MurphyA/hacker-news huggingface dataset:
by qcnguy | 2025-12-18 09:14:20+00:00
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Examples:

6 days ago: Their experience with Rust was positive for all the commonly cited reasons - if it compiles it works

8 days ago: I have to debug Rust code waaaay less than C, for two reasons: (2) Stronger type system - you get an "if it compiles it works" kind of experience

4 months ago: I've been writing Rust code for a while and generally if it compiles, it works.

5 months ago: If it’s Rust, I can just do stuff and I’ve never broken anything. Unit tests of business logic are all the QA I need. Other than that, if it compiles it works.

9 months ago: But even on a basic level Rust has that "if it compiles it works" experience which Go definitely doesn't.

Some people claim that the quote is hyperbolic because it only covers memory errors. But this bug is a memory error, so ...
by ForceBru | 2025-12-18 09:14:40+00:00
> LLMs are still trained on significantly more data pretty much no matter how you look at it ... 10-15 million words ... vs trillions for LLMs

I don't know how to count the amount of words a human encounters in their life, but it does seem plausible that LLMs deal with orders of magnitude more words. What I'm saying is that words aren't the whole picture.

Humans get continuous streams of video, audio, smell, location and other sensory data. Plus, you get data about your impact on the world and the world's impact on you: what happens when you move this thing? What happens when you touch some fire? LLMs don't have this yet, they only have abstract symbols (words, tokens).

So when I look at it from this "sensory" perspective, LLMs don't seem to be getting any data at all here.
by aebtebeten | 2025-12-18 09:14:48+00:00
Oops, I was a decade off in my primary referent: 1930s

https://en.wikipedia.org/wiki/Joseph_Goebbels#:~:text=Goebbe...

but sounds like 1920s may be fine overall?

https://en.wikipedia.org/wiki/History_of_public_relations#:~...

(at least Bernays, whatever he may have advocated about undermining source attribution, did not seem to advocate actual sock puppets?)

https://en.wikipedia.org/wiki/Edward_Bernays#Third_parties
by mlitwiniuk | 2025-12-18 09:15:07+00:00
The big difference is context-awareness. Vanta/Drata give you templates and checklists. Humadroid starts by understanding your company - what you actually do, how you operate, your tech stack.

From there, the AI generates policies that are yours, not generic docs with [COMPANY NAME] placeholders. Same with control descriptions - they're specific and actionable for your setup, not "implement access control" with no context. It also identifies risks based on what you actually do and helps build business continuity plans around your real critical processes.

You still review everything (it's compliance, not magic), but you're editing 80% done work instead of staring at a blank template wondering where to start.

The price difference is real too, but honestly that's a side effect of being early and solo - not the core value prop.
by ben_w | 2025-12-18 09:15:33+00:00
Some anecdotes, specific ways it can be unclear how many job openings exist:

I applied for some jobs, two of them liked me and I reached the point where they were competing with each other for me, and I was in salary negotiations. One of them, suddenly, decided to stop trading. I still don't know why.

Another time, I started working(!) and getting paid, but after 6 months the person who everyone (including themselves) was expecting to leave and for me to replace had still not found a new job (presumably due to all the ghost jobs), and there wasn't enough money for both me and them. Last in, first out, bye to me.

One place hired an PM about two weeks before the investors decided to shutter the entire company. (For actual ghost jobs: in my own job hunt after that, I found listings on job boards for that company, that were clearly from several years before I'd joined given the advertised wage range; as the company had told everyone to stop coming in for their notice period, there wasn't even anyone left to ask for those to be deleted).

Back when my dad was around, one of his anecdotes about interviewing candidates was asking the candidate "Why did you leave your last job?" and getting a reply along the lines of "After 6 months, management found out that our entire floor had been hired to do the same thing as the floor next to us. One of the floors had to go."
by baq | 2025-12-18 09:15:37+00:00
Fighting spam is a benefit for everyone and it’s most definitely done on purpose behind closed doors.

Yes accessibility would be nice, I agree, but if I’m understaffed, provide free as in beer service where being on the first page is worth millions in marketing spend and being top 1 for a few hours is worth tens if not hundreds so I’m constantly under attack from everyone and their dog who have anything at all to sell, it’s going to be hard to prioritize other things.

…yeah I agree they should hire an intern or something to just fix this on slow burn.
by vintermann | 2025-12-18 09:16:54+00:00
Many interest groups in the US are for hire. Meaning, if you don't like a piece of upcoming legislation, you can give them a donation and they'll find out a way the upcoming legislation hurts their demographic. These groups have overwhelmingly passive members, who don't run the organization in any meaningful way.

There are even more mercenary groups, whose business model is basically extorting organizations for donations, threatening with expensive lawsuits and bad publicity.

It seems pretty likely to me that NAD's lawsuits are more about this, and less about actually caring about deaf access. There are a lot of them, and they seem to go for big pockets. Probably the efforts Berkeley went to to offer accessibility would have been deemed good enough to not sue over (for now) if they had donated.

It doesn't mean the causes such orgs ostensibly fight for aren't good. It's just that when enforcement is by lawsuit, it's inevitably selective enforcement, and that just creates a huge business opportunity for unscrupulous lawyers (which there is no shortage of).
by kazinator | 2025-12-18 09:16:56+00:00
> there are two distinct sounds in the kana table for う and お.

Oh no, that totally escaped my feeble attention. Boy, do I feel sheepishly stupid now.

> Go ask a native to slowly sound out the individual mora

In fact, now that you point it out, even if I do that myself, it's obvious they are different: ko-u-cha, o-o-sa-ka!

Well, I've just been going about this all wrong, barking up the wrong tree.

In hindsight it now makes total sense that they wouldn't just use う as a marker to indicate that the previous お is long. Thats what ー is for; whereas う has a sound!

Ohohsaka, coacha: gonna practice that.
by yawpitch | 2025-12-18 09:17:19+00:00
The quote in the article is "as fluent in Python as we are in multiple other languages”… Russian is mentioned elsewhere, so gets incorporated by reference rather than directly here, but Python is still the exemplar she used for computerese.

Mastery in every domain is great, but part of that is knowing that mastering Python isn’t mastering any CS domain.
by bonesss | 2025-12-18 09:17:26+00:00
I find that technology really exciting. Partly because it’s a polished and comprehensive version of something I was implementing around my MCP cluster anyways.

Mostly, though, because it seems like we’re mere minutes away from having Star Trek style LCARS adaptable GUIs managed by an AI computer system simultaneously so smart it runs mission critical operations yet so dumb we have to remind it that we want our tea “hot” five times a day.

It’s happening. We’re gonna be living in the future!
by Jur | 2025-12-18 09:17:28+00:00
In the Netherlands by law you have the right to retrieve any written internal correspondence regarding your interviews as to ascertain it was a fair decision and decision making process.

Side effect of this is also to keep any bias out of the equation and, being on the other side, easier to call out colleagues making inappropriate or downright discriminating comments (which in my experience unfortunately happens everywhere still)
by spuzvabob | 2025-12-18 09:17:51+00:00
Neat! We made a similar thing years ago in the pre-AI era, with strong focus on detection of how the planned workouts were executed rather than making plan adjustments just on a single scalar metric (e.g. TSS). Didn't really go anywhere unfortunately.

https://www.kickstarter.com/projects/1725424103/summit-train...
by mstngl | 2025-12-18 09:18:14+00:00
𓇋𓅓 𓋴𓂋𓊪𓂋𓇋𓊃𓂧 𓊃𓄿𓏏 𓄿𓂋 𓊃 𓉔𓇋𓂋𓅱𓎼𓂋𓇋𓆑𓋴 𓄿𓂋 𓎡𓄿𓆑𓂋𓂧 𓃀𓄿𓇋 𓇌𓈖𓇋𓎡𓅱𓂧.

Even such rather exotic glyphs, like the biliteral 𓏞, which is U+133DE [1]. But I assume that the coverage by webfonts is somewhat bad.

P.S.: Sorry for such intended misuse of the principles of hieroglyphic writing.

[1] https://www.compart.com/en/unicode/U+133DE
by zwnow | 2025-12-18 09:18:54+00:00
I had good job security doing in house IT for some companies. Never have seen anyone being laid off, could've stayed there for years to come, the stuff I've built was actively being used and made work easier for people. The domain knowledge I gathered even strengthened my job security as it was more efficient to pay me over having to re-train other people. The only risk to my job was me as I left for a startup after a while. Sure, pay wasn't that high compared to FAANG but at least I didn't make peoples life worse while also hating my job.
Ask HN: Decentralized Auth for Information Exchange?
by vxsz | 2025-12-18 09:19:12+00:00
I have a media server project that I want to work on. But I'm stuck on one thing, convenience vs privacy.

As the project is about spinning your own server (media server), I want to have a smoother way to have a simple account system where the user just enters an email and a password, and get the server/ip list (everything from there is done on the actual server). For example, a user could be invited to 2 servers, and would see them in the same page, which makes things more straight-forward and a lot easier.

Now, I thought a lot about it, and mostly came down to the conclusion that centralizing it is the most sane option. The data itself comes down to: email, encrypted password, encrypted IP(s) list (via key exchanges).Is there any-way to do it decentralized? I searched, even asked LLMs, but nothing felt solid (best was a Nostr suggestion) but such method would make emails, password resets painful or almost impossible. I don't know a lot regarding this topic so its quite the challenge.

What's the point/why not just use URL? convenience. I know, but it SUCKS having to give a parent a URL, even with some techy friends it takes a bit communicating it. I want to eliminate as much friction as possible. Also, if centralized, this has the ability that users don't need to buy a domain, setup lets encrypt and all that which costs money and time (especially for simple/new selfhosters); its a lot nicer and smoother and in a way provide better privacy out-of-the-box.

Note, This project doesn't even exist yet. But I'm pursuing quite soon. I also only took 1 encryption course back in college days, while I understood and was good at it, I still need to audit/verify my method. It basically is: 1. hash the password+salt in a different algorithm, save the private key from it and send the public key to the central server 2. (media server owner wants to invite) the media server checks for a public key, encrypts the message containing all the details (IP, status, ports etc), and sends the encrypted message to the central server. 3. The client later checks, if there's a new message, it decrypts the ip/info from the server and connect.

Every device can login in this way and grab server list info securely. There's gonna be some sort of way to "quick connect" on TVs and such, and change passwords, but I don't want to get ahead of myself for now. I don't think the IP/server-info encryption suffers from any major things, but that's the general core principle. I maybe (probably?) have missed something.

The only issues I can maybe think of, is a "centralized" URL/domain would be showing up all the time instead of the owner. Note, it would be designed in a way that would allow you to instead send them to your own URL/domain and such.

Anyways, let me know what would be best. btw I'm not rich but such simple "auth" server would probably cost like $5/m + 2x5/m for redundancies, shouldn't be too bad.
by bratwurst3000 | 2025-12-18 09:19:22+00:00
that doesnt even make sense. if gas is 3x of electricity it should be the same cost but for every watt of electricity you get 3 watt of heating. so by your math if I pay 1w gas but need 3w for 1w of electricity and heatpumps give 3w on every watt of electricity heatpumps are 300% more effective then gas. sooo your point is also heatpumps ftw ;)
by joelreymont | 2025-12-18 09:20:06+00:00
Debugging Zig in LLDB is painful.

Slices show up as { ptr, len }, optionals are unreadable, and slice[0] just errors out. Python formatters help a bit but don’t fix expressions. zig-lldb fixes everything… if you’re willing to rebuild LLDB and maintain a fork.

zdb is a native LLDB plugin that sits in the middle:

- Works with stock LLDB (Homebrew / system) - Native C++ type summaries (no Python) - Zig-style expressions work: slice[0], opt.?, err catch x

(lldb) p int_slice[0] (int) $0 = 1

How? By calling LLDB’s internal APIs via versioned offset tables and rewriting expressions on the fly.

Limitations: no Variables View expansion (ABI issues with std::function). CLI debugging works great.

Check out the Github repo at https://github.com/joelreymont/zdb!
by ZuoCen_Liu | 2025-12-18 09:20:17+00:00
RSS isn't just alive; it's the only remaining protocol for deterministic content delivery. There is a fundamental philosophical divide between RSS and the current AI-driven wave that people often miss: RSS is a Push system: If I subscribe to a source, I get 100% of the signal. The 'algorithm' is my own intent. AI is a Filtering system: AI is probabilistic. Its entire job is to guess what I want, which by definition means it creates a 'lossy' stream. People claim AI can 'replace' RSS by summarizing my interests, but AI will never be able to provide the certainty of a feed. I don't want an AI to 'guess' which security advisory or niche technical blog post I should read today; I want the raw signal that I explicitly requested. As long as there are professionals who value information completeness over algorithmic convenience, RSS (or its successor) will be a hard requirement. You can't replace a pipe with a concierge.
by jmsgwd | 2025-12-18 09:21:10+00:00
> I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching

If an "online" password manager uses end-to-end encryption, then the credentials really are only on your computers. The only thing "in the cloud" is encrypted blobs of data being moved around for the purpose of device sync and backup.

This insistence on using local non-syncing password managers is a masochistic exercise in making life difficult for yourself with no security benefit.
by acituan | 2025-12-18 09:21:44+00:00
> What got me past that point was short bursts at BPMs way past my comfort zone and building synchrony _after_ I stumbled upon more efficient motions that scaled.

This is actually pretty close to what Stetina says. I just probably didn’t do a good job expressing it.

You’re oscillating above and below the comfort zone and that iteration like you say affords insights from both sides, and eventually the threshold grows.

Great suggestion of a video, I’ll check it out.
by mkleczek | 2025-12-18 09:22:23+00:00
> Your notion that you can avoid sharing internal ids is technically true, but that didn’t mean it’s a good idea. You’re trying force a philosophical viewpoint and disregarding practical concerns, many of which people have already pointed out.

What some call "philosophical viewpoint" I call "essential complexity" :)

> But to answer your question, yes, your customer will probably have some notion of a transaction id. This is why everyone gives you invoice numbers or order numbers.

We are in agreement here: externally visible identifiers are needed for many reasons (mostly technical). The discussion is not about that though but about what information should be included in these identifiers.

> This is why everyone gives you invoice numbers or order numbers.

And there are good reasons why invoice or order numbers are not randomly generated strings but contain information about the invoices and orders they identify.

My claim is that externally visible identifiers should possess a few characteristics:

* should be based on the data they identify (not detached from it)

* should be easy to remember (and that means they should be as short as possible, they should be easy to construct by a human from the data itself - so they cannot be hashes of data)

* should be versioned (ie. they should contain information somehow identifying the actual algorithm used to construct them)

* should be easy to index by database engines (that is highly db implementation dependent unfortunately)

* can be meaningfully sortable (that is not strictly a requirement but nice to have)

Coming up with an identifier having these characteristics is not trivial but is going to pay off in the long run (ie. is essential complexity).
by TheDong | 2025-12-18 09:22:23+00:00
Docker has to maintain relatively complicated looking build instructions like this to make these images: https://github.com/docker-hardened-images/catalog/blob/b5c7a...

Meanwhile, nix already has packaged more software than any other distro, and the vast majority of its software can be put into a container image with no additional dependencies (i.e. "hardened" in the same way as these are) with exactly zero extra work specific to each package.

The nixpkgs repository already contains the instructions to build and isolate outputs, there's already a massive cache infrastructure setup, builds are largely reproducible, and docker will have to make all of that for their own tool to reach parity... and without a community behind it like nix has.
by taupirho | 2025-12-18 09:23:10+00:00
Anthropic recently added structured output support to Claude, which allows you to constrain model responses to a defined schema instead of relying on prompt instructions and post-processing.

I put together a hands-on walkthrough showing how it works in practice, what problems it actually solves, and where it still falls short. The focus is on using structured output to make LLM responses predictable enough for real systems, rather than treating it as a chat feature.

The article includes concrete examples and implementation details, not just an overview.
by appsoftware | 2025-12-18 09:23:44+00:00
My product NumeroMoney (https://www.numeromoney.com) is the first I've built that makes over $500, and it's grown surprisingly quickly. I built it because I needed something simpler that the existing solutions I could find for understanding our families spending (YNAB etc were geared too much towards budgeting). It helps users to import and categorize bank statement transactions in a way that makes it really easy to make decisions about household spending.
by laurentiurad | 2025-12-18 09:23:58+00:00
thanks! Most of these projects are hosted on Vercel, and I am extensively using their observability solution to get alerts when something unexpected happens. After some time you get to fix everything and you'll spend less time firefighting.

For customer queries, I usually respond myself. However when I am not available, I have a small team of freelancers that help me just with that. I played with LLMs for responding to questions, but it just didn't work out for me.
by ryanackley | 2025-12-18 09:24:30+00:00
One observation I've had recently. Postman files seem more popular the OpenAPI specs lately. Major SaaS companies will produce a postman file but not an OpenAPI spec. Two examples: Salesforce and Notion

This is really unfortunate because Postman requires you to have an account and log in to download or export these to another format.

Prediction: Postman produces a paid MCP for API lookup in the near future
by watwut | 2025-12-18 09:24:39+00:00
> Usually the people who question decisions are shot down because they don’t have a wholistic understanding of the decision and (respectfully) don’t have good arguments.

It takes months of dysfunction until the customer says "I do not want to work with you anymore" or until the "overtime and over budget" thing suddenly becomes too large and problems show up in numbers. Or until key team suddenly completely decomposes. Every single time I have seen that, multiple people tried to communicate about the issue and were shot down.

It is not like management was always "wholistically" right and everyone down there just dont see big picture or have bad arguments - they usually just do not know what is going on on lower levels. Failure to actually listen, whether because it feels bad or because it would take time is quite common.
by nottorp | 2025-12-18 09:24:53+00:00
> It reads like “you probably want to game HN; stop doing so”.

YES.

> HN is completely unusable for people with vision impairments relying on assistive technologies.

For one, this is unrelated to allowing marketers to game the system.

For two, how much are you hyperbolizing there? I only ask because I was having a conversation in comments with a blind HN-er only like 3 days ago.
by HelloNurse | 2025-12-18 09:25:25+00:00
It is unreasonable to expect to run the same graphics code on desktop GPUs and mobile ones: mobile applications have to render something less expensive that doesn't exceed the limited capabilities of a low-power device with slow memory.

The different, separate engine variants for mobile and desktop users, on the other hand, can be based on the same graphics API; they'll just use different features from it in addition to having different algorithms and architecture.
Ask HN: Self-hosted AD/Entra ID alternative that works with Windows and Linux?
by marenkay | 2025-12-18 09:25:36+00:00
I'm working on an open-source identity platform (Rust, AD-compatible, native OIDC) and trying to figure out whether this is a real problem or something I've convinced myself matters.

The idea is: replace Microsoft AD/Entra ID with something you can self-host, that handles Windows domain join AND Linux login AND modern auth protocols.

Current options seem to be:

- stay with Microsoft AD (the original beast) - Samba AD (works but painful, no modern protocols) - UCS/Zentyal (wrap Samba, heavyweight) - Keycloak/Authentik/etc (no Windows domain support)

My questions:

- How do you handle identity across Windows and Linux today? Is it painful? - Have you actually looked for alternatives, or is AD "good enough"? - Would sovereignty/self-hosting be a important for you, or is that just talk?

I am having a lot of fun building and using this but I severely wonder if this is just a me problem. Help a guy out? :-)
by kevin061 | 2025-12-18 09:26:05+00:00
I think it is quite simple. Hacker News. News for hackers. Not in the "hacking" Hollywood sense of computer crimes (although there's some of that, too), but in the sense of intellectual curiosity.

Probably more than 70% of your post's impact will come from a catchy headline. People will be curious about your headline, and click through. And then, upvote if they find it interesting.

If the post is interesting but the headline isn't, then, well, bad luck.

Once a post gathers enough momentum, it goes to the front page. Then, there are a thousand bots on Twitter, Bluesky, Mastodon, etc, that repost articles that got to the front page, and it gathers even more momentum from a large portion of technologists that don't have an HN account but follow these bots.