MurphyA/hacker-news huggingface dataset:
by eddyg | 2025-12-17 18:31:19+00:00
Passkeys are fantastic for the vast majority of the population. They solve oodles of problems. No more teaching ${FAMILY_MEMBER} about good passwords, password re-use, trying to explain how to use a password manager, etc. Instead: create passkey, done. Then it's seamless login whether they're on their computer, phone or tablet.

As a tech-savvy user fully aware of the underlying machinations involved with passkeys, I greatly prefer their simple, fast login experience over: username submit password submit TOTP submit, and especially over the much-worse "we've emailed you a code" login slog.
by etempleton | 2025-12-17 18:31:22+00:00
I think it is trendy to hate on Firefox because of how cool Firefox felt in 2002 and how dominant they became in the mid 2000s before Chrome and so everything feels like a fall from grace from that.

I do think there have been missteps. I think Firefox is good and is my browser of choice but most of their new features feel superfluous.
by strict9 | 2025-12-17 18:31:28+00:00
>Primarily because web search these days is so shitty but that’s besides the point.

Obviously there are a lot of reasons for this. But I think one of the most important reasons is that there is so few organic interesting content destinations anymore.

Sure there are some neat shopify stores, news sites, and a few dedicated souls keeping up blogs. But so much of the casual browsing that the web once was has been obliterated by the move to social media.

And what hasn't moved is now a mess of AI generated fluff or link farms.

I used to think Google made search worse to increase ad revenue. And maybe it's tangentially related. But the stuff I used to search for and find and get inspiration from has moved to walled gardens. Reddit is one of the few remaining open web destinations left.

AI can't solve that problem.
by dangus | 2025-12-17 18:31:47+00:00
The formula is so simple, but complicated to achieve underneath: sell the best products.

That’s all you have to do. But so many companies resort to financial games and short term business gimmicks rather than believing that they can make the best products and putting focus and drive into that goal (not just money!)

Stellantis can make great products but for the most part they just won’t. They actively refuse to. Same deal with Ford.

GM is doing well with EVs because they actually make good products. The Silverado EV is the best EV truck on the market, Cadillac makes the best luxury EVs on the market[1], and the Honda Prologue (made by GM) is a sales star because it’s a good product that knows its market. Even the Chevy Trax is a great product because of the sheer impossibility of its value proposition: nobody can compete with the amount of things that vehicle gives you for the price.

Ford half-assed their sedans and bowed out of that market and now their supposed focus on SUVs is not good enough because none of their SUVs, gas or electric or hybrid, give you any reason to buy them. They are half-assing all their vehicles until they reach their inevitable demise.

Why is anyone buying an Expedition over a Telluride, Grand Highlander, or Chevy Suburban derivative?

Why is anyone buying an Explorer over a RAV4, CRV, etc.

The only thing Ford makes that’s any good is the F-150, Maverick, Bronco and Mustang (very niche). This means they have basically zero cars to sell outside the US.

[1] Yes, better than Tesla and Lucid: more luxurious and isolated with better interior materials, fewer reliability problems, better ergonomics and physical controls, stronger dealer and service network.
by n1xis10t | 2025-12-17 18:32:00+00:00
Another option to consider (which marginalia-search.com uses) is Anubis (anubis.techaro.lol). The operator of Marginalia told me that he was getting lots of people spamming the same queries over and over, which he thought might be them trying to influence suggested searches. He put Anubis in place and the query volume dropped to much more reasonable levels. It works by running some sort of complex calculation in javascript, so it won’t get rid of all bots, but it should slow them all down.

The downside is that their silly anime girl mascot is displayed whenever the challenge is running, which I think some people might find off-putting.

Edit: Are you going to announce the search engine on hacker news?

2nd edit: If you are making a search engine, this is probably a good article to read: https://archive.org/details/search-timeline It talks about various search engines that have disappeared mysteriously over the years.
Show HN: Why I'm building a graphical, simple Proof Assistant for kids
by tri2820 | 2025-12-17 18:32:19+00:00
Why HN,

I'm embarking on a journey to build an intuitive, graphical Proof Assistant. Wish me luck! The idea came when I saw my sister struggling to keep track of different definitions and theorems while studying Euclidean geometry. I wanted to give those abstract ideas a shape. Something she can easily see and interact with.

In the blog, I’ve included some screenshots of how I imagine it would work. Here’s also the link to the original code.

https://github.com/tri2820/remath
by n8cpdx | 2025-12-17 18:32:21+00:00
I did a computer graphics course on EdX: https://www.edx.org/learn/computer-graphics/the-university-o...

Objectively the quality of the production was pretty mediocre, but the assignments were challenging and I learned a lot. Similar to a real course taught by a professor. The final assignment (ray tracing) only asked for render results so I took it as an opportunity to learn rust.

The content was maybe a little outdated, but I think the concepts haven’t changed much and that’s what I was there for.

Course materials were updated for M1 macs, but there was a little friction in figuring things out.

I plan to take the follow up soon.
by alephnerd | 2025-12-17 18:32:38+00:00
That's how it's already done, and has been done since 2014.

Most Indian states have multiple dedicated manufacturing clusters and SEZs for specific industries ranging from the megaclusters like NOIDA and Hosur to smaller ones like Kashipur IIE in Uttarakhand for electronic components or Baddi SEZ in Himachal Pradesh for generic pharma.

The OSAT that is being considered is part of an electronics+automotive SEZ that Micron, Mitsubishi, Hitachi, and Tata are members of (Sanand SEZ).

Most manufacturing in India has shifted to Tier 2/3/4 towns because of land availability and single-window policies, and in my opinion this is a better strategy as it helps build out regional economies. Heck, my ancestral village has had a wind turbine and battery storage factory for a decade now.

The development of this industrial strategy is underreported in non-Asian media (imo due to a lack of on-the-ground reporting in India), but is starting to be analyzed in the NatSec space [0]. I remember seeing a similar blindness to "Make in China" during it's early years.

[0] - https://carnegieendowment.org/research/2025/08/indias-semico...
by JeremyNT | 2025-12-17 18:33:02+00:00
I think seniors know enough to tell whether they need to learn or not. At least that's what I tell myself!

The thing with juniors is: those who are interested in how stuff works now have tools to help them learn in ways we never did.

And then it's the same as before: some hires will care and improve, others won't. I'm sure that many juniors will be happy to just churn out slop, but the stars will be motivated on their own to build deeper understanding.
by kakacik | 2025-12-17 18:33:32+00:00
Maybe, but you make it sound like juniors are more worthy to companies than seniors. Then fire most/all seniors and good luck with resulting situation.

Coding in any sufficiently large organization is never the main part of senior's time spend, unless its some code sweatshop. Juniors can do little to no of all that remaining glue that makes projects go from a quick brainstorming meeting to live well functioning and supported product.

So as for worth - companies can, in non-idedal fashion obviously, work without juniors. I can't imagine them working without seniors, unless its some sort of quick churn of CRUDs or eshops from some templates.

Also there is this little topic that resonates recently across various research - knowledge gained fast via llms is a shallow one, doesn't last that long and doesn't go deeper. One example out of many - any time I had to do some more sophisticated regex-based processing I dived deep into specs, implementation etc. and few times pushed it to the limits (or realized task is beyond what regex can do), instead of just given the result, copypasted it and moved along since some basic test succeeded. Spread this approach across many other complex topics. That's also a view on long term future of companies.

I get what you say and I agree partially but its a double edged sword.
by mmaunder | 2025-12-17 18:33:49+00:00
I think about what would be most terrifying to Anthropic and OpenAI i.e. The absolute scariest thing that Google could do. I think this is it: Release low latency, low priced models with high cognitive performance and big context window, especially in the coding space because that is direct, immediate, very high ROI for the customer.

Now, imagine for a moment they had also vertically integrated the hardware to do this.
by bckygldstn | 2025-12-17 18:34:26+00:00
There's a biological analogue here

• A frog species evolves to be poisonous, making them less palatable to predators.

• A different Delicious frog species evolves to visually mimic the Poisonous frog.

• This creates an evolutionary pressure for the Poisonous frog to change its appearance to less resemble the Delicious frog. The pressure is stronger the more the Delicious frog outnumbers the Poison frog.

• The cycle repeats.
by pizza234 | 2025-12-17 18:34:44+00:00
It really depends on what's being learned. For example, take writing scripts based on the AWS SDK. The APIs documentation is gigantic (and poorly designed, as it takes ages to load the documentation of each entry), and one uses only a tiny fraction of the APIs. I don't find "learning to find the right APIs" a valuable knowledge; rather, I find "learning to design a (small) program/script starting from a basic example" valuable, since I waste less time in menial tasks (ie. textual search).
by delichon | 2025-12-17 18:34:49+00:00
If Humphrey's Executor goes down, "independent" becomes effectively unconstitutional under the current SCOTUS. It's awkward to have an unconstitutional goal hard wired into an agency's mission, and could be used against it in court. It's a bit of a presumption that Trump v Slaughter will turn out this way, but given the tone of the oral arguments, not a lot.
by yuni_aigc | 2025-12-17 18:35:25+00:00
One thing I’ve noticed when comparing these models is that “quality” and “realism” don’t always move together.

Some models are very strong at sharp details and localized edits, but they can break global lighting consistency — shadows, reflections, or overall scene illumination drift in subtle ways. GPT-Image seems to trade a bit of micro-detail for better global coherence, especially in lighting, which makes composites feel more believable even if they’re not pixel-perfect.

It’s hard to capture this in benchmarks, but for real-world editing workflows it ends up mattering more than I initially expected.
by gls2ro | 2025-12-17 18:35:37+00:00
In some definitions (that I happen to agree with but because we wanted to save money by first not properly training testers and then getting rid of them is not present so much in public discourse) the purpose of testing (or better said quality control) is:

1) Verify requirements => this can be done with formal verifications

2) Validate fit for purpose => this is where we make sure that if the customer needs addition it does not matter if our software does very well substraction and it has a valid proof of doing that according with specs.

I know this second part is kinda lost in the transition from oh my god waterfall is bad to yeyy now we can fire all testers because the quality is the responsibility of the entire team.
by timpera | 2025-12-17 18:35:53+00:00
Looks awesome on paper. However, after trying it on my usual tasks, it is still very bad at using the French language, especially for creative writing. The gap between the Gemini 3 family and GPT-5 or Sonnet 4.5 is important for my usage.

Also, I hate that I cannot send the Google models in a "Thinking" mode like in ChatGPT. When I send GPT 5.1 Thinking on a legal task and tell it to check and cite all sources, it takes +10 minutes to answer, but it did check everything and cite all its sources in the text; whereas the Gemini models, even 3 Pro, always answer after a few seconds and never cite their sources, making it impossible to click to check the answer. It makes the whole model unusable for these tasks. (I have the $20 subscription for both)
by nine_k | 2025-12-17 18:36:07+00:00
Passkeys seem to be the best solution for users whose technical chops cannot be trusted, and who are also gullible enough to be a scam / social engineering target. Which, to my mind, describes a large enough chunk of audience of most popular services.

A tech-savvy relative of such a user should help them generate rescue codes, write them on a piece of paper, and store them along with all other important documents. Ideally the paper should also read: "Call me before using any of these codes! <phone number>."
by BSVogler | 2025-12-17 18:36:55+00:00
First look shows me that this is not an easy drop in replacement. First thing is this requires a log-in and makes me wonder why this is required. Perhaps some upselling coming.

With Bitnami discontinuing their offer, we recently switched to other providers. For some we are using a helm chart and this new offer provides some helm charts but for some software just the image. I would be interested to give this a try but e.g. the python image only various '(dev)' images while the guide mentions the non-dev images. So this requires some planning.

EDIT: Digging deeper, I notice it requires a PAT and a PAT is bound to a personal account. I guess you need the enterprise offering for organisation support. I am not going to waste my time to contact them for an enterprise offer for a small start-up. What is the use case for CVE hardened images that you cannot properly run in an CICD and only on your dev machine? Are there companies that need to follow compliance rules or need this security guarantee but don't have CICD in place?
by Groxx | 2025-12-17 18:37:04+00:00
Device loss:

If you had multiple devices set up on the site (each site must have done this individually), you just use a different device.

If you had synced your passkeys somewhere (note that the spec allows sites to block this, though I'm not aware of any actually doing so), you sync them to the new thing and log in normally.

If you did none of those, it's gone forever. Do the account recovery process, if one exists.

So it degrades to equal or worse than passwords in all cases (which cannot block backups or syncing, and you can enter them individually by hand so you're not exposing all your passwords to the device, and you can communicate them over the phone or in writing), for device loss purposes.

Restoring access in this scenario is imo one of their worst qualities.
by jmsgwd | 2025-12-17 18:37:20+00:00
I keep hearing it repeated, but where does this "tied to a single device" idea come from?

The default, built-for-the-masses implementation of passkeys is called "synced passkeys". They are designed to sync between all your enrolled devices, ideally using end-to-end encryption.

You authenticate with whatever device you happen to be using at the time - phone, tablet, laptop, desktop - doesn't matter. If you lose one, you replace that device and re-enroll - then all your passkeys magically re-appear on the new device.

If you're cross-platform, modern password managers work across ecosystems - for example, 1Password syncs passkeys between Mac, Windows, iOS, Android, and Linux. If you're all-in on Apple, their native passkey implementation syncs passkeys between all your Apple devices. I thought Google and Microsoft do something similar now.

It's a real mystery why people believe passkeys have to be stored on your phone only.
by 0x457 | 2025-12-17 18:37:30+00:00
> Their ssh supports the -X and -Y options to run remote X applications.

Cool, I remember using it in 2003 a few times. I highly doubt many people going to miss if those were gone. I would not be surprised if the majority of ssh server installations disable x11 session forwarding.

> Until then, get comfortable in a small and discardable minority.

Are you sure you're not confusing Wayland users with OpenBSD users?
by lo_zamoyski | 2025-12-17 18:37:33+00:00
> if you come from traditional programming languages, is quite harsh

This may be the result of failing to adequately distinguish between the spec and the implementation. PlusCal, as I understand it, is an attempt to bridge this gap for programmers who don't yet have a good grasp of this distinction. So where in TLA+ you would model the observable behavior of a system in terms of transitions in a state machine, PlusCal gives users a language that looks more like implementation. (Frankly, I find the PlusCal approach more distracting and opaque, but I'm also a more abstract thinker than most.)
Show HN: AI agent that investigates CloudWatch alarms – 5-min Terraform deploy
by avansledright | 2025-12-17 18:38:12+00:00
Hey HN,

I built this because I was tired of spending 20-30 minutes investigating every CloudWatch alarm that fired. AWS just released CloudWatch Investigations (June 2025) which does similar things, but requires significant setup and lives in the console. Mine takes a different approach.

CloudWatch AI Agent: When an alarm fires, an AI agent autonomously investigates and sends findings to Slack. Deploy via Terraform in 5 minutes.

How it works: - Terraform module (Apache 2.0) deploys Lambda + SNS integration - Alarm triggers → AI agent queries your AWS environment (read-only) - Analyzes metrics, logs, EC2/RDS/Lambda configs, alarm history - Sends root cause analysis + ready-to-run CLI commands to Slack - ~30 seconds total

vs AWS CloudWatch Investigations: - CloudWatch Investigations: Console-based, requires investigation groups, IAM role setup, CloudTrail→CloudWatch Logs config, limited to 2 concurrent investigations - Mine: Terraform apply, works immediately, Slack-native, unlimited investigations

The Terraform module is fully open source. The Lambda code is obfuscated (contains AI orchestration logic, prompts) - this is the core IP. Business model is $5/mo API key subscription.

Cost: $5/mo + ~$0.001 per alarm (AWS Bedrock usage)

Why build this when AWS has a free native solution? 1. Infrastructure-as-code teams want Terraform deployment, not console configuration 2. Slack-native workflow vs AWS console workflow 3. No investigation limits (AWS caps at 150 enhanced/month) 4. 5 minutes vs 2-3 hours of setup

I'm a solo AWS engineer. Built this for myself, now productizing it. The obfuscated Lambda is a tradeoff - I know trust is an issue, but the Terraform is fully auditable, IAM permissions are read-only, and everything runs in your account with CloudTrail logging.

Not for everyone (especially teams with strict "no obfuscated code" policies), but for Terraform-first DevOps teams who want simple tooling, it solves a real pain point.

Site: https://aiopscrew.com

Happy to answer questions about the implementation, security model, or why I made specific design decisions.
by thatjoeoverthr | 2025-12-17 18:38:36+00:00
I actually had a fantastic experience with Fortran lately. I ported a compute kernel from python/numpy to Fortran 2018, partially due to the GIL and partly so I could use Intel's compiler. The performance improvement was tremendous. Several times faster per core, then multiplying further because I could take advantage of threading. In all, the 3 day project increased actual throughput 450x.

(I considered JAX, but the code in question was not amenable to a compute graph. Another option was to thread by fork, and use IPC.)

I liked the language itself more than expected. You have something like "generics" with tensors. Suppose you pass a parameter, N, and you also would like to pass a tensor, and you would like to specify the tensor's shape (N, N). You can do this; the parameter type constraints can reference other parameters.

Tensors and various operations are first-class types, so the compiler can optimise operations easily for the system you're building on. In my case, I got 80% improvement from ifx over gfortran.

Invocation from Python was basically the same as a C library. Both Python and Fortran have facilities for C interop, and Numpy can be asked to lay out tensors in a Fortran compatible way.

Part of what eased the port was that Numpy seems to be a kind of "Fortran wrapper". The ergonomics on tensor addressing, slicing and views is identical.
by tialaramex | 2025-12-17 18:38:38+00:00
I guess the problem here is that you and the writer have different understandings of what "the error" means.

The author is thinking about "the error" as some source code that's incorrect. "Your error was not bringing gloves and a hat to the snowball fight" but you're thinking "the error" is some diagnostic result that shows there was a problem. "My error is that I'm covered in freezing snow".

Does that help?
by fngjdflmdflg | 2025-12-17 18:38:39+00:00
I think this almost has to be the future if most compute development goes to AI in the next decade or so, beyond the fact that the proposed API is much cleaner. Vendors will stop caring about maintaining complex fixed function hardware and drivers for increasingly complex graphics APIs when they can get 3x the return from AI without losing any potential sales, especially in the current day where compute seems to be more supply limited. Game engines can (and I assume already do) benefit from general purpose compute anyway for things like physics, and even for things that it wouldn't matter in itself for performance or would be slower, doing more on the GPU can be faster if your data is already on the GPU, which becomes more true the more things are done on the GPU. And as the author says, it would be great to have an open source equivalent to CUDA's ecosystem that could be leveraged by games in a cross platform way.
by mmaunder | 2025-12-17 18:39:17+00:00
Yeah the only thing standing in Google's way is Google. And it's the easy stuff, like sensible billing models, easy to use docs and consoles that make sense and don't require 20 hours to learn/navigate, and then just the slew of bugs in Gemini CLI that are basic usability and model API interaction things. The only differentiator that OpenAI still has is polish.

Edit: And just to add an example: openAI's Codex CLI billing is easy for me. I just sign up for the base package, and then add extra credits which I automatically use once I'm through my weekly allowance. With Gemini CLI I'm using my oauth account, and then having to rotate API keys once I've used that up.

Also, Gemini CLI loves spewing out its own chain of thought when it gets into a weird state.

Also Gemini CLI has an insane bias to action that is almost insurmountable. DO NOT START THE NEXT STAGE still has it starting the next stage.

Also Gemini CLI has been terrible at visibility on what it's actually doing at each step - although that seems a bit improved with this new model today.
by dangus | 2025-12-17 18:39:32+00:00
Do you not comprehend what I’m saying? Can you try to read back to me what the substance of my argument is?

I’m not debating whether the guy is morally reprehensible.

People can ignore that because that doesn’t affect them. Chris Brown is still selling out stadiums because he didn’t personally assault his fans.

What does affect people are everyday things like whether their favorite app got banned or whether eggs are affordable.