MurphyA/hacker-news huggingface dataset:
by maxglute | 2025-12-18 21:55:59+00:00
Nowhere close, but pace now seems faster than estimated, i.e. original western estimate is they won't even get EUV prototype up until 2030s.

Right now their chips are already "economically" competitive, as in SMIC is starving on 20% margins vs ASML/TSMC/NVIDIA getting gluttonous on 50-70%, at least for enterprise AI. Current scarcity pricing = litho costs borderline rounding error, 1500 Nvidia chip flips for 30000, 6000 huawei chip flips for 20000. The problem is really # of tools access and throughput. They can only bring in so many expensive ASML machines, including smuggling, which caps how much wafers they can afford to toss at low yield. They figure out domestic DUV to 2000 series and throughput is solved.

Hence IMO people sleeping on Huawei 9030 on 5nm DUV SAQP, still using ASML DUV for high overlay requirement processes, domestic DUV to fill rest. But once they figure out SAQP overlay, which will come before EUV, they're "set". For cost a 300m-400m ASML EUV, PRC can brrrt tools at BOM / cost plus margin. Think 40 domestic DUVs and associated infra for price of one ASML EUV to run 8x lines with 30% yield and still build 2x more chips normalized for compute that they can run on cheap local energy to match operating costs. Then they have export shenanigans like bundle 5nm chips with renewable energy projects and all of sudden PRC data center + energy combo deals might be globally competitive with 3/2nm. Deal with our shitter chips for now, once they deprecate we give you something better when our processes narrows gap, and you have bonus power to boot because some jurisdictions, building grid is harder than building fabs.
by owl57 | 2025-12-18 21:56:02+00:00
> Hey I wonder if there is some situation where negative SEO would be a good tactic. Generally though I think if you wanted something to stay hidden it just shouldn’t be on a public web server.

At least once upon a time there was a pirate textbook library that used HTTP basic auth with a prompt that made the password really easy to guess. I suppose the main goal was to keep crawlers out even if they don't obey robots.txt, and at the same time be as easy for humans as possible.
by rafram | 2025-12-18 21:57:23+00:00
I think it’s very fair. Anubis generated a lot of buzz in tech communities like this one, and developers pushed it to production without taking a serious look at what it’s doing on their server. It’s a very flawed piece of software that doesn’t even do a good job at the task it’s meant for (don’t forget that it doesn’t touch any request without “Mozilla” in the UA). If some security criticism gets people to uninstall it, good.
by bigbadfeline | 2025-12-18 21:57:29+00:00
> I don't think Nvidia wants to give up on consumer... This is a pragmatic choice.

You mean, NV is after the money with a heavy heart and a sad tear or two over the abandoned consumers, like "We love you so much but sorry, we must go pragmatic on you"?

> And most of the money is in commercial.

This is a serious systemic failure and it's even wilder that it's accepted without question.
by ximm | 2025-12-18 21:57:38+00:00
> For coders, visual aesthetics don’t matter. For lawyers, they are a technical requirement. While this difference may seem arbitrary on the surface, it is downstream of a critical technical difference between the two fields. Machines interpret the work of coders. Human institutions interpret the work of lawyers.

I believe this is not only infuriating, I am pretty sure it is actually illegal. If lawyers would think that visuals are more important than semantics, they would explicitly discriminate blind people.
by jijijijij | 2025-12-18 21:58:35+00:00
> That's not how any of this works.

Yes, evidently not.

Just because on average the intelligence agencies or ransom ware distributors wouldn't pay big bucks for XSS on Zerodium etc. doesn't mean that's setting the fair, or wise price for disclosure. Every bug bounty program is mostly PR mitigation. It's bad PR if you underpay for a disclosed vulnerability, which may have ended your business, considering the price of security audits/practices you cheaped out on. I mean, most bug bounty programs are actually paid by scope, not market price for technically comparable exploits. If you found an XSS vulnerability in an Apple service with this scope, I bet you would have been paid more than 4k.
by xmprt | 2025-12-18 21:58:57+00:00
It might be a bit nihilistic but at this point I don't think the current US administration has any strategy. In past administrations, it felt like even if there was a strategy, bureaucracy and lack of caring enough to do their job led to nothing happening. In this administration, it feels like there's no care for the rules so in theory a strategy could be pushed through... except there isn't one - literally whoever is the last person to talk to the president is the person who gets to set the direction.
by owenversteeg | 2025-12-18 21:59:05+00:00
This discussion comes up from time to time on HN. I actually think the country _has_ accomplished a lot given their geopolitical situation. Just to list a few things in the 21st century: 1) they had years of (at times fairly successful) proxy wars with three of the most militarily powerful US allies until the recent collapse, 2) a nuclear program, 3) the largest ballistic missile attack in history against the US, and 4) the most significant development in modern warfare (the Shahed drone.) Imagine any other relatively poor country, sanctioned and hated by the West, with substantial brain drain, ruled by an anti-Western theocracy for nearly fifty years; they wouldn’t manage a tenth of that. Imagine what they could do if they set down their weapons…
by DIVx0 | 2025-12-18 21:59:10+00:00
can't sign up with gmail or "personal" email addresses? What if I want to evaluate but I am not ready to inundated with sales calls? My 'work' email domain is one that many vendors would love to see in their CRM. I always sign up with disposables first.

I guess I should thank you for saving my time? Plenty of others in this space.
by johnwheeler | 2025-12-18 21:59:45+00:00
- Tech layoffs grow 100% YoY

- Multiple interest rate cuts instead of 1

- News about prosecutions for insider trading on Polymarket.

- Bitcoin will touch a multi-year low. MSTR becomes insolvent.

- Google Gemini will overtake ChatGPT in DAU.

- Software will be more commoditized and the authors’ “taste” will become its primary differentiator.

- Fiserv will increase 50% or more in market cap (I said the same thing last year about PayPal, and I was wrong)

- Warren Buffett will pass away. (I hope I’m wrong) :-(

- Google will drop the price of Gemini Ultra to $125 a month or less, Anthropic and OpenAI will follow suit.

- Logitech will start making a dedicated vibe-coding microphone-whatever that means.
by magicalist | 2025-12-18 21:59:49+00:00
> AFAIK there are differences established

Well, you "haven't read literature on the topic"[1] so maybe leave the speculation at the door or go out and read some literature to cite rather than presenting "ideas [you]'ve picked up that [you] can agree with" as "established"?

[1] https://news.ycombinator.com/item?id=46315540
by physicles | 2025-12-18 22:00:41+00:00
This piqued my curiosity. Are you the author of the paper?

For this principle to become widely known, it needs to be communicated in a more succinct way. 400 pages is too much to ask people to invest.

Even so, as far as I understand the gist of what the paper says, the principle helps make explicit some intuition I’ve had about design for a long time.
by floren | 2025-12-18 22:00:56+00:00
The size of the United States has not increased since 1970, but the number of people has. So yes, no shit, (US pop / US land area) has gone up. But the question is, "is the average neighborhood more dense than it was in 1970", and that's not a question you can answer from that number, because obviously cities & towns have spread since then.

If you want an intellectually honest comparison, take a look at the District of Columbia, which is basically 100% city and has been for many decades. It's gone down since 1970.
by cycomanic | 2025-12-18 22:01:15+00:00
But the quote "Here's how not to get banned next time" is rather factitious. It's in fact "we will not even tell you why you got banned".

I don't know what you mean by "tipping off" laws mean, but certainly if you get given a penalty in law (e.g. you get judged in court), you will be told what you have done wrong, and shown proof of it.
by TacticalCoder | 2025-12-18 22:01:45+00:00
It shall also allow to make re-recordings in higher quality of stuff that are impossible to find in good quality. Like that cover that that band played only once at that obscure concert and that was recorded on an old tape. Or many very old reggae songs: although many from Jamaica/Kingston had great recordings (there was know-how and great recording studios there) there's also a shitload of old reggae songs that are just barely listenable to because the recording is so poor (and, no, it's not an artistic choice by the artist: it's just, you know, a crappy recording).
by catapart | 2025-12-18 22:01:50+00:00
lol. I didn't ask for SKUs, I asked for plugins. I wouldn't mind the dev tools, and PDF viewer being plugins too. Again, include those plugins in the default download, just let me have a download that doesn't include them. Modularity to the bone, packaging for the masses. It really is that easy.

But, sure, I need to go build it myself because I had the gall to ask "can't I just have the parts I need?"
by recursivedoubts | 2025-12-18 22:01:52+00:00
¯\_(ツ)_/¯

any factoring you do on the front end you can do on the back end too, there's nothing magic about it and you don't need different end points: that can be a query parameter or whatever (if it's even a request, in most hypermedia-based apps you'd just render what you need when you need it inline with a larger request)

it's a different way of organizing things, but there are plenty of tools for organizing hypermedia on the server well, you just need to learn and use them
by marisen | 2025-12-18 22:02:01+00:00
Given this (including the linked writeup on the mintlify RCE), after the React RCE, if think it should be pretty obvious that

1. content security policies should always be used to prevent such scripts (here they would prevent execution of scripts from the SVG)

2. The JavaScript ecosystem should be making ` --disallow-code-generation-from-strings` a default recommendation when running NodeJS on the server.

Vercel (and other nodejs as a service providers) should warn customers that don't use CSP and `--disallow-code-generation-from-strings` that their settings should be improved.

There are a bunch of other NodeJS flags that maybe you should look into too: https://sgued.fr/blog/react-rce/#node-js-mitigations
by jsnell | 2025-12-18 22:02:07+00:00
It was for a dynamically growing ring buffer that also did short-object optimization. The natural implementation was to have the capacity and the offsets stored in fixed locations and with a fixed width, and have the variable part be a union of pointer or inline byte buffer.

Depending on the element width, you'd have space for different amounts of data in the inline buffer. Sometimes 1, sometimes a few more. Specializing for a one-element inline buffer would be quite complex with limited gains.

In retrospect trying to use that as a running gag for the blog post did not work well without actually giving the full context, but the full context would have been a distraction.
by RossBencina | 2025-12-18 22:02:57+00:00
It is not just a way of writing ring buffers. It's a way of implementing concurrent non-blocking single-reader single-writer atomic ring buffers with only atomic load and store (and memory barriers).

The author says that non-power-of-two is not possible, but I'm pretty sure it is if you use a conditional instead of integer modulus.

I first learnt of this technique from Phil Burk, we've been using it in PortAudio forever. The technique is also widely known in FPGA/hardware circles, see:

"Simulation and Synthesis Techniques for Asynchronous FIFO Design", Clifford E. Cummings, Sunburst Design, Inc.

https://twins.ee.nctu.edu.tw/courses/ip_core_04/resource_pdf...
by Hoasi | 2025-12-18 22:03:11+00:00
LinkedIn is one the most useless app ever. I have trashed it countless times, but I do use it now and ten to keep up with companies and respond to a few solicitations. There is almost never anything of value in my feed, between the fake jobs and the low value self-promotion AI-written posts. Who even reads this? Not even mentioning the political, and pseudo-activist posts. And this happens despite systematically marking all of these posts irrelevant or “inappropriate for LinkedIn”. This app is beyond repair. Uninstalling.
by QGQBGdeZREunxLe | 2025-12-18 22:03:29+00:00
I’ve always thought a solution would be to allow Airbnb but cap the amount you can earn per property to the equivalent of an average annual rent.

This wouldn’t outright ban short-term rentals, but it would reduce the largest financial incentive.

I say this selfishly, as someone who wants to use the platform while still occupying my own place. Something that offering it as a full-time rental doesn’t allow.
by cons0le | 2025-12-18 22:03:30+00:00
My friend has a velotric T1 and it's really great. Definitely get an ebike. I got a reflective jacket on ebay for $20 so cars can see me at night. Ebikes are just as good as normal bikes ( it took me years to realize this ). I have an EUC so I wont get an ebike fore now.

And yeah if I end up having kids, Ill get a minivan or something for chauffeuring. Sometimes you do in fact, need a car
by EnPissant | 2025-12-18 22:04:12+00:00
Claude Code is just a better CLI:

- Planning mode. Codex is extremely frustrating. You have to constantly tell it not to edit when you talk to it, and even then it will sometimes just start working.

- Better terminal rendering (Codex seems to go for a "clean" look at the cost of clearly distinguished output)

- It prompts you for questions using menus

- Sub-agents don't pollute your context
by XorNot | 2025-12-18 22:04:12+00:00
For the average paranoid person who is wasting their life on it, sure

But large organizations like defense are all about distributed trust anyway - even if you could verify the hardware, the guy you order to do it is going to be a whole command chain removed and likely a contractor with a clearance in the civilian world.

Whereas your high level political and military leadership having direct contact with managers and designers in production facilities is extremely valuable.
by antonymoose | 2025-12-18 22:04:31+00:00
Stepping aside the fact that I think most everyone here is playing fast-and-loose with the “slave” terminology here… Why do you feel prisoners doing low wage labor to be wrong?

Practically everyone in human history since the dawn of time has had to go out and produce something of value. Why, all of a sudden, should a murderer or rapist get to sit on their ass and consume what we all produce? I find nothing questionable about a humble job for them at all.
by usefulcat | 2025-12-18 22:04:37+00:00
Regarding the failure of internal components--there are some 'failure' modes which I had not even contemplated previously.

I have a TV that's only about 5-6 years old and has a built in Roku. It mostly works fine, but the built in hardware is simply not fast enough to play some streaming services, specifically some stuff on F1TV. And before anyone asks, it's not a bandwidth problem--I have gigabit fiber and the TV is using ethernet.

Anyway, between that, general UI sluggishness and the proliferation of ads in the Roku interface, I switched to an Apple TV and haven't looked back.
by WhyOhWhyQ | 2025-12-18 22:04:43+00:00
"the last couple weeks"

When I ran this experiment it was pretty exhilarating for a while. Eventually it turned into QA testing the work of a bad engineer and became exhausting. Since I had sunken so much time into it I felt pretty bad afterwards that not only did the thing it made not end up being shippable, but I hadn't benefitted as a human being while working on it. I had no new skills to show. It was just a big waste of time.

So I think the "second way" is good for demos now. It's good for getting an idea of what something can look like. However, in the future I'll be extremely careful about not letting that go on for more than a day or two.
by superasn | 2025-12-18 22:05:13+00:00
This is a pretty scary exploit, considering how easily it could be abused.

Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg. If you click it, JavaScript runs on the discord.com origin.

Here's what could happen:

- Your Discord session cookies and token could be stolen, leading to a complete account takeover.

- read/write your developer applications & webhooks, allowing them to add or modify bots, reset secrets, and push malicious updates to millions.

- access any Discord API endpoint as you, meaning they could join or delete servers, DM friends, or even buy Nitro with your saved payment info.

- maybe even harvest OAuth tokens from sites that use "Login with Disord."

Given the potential damage, the $4,000 bounty feels like a slap in the face.

edit: just noticed how HN just turned this into a clickable link - this makes it even scarier!
by Amezarak | 2025-12-18 22:05:16+00:00
Librarians around the US have been doing mass purges of older books, especially politically sensitive older books and often for political reasons. There’s lots of news on this, if you’re interested. The problem also exists in Canada. I just checked my local library SYSTEM- consisting of about a dozen libraries - and it is in fact nowhere in there. It’s possible that, were my ILL privileges not restricted for “excessive use” (I don’t read new books, so nearly all my checkouts were ILl), that they would condescend to get it to me that way. Of course, they might not. And ILL has tighter restrictions and is more inconvenient. The primary mission of libraries today is not education, preservation of knowledge, or even literacy. The old mission statements are all dead. It’s entertainment and community support.

Either way, this is a silly argument. All these “banned” books are also readily available in your public library - they’re pop lit, your local library likely has more copies of Maas than all the Greek writers of antiquity combined.

Edit: on page 2 of 11, I have already counted 62 copies of Sarah J Maas book. As an institution for serving the public entertainment, my library system is doing great.
Breaking Changes in Python-3.14
by wef | 2025-12-18 22:05:45+00:00
One of the reasons Linux is so successful is Torvald's insistence on never breaking user space.

The python people don't adhere to this principle and maybe I need to give up on it, I'm just sick of this crap.

Those of us of a certain vintage will recall the tumult of python-2 to -3. Suddenly, production code needed significant re-writing. We got an arguably better python out of it, but oh! the pain.

In 3.14, (among many other things) the python developers decided to make 'forkserver' the default instead of 'fork' for the Process() method (this is for starting a child process - https://docs.python.org/3/library/multiprocessing.html). Why on earth break our code in such a wanton way? Why not leave the default alone - there was always the option to use 'forkserver' if one wanted it. Or maybe they could have created a new entrypoint with the new behaviour Process_fastserver() or some such? Oh no! Just break it and make their customers patch furiously!

When we adopt a language, we like to think that what runs today will run tomorrow - C and bash programs that I wrote 30 years ago still run. Not with python - if you use it, buckle up and make sure your regression tests are thorough, it'll be a rough ride.

Move slow and break things, perhaps?
Show HN: Anonymous platform for writing and discovering personal diary entries
by reagantriminio | 2025-12-18 22:05:46+00:00
I wanted a place to say things I couldn't tell my friends or family—but I still wanted to be heard. So I made Inkwells.

This is a personal project I built for anonymous writing. You're identified only by a number on your diary. Otherwise there are no profiles or usernames at all. You can browse other people's entries, save inkwells you like, and even comment/react without any ties to your own personal diary.

Any comments, questions, or suggestions are greatly appreciated!

I would also appreciate if you guys could point out any bugs, or features you find unintuitive.

URL: https://www.inkwells.io/
by lambdaone | 2025-12-18 22:06:20+00:00
At this point, web design 'ecosystems' are essentially money whirlpools. They're complex, so they require programmers skilled in using them, who in turn make more sites which need more programmers, and so on, and the network effect takes over and cements this feedback loop in the structure of the jobs market.

And the frameworks are churned continuously and are also bug-ridden nightmares, so that continuous development and support is needed to keep websites functioning and secure.

Any reduction in framework complexity threatens the whole edifice.
by zzo38computer | 2025-12-18 22:07:20+00:00
I agree it should do something, which might be configurable by the end user and implementation dependent. For example, a browser might have an option to display the time converted into your preferred time format and time zone. If the operating system environment has some way to specify that some text refers to date/time and can be used with other software in this way, then it would be possible to do that, too.

(My own Scorpion document format is intended to include this capability, as well as the ability to specify other things (e.g. units of measurement, international telephone numbers, how a word is pronounced, languages, etc) to be handled in similar ways, but it is not currently fully defined.)
by mathgradthrow | 2025-12-18 22:07:22+00:00
>The problem is that you stopped there, you haven't even made any attempt at reconciling them with the original claim.

What are you talking about? I've done all the diligence that is due. If you want to convince me, you have to actually present your evidence. When you do present evidence, I'm free to assume that the evidence you've presented is your best evidence.

The article starts with a story about an 83 year old farmer with Parkinsons. I'm not going to continue reading after that point. An 83 year old with Parkinsons is not an anomaly, his existence is not evidence of anything. I'm not required to look beyond this point, and I'm absolutely free to comment about that. This is reasonable skepticism. I am not claiming evidence of absence, I'm claiming absence of evidence.

But fine, if you want to look for evidence of absence, then as you say, We need look no further than a random country where paraquat is banned. Paraquat is banned in germany, and there are 80 million people in germany, go google how many of them have Parkinson's disease.

If you are trying to convince me of an effect so small that you cannot even come up with one anomalous Parkinson's case to write a story about, then I don't care.
by nice_byte | 2025-12-18 22:07:41+00:00
You can play with a demo here: https://huggingface.co/spaces/microsoft/TRELLIS.2 (requires a hugging face acct)

The results from arbitrary pictures are not nearly as good as what's shown in the posting. So either the demo is running a gimped version of the model or the examples are _very_ handpicked.
by tptacek | 2025-12-18 22:07:41+00:00
I haven't read her book, am myself somewhat read in to the background here, and if she's claiming NSA was stockpiling serverside web bugs, I do not believe her.

In reality, intelligence agencies today don't even really stockpile mobile platform RCE. The economics and logistics are counterintuitive. Most of the money is made on the "backend", in support/update costs, paid in tranches; CNE vendors have to work hard to keep up with the platforms even when their bugs aren't getting burned. We interviewed Mark Dowd about this last year for the SCW podcast.