MurphyA/hacker-news huggingface dataset:
by LexiMax | 2025-11-24 17:05:51+00:00
This has been the case on nearly every open source and proprietary project, I have worked on.

Most people do not care and will stick with the old default on old projects and use the new default on new projects. Occasionally, it stokes conversations around possible third options that are more descriptive like stable or development, but the norm is to just go with the default.

Going out of your way to set the default to the old name really reeks to me of slacktivism. People probably think that they're taking a stand, but in actual fact others will just assume that your repository is older or that you have an old configuration.
by PopAlongKid | 2025-11-24 17:06:02+00:00
Disagree, in the U.S. the original by Johnny Nash reached number 1 on the Billboard chart while the cover version by Cliff only reached #18. While chart position is not the ultimate determination of "better", I also personally have always liked the Nash version, I didn't even know Cliff did a cover until today.

https://en.wikipedia.org/wiki/I_Can_See_Clearly_Now
by Asparagirl | 2025-11-24 17:06:02+00:00
It’s not common, but it does happen. Andy Weir, author of “The Martian” and “Project Hail Mary”, originally gave his work away for free online on his website. He only self-published to Kindle (for the lowest possible price setting, 99 cents) because some of his fans didn’t know how or didn’t want to manually install his home-rolled ePubs on their devices, and begged him for the Amazon/Kindle distribution.
by Lutger | 2025-11-24 17:06:08+00:00
You're severely limiting the blast radius. This malware works by exfiltrating secrets during installation, if I understood it correctly. If you would properly containerize your app and limit permissions to what is absolutely required, you could be compromised and still suffer little to no consequences.

Of course, this is not a real defense on its own, its just good practice to limit blast radius, much like not giving everybody admin rights.
by steveklabnik | 2025-11-24 17:06:43+00:00
Well, the issue is that "aliasing optimizations" means different things in different languages, because what you can and cannot do is semantically different. The argument against strict aliasing in C is that you give up a lot and don't get much, but that doesn't apply to Rust, which has a different model and uses these optimizations much more.

For Rust, you'd have to patch the compiler, as they don't generally provide options to tweak this sort of thing. For both rust and C this should be pretty easy to patch, as you'd just disable the production of the noalias attribute when going to LLVM; gcc instead of clang may be harder, I don't know how things work over there.
by sevensor | 2025-11-24 17:07:35+00:00
I disagree. Our notion of waves is no less an analogy to macroscopic phenomena than billiard balls. There’s no avoiding the dual nature, and there’s no problem with saying that the wave analogy works in some places, but the particle analogy works in others. The only real truth here is “neither.” A photon is a photon, and there is no macroscopic analogy it reduces to perfectly.
by mort96 | 2025-11-24 17:08:49+00:00
HDR should not be "typical web" anything. It's insane that websites are allowed to override my system brightness setting through HDR media. There's so much stuff out there that literally hurts my eyes if I've set my brightness such that pure white (SDR FFFFFF) is a comfortable light level.

I want JXL in web browsers, but without HDR support.
by whimsicalism | 2025-11-24 17:09:01+00:00
Because ‘poverty’ is a moving waterline generally pretty divorced from material circumstance in developed countries.

> Around one-third of Britain’s children – about 4.5 million – now live in relative poverty, often measured as living in a household that earns below 60% of the national median income after housing costs, a government report published in April found.

It makes no sense for poverty to be a fully relative measure, it should be against a basket of goods.
by CuriouslyC | 2025-11-24 17:09:10+00:00
There's a real discoverability issue on platforms from generative AI; real artists are getting crowded out due to poor algorithmic curation. 100% agree on this point.

Real talking head videos do way better than AI videos though (there's a huge authenticity movement), and a lot of what people like about consuming content is the connection with the creators, so I don't think creators are really threatened by AI.

Generative AI is dangerous to pop, but for subculture fans, the uniqueness of the art means a lot more, because subculture people tend to be discovery motivated.
by Yokohiii | 2025-11-24 17:09:38+00:00
I'd require vendor code being committed to git and integrated into the CI/CD pipeline. It should be treated as if you own it, just with a policy whether you want to change it or not.

The difficulty to make changes obvious is same for forks and vendored commits, imho. You can write big warnings in commit messages, that's it I guess. Which kind of boils down to deliberate team policy again. But I generally prefer monorepos for various reasons.
by twistedpair | 2025-11-24 17:09:45+00:00
ProTip: use PNPM, not NPM. PNPM 10.x shutdown a lot of these attack vectors.

1. Does not default to running post-install scripts (must manually approve each)

2. Let's you set a min age for new releases before `pnpm install` will pull them in - e.g. 4 days - so publishers have time to cleanup.

NPM is too insecure for production CLI usage.

And of course make a very limited scope publisher key, bind it to specific packages (e.g. workflow A can only publish pkg A), and IP bound it to your self hosted CI/CD runners. No one should have publish keys on their local, and even if they got the publish keys, they couldn't publish from local. (Granted, GHA fans can use OIDC Trusted Publishers as well, but tokens done well are just as secure)
by gnfargbl | 2025-11-24 17:09:53+00:00
Let's invert that thinking. Imagine you're the "security area director" referenced. You know that DJB's starting point is assumed bad faith on your part, and that because of that starting point DJB appears bound in all cases to assume that you're a malicious liar.

Given that starting point, you believe that anything other than complete capitulation to DJB is going to be rejected. How are you supposed to negotiate with DJB? Should you try?
by VWWHFSfQ | 2025-11-24 17:10:14+00:00
I seem to remember the FBI attempting to compel Apple to decrypt a criminal's iPhone, only for Apple to refuse and claim that it wasn't possible. I'm not sure exactly what happened after that. I think it was suspected that the NSA was able to do it by exploiting an unpatched zero-day. So they didn't need Apple's help anymore and the issue was dropped from the public's eye.
by chimeracoder | 2025-11-24 17:10:31+00:00
> It does, however, make providing housing more profitable, which, on the margins, will drive more landlords and home builders into the market, decreasing long term costs

Landlords are, by and large, not the ones who create new housing units, and "lack of profit potential is" also generally not the main impedance to creating new housing in most locations either.
Show HN: Nano Banana Pro – Simple text-to-image and image editing playground
by zphrise | 2025-11-24 17:10:38+00:00
Hi HN,

I built a small web app around the new *Nano Banana Pro* image model: https://nanobananaproimg.com

It’s a very simple, hosted playground focused on two things:

- *Text to Image* – Type a prompt and get a high-quality image. - *Image to Image* – Upload an image and edit it with text instructions (change style, background, lighting, objects, etc.).

No local setup, no API keys, no fine-tuning. You just sign up, buy credits, and use the model in the browser.

---

### What you can do on the site

- Generate images from text prompts (up to 2000 characters). - Upload an existing image and restyle / edit it. - See cost and remaining credits next to the generator (2 credits = 1 image). - Download the result and use it for social posts, thumbnails, simple marketing visuals, etc.

Right now there are three paid annual plans (Starter / Standard / Premium) with different monthly credit amounts. The goal is just to make the pricing predictable and keep the UI minimal so non-technical users can still play with the model.

---

### What this is *not*

To be clear:

- It’s *not* a fine-tuning / training platform. - It’s *not* a local setup tool. - It’s *not* an official product from the team behind the model. - It’s just an independent wrapper around the Nano Banana Pro image API with a credit system and a clean UI.

---

### Why I built it

I’m an indie developer experimenting with small AI SaaS products. Nano Banana Pro launched with strong image capabilities, but most non-technical users don’t want to deal with API docs, SDKs, or dev environments.

This project is mainly:

- A way to learn how people actually use the model (what prompts, what use cases). - A testbed for pricing / credits and onboarding flows. - A minimal tool for creators who just want “type prompt → get image”.

---

### Feedback I’m looking for

- Is the UI/flow clear enough for you? - Does the credit + pricing structure make sense? - What’s missing for your real workflows (e.g. batch generation, history, presets, etc.)?

If you have thoughts on the UX, pricing, or landing page copy, I’d love to hear them. Thanks for taking a look!
by dghlsakjg | 2025-11-24 17:10:44+00:00
This is a US site, patronised seemingly by mostly non-Candians. My purpose is to contextualize who and what the subtext of this phrase's use in Canada within the context of this Canadian story.

> All of these supposed "dog whistle" call-outs do not feel constructive to me. I would never have though the parent comment was deriding Indians (and still don't).

The point of a literal dog-whistle is that the intended audience (dogs) can hear and understand the whistle perfectly, while other people do not hear anything at all.

Figuratively, a dog-whistle phrase leaves room for debate (like this), and provides cover for people to say unsavory things while still being able to deny the meaning. Well-meaning folks can say things like "I would never have though the parent comment was deriding Indians" because that is the whole point of the dog-whistle in modern rhetoric.

The analogy holds well here as well. You can wade into any right wing space in Canada and you will hear the phrase "low trust society' and "high trust society". It is ALWAYS used in the context of immigrants (low trust) and white Canadians (high trust). It is almost always used in reference to Indian immigrants specifically.

The whole point of a dog whistle is that you can take them at face value and see nothing explicitly wrong with the statement. Is it possible that this commenter simply blundered into this phrasing without understanding that it is used specifically against Indian immigrant cultures by the extreme right? Yes. Do I believe that they happened on the exact same particular phrasing and argument that anti-Indian/anti-immigrant groups use was made by pure coincidence? No.

If OP did blunder into their statement, they can easily reply and correct their true intent. If I accidentally used a racially loaded statement that signals allegiance with certain groups, I would absolutely want someone to point it out so I can clarify.

You can believe whatever you want.
What are ways you have maximized your agency in life?
by cbenjumea | 2025-11-24 17:11:00+00:00
Since I came across the concept of agency years ago (thanks to George Mack), it’s something I keep revisiting in my life: how can I make the most of my personal agency? There are obvious things, like having a bias toward taking action and taking extreme ownership of everything, but what less common things do you think help increase agency in life?

Here’s mine: having interesting hobbies, and doing and reading things purely for the joy of it, creates engaging topics of conversation that build deeper connections with people than staying on the surface level. And it’s a way to make things happen to you. A person of high agency is always an interesting person.

Do you have any similar examples that have helped you have more agency in your life?
by timschmidt | 2025-11-24 17:11:29+00:00
> I'm confused

The original paper which proposed the OpenSSL Heartbeat extension was written by two people, one worked for NSA and one was a student at the time who went on to work for BND, the "German NSA". The paper authors also wrote the extension.

I know this because when it happened, I wanted to know who was responsible for making me patch all my servers, so I dug through the OpenSSL patch stream to find the authors.
by nedt | 2025-11-24 17:11:38+00:00
I had being using krypton, with the private key being on my iPhone, and am now using secretive. Never had much of an issue with not having access to my private key. We made rolling out public keys to the servers very easy by using the gitlab key file. So when I get a new Macbook I'd just need to create a new key and upload it to gitlab. We have multiple devops that can run the playbook to roll it out to the servers. And if they have a new Macbook I roll it out for them. And we don't have that many Macbook upgrades anyway.
by anonymousiam | 2025-11-24 17:12:15+00:00
Not sure if you've been to China lately, but their standard of living has improved dramatically over the past 25 years (after they began restricting and penalizing imports). The quality of their domestically-built consumer products now exceeds what's available in the US, and costs less. This is what happens when you stop outsourcing and bring manufacturing on-shore. The opposite has happened to the US over the same period, where international corporations (such as GE, GM, etc.) shut down on-shore manufacturing and import everything. In addition to the immediate economic effects, the long term effect is that the US has lost its ability to participate (let alone compete) in many manufacturing areas.

https://en.wikipedia.org/wiki/Economic_history_of_China_(194...
by james2doyle | 2025-11-24 17:12:32+00:00
There seems to be quite a few of projects like this these days:

* https://github.com/Scythe-Technology/zune * https://github.com/lune-org/lune * https://github.com/luau-lang/lute * https://github.com/seal-runtime/seal

All slightly different. Personally, I like Lune and Zune. Have used both to play around and find them fun to use
by crazygringo | 2025-11-24 17:13:20+00:00
> Under Termination, a media company can force you to sign away your rights in perpetuity, but you can still claim those rights back after 35 years. Termination isn't just something to bargain away, it's a new power to bargain with.

It's sentences like these that make it hard for me to take Doctorow seriously.

No media company is "forcing" anyone to do anything. They're paying creatives for their work. Every creative is free to say no. Musicians are free to shop their music to different record labels for the best deal. Authors pitch their books to different publishers to see which one offers the best deal. And there's always self-publishing as well.

We can have a reasonable conversation about copyright without saying silly untrue things like media companies are "forcing" creators to take deals.
by lukifer | 2025-11-24 17:13:20+00:00
They're inherently different: creative work (especially in a digital, trivially replicated format) is non-rivalrous, and at least partially non-excludable. "You wouldn't download a car." [0]

Property rights are a social technology to balance incentives and peacefully negotiate scarce resources (including time and effort). It's helpful to think about them in reverse: that they encode legitimacy to use force (usually via the State) against anyone who violates the right. That doesn't make the force right or wrong, a priori; it simply describes what happens. Exactly when that force is legitimate is the question at hand.

"Intellectual Property" is a post-hoc neologism. What we actually have are three very specific institutions: copyrights, patents, and trademarks. The last is arguably more like regulation than property: persistent brand identity to prevent fraud and confusion. Copyrights and patents are extremely clear in the Constitution, that their purpose is collective, moreso than an individual right for its own sake: "To promote the Progress of Science and useful Arts". Hence why they expire: at some point, the incentive has already been provided, and the body politic benefits more by their being open-sourced.

Whatever "rights" framework one subscribes to, it is an extremely thorny question, whether they include the right to alienate those rights, to give them up on purpose. We allow people to alienate their labor, an hour at a time; but not to do so for a lifetime (voluntarily sell one's self into slavery). Many US states now refuse to defend "non-compete" clauses: that you cannot constrain your future self from working for a competitor for X years, even if you wanted to, even for very lucrative terms in the contract.

I'd argue that intellectual/creative works, are more like non-compete clauses: you actually create more bargaining power if you limit the scope, and take away the capacity to give up future bargaining power.

[0] https://www.youtube.com/watch?v=V_gZZHu4TBk
Show HN: Hacker Dash"-Lovable for Terminal
by belai | 2025-11-24 17:14:04+00:00
I built this over a weekend after getting tired of writing the same monitoring scripts.

You describe what you want in plain English, and it generates a working terminal dashboard with cyberpunk aesthetics using Claude + Textual.

Example: "show CPU and RAM usage" → instant TUI with live data

Key features: - Self-healing code (if it crashes, Claude fixes it automatically) - Built-in API usage tracking - Zero-install deps with uv

It's basically Lovable.dev but for your terminal. Open source, MIT licensed.

Would love feedback from the HN community!
by jcranmer | 2025-11-24 17:14:06+00:00
So there's a controversial feature added in C2y, named loops, that has spawned many a vociferous argument. Now, I'm a passionate supporter of this feature, for various reasons, that I can (and have, in the committee) brought up. And I know some people who are against this feature, for various reasons that have been brought up. And at the end of the day, it kind of is a popularity contest because weighing an argument of "based on my experience, this is going to be confusing for users" versus "based on my experience, this is not going to be confusing for users" is just a popularity contest among the voters on the committee, admittedly weighted by how much you trust the various people.

And then there's a third category of person (really, just one person I think, though). This is responsible for the vast majority of the email traffic on the topic. They're always ready with a detailed point-by-point reply of any replies to their posts. And their argument is... um... they don't like the feature. And they so don't like the feature that they're hanging on to any scintilla of a process argument to make their displeasure derail the entire feature, without really being able to convince anybody else of their dislike (or being able to be convinced to change their mind to any argument).

Now I don't have the cryptographic chops to evaluate DJB's arguments myself. But I also haven't seen any support for his arguments from people I'd trust to be able to evaluate them. And the way he's responding at this point reminds me very much of that third category of people, which is adversely affecting his credibility at this point.
by johncolanduoni | 2025-11-24 17:14:15+00:00
Not that I think this is the case for this algorithm, but backdoors like the one in Dual_EC cannot be used by a third party without what is effectively reversing an asymmetric key pair. Their public parameters are the product of private parameters that the NSA potentially has, but if China or whoever can calculate the private parameters from the public ones it’s broken regardless.
by nathannaveen | 2025-11-24 17:14:31+00:00
Truthfully, there isn't any way to prove that we are going to OSS, but we don't want to throw out a half assed product.

I agree, this isn't an ideal scenario, but we want to release our product when we have a working version.

We love open source, and have been working on open source for years now. https://github.com/nathannaveen.

Additionally, we have already open sourced a security tool that we were building before hand https://github.com/bomfather/minefield.
by babypuncher | 2025-11-24 17:14:39+00:00
> Why would the government wish to remove private jets from the list of purchases that can be deducted from income taxes?

To bring in tax revenue to pay for things we actually need.

> Why would they be unable to do this without making a deal with people who want open source software development to be designated a charitable purpose? How would making a deal with people who want open source software development fix this?

Because my comment is this thing we call a joke, it was meant to highlight the absurdity of the fact that some obviously charitable work gets taxed, while toys for billionaires are tax exempt because...reasons?
by nerdponx | 2025-11-24 17:14:51+00:00
It's a measure of inequality, not poverty as such, sure.

But practically it's obvious just by looking at the lives of "poor" people that, yeah, they are materially still struggling. I can't speak for Britain but I can speak for the USA: if you did both the "relative poverty" analysis and the "basket of goods" analysis, you'd find a lot of overlap. Splitting hairs over how exactly poverty is defined is just being dismissive of the actual people who are actually experiencing some form of material poverty, and shifting focus away from making things better.
by tlar | 2025-11-24 17:14:52+00:00
> A question: how do you find them in conversations with multiple people? Do the glasses help you distinguish speakers by breaking out text from different voices, or is it all just a stream of words? What if there are multiple conversations going on - do the glasses manage to "focus" captioning on the one you're closest to, or do other conversations creep in?

It really depends if people are talking at the same time or not. If in a close group (space matters, the mic only goes ~2-3m), one person talking at a time, then they're great. That's the setup I most often have at conferences, so it's been great there.

In evenings/parties, it's a bit more chaotic, and the glasses tend to fall off for sure.

Regarding distinguishing different speakers etc I haven't needed that, I use the glasses as a helper, they fill in the gaps. So it's "just a stream of words", but it has been enough to already help a ton.

The directional mic does work quite well, but sometimes you have just 2 conversations happening in front of you and it's not working at all. In other setups (especially professional ones), people usually speak one at a time and it works great.
by ethagknight | 2025-11-24 17:15:13+00:00
I seriously long for a free transit solution in my city, Memphis. We already pay for 90% of the operating cost anyway via various taxes, and fareboxes frequently cost more than they bring in. If I am a citizen paying property taxes in the city, why charge me $1.75 to hop on a bus?

However- it shouldnt be simply "free".. it should be "free with a pass, which is free" and a pass is easy to get, tied to your ID, and easy to revoke. No pass? thats fine, pay the $3 to ride. bus driver yanked your pass because you were peeing on the seat or intimidating other riders? You can ride again, for $3. Concerned about security or privacy? No problem, Pay $3.

Before the majority of law abiding citizens and travelers, passes are easy and free to get.