MurphyA/hacker-news huggingface dataset:
by wormslayer666 | 2025-11-30 20:06:19+00:00
I opted to try the "beg the manufacturer to turn off the panopticon" approach[1]. The first time I got 2 hours of elevator music before hanging up, the second I went through 3 levels of customer support before they claimed it was done (3 days later). Might have to steal your approach to verify that though...

[1] https://www.mazdausa.com/site/privacy-connectedservices
by LudwigNagasena | 2025-11-30 20:06:55+00:00
There is no secure notion of "correctly" that goes both directly against specs and de facto standards. I am struggling to even imagine how one could make an L7 balancer that should take into account possibilities that someone would go against HTTP spec and still get their request served securely and timely. I personally don't even know which L7 balancer my company uses and how it would cache GET requests with bodies, because I don't have to waste time on such things.

Running PostgreSQL on any non-privileged port is a feature, not a deviation from a standard. If you want to run PostgreSQL on a port under 1024 now that would be security vulnerability as it requires root access.

There is no reason to "build up a risk assessment and judge each deviation on its own merit" unless it is an unavoidable technical limitation. Just don't make your life harder for no reason.
by jeroenhd | 2025-11-30 20:07:18+00:00
OsmAnd works fine in Android Auto with WiFi and mobile data turned off. Sygic does too. I believe TomTom also sells navigation apps that will work fine under these conditions.

I use Android Auto mostly because I don't trust manufacturers of car components to maintain their software and to put more than bargain bin SoCs in their infotainment consoles. There's no need for your Android phone to have a connection to the outside world if all you're using it for is locally installed apps.
by lurk2 | 2025-11-30 20:08:58+00:00
> Conservatives are split into 2 groups. Conservatives who are in it for the money and conservatives who are in it because they don't know any better.

An inane assertion made without evidence.

> nor is it a job that someone who isn't very knowledgeable could do

So why is the bias the worst in the least rigorous fields?
by mjr00 | 2025-11-30 20:09:04+00:00
I feel like this has been beaten to death and this article isn't saying much new. As usual the answer is somewhere in the middle (what the article calls "miniservices"). Ultimately

1. Full-on microservices, i.e. one independent lambda per request type, is a good idea pretty much never. It's a meme that caught on because a few engineers at Netflix did it as a joke that nobody else was in on

2. Full-on monolith, i.e. every developer contributes to the same application code that gets deployed, does work, but you do eventually reach a breaking point as either the code ages and/or the team scales. The difficulty of upgrading core libraries like your ORM, monitoring/alerting, pandas/numpy, etc, or infrastructure like your Java or Python runtime, grows superlinearly with the amount of code, and everything being in one deployed artifact makes partial upgrades either extremely tricky or impossible depending on the language. On the operational and managerial side, deployments and ownership (i.e. "bug happened, who's responsible for fixing?") eventually get way too complex as your organization scales. These are solvable problems though, so it's the best approach if you have a less experienced team.

3. If you're implementing any sort of SoA without having done it before -- you will fuck it up. Maybe I'm just speaking as a cynical veteran now, but IMO lots of orgs have keen but relatively junior staff leading the charge for services and kubernetes and whatnot (for mostly selfish resume-driven development purposes, but that's a separate topic) and end up making critical mistakes. Usually some combination of: multiple services using a shared database; not thinking about API versioning; not properly separating the domains; using shared libraries that end up requiring synchronized upgrades.

There's a lot of service-oriented footguns that are much harder to unwind than mistakes made in a monolithic app, but it's really hard to beat SoA done well with respect to maintainability and operations, in my opinion.
by dzentota | 2025-11-30 20:09:06+00:00
OP here. This is a detailed analysis of a malware attack I recently encountered.

TL;DR: I was approached for a job on LinkedIn and asked to run a Next.js project. The malware wasn't in package.json dependencies but was triggered by next.config.js executing a fake jQuery file during npm run dev.

It dropped a Python RAT that targets LastPass vaults and crypto extensions. I managed to deobfuscate 65 layers of the payload to find the source code.

Happy to answer any questions about the analysis or the vectors used.
by abeppu | 2025-11-30 20:09:10+00:00
No, if anything the article has a copyedit error in saying twice in one sentence that the doubling is after inflation-adjustment.

> While there have been some small declines in tuition prices over the last decade, when adjusted for inflation, College Board data shows that the average, inflation-adjusted cost of public four-year college tuition for in-state students has doubled since 1995.
by moondev | 2025-11-30 20:09:18+00:00
> They check all the boxes for server / NAS

I was pretty disappointed to find out that none of the ms-01 ms-a1 or ms-a2 have a ATX power button header. This means you need to solder wires to the tiny tactile switch and connect those to something like a pi-kvm to get true power control/status and ipmi/redfish

Just seems like something simple they could have easily included if they wanted to really target the homelab space
by mkup | 2025-11-30 20:09:52+00:00
Microsoft has dropped 16-bit application support via builtin emulator (NTVDM) from 64-bit builds of Windows, whether it happens to be Windows 10 or earlier version of Windows, depends on user (in my case, it was Windows Vista). However, you can still run 16-bit apps on 64-bit builds of Windows via third party emulators, such as DOSBox and NTVDMx64.
by eric-burel | 2025-11-30 20:10:01+00:00
I call that self-destructive prompting in the sense that you use AI to output programs that replace calling the AI in the future. The paper seems to indicate that this also brings much better results. However it's subject to attacks as running generated code is usually unsafe. A sandbox has to be used, major agentic AI players are providing some solutions, like Langchain sandbox released earlier this year.
by everforward | 2025-11-30 20:11:08+00:00
I work as an SRE and would fight tooth and nail against this. Not because I can’t do it, but because it’s a terrible idea.

For one, you’re wrong about TLS meaning only your infra and the client matter. Some big corps install a root CA on everyone’s laptop and MITM all HTTP/S traffic. The one I saw was Bluecoat, no idea if it follows your expected out-of-spec behavior or not.

For two, this is likely to become incredibly limiting at some point and require a bunch of work to re-validate or re-implement. If you move to AWS, do ELBs support this? If security wants you to use Envoy for a service mesh, is it going to support this? I don’t pick all the tools we use, so there’s a good chance corporate mandates something incompatible with this.

You would need very good answers to why this is the only solution and is a mandatory feature. Why can’t we cache server side, or implement our own caching in the front end for POST requests? I can’t think of any situations where I would rather maintain what is practically a very similar fork of HTTP than implement my own caching.
by rlt | 2025-11-30 20:11:49+00:00
I don’t we’re at the “companies bought too many GPUs” stage yet. My understanding is they still can’t get enough GPUs, or data centers to put them in, or power to run them. Most companies don’t even own them, they rent from the clouds.

We are, however, at the “we need an AI strategy” stage, so execs will throw anything and everything at the wall to see what sticks.
by susam | 2025-11-30 20:11:59+00:00
I learnt this subject from the book Galois Theory, 5th ed. by Ian Stewart. Quoting from page 177:

Theorem 15.10. The polynomial t⁵ - 6t + 3 over ℚ is not soluble by radicals.

As you can see, this theorem occurs in Chapter 15. So it takes fourteen chapters before we reach here. It takes a fair amount of groundwork to reach the point where the insolubility of a specific quintic feels natural rather than mysterious.

To achieve this result, the book takes us through a fascinating journey involving field extensions, field homomorphisms, impossibility proofs for ruler and compass constructions, the Galois correspondence, etc. For me, the impossibility proofs were the most interesting sections of the book. Before reading the book, I had no idea how one could even formalise questions about what is achievable with a ruler and compass, let alone prove impossibility. Chapter 7 explains this beautifully and the algebraic framework that makes those proofs possible is very elegant.

By the time we reach the section about the insoluble quintic, two key results have been established:

Corollary 14.8. The symmetric group S_n is not soluble for n ≥ 5.

Theorem 15.8. Let f be a polynomial over a subfield K of ℂ. If f is soluble by radicals, then the Galois group of f over K is soluble.

The final step is then quite neat. We show that the Galois group of f = t⁵ - 6t + 3 over ℚ is S₅. Corollary 14.8 tells us S₅ is not soluble. By the contrapositive of Theorem 15.8, f is not soluble by radicals.

Obviously whatever I've written here compresses a huge volume of work into a short comment, so it cannot capture how fascinating this subject is and how all the pieces fit together. But I'll say that the book is absolutely wonderful and I would highly recommend it to anyone interested in the subject. The table of contents is available here if you want to take a look: https://books.google.co.uk/books?id=OjZ9EAAAQBAJ&pg=PT4

Two small warnings: The book contains a fair number of errors which can be confusing at times, though there are plenty of errata and clarifications available online. And unless you already have sufficient background in field homomorphisms and field extensions, it can take several months of your life before you reach the proof of the insoluble quintic.
by davnicwil | 2025-11-30 20:12:11+00:00
In my experience basically everything being good in software is downstream of good data modelling.

It's partly why I've realised more over time that learning computer science fundamentals actually ends up being super valuable.

I'm not talking about anything particularly deep either, just the very fundamentals you might come across in year one or two of a degree.

It sort of hooks back in over time as you discover that these people decades ago really got it and all you're really doing as a software engineer is rediscovering these lessons yourself, basically by thinking there's a better way, trying it, seeing it's not better, but noticing the fundamentals that are either being encouraged or violated and pulling just those back out into a simpler model.

I feel like that's mostly what's happened with the swing over into microservices and the swing back into monoliths, pulling some of the fundamentals encouraged by microservices back into monolith land but discarding all the other complexities that don't add anything.
by kousun12 | 2025-11-30 20:12:46+00:00
A project that I am working on. Like claude code but for more than coding. Your own stateful, computational environment where an agent can do instrumental computing to help you get things done, build mini apps (preferring local dbs and indexes), and set up automations. Networking built in (stable URLs), system level snapshots / rollbacks, fluid compute (temporarily switch the system to super specs / GPUs). Drive the agent with any of the latest foundation models.
by cyberax | 2025-11-30 20:12:56+00:00
I tried to use K8s several times, and I just can't make it work. It's fine as a deployment platform, but I just can't justify its complexity for local development.

We're using Docker/Podman with docker-compose for local development, and I can spin up our entire stack in seconds locally. I can attach a debugger to any component, or pull it out of the Docker and just run it inside my IDE. I even have an optional local Uptrace installation for OTEL observability testing.

My problem is that our deployment infrastructure is different. So I need to maintain two sets of descriptions of our services. I'd love a solution that would unify them, but so far nothing...
by pfannkuchen | 2025-11-30 20:13:12+00:00
Land is fundamentally scarce, though, unlike other durable goods, so what you say does not follow. And by land, I mean land situated near geographically and/or economically useful areas. To make land like other durable goods, you need to convince people to treat all land equally, which is against human instinct (ie good luck with that).

This doesn’t mean nothing should be done and things are great, but if we mischaracterize a problem we have little hope of solving it.
by jeroenhd | 2025-11-30 20:13:18+00:00
eCall mustn't be active until an accident occurs. The lawful interception lobby tried hard to turn every car into a free data point they could sell to the government, but their efforts have failed.

Last I heard they've shifted their efforts to making remote activation of on-board cameras part of the 5/6G smart car bullshit (which will of course be part of road safety requirments not long after).
by SatvikBeri | 2025-11-30 20:13:33+00:00
Re 1: I like Matt Ranney's take on it, where he says microservices are a form of technical debt – they let you deploy faster and more independently in exchange for an overall more complex codebase.

This makes it clear when you might want microservices: you're going through a period of hypergrowth and deployment is a bigger bottleneck than code. This made sense for DoorDash during covid, but that's a very unusual circumstance
by tim333 | 2025-11-30 20:13:55+00:00
I recently bought one of these. It's pretty quiet (on the low setting) - you quite likely wouldn't hear it near a freeway https://www.amazon.co.uk/gp/aw/d/B071SLZRRV

vid of the noise levels https://youtu.be/wOc0TM1ErYA?t=195
by twodave | 2025-11-30 20:14:17+00:00
I came here to say the same. If you’re arguing either for or against microservices you’re probably not thinking about the problem correctly. Running one big service may make sense if your resource needs are pretty uniform. Even if they’re not you need to weight the cost of adding complexity vs the cost of scaling some things prematurely or unnecessarily. Often this is an acceptable precursor to splitting up a process.
by viccis | 2025-11-30 20:14:54+00:00
>Certainly if a student can get admitted into an ivy league they should at least inquire about eligible aid packages.

Bear in mind when I say "elite college", I'm not talking Ivy Leagues, as those have covered tuition for the non-wealthy students for a while now. I'm talking elite liberal arts colleges (Amherst, Swarthmore), elite private universities (MIT, Rice), etc. Many state schools cover a lot but your mileage varies dramatically, and it's often tied to fairly intense GPA requirements. Georgia Tech has a student suicide problem because of this, for example.

>This was ~15 years ago but during that time all the teachers at the CC had Masters degrees in their field and also had additional teaching credentials(some had PHDs).

It's much worse now. A lot of the core classes (calculus, first semester bio and chem, etc.) don't have teachers at all. You're given all of your instruction via canned videos and your homework and evaluation through online tests. There's often a way to contact a teacher of some sort, but they will mostly be terse and just link you to a resource to work on it yourself or direct you to a forum where you and your classmates can talk about it.

This isn't covid, this is from this year. A lot of this started with covid but has stuck around for budgetary reasons. YMMV but for a lot of places, this is how you cut costs to be able to easily offer free college. Some of the classes will still have teachers, but the big ones that people typically use CC for will be largely automated because that's what scales.
by rconti | 2025-11-30 20:15:09+00:00
The ADAS systems mandated in Europe are insanely intrusive. I had a few rental cars in Europe this summer and wanted to send them off a cliff. (and I'm not an auto tech luddite, I've had modern cars in the US with autopilot type systems, lane keep, blind spot warning, rear traffic assist radar, forward collision warning, etc. IMO rear traffic assist/FCW/AEB tend to work really well, autopilot pretty well, and lane keep and blind spot silly gimmicks at best).

Bring on the full self-driving cars, or let me drive my own car. This human-in-the-loop middle state is maddening. We're either supervising our "self-driving, but not really" cars, where the car does all of the work but we still have to be 100% aware and ready to "take over" the instant anything gets hard (which we know from studies is something humans are TERRIBLE at)... Or, we're actively _driving_ the car, but you're not really. The steering feel is going in and out as the car subtly corrects for you, so you can't trust your own human senses. Typically 40% brake pedal pressure gets you 40% brake pressure, unless you lift off the throttle and hop to the brakes quickly, in which case it decides when you apply 40% pedal pressure you actually want 80% brake pressure. Again, you can't trust your human senses. The same input gets different outputs depending on the foggy decisions of some computer. Add to that the beeping and ping-ponging and flashing lights in the cluster.

It's like clippy all over again. They've decided that, if one warning is good and helpful, constant alerts are MORE good and MORE helpful. Not a thought has been given to alert fatigue or the consequences of this mixed human-in-the-loop mode.
by Veserv | 2025-11-30 20:15:39+00:00
You clearly do not understand protocol/interface design.

The behavior and constraints of a generic interface is a lower bound on the behavior and upper bound on the assumable constraints by all direct participants when handled in general. This is POST in general. This is the weakest usage.

A specialized interface may enhance behavior or tighten constraints further. This is actually using POST to achieve some website-specific end. You can not actually use a website/reason about usage in anything other than a read-only fashion without knowing what the endpoints actually do and when to issue requests at which endpoint.

Indirect or intermediary participants should maintain behavior and constraints at the lower of the level of specialization they are aware of and the participants they are between. If you are designing a generic intermediary, then you do not have access to or knowledge about the specialized interfaces, so are less able to leverage specialized behavior or constraints. In HTTP, various headers serve the purpose of communicating various classes of common interface specializations so someone can write more powerful generic intermediarys. However, you could always write a specific intermediary or handler if you control portions of the chain, which people do all the time.

This applies across all classes of software interfaces and protocols not just websites using HTTP. But I guess HTTP is just such a special snowflake that it is beyond learning good practice from other fields.
by Quekid5 | 2025-11-30 20:15:56+00:00
> I think it's pretty widely agreed that requiring type annotations at the function level is a good thing anyway. Apparently it's considered good practice in Haskell even though Haskell doesn't require it.

In Haskell-land: At the global scope, yes, that's considered good practice, especially if the function is exported from a module. When you just want a local helper function for some tail-recursive fun it's a bit of extra ceremony for little benefit.

(... but for Rust specifically local functions are not really a big thing, so... In Scala it can be a bit annoying, but the ol' subtyping inference undecidability thing rears its ugly head there, so there's that...)
by petermcneeley | 2025-11-30 20:16:13+00:00
How do I prove where I got my copper from? I can tell you why all of these things are bad ideas. They are bad ideas because you are outlawing legal commerce.

Copper has value. If people have this copper in their garage they can then get some value. The copper then goes back into the economy. Win Win. However if there is no gain to recycling it it might not quickly end up back into the economy. This is of course bad.

A totally radical view is to simply outlaw stealing :)
by wredcoll | 2025-11-30 20:16:20+00:00
People who use the term "cancel culture" are trying to silence their critics. If this isn't what you intend, you may wish to reexamine the words you use and how you use them. Because you keep bringing up wikipedia, lets actually quote from it:

> n October 2017, sexual assault allegations against film producer Harvey Weinstein led to the cancellation of his projects, his expulsion from the Academy of Motion Picture Arts and Sciences, and legal consequences, including a conviction on charges of rape and sexual assault.

Is this the cancel culture you're so vehemently against? People disassociating from Harvey Weinstein because of his history of sexual abuse?

How about the next one:

> In November 2017, comedian Louis C.K. admitted to sexual misconduct allegations and, as a result, his shows were canceled, distribution deals were terminated, and he was dropped by his agency and management.

Is this more of that cancel culture you're trying to get rid of?

I'll pick an example I like from that page:

> According to Lisa Nakamura, University of Michigan professor of media studies, canceling someone is a form of "cultural boycott" and cancel culture is the "ultimate expression of agency", which is "born of a desire for control [as] people have limited power over what is presented to them on social media" and a need for "accountability which is not centralized".[3][42][43]

There's some abstract talk about "mob justice" and "disproportionate response" but that is so far from reality that attempting to use it as a guideline for what's actually happening is laughable.

In the actual, real world, cases, rich and powerful people with nearly infinite access to spreading their own speech are complaining about being disinvited from college speeches or even fired from their tv show.

Here's a follow up: in your definition of the word and your understanding of reality, do you claim the jk rowling was cancelled or experienced cancelled culture and if so was this a bad thing?
by seanmcdirmid | 2025-11-30 20:16:32+00:00
I don’t know much about Harvard except like Stanford computer science became the biggest major by far in the last couple of decades. It could be a lot of rich kids are choosing it’s a major without much of a passion for it. It could have also become the default major for people who are planning to got into politics, business, management, or even law (Harvard’s traditional strengths).

Don’t get me wrong, we don’t have much of a choice in evaluating especially junior hires. Even for senior hires you want to make sure they haven’t drifted through their last jobs without actually coding. But on the spot performances are different even for the simple stuff, they should practice coding questions on the fly regardless, and even the worst possible SWE candidate should be able to pass these with a bit of prep. With a lot of prep they could do leetcode, a still suck at the job when they get it.