MurphyA/hacker-news huggingface dataset:
Ask HN: How are you preparing for the impending Android sideloading changes?
by BrenBarn | 2025-11-29 07:11:00+00:00
I've been dismayed to see the news in the past few weeks about Android effectively killing "true" sideloading (i.e., entirely out of Google's control). One recent post did suggest they'll provide an escape hatch for "advanced users" but I'm not super optimistic about how that gets implemented.

My current phone is old and getting slow so I've been pondering how to prepare for this change. I use (and need to use) a mix of F-Droid and Play Store apps, so I'm not such a die-hard that I insist on using only FOSS. But I'd like to do what I can to keep that option open. I've considered various options when getting a new (but fairly cheap, mid-grade) phone: trying to disable OS updates; trying to find a reasonably cheap phone that's compatible with an alternative like Postmarket; doing nothing and hoping the "advanced" escape hatch is actually workable. Switching to Apple is a bridge too far for me. :-)

I'm curious if other people here are thinking about how to react. What will you do if this goes through and sideloading becomes impossible or impractical? Also curious from a developer perspective for those who have apps on F-Droid or the like: how will you distribute your apps in the future?
by navar | 2025-11-29 07:13:03+00:00
I created a small app that shows the difference between embedding-based ("semantic") and bm25 search:

http://search-sensei.s3-website-us-east-1.amazonaws.com/

(warning! It will download ~50MB of data for the model weights and onnx runtime on first load, but should otherwise run smoothly even on a phone)

It runs a small embedding model in the browser and returns search results in "real time".

It has a few illustrative examples where semantic search returns the intended results. For example bm25 does not understand that "j lo" or "jlo" refer to Jennifer Lopez. Similarly embedding based methods can better deal with things like typos.

EDIT: search is performed over 1000 news articles randomly sampled from 2016 to 2024
by moepstar | 2025-11-29 07:13:46+00:00
Sure, having legislation would help tremendously.

What would help just as much: people actually giving a fcuk - as in: researching how durable something is, how hackable, how cloud-dependant or not...

...and not act all surprised when something stops working once the manufacturer calling it quits (or starts charging for a previously-free service).

Today, whenever i talk to others how i evaluate products i still get blank stares and i might as well have talked in a foreign tongue.

Also not happening: learning from $companys previous behaviour - stopped supporting something after a year? No parts, no schematics, no nothing?

Well - welcome to my shitlist of companies that'll never see another $/€ from me, ever again.

Doing this eventually would force companies to change their ways, but as long as they can continue selling whatever dreck they come up with to the masses...
by ProllyInfamous | 2025-11-29 07:14:51+00:00
At a minimum: If your resumé previously lacked page 2, it no longer does.

I'd recon your page 3 has already begun, too... as you digest all these intentional comments, over the next few months: don't ever lose your glee of hackiness.

Luck, given — but you've already done all the work!
Show HN: Structural Genesis – structure emerging from nothing (Ø₀)
by jengbeng | 2025-11-29 07:14:54+00:00
A compact structural framework proposing that Ø₀ (a null non-structure that only permits distinguishability) is the unique origin and terminus of all structure. From this, a deterministic gradient emerges: Ø₀ → θ₁–θ₈ → Δ₀ → S₀ → Sₙ → X → Ø₀. It formalizes how distinctions, subjectivity, ensembles, and coherence limits arise and collapse. Looking for critique, prior work, or collaborators.
by tartoran | 2025-11-29 07:15:33+00:00
It's not as subjective as it is more of a case by case decision. This example is quite misleading but polymorphic classes are sometimes useful when the domain grows, when you have have to update new behaviors all the time.. In that case then the switch becomes harder to maintain. Classes isolate behavior so new types don't modify existing code. I'd stick with switch statements in all the other cases. Sure, this could be abused and make simple things unnecessarily complicated but am just pointing out that there's a use-case for it.
by tbyehl | 2025-11-29 07:16:28+00:00
I started a new job a couple months ago and a week hasn't gone by where I haven't said "For less than we're paying annually for [some software / SaaS], we could buy three Synologys sized to do that thing, at least as good if not significantly better, with a high-availability cluster on-prem plus a remote replica, with no more administration overhead than we have now."

And invariably the conversation turns to hardware specs. SMDH.
by godelski | 2025-11-29 07:17:05+00:00
> It sounds good in theory but signal updates are beyond excessive

Those are two different arguments.

Updating too frequently is not equivalent to "doesn't need to be updated." I can agree that they update a bit too frequently but that's nowhere near the argument about never updating.

A program cannot be secure if it does not update. Full stop.

> Most of the time there is zero explanation for the update

There's always a changelog.

If you, unlike most people, are interested it is all open source

https://github.com/signalapp https://github.com/signalapp/libsignal/releases https://github.com/signalapp/Signal-Android/releases https://github.com/signalapp/Signal-iOS/releases https://github.com/signalapp/Signal-Desktop/releases

I would suggest looking at the actual commits and not just the release notes. Libsignal usually has more info about the security

> legitimately can't think of another app or program that updates more frequently

Probably because they do so silently.
by Tanoc | 2025-11-29 07:17:08+00:00
There's an issue of scale to it all, and interconnectivity. Back in '98 you could reasonably post something in one forum/BBS/IRC channel and it would only be viewed there. There was no way to look up who was on what website or room and where they regularly hung out. And even if there was, it's unlikely that more than ten people would ever see what you posted. There weren't enough people to care, and there wasn't any extrinsic incentive to look up what people did outside of your tiny island. Eventually the island would sink, and all traces of it except maybe an archived snapshot of the home page would remain.

Smartphones changed that with Youtube and Facebook. Youtube incentivized you to use a Google account, and Facebook wouldn't let you use it anonymously without an account. Because you could use one account to log into multiple places people could track you across websites. People could make archives, screenshots, and transcriptions of anything you had done with those linked accounts. With this change there was no safe corner to hide if you said something stupid. And because so many people were foolish enough to tie their real identities to these online accounts with their real names or pictures of themselves, it gave a way for particularly unruly people to track these individuals even offline. There was now a real danger if you said something stupid, because instead of just getting your post deleted or starting a derailment in the thread people could harass you at your home, get you fired, and even send the police to terrorize you in the middle of the night via SWAT raids. It's no longer just one person calling you out. It's now hundreds, maybe even thousands, all armed with information.

And this is why I say it's stupid to require phone numbers and real names to sign up for insignificant things like being able to view someone bake a duck shaped cake live over the internet.
by arjie | 2025-11-29 07:17:50+00:00
I remember reading this headline and then going and looking at the XMAG index[0].

YTD: +15.5%

1 year: +9%

Since inception (Oct 2024): +14%

Comparing that with S&P500

YTD: +16.7%

1 year: +13%

Since XMAG inception: +18%

The article should start with such a comparison but it just seems like a lot of text with very little numerical comparison, which makes it not very useful to conclude what the case is.

0: https://www.defianceetfs.com/xmag/
by WCSTombs | 2025-11-29 07:18:40+00:00
There are thousands of different proofs of the Pythagorean theorem, and some of them are really cool. The purely trigonometric proof that was found by some high school students recently is a great one. However, I think the greatest proof of all is this little gem that has been attributed to Einstein [1].

Take any right triangle. You can divide it into two non-overlapping right triangles that are both similar to the original triangle by dropping a perpendicular from the right angle to the hypotenuse. To see that the triangles are similar, you just compare interior angles. (It's better to leave that as an exercise than to describe it in words, but in any case, this is a very commonly known construction.) The areas of the two small triangles add up to the area of the big triangle, but the two small triangles have the two legs of the big triangle as their respective hypotenuses. Because area scales as the square of the similarity ratio (which I think is intuitively obvious), it follows that the squares of the legs' lengths must add up to the square of the hypotenuse's length, QED.

It's really a perfect proof: it's simple, intuitive, as direct as possible, and it's pretty much impossible to forget.

[1] https://paradise.caltech.edu/ist4/lectures/Einstein%E2%80%99...
by turblety | 2025-11-29 07:18:44+00:00
Oh, no way. This is really cool. Anything to make presentations more interactive and interesting. I like the look too.

I’m doing something similar with interactive stories [1] but where multiple trees can happen.

I wonder if you could use AI to let people explore your presentation on their own after (maybe even during the presentation).

Like, explain a slide in more detail. You put a dump of information (death by PowerPoint style stuff) then let it think up questions the guest can explore?

1. https://gluze.com
by rkagerer | 2025-11-29 07:20:47+00:00
Once upon a time I would download the source code of a library, unzip it, and personally vet the code before adding it to my project.

With some package managers these days I don't even know how to do that (and I'm not necessarily talking about Node, specifically). How do you figure out what the install process does to your computer, without becoming an expert on the manifest syntax? For those of us who care about what goes on under the hood, it is definitely not easier than the days of following well-formed (or even semi-formed) documentation by hand.
by skirmish | 2025-11-29 07:21:09+00:00
> It's a lesson that's always learned far too late when it becomes slow and costly to deliver something new because you've amassed so much tech debt

No, it is just standard operating procedure: deprecate a working system and write a new system from scratch, with 50% of features not supported. This side-steps the tech debt and gives everybody artifacts for promotion. It screws all users of the system but who cares about them!
by raphman | 2025-11-29 07:23:52+00:00
hiq's comment was not about Whisperfish but about the presage library. My comment can be read as "Whisperfish wrote their own implementation of the signal protocol" - which is wrong. (Sorry, can't edit it anymore)

With presage, Whisperfish has a high-level Rust library that wraps the official libsignal libraries (which are also written in Rust) and makes it much easier to write clients. The official Signal repo only contains Java/Typescript/Swift wrappers. As presage is rather obscure, I thought that some HN readers might appreciate the link.
by max51 | 2025-11-29 07:24:14+00:00
>While she was moving my legs using her upper body, it felt quite intimate and I admired her for being so professional while doing her work physically and giving psychological support as a bonus.

Have you considered that from her pov, there was nothing intimate about it? I wasn't there to watch it, but in my experience, these situations are only "intimate" or awkward AFTER you start talking about how intimate and awkward there are. For people who have to touch bodies regularly at work (eg. me when I was a gymnastic coach), there is nothing intimate about it. The only ones who think it's sexual/intimate/awkward/weird/etc. are those who have no experience with it.

It's the same thing when you get a medical procedure done. Believe it or not, the nurses and the surgeon do not give a single fuck about seeing your dick. Its not intimate or sexual for them.
by navar | 2025-11-29 07:25:56+00:00
You can refer to https://huggingface.co/spaces/mteb/leaderboard and use that to guide your selection.

Check under the "Retrieval" section, either RTEB Multilingual or RTEB German (under language specific).

You may also want to filter for model sizes (under "Advanced Model Filters"). For instance if you are self-hosting and running on a CPU it may make sense to limit to something like <=100M parameters models.
by sam1714 | 2025-11-29 07:26:55+00:00
It's a thing, but it's not universal on the A320.

Original 1984 critical hardware: the box has an EEPROM module, you swap it on the plane.

FMS (which requires monthly nav data updates) and all modern hardware: the box can be updated over the ARINC 429 serial bus or Ethernet (newer systems/planes), called dataloading

Dataloading had different methods. A320s through the 2000's, most airlines had a 3.5 floppy disk drive on board (Airbus FDDU), and a mechanic fed floppies in. It was slow. Evolution of that was a USB port that took a flash drive.

Most current planes of older models just got rid of on-board dataloading. The mechanic uses a laptop with a cable or purpose-built tablet and plugs into a port. The mechanic can download the software via Wi-Fi or cellular onto the device: https://www.teledynecontrols.com/products/hardware-systems/p...

Airlines can indeed buy a on-board box that connects to Wi-Fi and LTE at the gate which downloads software. This is standard for the latest models that produce more data (A350, 787), but optional for older models. The mechanic still needs to go to the plane and push the buttons to tell it to load.

https://www.teledynecontrols.com/products/dataloading/eadl-x... https://www.teledynecontrols.com/products/hardware-systems/g...
by godelski | 2025-11-29 07:28:51+00:00
> update or not shouldn't be taken away from users.

So turn off auto-update? You can do this everywhere except iOS.

> Let users make the trade off between those downsides and the risk of zero days.

Those trade-offs are that if your version is too old (protocol has been updated several times and you are out of the lifetime) then you can no longer communicate with those who have updated as you will make their communications insecure.

If you don't want to update, that's fine. But your preference for not updating doesn't get to override my preference for secure communication. It is literally the whole point of Signal... if you don't want security and privacy then don't use Signal, that's your choice and no one is forcing you to use the app.
by rwmj | 2025-11-29 07:29:13+00:00
VMs might not have a network connection at all, or (in a more normal secure configuration) have all their network traffic trunked onto a VLAN that avoids touching the host. Vsock is designed so it can only be used for traffic between the hypervisor/host and guests (or between guests on the same host). It's more akin to virtio or hypercalls than a traditional network.
by godelski | 2025-11-29 07:31:41+00:00
> a update that I not personally security reviewed

Great, can you give me a summary of the updates for the Linux Kernel, Android Kernel, iOS kernel, libssl, and all the drivers that updated this week on my arch machine?

> Sorry, thats not a argument.

Neither is pretending you're reviewing hundreds of thousands of lines of code a week.

This is Hacker News man, some of us actually understand how computers work.
by TeMPOraL | 2025-11-29 07:31:47+00:00
> - still scrapes metadata

> - run by company who's entire objective is to profile you

And? Pick your poison. Being profiled by Meta isn't high enough on my threat board to be worth switching to E2EE as a countermeasure; in fact, I only use E2EE because Meta forced it on me with Whatsapp (new network effects) and by enabling it in Messenger (old network effects).

But that's besides the point. The point is, I did not expect such an alignment of outcomes between user-hostile corporations and grassroots OSS developers, as both fight to saturate the IM space with network effects-driven apps that disenfranchise end users "because security".

I imagine Signal is also more than happy about remote attestation and upcoming Android developer verification? All more ways to protect the integrity of the network and ensure the user isn't accidentally stripping E2EE by doing something silly like perusing their messages in ways not prescribed by the developer?

> What, should we also just use telegram where E2EE is off by default?

I don't like it because it made other choices that led to their larger network being infested with scammers and all kinds of shady types, but at least the client itself doesn't suck :).
by lmm | 2025-11-29 07:34:45+00:00
You can have a system that puts out heartbeat timestamps and treat that as the single root upstream for all your inputs, or you can allow each source to timestamp its inputs and make a rule about how far your clocks are allowed to drift (which can be quite generous), or you can give every source an id and treat your timestamps as vectors and have a rule that any "combine events from source x and source y" must happen in a single canonical place.
by Grimblewald | 2025-11-29 07:35:02+00:00
No, if i recall the section in her autobiography, specifically it was being taught the concept of "i" / "me" that did it.

Up until that point language was just an extension of what she already knew, it was the learning of being other that did the trick. Being blind and deaf would certainly make it hard to draw a distinction between the self and the world, and while languaged helped her get that concept under wraps, i dont think it's strictly speaking required. Just one of many avenues towards.
by dijit | 2025-11-29 07:36:29+00:00
yep, but for most of those its not very good for us.

Like fast food, it makes satiates a short term desire for a long term problem.

At least, facebook, instagram and an argument can be made for gmail.

I think goods are a different thing altogether though, nobody tells you what to do with your washing machine after you buy it, but social media engines use your data against you and change the rules/system on a whim.
Ask HN: Dunkelflaute' turns off my monitor
by bertili | 2025-11-29 07:37:26+00:00
I'm based in Denmark and blackout or power grid issues are a non issue here, as far as I know. I also have three state operated wind turbines when looking out the window (not that it probably matters here) but I can easily tell if the wind is blowing.

My problem is that today, and in periods during winters, we sometimes have periods of what Germans call 'dunkelflaute' - foggy weather where the turbines stall and solar panels go dark. And then my monitor turns dark! I can sometimes get it back after switching it on and off a few times, but it will soon go dark again on "those days", where I work on a laptop instead.

Previous years I didn't grok the spooky correlation/causation, but I clearly see it now.

The monitor (which I really like, Dell UltraSharp 43", running at 53 watts) is connected to a Mac Mini M4 via a HDMI cable (5 meters long). Changing the HDMI cable, the issue still persist. With a smaller Dell monitor, there are no issues. Ok, no problem, just change the monitor.

But wait... I got spooked up - is there is even such a thing as 'thin' or 'fluttering' electrical supply at this 53 watt consumption level? Is this be a first hint of a solarpunk future where data centers gobble up the "good electricity" and we are left with "leftovers"?
by baobun | 2025-11-29 07:37:33+00:00
If it helps your intuition: Even at 3-4 remaining, you'll still win at the next turn. Above that your chances of getting it right are too low compared to the reduction (assuming there is an option eliminating enough).

This could be made more complicated/interesting if you play a series of games and are awarded points based on either how many rounds it took to win or how many remaining cards you still had.
by nkmnz | 2025-11-29 07:37:59+00:00
You’re looking at the 0.00001% as an argument why the lower 99.99999% cannot marry into that class - when, in fact, it’s just a matter of math that they cannot do. The marriages of Markle and Simpson have always been more accepted than a peasant marriage between a Catholic and a Protestant in 1950s Germany - just to put your claim into perspective.

Edit: or to put it differently, which of the two scenarios has been more likely in the past 500 years: the daughter of a blacksmith marrying a baron, or the son of a blacksmith becoming a baron through merit?
by sfink | 2025-11-29 07:39:11+00:00
I didn't know that at some point, then I knew that and found it obvious, and now I don't know it again.

Strings are very very not sequences of bytes. Strings are a semantic thing. There may be a sequence of bytes in some representation of a particular string, but even then those bytes are not enough to define a string without other stuff. An encoding, at the very least. But even then, there are many things that could be described as a "string". A sequence of code points, perhaps? Or scalar values? Grapheme clusters?

Not to mention that you may not even have a linear sequence of bytes at the bottom level. You might have a rope (cons cell), or an intern pointer, or...
by ece | 2025-11-29 07:39:19+00:00
A few vendors have been stopped from shipping binary modules with Linux, notably those linking to certain symbols. Enough vendors have contributed enough to make Linux actually usable on the desktop with a wide range of off the shelf hardware and more and more are announcing day one compatibility or open source contributions. The same is hardly true for the BSDs.

It's obvious Sony is keeping certain drivers closed source while open sourcing other things, and why Nvidia decided to go with an open source driver. It's not hard to understand why, it could be some pressure or a modified GPL2.
by godelski | 2025-11-29 07:39:43+00:00
> I hired a company called OpenAI to do it for me. >>> If it's OK to encode it in your natural neural net, why is it not OK to put it in your artificial one?

Well I guess that lines up. With that line of reasoning I have zero issue believing you outsourced your reading to them. You clearly aren't getting your money's worth.
by auggierose | 2025-11-29 07:40:02+00:00
Of course a lot of apps will not be able to live with the restrictions, but if you can write your app as a webapp (PWA), you should do that instead of using Electron or Tauri. I do it because I find either build system atrocious, and with webapps I can just use esbuild. Using Chrome for example, people can install webapps as desktop apps on any operating system, if they like, and the footprint is minimal.
by queenkjuul | 2025-11-29 07:40:19+00:00
I've had mixed results with this, recent versions of Adobe in particular gave me trouble.

I've been meaning to try WinBoat, but it's based on the same underlying technology (docker+RDP) so I'm guessing I'll hit the same bugs. I was thinking maybe i could alter the code to launch a different RDP client instead of the default.

Still, if you just need Office, it's a much more integrated setup than you can easily achieve with VMs.