has I believe 10 - 12 devs working. Maybe they've grown since the past years.
by andriamanitra | 2025-11-24 13:12:14+00:00
> No? It’s not just crime, it’s harassment, antisocial behavior, and other things that are not strictly crimes but you don’t want to be around. A lot of crimes are crimes of opportunity where someone strikes because they’re in the same place as you and see an opening. The more time they’re in the place, the more opportunities for those crimes.

Isolating people from each other is a really dystopian "solution" to reduce crime and antisocial behavior. Things naturally tend to happen more when people come together – in both good and bad. The good usually outweighs the bad by a wide margin.
by ghtbircshotbe | 2025-11-24 13:12:31+00:00
One of the dangers of a non rigorous approach is not being clear about relative rates. If you're not being precise you're going to confuse people when you say eg that in the limit this triangle is a right triangle. Or look at Taylor's theorem. In different limits you can say a curve is a line, a parabola, a cubic, etc.
by anonymous908213 | 2025-11-24 13:12:52+00:00
The Budapest Memorandum did no such thing. It is completely and totally incomparable to the US-Japan alliance. At most, it calls for a weaselly "security council action to provide assistance".

>Seek immediate Security Council action to provide assistance to the signatory if they "should become a victim of an act of aggression or an object of a threat of aggression in which nuclear weapons are used".
by ashirviskas | 2025-11-24 13:13:38+00:00
You can install codex without npm if you build it yourself, they have migrated to rust in June and npm is just a convenient install wrapper it seems.

Just `git clone git@github.com:openai/codex.git`, `cd codex-rs`, `cargo build --release` (If you have many cores and not much RAM, use `-j n`, where n is 1 to 4 to decrease RAM requirements)
by dts-five | 2025-11-24 13:13:44+00:00
I posted this standalone, but replying to you since you specifically asked about HAs in noisy environments.

The newest HAs have AI that helps in noisy environments. The ones I have are the Phonak Audéo Sphere Infinio I90s. I've worn HAs for 40 years. It's truly unbelievable in noisy environments. I know it's easy to think it's all marketing garbage, but some great demos on YT of the technology. I keep them in AI mode all the time when I have them on, and charging them for an hour at lunch is enough to get me the necessary runtime.
by input_sh | 2025-11-24 13:14:17+00:00
This is very much like asking why are you focused on fixing one bug at a time in your software when you can fix every reported bug simultaneously?

I don't know man, maybe it's because fixing this one completely inconsequential bug faces so much backlash for no particular reason other than "change bad"?

And well done with using an example from a book series where the only Asian character is named Cho Chang and where there are elves with long noses in charge of the "central bank". That really works in your favour, you totally owned me [pun intended] with that one!
by throwaway0352 | 2025-11-24 13:14:22+00:00
> charge fares, subsidize low-income riders, and fund the basic system with taxes.

Car traffic is also expensive. Highways, parking, and maintenance are massively subsidized through taxes, and they consume far more space per traveler making cities more congested and polluted.

Cities with good public transport also tend to be more walkable, which has health benefits and could provide significant impact to healthcare costs.

According to this article, every $1 invested in public transit generates about $5 in economic returns:

https://govfacts.org/housing-infrastructure/transportation/p...
by 0xFEE1DEAD | 2025-11-24 13:15:02+00:00
You should remove any reference to LEGO from the website and the examples. LEGO is extremely protective of its brand (similar to / worse than Nintendo) and does not want third parties using its name, because it is concerned that LEGO could become a generic term which could put its trademark at risk.

See: "Lego sues Dutch firm over anti-terror blocks using name and shape" https://www.thetimes.com/world/europe/article/lego-sues-dutc... ( http://archive.today/q5XrX )
by monkeydust | 2025-11-24 13:15:56+00:00
The real interesting thing is how does that principle interplay with their pillars and goals i.e. if the goal is to "optimize workflow and resource usage" then having a human in the loop at all points might limit or fully erode this ambition. Obviously it not that black and white, certain tasks could be fully autonomous where others require human validation and you could be net positive - but - this challenge is not exclusive to CERN that's for sure.
by throw0101a | 2025-11-24 13:16:08+00:00
Perhaps related: from 2022, on his (FOIA?) lawsuit against the government:

* https://news.ycombinator.com/item?id=32360533

From 2023, "Debunking NIST's calculation of the Kyber-512 security level":

* https://news.ycombinator.com/item?id=37756656
by iso1631 | 2025-11-24 13:17:24+00:00
> Fuel taxes and licensing costs don't remotely cover the infrastructure costs

In which country? Because they certainly do in the UK - about £10b a year on maintenance vs £33b a year from road taxes. Half that maintenance comes from local property taxation and half from the central exchequer

If you include the societal costs from road accidents it's nearer, with estimates putting all costs from accidents including lost productivity at £35b a year. Throw in global warming and you find drivers only cover about half the costs.

But then people who argue societal costs need to be included never seem to acknowledge the societal benefits of a road network.
by Lerc | 2025-11-24 13:17:27+00:00
Not a Lawyer, but this seems like work-for-hire.

https://en.wikipedia.org/wiki/Work_for_hire

I assume Germany has something like this (possibly a EU requirement). It would cover more than just ghostwritten books.

Most software is written in a similar manner. Microsoft didn't write windows, lots of ghostwriting programmers did.
by 999900000999 | 2025-11-24 13:17:32+00:00
There's also a legendary Star wars merch rights agreement that only expired because the rights holder forgot to send Lucas a check while the franchise was inactive.

Billions of dollars gone because of an oversight.

Arguably they didn't know Lucas was going to bring it back.

https://equinoxbusinesslaw.com/blog/how-hasbro-almost-blew-a...
by the_af | 2025-11-24 13:18:55+00:00
> Nadella does not need to justify his layoffs.

Only if his goal is to make money at all costs, which is the stance you're taking even if you protest you are not.

> It's bad, because it makes businesses highly reluctant to hire people, which makes the economy less prosperous.

(I preempted your reply, because it wasn't the point to debate whether employee protection regulations are right or wrong; the point was to show you there are different ways of conducting a business that are not merely about making maximum money).

Again, this (and pretty much everything else you wrote in your last comment) is a very American way of doing business, precisely stavros' point.

Thankfully there are other, more respectful ways, as others have pointed out repeatedly and you insist in ignoring.

> How horrible that Microsoft minted tens of thousands of multimillionaires out of their employees!

Complete non sequitur, since you're so fond of calling out logical fallacies.

> Dummy me that didn't get hired on by MSFT in the 1980s

Yes, I'm sure you'd be a millionaire and would be spared arguing with random guys on HN. Life's a bitch.
by conception | 2025-11-24 13:18:58+00:00
This is a biased source but is the first I could find- https://www.americanprogress.org/article/tax-cuts-are-primar...

But we were set to pay off the nation debt by 2013 before Bush tax cuts. Bush’s tarp, Trump tax cuts plus Covid were the other nails in the coffin of debt reduction.

Starve the beast has been an official Republican strategy for 40 years.
by intended | 2025-11-24 13:19:00+00:00
I applaud your efforts! You stated:

> I really hope that AI business models don't fall into relying on getting and keeping attention. I also hope the creators of them exist in a win-win relationship with society as a whole.

The ratio of total hours of human attention available to total hours of content is essentially 0. We have infinite content, which creates unique pressures on our information gathering and consumption ability.

Information markets tend to consolidate, regulating speech is beyond fraught, and competition is on engagement, not factuality.

Competing on accuracy requires either Bloomberg Terminal levels of payment, or you being subsidized by a billionaire. Content competes with content, factual or otherwise.

My neck of the words is content moderation, misinformation, and related sundry horrors against thought, speech and human minds.

Based on my experience, I find this hope naive.

I do think it is in the right direction, and agree that measured interventions for the problems we face are the correct solution.

The answer to that, for me, is simply data and research on what actually works for online speech and information health.
by dts-five | 2025-11-24 13:19:04+00:00
I have worn HAs for 40 years and will give my take. HAs are better, especially the new ones with AI built in. However, if you already own AirPods Pro, it's straightforward to take the test and give yourself a boost if needed. And it's an excellent way to introduce people to the idea of HAs, without breaking the bank. I've even used old pairs of them for my parents. Of course, battery life isn't sufficient for all-day use, but if you need it for a recital or one-on-one talks, and the like, it's the best bang for your buck on the market.