MurphyA/hacker-news huggingface dataset:
by tptacek | 2025-11-04 20:20:33+00:00
It sounds like common sense, but halfhearted diversification --- which is all that's available to mainstream users and enterprises --- can easily reduce security. That's because almost all real world security is logically perimeterized, with a single outward-facing attack surface that's given attention and an implicit premise that post-compromise persistence and pivoting is a given. Nobody survives an internal pentest, not even in 2025.

So by running BIND on Linux and Apache on OpenBSD and trying to tie it all into MSAD, what you're really doing is just expanding your attack surface, and once any of those are broken, attackers won't have to care about the state of the art in vulnerabilities to extend access from there.

The "monoculture" stuff is a product of a time when security pundits worried Microsoft was running the table on corporate IT. We're (generally) SAAS startup people here and very few of us run any Microsoft stuff. Almost all of us are better off extensively hardening a single Linux server environment than we are in deliberately trying to sprinkle NetBSD and Microsoft servers. That's doesn't improve security; it just turns your network into a CTF challenge.
by GuB-42 | 2025-11-04 20:21:15+00:00
In the article, many tradeoffs are mentioned. The thing is, many of these tradeoffs are necessary to support the bloat, that is, bloat needs bloat.

- Layers & frameworks: We always had some layers and frameworks, the big one being the operating system. The problem is that now, instead of having these layers shared between applications (shared libraries, OS calls, etc...), every app wants to do their own thing and they all ship their own framework. For the calculator example, with the fonts, common controls, rendering code, etc... the global footprint was probably several MBs even in the early days, but the vast majority of it was shared with other applications and the OS shell itself, resulting in only a few extra kB for the calculator.

- Security & isolation: That's mostly the job of the OS and even the hardware. But the one reason why we need security so much is that the more bloated your code is, the more room there is for vulnerabilities. We don't need to isolate components that don't exist in the first place.

- Robustness & error handling / reporting: The less there is, the less can go wrong, so more robust and less errors to handle.

- Globalization & accessibility: That's true that it adds some bloat, however, that's something that the OS should take care of. If everyone uses the same shared GUI toolkit, only it has to deal with these issues. Note that many of these problems were addressed in the Windows 9x era.

- Containers & virtualization: Containerization is a solution to dependency hell and non-portable code, you carry your entire environment with you so you don't have to adjust to a new environment. The more dependencies you have, i.e. the most bloat, the more you need it. And going back to security and accessibility, since you are now shipping your environnement, you don't benefit from system-wide updates that address these issues.

- Engineering trade-offs: that is computers are cheap, developers are expensive. We are effectively trading time to hand-craft lightweight optimized software to keeping up with the bloat.

I get the author's point, but I believe that most of it is self-inflicted. I remember the early days of Android. I had a Nexus One, 512MB RAM / 1GHz single core CPU / 512MB Flash + 4GB MicroSD and it could do most of what I am doing now with a phone that is >10x more powerful in every aspect. And that's with internationalization, process isolation, the JVM, etc... Not only that but Google was much smaller back then, so much for lowering development costs.
by cv5005 | 2025-11-04 20:21:22+00:00
This data is publically available to anyone in Sweden:

Your salary (well, last years taxable income), debts/credit rating, criminal history, address, phone number, which vehicles and properties you own and which company boards you're on.

One of organized criminals biggest income these days are scamming rich old folks because it's so trivial to get all details needed (and who to target) to be a pretty convincing bankman, IRS type agent/etc.

Some of it you have to kind of manually request at various places, but it's all available.

So data breaches aren't really that big of a deal when everything is already public.
by mrguyorama | 2025-11-04 20:21:23+00:00
My mother kept writing paper checks all the way into 2012. When I worked the local grocery store, she was one of the only people left who made us use the check printer machine.

She's just very conservative with money and relied on inertia to maintain a balanced budget and was averse to change that may cause her to mismanage money, as we were very poor.

Check writing lasted far too long here in the US, for whatever reason, but was somewhat killed in the early 2000s when dramatic increases in gas prices led to gas stations no longer accepting checks as they got so many bounced ones.

The benefits of writing a check: 100% offline. If someone is willing to accept a check from you, there's zero interaction with a third party at transaction time.

Checks take longer to process, so you can take advantage of that by spending money today that you will not have until tomorrow, with zero interest. This also allowed a kind of fraud called "Kiting" where you keep cycling bad checks to artificially increase some balances temporarily, but that was less possible by the 80s I think, as even then forms of electronic settlement existed.

They feel meaningful. It's effort to put together and requires effort to manage your account so you treat it as a bigger event, reducing impulse to spend. Credit card companies sold merchants on the ability to induce more spending, and Debit cards have the exact same feature.

You can give someone a blank check to spend for something without having to do any work with third parties "authorizing" their spend. Good for parents or small businesses, and quite dangerous.

Checks are sociologically neat. Literally just a piece of paper, but they keep up the bargain often enough that we were able to use writing on paper as an entire financial system. They also required an amount of trust and familiarity between transacting parties that isn't really normal anymore. The guy in charge of the local grocery store is some overpaid desk jockey with an MBA tweaking excel spreadsheets of spend and revenue until the graph goes up and to the right enough. 40 years ago that guy was my dad and he knew everyone in the town by name.

I have written a check three times in my life. Setting up a way to accept a debit card is way more difficult than just cashing a piece of paper once a month, so landlords are a big consumer of real checks nowadays.
by rekabis | 2025-11-04 20:21:54+00:00
> for a lot of jobs in security it's pretty hard to measure how well it's being done

Nothing going wrong: “What are we paying you for?”

Everything going wrong: “What are we paying you for?”

It’s a no-win situation unless you manage to score a division manager who understands security and understands the reports a good security division produces. And most importantly, understands that no news is good news.
by TeMPOraL | 2025-11-04 20:22:47+00:00
> Cooling is conspicuously absent other than a brief mention in the conclusion.

It's not absent - it's covered in the paper, which this blog release summarizes. There's a link to the paper itself in the side bar.

> In fact everything in this paper is already solved by SpaceX except GPU cooling.

Cooling is already solved by SpaceX too, since this paper basically starts with the idea of swapping out whatever payload is on Starlink with power-equivalent in TPUs, and then goes from there.
by embedding-shape | 2025-11-04 20:23:15+00:00
The top right button has a "Download code" which gives you a .zip file. That .zip file doesn't have any JS in it, and renders the terrain just like in the online editor, except you can turn off JS and it still works.

Edit: someone else wrote basically the same an hour ago: https://news.ycombinator.com/item?id=45814791
by vlad | 2025-11-04 20:23:21+00:00
I explained to Affinity this summer, "...it would only be in your favor to have a designer learn your tools instead of Figma and Adobe, because the reason they got popular is because people brought them to work."

In 2025, Affinity's trial was one week. Last year, hundreds of thousands of people saw ads and signed up for 6 month licenses. I signed up, but I didn't activate. There was no requirement to activate immediately in the offer, and the welcome email specifically mentioned the license would start after the downloadable products were activated.

Affinity announced in 2024 that the offer has been updated: the 6 month licenses would expire immediately if not started in the next weeks.

Since I had written my own desktop software products, I advised Affinity to email the hundreds of thousands of people and offer another long license, especially if they didn't activate or didn't use it.

I explained my advice to affinity@serif.com:

"I decided... I'm not going to be using my time to learn new design software in a week's trial... I think there is a very easy and (practically) free solution, like I wrote in the original replies, including extending a license."

"...it would only be in your favor to have a designer learn your tools instead of Figma and Adobe, because the reason they got popular is because people brought them to work."

And now, the 2024 web page with the offers redirects to the new announcement!
by goatlover | 2025-11-04 20:23:32+00:00
What does it mean to assume consciousness has no manifestation even in the case of humans? Is that denying that we have an experience of sensation like colors, sounds, or that we experience dreaming, memories, inner dialog, etc?

That's prima facie absurd on the face of it, so I don't know what it means. You would have to a philosophical zombie to make such an argument.
by sshine | 2025-11-04 20:23:46+00:00
My wife and I went for wall decoration. There’s an art gallery and a poster shop right next to each other. The price difference is a factor 100 for an average art piece.

In the poster shop you can choose between a bunch of classics, or you can upload your own AI-generated picture and have that printed as a poster.

Art was always expensive, and posters as an alternative to paintings existed way before AI. Same with copying all kinds of art.

The main difference seems to be that we can’t clearly pay royalties to anyone for AI artwork, because it’s not obvious exactly where it came from.

There was a YouTube channel dedicated to Warhammer lore narrated by an AI David Attenborough. It got taken down for infringing on his voice, but its replacement came up, starting out with a generic old man’s voice and over time gradually more Attenborough-like. When should the Attenborough estate start to get royalties? At 60% Attenborough? Or at 80% Attenborough?
by bitwize | 2025-11-04 20:24:03+00:00
When I think of good Electron apps, the first name that pops to my mind is Visual Studio Code. They really did a lot of work to make the editor responsive and capable of sophisticated things without blowing your RAM/disk budget.

But it's still bloated compared to the editor I use, Emacs.

And it's still bloated compared to a Java-based IDE of equivalent functionality. (Eclipse and IntelliJ can do much more OOTB than VS Code can.)
by geodel | 2025-11-04 20:24:38+00:00
> But programmers seem to feel that they are above this stuff.

No, programmers are quite below this stuff. Budgets for medical research, treatments, trials are way more than IT budgets. And for typical IT project the underlying point is even if requirements were wrong, changed halfway , software is malleable enough, to be changed, refactored. And all while it can remain in use even during change cycle.
by HydroKai | 2025-11-04 20:24:49+00:00
Stick figures live on! Hyun's Dojo is the new place where stick animations are. Recently the winners of a stick figure tournament have been announced https://www.youtube.com/watch?v=KO5hiRV5MTk

There is even a timeline if you want to know the full history; https://cdn.knightlab.com/libs/timeline3/latest/embed/index....
by yandie | 2025-11-04 20:24:55+00:00
I'm confused. I checked out the repo and I don't think the notebook itself - the equivalent of Jupyter is open source yet:

https://github.com/deepnote/deepnote/

What's the equivalent of `jupyerlab run`?

> You'll soon be able to:

> Take the UI you're used to from Deepnote Cloud and run it locally > Edit notebooks with a local AI agent > Bring your own keys for AI services > Run your own compute
by knlb | 2025-11-04 20:25:15+00:00
The whole post feels like it was edited/modified by ChatGPT; `What we opened — in English, not a changelog`, `Why it matters (no fluff):`, `We are big believers in notebooks — full stop` are patterns that always make me feel like an LLM wrote it (sentence followed by a marketing qualifier).

I really liked Deepnote the product when I last used it, but the post definitely feels off.
by rmonvfer | 2025-11-04 20:25:19+00:00
This looks awesome. I’m a very heavy Claude Code user (and Codex) in both the CLI and VS Code (and now in the web too!) and it’s quite infuriating when the agent just gets lost after context compaction and I have to point it to read CLAUDE/AGENTS.md (and update it if a lot of changes have been made)

I tried Windsurf a while back but I’ll definitely come back ASAP just to play with this and see how it does in a somewhat complex project I’m working on.

Kudos to the team!
by rixed | 2025-11-04 20:25:32+00:00
No really, that's a small ecosystem, we are not talking about Java or JS or python. Also, you should not need to know all the ropes of an ecosystem to work in one given environment.

If you are reasonably experienced with computers, learning the syntax will take you 2h. Again, that's Ocaml we are talking about. ML syntax has been designed to teach programming to fresh students with just a background in math.

If you already know C and Unix, you will be good to go in one afternoon... unless you want to use dune or compile to JS or use the repl etc.
by asdev | 2025-11-04 20:25:50+00:00
A feature like this isn't useful because knowing what connects to what, dependencies, etc. means nothing without business context. AI will never know the why behind the architecture, it will only take it at face value. I think technical design docs which have some context and reading the code is more than enough. This sits in the middle ground where it lacks the context of a doc and is less detailed than the code.
by syncsynchalt | 2025-11-04 20:26:24+00:00
His dad was Bob Morris. Unless that's the joke you're making.

Bob Morris wrote crypt(1), dc(1), crypt(3), libm, co-wrote the rainbow series, and did additional unknown work as a cryptographer for the NSA.

dmr writes about working with Bob Morris here: https://web.archive.org/web/20250121041734/https://www.bell-...
by fragmede | 2025-11-04 20:26:41+00:00
Apologies, I wasn't trying to have you feel like you needed to state that explicitly.

My personal opinion is still that there exist meetings and chapters that aren't religious. There are also some that absolutely are. You're free to disagree that non-religious ones don't exist. More to the point though, I don't think ratholing on an HN comment thread on the exact degree of the religioslity of "turning your will over to" the god of "really neat looking leaves" vs "it's spiritual, not religious", vs no, it's actually religious, even if we were able to reach some common ground; I don't think that's going to change underlying psychology or nature of addiction.

If all someone ever gets from going to meetings is how much they hate Christianity, yeah, they're not going to get relief and aren't likely to succeed. But if someone's able to get over that hump and find the right meetings where it's not too overbearing for them, I know it's possible for people to succeed.
by pgguru | 2025-11-04 20:26:56+00:00
For testing, we at least have a Dockerfile to automate the setup of the pgduck_server and a minio instance so it Just Works™ with the extensions installed in your local Postgres cluster (after installing the extensions).

The configuration mainly involves just defining the default iceberg location for new tables, pointing it to the pgduck_server, and providing the appropriate auth/secrets for your bucket access.
by graypegg | 2025-11-04 20:27:01+00:00
> Your total UNCOMPRESSED web resources must not exceed 512KB.

I would be interested to know how they define web resources. HN would only fit this description if we don't count every possible REST resource you could request, but instead just the images (3 svgs), CSS (news.css), and JS (hn.js).

The second you count any possible response to `https://news.ycombinator.com/item?...` in the total, we've blown the cap on 512kb... and that's where the actual useful content lays.

Feels like regular ol' REST-and-forms webapps aren't quite the target of this list though, so who knows.
by jonrouach | 2025-11-04 20:27:24+00:00
yes!

this announcement had such strong gpt-output vibe..

to the "writers": pleeease don't present unedited slop to me. i'm a human, if you want my attention consider using your own voice. i don't want to read what gpt thought would "market" you best.

but this thread did remind me of marimo so that's sweet
by FrankWilhoit | 2025-11-04 20:27:30+00:00
Maintainability -- which depends upon legibility -- trumps performance. The article acknowledges (however reluctantly) that the legacy code (A) is the only repository of the business processes and (B) is not legible enough to reverse-engineer. Never mind migration: this is an unacceptable situation right now, and the auditors ought not sign.
by dugmartin | 2025-11-04 20:27:32+00:00
Slower and unstable. I spent a lot of my freshman year in college on Bitnet chat and iirc about every 30 minutes there would be a "netsplit" and a bunch of folks in the chat would disappear. Maybe it was our universities connection, which I think was direct to UIUC. I've posted here before that back then I thought Bitnet chat was magical. Things like being in a chat room with students in Berlin while the wall was falling felt so futuristic to me.
by dingnuts | 2025-11-04 20:27:52+00:00
I've used it, and I thought it was absolute trash. Goes crazy doing shit I don't want. I spend more time deleting crap I didn't want and reviewing and changing its code than I do just writing it myself.

I know what you're going to say: I need to learn to use this groundbreaking technology that is so easy to use that my product manager will soon be doing my job but also is too hard for me a senior engineer, to find value in.

Kindly: no, I trust my judgement, and the data backs me up.

Have you taken measurements of how many features and bugs you've shipped over the last twelve months or are you just like the engineers in the METR study who self reported an improvement but when measured, had been impaired? What evidence do you have that your attitude is not simply informed by the sunk cost of your subscription?

Please share your data below
by immibis | 2025-11-04 20:27:57+00:00
I used to release an Android app 10ish years ago (before I was banned by Google from releasing Android apps) and this was the case back then. Every time I opened Eclipse it would automatically add the 6MB "support library" to my otherwise 50kB app. There was no way to turn this off, but if you removed it, it would stay removed for that session. Usually I only noticed I'd forgotten when I built the final .apk and went to upload it to the App Store.
by mslot | 2025-11-04 20:27:57+00:00
When we first developed pg_lake at Crunchy Data and defined GTM we considered whether it could be a Snowflake competitor, but we quickly realised that did not make sense.

Data platforms like Snowflake are built as a central place to collect your organisation's data, do governance, large scale analytics, AI model training and inference, share data within and across orgs, build and deploy data products, etc. These are not jobs for a Postgres server.

Pg_lake foremost targets Postgres users who currently need complex ETL pipelines to get data in and out of Postgres, and accidental Postgres data warehouses where you ended up overloading your server with slow analytical queries, but you still want to keep using Postgres.
by shakna | 2025-11-04 20:28:28+00:00
In the past, Datacarry has almost exclusively used phishing as their first penetration of systems. (Exploits follow for escalation, but not generally penetration.)

Whilst we don't know exactly what they did here, a secure programming language will do bupkus when you're targeting the meatbag behind the keyboard. We need to treat people like infrastructure, that can and will eventually fail.
by goatlover | 2025-11-04 20:28:35+00:00
Because genes don't encode the millions of years of experience from ancestors, despite how interesting that is in say the Dune Universe (with help of the spice melange). My understanding is genes don't even specifically encode for the exact structure of the brain. It's more of a recipe that gets generated than a blue print, with young brains doing a lot of pruning as they start experiencing the world. It's a malleable architecture that self-adjusts as needed.
by Night_Thastus | 2025-11-04 20:28:45+00:00
Proton is getting there but even so, it doesn't make Linux+Proton a drop-in replacement for people who have used Windows all their lives.

For people with more technical background, who are enthusiasts about computers and software - sure. For a lot of casual users who need things to 'just work' the way they always have, asking them to swap to an entirely new OS is nonsense.

I'm considering it myself but even with years of experience on Linux I'm still cautious because of a lot of edge cases where something I use now wouldn't work or wouldn't work well in Linux.
by CamJN | 2025-11-04 20:30:20+00:00
I think that ship has sailed. They already make iPads (the pro line) with M-class processors just like the laptops that run full-featured macOS. This change is to add laptops that run A-class processors like run the iPhone. If all Apple cared about with regards to what capabilities they expose in an OS was what processor was in a device then the iPad Pros would be able to run macOS, but they don’t view their products that way.
by bluebarbet | 2025-11-04 20:30:22+00:00
This is not the full picture, as you surely know.

Remote workers from rich countries do pay tax locally, in the form of VAT and sales taxes. And they typically spend far more than locals, on food to accommodation and everything in between, all while requiring nothing of the local welfare state. It's a direct wealth transfer of thousands per month, earned in one economy and spent in another. In purely economic terms, it's hard to see how this is anything but a good deal for the host country, in the large majority of cases. Hence digital nomad visas.

This is not to say that countries - and societies - don't have the right to allow or deny access to foreigners as they see fit.
by MSFT_Edging | 2025-11-04 20:30:58+00:00
I look forward to a possibility where the dumb terminal is less centralized in the cloud, and more how it seems to work in the expanse. They all have hand terminals that seem to automatically interact with the systems and networks of the ship/station/building they're in. Linking up with local resources, and likely having default permissions set to restrict weird behavior.

Not sure it could really work like that IRL, but I haven't put a ton of thought into it. It'd make our always-online devices make a little more sense.