MurphyA/hacker-news huggingface dataset:
by Nextgrid | 2025-11-24 00:16:08+00:00
> How can the "cartel" "blacklist" anyone?

All they have to do is publish a "best practices" statement or some RP certification program mandating attestation to be used (and some PR around how only "certified" RPs are secure) and job done. The only reason they didn't do that yet is that Apple is refusing to play ball and support attestation (but this may change).

The threat was clearly there in the original Github issue, and it's just a temporary inconvenience they can't currently follow through on it.

> Yes, but that doesn't mean you can't backup the full authenticator state.

Having the secondary authenticator present in the same vicinity as the primary one exposes it to risks. Having to dump authenticator state at regular intervals now means your backup authenticator must be reachable for writing online, so it can't be a simple "cold storage" backup like a Yubikey in a safe anymore. This also opens up security concerns since you're now dumping and syncing private keys left and right over a network and you lose the peace of mind of using an HSM-backed non-exportable private key where the HSM being unplugged guarantees nobody is currently using your keys.

Seems like a shit ton of complexity and effort to work around a problem OpenSSH elegantly solved 30 years ago.

> Here's a toy WebAuthN implementation

Thanks, I will check it out and read up on it. I'd be genuinely happy to move to WebAuthn if I could build my own hardware authenticators that allow the backup one to remain fully offline in a safe, and not have private keys flying around (if I'm doing that, it's not much of an improvement over syncing passwords - except those I can at least type or tell over the phone in an emergency when I need someone else to act on my behalf).

Edit: so it seems like I am mostly right? Only discoverable credentials count as "passkeys", and those generate per-site private keys, meaning offline, cold-storage backups are impossible. I guess I'm sticking to my password manager then since passkeys would provide no improvement in this case.
by lsaferite | 2025-11-24 00:16:31+00:00
The University of Florida (Gainesville, FL), has a small nuclear reactor on campus. My mom always talked about it when I was young as she worked in the nuclear engineering department. I just checked and it's still active. Apparently it's been online since 1959.

https://news.ufl.edu/2025/10/uf-students-join-elite-ranks/

https://neup.inl.gov/infrastructure/university-research-reac...
by __MatrixMan__ | 2025-11-24 00:17:17+00:00
You just go after the top four or five. It's not about proportional punishment, but about ensuring that those with enough power to actually affect outcomes feel a sense of responsibility over those outcomes whether or not they later divest.

Blindly letting a CEO commit crimes should itself be a crime, but only if there's something you could've done to prevent it--that's not most shareholders.
by lurk2 | 2025-11-24 00:17:39+00:00
> The network was small: just 49 Facebook accounts, 85 Instagram accounts and 71 Twitter accounts in question.

This is the pattern with all Russian influence operations; they’re always implied to be ominously large and end up being laughably small.

American political polarization had nothing to do with the Russians; this is just the refrain of frustrated Democrats who refuse to acknowledge the consequences of ill-conceived policy. Israel has always had far more sway over American politics.
by ebbi | 2025-11-24 00:17:50+00:00
> Yes, "aggression" that happened on its own, completely unprovoked.

Ahh, propaganda again. You really are a victim of propaganda, or believe history started on Oct 7. Predictable.

> You are seriously justifying rampant murder by terrorists.

I'd say, and most people around the world, that that's what you're doing. I'm recognizing resistance, and calling out crimes where it occurs. I'm not one to tell oppressed people how to be oppressed, how to be the perfect victims. When you oppress people, it's going to backfire at some point in time.

As far as I recall, Hamas has openly called for, and encouraged, third party involvement to investigate any war crimes committed on Oct 7th and to prosecute the perpetrators. Israel? Not so much...
by gfiorav | 2025-11-24 00:18:54+00:00
I’m not against public spending. US presidents from both parties have increased public spending when necessary.

Your perspective on the US political spectrum is where I suggest you reconsider. Most Europeans are ethnonationalists, regardless of their political leanings.

Consider the rise of the far right following immigration. While the outcome remains uncertain, I fear it won’t be pretty. It certainly won’t be something to boast about. Europe is on the brink of experiencing its most extreme, fascist, racist, and rightward shift in a long time.

This raises the question of why you’re so certain that Europe is “left-leaning.”
by JoshTriplett | 2025-11-24 00:19:04+00:00
> My main use case is to get up-to-date news on things that mainstream media doesn't cover accurately.

Or hasn't covered yet. It's interesting to watch the cycle of "shows up on social media" then "shows up in industry-specific press" then "shows up in mainstream press", with lag in each step.

These days, Fediverse is providing the same thing for some industries. You see stuff show up there first, then show up on X and industry press a little later, then mainstream press a little later.
by laxd | 2025-11-24 00:21:07+00:00
I've felt it through my guilty pleasure of scrolling instagram reels periodically. They've obviously changed their algorithm from time to time and it's crazy how I've intermittently have gotten endless right wing stuff and leftist ridiculing and thinking there's a lot good points. Then it's suddenly just convincing leftist material again or at best you're-all-dumb content.

It's really fucked how the online content providers have moved from letting you seek out whatever you might fancy towards deciding what you're going to see. "Search" doesn't even seem like an important feature anymore many places.
by pod_krad | 2025-11-24 00:21:44+00:00
>Incremental progress would be a peace negotiation which brings both nations back to the realm of economic exchange, and an end to the senseless mass murder of innocents.

Again you don't understand what you talking about. There are no negotiations. At all. There is only a proposition for Ukraine to capitulate to Russia: the reduction of the Ukrainian army by more than half, the near-legal recognition of the captured territories as Russian, and so on.
by iamnothere | 2025-11-24 00:22:03+00:00
> how open are you to a US citizen verified town square online? You'd have to scan your passport or driver license to post memes and stuff.

I had this same idea before and it’s not terrible. If it guaranteed user privacy by using an external identification service (ID.me?), it might get some attention. You would likely have to reverify accounts every 6 months or so to limit sales of accounts, and you would need to prevent sock puppets somehow.

If you allow pseudonymity you would get some interesting dynamic conversations, while if you enforced a real name policy I think it would end up like a ghost town version of LinkedIn. (Many people don’t want to be honest on a “face” account.) The biggest problem with current pseudonymous networks like X/Twitter is you have no idea if the other person really has a stake in the discussion.

Also, if ID were verified and you could somehow determine that a person has previously registered for the service, bans would have teeth and true bad actors would eventually be expelled. It would be better to have a forgiving suspension/ban policy because of this, with gradually increasing penalties and reasonable appeals in case of moderation mistakes.
by neom | 2025-11-24 00:22:28+00:00
I'm not sure how they are getting the info but it's not as simple as logged in IP, mine says I'm based in Costa Rica, I was on vacation there 2/3 months ago, but it's not primarily where I use my x account and I've logged in from a phone and a computer from other countries since, and CR would be a relatively small amount of time in my total usage, so I find it strange it thinks my account is based there.
by ofalkaed | 2025-11-24 00:22:46+00:00
That task would be beyond my skills, as I said, I am just a hobbyist. I think it would be interesting to see what would result from going back to one of those early foundational languages and developing a modern language from it. With a language like Algol we don't have the decades of evolution (baggage) which are a big part of languages like C and C++ and trickle into the languages they inspired even if they are trying to remove that baggage. So, what would we get if we went back to the start and built a modern language off of Algol? What would that look like?
by djohnston | 2025-11-24 00:22:58+00:00
> regard schizophrenics as "subhumans".

I hope you aren't insinuating this is my position? That man is a subhuman. He is lesser than a rat. I wish him nothing but unending torment and fear for many years to come. In no way is my contempt for him universally applicable to all schizophrenics. I judge the man by his actions not his condition.
by rafabulsing | 2025-11-24 00:23:22+00:00
As I pointed out, I agree that defining what should be deemed acceptable and what shouldn't is a bit subjective, and can definitely be debated. Reasonable people can disagree here, for sure.

That's why I proposed that maybe the solution is:

1. only explicit actions are considered. A click, a tap, an interaction, but not just viewing, hovering, or scrolling past. That's an objective distinction that we already have legal framework for. You always have to explicitly mark the "I accept the terms and conditions" box, for example. It can't be the default, and you can't have a system where just by entering the website it is considered that you accepted the terms.

2. explicitly labeling and confirming of what is an suggestion algorithm altering action and what isn't. And I mean, in band, visible labeling right there in the UI, not a separate page like that Meta link. Click the "Subscribe" button, you get a confirmation popup "Subscribing will make it so that this content appears in your feed. Confirm/Cancel". Any personalized input into the suggestion algorithm should be labelled as such. So companies can use any inputs they see fit, but the user must explicitly give them these inputs, and the platforms will be incentivized to keep this number as low as possible, as, in the limit, having to confirm every single interaction would be annoying and drive users away. Imagine if every time you clicked on a video, YouTube prompted you to confirm that viewing that video would alter future suggestions.

I'm ok with global state being fed into the algorithm by default. Total watch time/votes/comments/whatever. My main problem is with hyper personalized, targeted, self reinforcing feeds.
by wiredpancake | 2025-11-24 00:24:49+00:00
I'm not sure what you are trying to suggest.

What does it matter if Gabe has a yacht? He has multiple of them. Gabe also have an undersea research company called Inkfish, which is a non-profit company designed to "conduct deep-sea research and explore, map, and study the least-explored parts of the ocean".

In 2020 he donated $300,000 to the Starship Children's Hospital. In 2020 Gabe Newell arranging free concert for New Zealand. In 2014 Gabe founded a Racing Team which helps support Grassroots motorsports, the Heart of Racing Team also supports the Seattle Children's Hospital. Game is also the co-founder of a company called foundry10, which is an education research organization focused on youth philanthropy.

Gabe is not the evil person you are trying to make him out to be. He has visited numerous schools, colleges and universities and done free talks out of goodwill. He has put millions into research and development of Linux software for the bettering of Linux community as a whole. He doesn't "Just like Linux", through his investments and care for the Linux community, Valve has made Linux a viable gaming platform, which it would be likely a decade behind without his investments.
by aw1621107 | 2025-11-24 00:24:49+00:00
> Rust cannot recover.

catch_unwind exists for a reason.

> e.g. when you have an exception in a destructor then it's a guaranteed `std::terminate`.

You can throw in a destructor [1]. You just need to mark that destructor noexcept(false). You do get a guaranteed std::terminate if an exception escapes a destructor while unwinding is already underway, though.

> Do note that C did not have such a flaw built into language

assert() says hi?

> I mean specially designed embedded C code can survive total RAM erasure and still perform some meaningful work (with CPU registers and ROM intact).

Why doesn't a similar argument apply to "specially designed" Rust?

> Or compare it to BEAM that can have processes crash all day long and still continue to work.

Again, nothing stops you from writing Rust that does the same.

[0]: https://doc.rust-lang.org/std/panic/fn.catch_unwind.html

[1]: https://cpp.godbolt.org/z/ao4cf3zrr
by byko3y | 2025-11-24 00:25:41+00:00
>Eventually I rewrote my btree on top of Vecs. My node & leaf pointers are now array indices. The result? There is no longer any unsafe code. The code has become significantly simpler and it now runs ~10% faster than it did before, which is shocking to me. I guess bounds checks are cheaper than memory fragmentation on modern computers.

Optimizations are very complex and potentially fragile in Rust, LLVM has to sort through tons of generated IR, so it might be just that native Rust structures are optimized better for compilation. Particulary, Rust is able to optimize out some bound checks.

Do note that binary trees are mostly an obsolete legacy today — they are way too cache-unfriendly. I mean you could have written similar code in C++ using std::vector or std::dequeue and get the bounds checking too.

>Everyone talks about memory safety but IMO rust’s best features are enums, traits, cargo, match expressions and so on

C++20 with concepts mostly reproduce the traits. C++17 with std::variants emulate enum/tagged union. Match is unmatched by C++, that's true.

Cargo is good for as long as there are few packages in there. Large projects already suffer from five versions of serde in one build and dependencies on FFI-connected libs that cargo itself cannot build. I mean look at the NPM nightmare — and they've mostly dodged FFI-s.
by gerdesj | 2025-11-24 00:26:30+00:00
Erdős

I was told by a hungarian, that hungarian written spelling and spoken pronunciation is pretty precisely aligned compared to, say, english. Except when it comes to names when it gets a bit random!

Why not do the bloke the decency to spell his name correctly? Those diacritics are important.

Anyway, I was told that Paul's name is very roughly pronounced by an anglophone as: "airdish".
by blargey | 2025-11-24 00:27:22+00:00
And so the user response is just organic local political provocateurs crowing over examples of their "opponents" on social media being foreign plants, while ignoring all the times their "side" were baited by fake enemies and boosted by fake allies, and then it's back to business as usual. Same game different players - if even that; the success of these accounts already relied on some combination of credulity and wilful ignorance.

Yay politics. Hooray for the engagement-driven internet.
by lurk2 | 2025-11-24 00:27:33+00:00
There were a number of accounts that got doxxed in the last year that were demonstrated to have Indian owners. Engagement farms have been doing this since Trump’s first term; the goal is primarily ad revenue, not political influence. I didn’t see any that were Israeli but everyone knew those accounts were there.

It’s possible the Russians have contracted influence campaigns out to Indian and Israeli firms, but the simpler explanation is just that India is continuing its long and storied history of using telecomm networks to scam unwitting boomers while Israel is continuing its long and storied history of being the worst greatest ally of all time.
by Nextgrid | 2025-11-24 00:29:35+00:00
I was thinking the HSM in this case is your Macbook and its TPM/Secure Enclave, in which case you'd either recover it or assume the attacker is unable to use it due to biometrics/PIN. I guess the Yubikey has a PIN too with a limited number of tries.

Either way, you either recover the HSM and then don't need to rotate the keys, or you don't in which case you either use OpenSSH's key revocation mechanism (which I believe involves distributing some some sort of CRL to every server), use time-limited SSH certificates and wait out the expiry of the compromised key, or scrap the whole CA and start fresh.

Again this depends on your threat model. The somewhat uncommon requirement where you can't manage your own `authorized_keys` on the remote host complicates things a lot; if you could, then you'd use your existing access (sign yourself a new certificate using your SSH CA) to rotate the whole CA... or just keep two keys in there (primary and backup) and skip the whole CA dance, since it's purely a workaround for the hard requirement of only being able to put one key in authorized_keys.
by energy123 | 2025-11-24 00:29:56+00:00
This sounds like being wilfully uninformed. Russia organized almost a dozen Black Lives Matter protests, one of them attended by Michael Moore. They ran about half of the largest US identity focused Facebook groups (Christian/Black/etc) during the 2020 US election. I gave you one small example, it's on you to look for the full picture rather than jump to an erroneous conclusion based on god knows what motivations.

The problem in particular is not only the scale but that this propaganda is not solely directed at altering US policy towards Russia, it's also about stoking ethnic and religious tension to try to weaken the US and destroy its ability to be a unified cohesive country. If the US is fighting itself then it isn't fighting Russia after all.
by ddtaylor | 2025-11-24 00:30:42+00:00
I'm not claiming that any specific companies are registered in China or operate from China. It's possible that because many Chinese users are using Zorin this is why their community has taken a different stance on free/open software licensing.

EDIT: Either way, my main point is that Zorin is responsible for how they redistribute the source code and other modifications to the software they sell. They refuse to do that sometimes, and they gaslight their community / the open source community.
by o11c | 2025-11-24 00:31:20+00:00
Let's say a gallon of gas costs $4 and your car gets 40 MPG. So $1 gets you 10 miles if you only consider gas (which very many people do, even if you think they shouldn't - much maintenance is imagined as time-based, and this is not entirely wrong - cars do decay even if you don't drive them, and insurance only rarely considers your odometer and only coarsely if so).

Wear and tear is generally assumed to be roughly equal to gas costs on well-maintained roads, depending on a lot of varying assumptions of what to include. So, 5 miles.
by vidarh | 2025-11-24 00:32:12+00:00
"Homeless" in that sense, however, are not rough sleepers (people who actually sleep outside), which would seem to be what is meant in this context.

It's by no means zero, but in autum 2024, rough sleepers were estimated at less than 4700 in the UK. That might well represent and undercount, but it is certainly nowhere remotely near the people counted as homeless, who would include anyone without a permanent address, such a people e.g. sleeping at friends places on a non-permnanet basis.
by makeitdouble | 2025-11-24 00:32:41+00:00
> from a core of fantastic engineers surrounding by marketing/sales, to the org's direction being set by marketing/sales UX be damned.

> MacOS

I think macos is on the same path.

Apple refined the MacBook formula to a perfection and the hardware division made the best of it. But outside of the processor, what is the last significant leap forward that involved brilliant engineers that you can think of ?

One could argue that nothing should change, but that's a lot of missed opportunies (I personally wanted a response to the Surface Pro, and figured out it won't come anytime soon) and we also know that's not how it goes. If there's no significant progress there will be change for the sake of change (coughLiquid Glasscough)
by thomassmith65 | 2025-11-24 00:33:13+00:00
While the location now shows US, X notes that the account location might not be accurate due to use of VPN

Just 'now'... not when signing up for their account?

It's cheap and easy to use social media to propagandize, so certainly there are scores of fake American accounts, but it's irritating that this article doesn't address VPN-usage during account creation.
by engeljohnb | 2025-11-24 00:34:34+00:00
> As you probably can deduce by now, I see both examples as having the potential of being art

I suppose it was a mistake to get distracted by trying to find out what exactly you're trying to say -- it's now completely clear that it has nothing to do with whether art or programming takes longer to gain proficiency.

>labored [...] tedious

Saying my points are long-winded or redundant also doesn't support your point. You're doing a lot of philosophizing about what art is or whether my points are "useless," but you still haven't reasoned about why it's not true that art takes longer to learn than programming. Which is rich since you've spent more words on this matter than me.

>Such comparisons, as relatable as they might sound to someone who is familiar with these titles, are often useless as well (I am aware of these games and their game mechanics, but have never played them nor care to do so).

So, you haven't played the games, therefore you have no insight into the analogy, so you're not really in a position to say whether the comparison is useless.

You've also used the word "useless" a handful of times here, all without any follow-up as to why exactly. What "use" are you referring to here?

In the context of a programmer wanting to know how learning to draw compares to learning to program (something I've only been asked once, but even once is enough to prove it's useful), to say "expect drawing proficiency to take longer, because it requires more repetition" is useful.

Once again, this isn't deduction or hypothesis. It's my own experience with both crafts.
by FloorEgg | 2025-11-24 00:34:46+00:00
Most content on the internet has been optimized to get attention, not to represent truth.

AI trained on most content will be filled with misconceptions and contradictions.

Recent research has been showing that culling bad training data has a huge positive impact on model outputs. Something like 90% of desirable outputs comes from 10% of the training data (forget the specifics and don't have time to track down the paper right now)

I really hope that AI business models don't fall into relying on getting and keeping attention. I also hope the creators of them exist in a win-win relationship with society as a whole. If AIs compete with each other based on which best represent truth, then overall things could get a lot better.

The alternative seems dreadful.

Edit: I am curious why this is getting downvoted.
by vidarh | 2025-11-24 00:35:43+00:00
Most heroin addicts can be remarkably close to a normal functioning healthy person if they don't live in precarious conditions without access to a clean supply.

The proportion of heroin addicts who would still be wrecks with healthcare that extends to prescribing what they need is miniscule.

So the first problem is thinking you need to get them off heroin to be able to start dramatically helping.
by chaboud | 2025-11-24 00:36:01+00:00
Well, this is THE Bay Area, where we live in THE city, drive on THE 101, and eat in THE Chinatown.... wait...

Funny enough, though, it wasn't until I moved here 15+ years ago that it struck me how odd it is to call it "the Bay Area" and expect people to know what that means. Nonetheless, sportscasters do it. Musicians do it. All other bay areas are just areas around bays...