MurphyA/hacker-news huggingface dataset:
by glenstein | 2025-12-17 17:53:15+00:00
I think you're right, but it's important to emphasize many of these attempts to tell the story of market share get major facts catastrophically wrong. The decline in Firefox market share from like 33% to below 10% is mostly because the world pivoted to mobile, and Firefox "dominance" was in a world of desktop browsers. It was defaults and distribution lock-in as the world pivoted to mobile that led to the change in market share. As well as the web as a whole effectively tripling in number of users, and Google leveraging its search monopoly and pushing out Chromebooks effectively at cost.

For some reason that part of the story always seems to get omitted, which I find bizarre. But the web pivoted to mobile and Google flexed its monopoly powers. I would argue that upwards of 95% of the change in market share is explained by those two factors.
by notanastronaut | 2025-12-17 17:53:21+00:00
Not to dog pile, just to affirm what jacquesm is saying. Remember, what you do consciously is what you end up doing unconsciously when you're distracted.

Here is a hypothetical: A loved one is being hauled away in an ambulance and it is a bad scenario. And you're going to follow them. Your mind is busy with the stress, trying to keep things cool while under pressure. What hospital are they going to, again? Do you have a list of prescriptions? Are they going to make it to the hospital? You're under a mental load, here.

The last thing you need is to ask "did I use my turn signal" as you merge lanes. If you do it automatically, without exception, chances are good your mental muscle memory will kick in and just do it.

But if it isn't a learned innate behavior, you may forget to while driving and cause an accident. Simply because the habit isn't there.

It's similar for talking to bots, as well. How you treat an object, a thing seen as lesser, could become how a person treats people they view as lesser, such as wait staff, for example. If I am unerring polite to a machine with no feelings, I'm more likely to be just as polite to people in customer service jobs. Because it is innate:

Watch your thoughts, they become words; Watch your words, they become actions.
by Aachen | 2025-12-17 17:53:31+00:00
Keep in mind that votes aren't supposed to be about whether you agree or disagree, but whether a comment adds substance to the thread. A good question that makes a wrong assumption can be worth upvoting; a correct but fairly irrelevant statement about politics not (to give a relatively obvious example)

Being "voted to -2" doesn't necessarily mean you were wrong (it often correlates though). People might just think it wasn't relevant in whatever context you posted it in

I often find it hard to tell what makes people think something I write is not helpful (or sometimes also a comment someone else made) and thus appreciate comments that clarify constructively. It can also help to ask for clarification if you're particularly surprised about the votes on a given post
by JohnMakin | 2025-12-17 17:53:45+00:00
Sorry, but this overwhelmingly has not been my experience in nearly a decade working in tech. Even if you get 2-3 years out of a junior before they jump ship to a "big tech" (not as easy or common as you make it sound, by the way, especially during the last few years of layoffs and hiring freezes), you likely have reaped far more benefits at a low cost relative to the market than the ramp-up time investment in the junior. Furthermore, the talent pipeline here benefits everyone - even if they jump ship elsewhere, because you could not promote or otherwise mentor them into staying, you can also hire these "jump ship" engineers on the other side of the pipeline.

When this dries up because the market stops investing in junior engineers, you're left with absolutely nothing after a mere handful of years. I worry about this future a lot. Luckily I am in a shop that does not mind hiring them (now is a super good time to find junior talent at a good price too).
by BizarroLand | 2025-12-17 17:54:00+00:00
And because of Googles search system, almost every result comes from a content farm or some other page that has "optimized for google search" i.e., filled their pages with so much pointless dreck that finding the information you came for becomes nearly impossible.

LLMs that are trained off of that dreck give you the answer you were looking for (sometimes, when they don't make it up).

And they've gotten to the point where they do so more quickly than trying to find it yourself in many cases, but I would much rather websites and search results being faithful stewards of the functions they are intended for and to get the information from the tap rather than having an AI butler deliver it to me.
by e2le | 2025-12-17 17:54:07+00:00
Thunderbird is entirely funded by donations for some years now and is more than enough. In 2024, Thunderbird received $10.3M (19% increase over the previous year) in donations which was used to employ 43 people.

https://blog.thunderbird.net/2025/10/state-of-the-bird-2024-...
by whazor | 2025-12-17 17:54:09+00:00
Amazon has an internal platform for building software. The workflows are documented and have checks and balances. So the CEO wants to have more junior developer that are more proficient with AI, and have (in ratio) less senior developers. Also, product context comes from (product) managers, UX designers.

For medium or small companies, these guardrails or documentation can be missing. In that case you need experienced people to help out.
by sltkr | 2025-12-17 17:54:25+00:00
> Yeah no, (1) Mozilla was going to be in for a tough go no matter what; I don't think Eich would have fared any better.

Nobody knows this for sure. We do know that Eich was fired for political reasons, and not because of his technological direction.

This betrays a decision making process that prioritizes political correctness above leadership qualities and technical contributions.

> you can't donate to stop your own employees and users from having civil rights without repercussions.

Why not? Why can't the CEO of Mozilla have his own private political views just like anyone else, and donate his own private money to whatever democratic causes he likes?

This really isn't obvious to anyone except the people, like you, who view Mozilla as a political project first, and as a software project a distant second.

Firing your CEO for not being sufficiently aligned with the American Democratic Party only makes sense if you assume the purpose of Mozilla is to push American Democratic politics, rather than make good software that anyone in the world may use (spoiler alert: many users of open-source software are not American Democrats!)
by echelon | 2025-12-17 17:54:55+00:00
This.

E-learning can be like Steam to some people. You buy the course and then it sits there. You get a dopamine hit when you buy, and you can finish the course later. Sometime.

Some people need structure. But mostly structure is a way of dragging along those who aren't soaking up learning already, who aren't naturally seeking the next problem and breaking it apart. Not everyone does this, and so structure helps as a forcing function.

There are some subjects where you need academic and theoretical grounding. Or expensive equipment. For everything else, it's best to get hands on and just throw yourself at the subject. There's nothing really stopping a motivated person.
by kemotep | 2025-12-17 17:55:06+00:00
2 things about passkeys I wish would be fixed.

1. Passkey prompts asking if I want to use a phone or security key when I only have one (or neither!) registered. The UI for this gets in the way and should only ever present itself if I happen to have both kinds of devices registered.

2. Passkeys should have had the portability and flexibility that ssh keys have from the start. Making it so your grandparents can use public key cryptography and gain a significant advantage in securing their accounts in a user friendly manner should have been the priority. Seems like vendor lock-in was the goal from the start.
by moralestapia | 2025-12-17 17:55:15+00:00
The real answer is:

You should have a mental model about how the world works and the fundamental rules of the context where you're operating. Even though you might not know something, you eventually develop an intuition of what makes sense and what doesn't. And yes, that applies even to "university lectures" since a lot of professors make mistakes/are wrong plenty of times.

Taking an LLM's output at face value would be dumb, yes. But it would be equally dumb to take only what's written on a book at face value, or a YouTube video, or anyone you listen to. You have to dig in, you have to do the homework.

LLMs make it much easier for you to do this homework. Sure, they still make mistakes, but they get you 90% of the way in minutes(!) and almost for free.
by ChrisArchitect | 2025-12-17 17:55:31+00:00
[dupe] Lots of discussions:

Mozilla appoints new CEO Anthony Enzor-Demeo

https://news.ycombinator.com/item?id=46288491

Is Mozilla trying hard to kill itself?

https://news.ycombinator.com/item?id=46299934

No AI* Here – A Response to Mozilla's Next Chapter

https://news.ycombinator.com/item?id=46295268
by godelski | 2025-12-17 17:55:32+00:00
Can we just not be irrationally mad at Mozilla for once?

It is beyond me that here, on HN, of all places people do not understand the criticality that FF is to the free and open internet. Use WaterFox or whatever, but stop picking a different color of Chrome.

It doesn't take a genius to figure out Mozilla is trying everything they can to stay relevant. Literally everything they do ends up with tons of HN comments making complaints. Tons of complaints coming from people who haven't even used FF in a decade! It feels like a disinformation campaign but I'm pretty sure you all just like to hate on Mozilla and justify your usage of Chrome.

We're just fucking ourselves over here. Yes, there's reasons to complain about FF. There's no shortage. But are they truly big enough reasons to hand over the keys to the internet to a singular entity? And to Google of all companies?! Who the fuck cares about this AI browser stuff, you can opt out or use a fork like WaterFox who makes that the default. Guess who's AI stuff you can't opt-out of?

Is it really worth it?

Is 3 clicks to uninstall AI seriously enough justification to give Google the internet?

What are we even doing...
by glenstein | 2025-12-17 17:55:49+00:00
Exactly! I keep banging this drum but I'm fascinated by the possibility of Android being required to have a pop-up where people can choose different browsers, as a potential remedy to Google's monopoly. Because engineering a path dependency on Google search, from mobile hardware, to software, to default browsers, to default search on the browser, I think is part of how they've enforced their monopoly. There's been a legal judgment that they are, in fact a monopoly, but I don't think any remedy has been decided on yet. And there's a lot of historical precedent for a pop-up to select a default as a remedy to software monopolies.

Granted in Google's case, it seems that the Monopoly judgment was with respect to ad markets, but locking people into search to serve ads might be understood as part of the structure of that monopoly.
by recursive4 | 2025-12-17 17:55:58+00:00
Really cool to see this! Building a security scanner specifically for LLM apps feels like an important step given how quickly production AI workflows are proliferating.

What stood out to me in the blog is how the scanner isn’t just a general linting tool — it actually traces inputs and outputs through the code to understand how untrusted user data might flow into prompts, models, and then back into privileged operations. That focus on data flow and behavior rather than just surface diffs seems like a solid way to reduce both blind spots and noise in alerts.

I also appreciate the emphasis on concrete vulnerabilities and real CVEs (e.g., LLM code executing arbitrary commands or translating LLM output directly into database queries) — showing that these aren’t just hypothetical risk categories but things happening in the wild.

A couple of thoughts / questions from my side:

Balancing precision vs noise: The blog mentions tailoring what counts as a real finding so you don’t overwhelm engineers with false positives. It’d be interesting to hear more about how that balance was tuned in practice, especially on larger codebases.

Integration with existing pipelines: I saw the GitHub Action auto-reviews PRs, but how do teams handle this alongside other scanners (SAST, dependency scanners, etc.) without ballooning CI times?

Vulnerability taxonomy: Prompt injection, jailbreak risk, and sensitive information leaks are all big categories, but there are other vectors (RAG-specific issues, tool misuse in agents). Curious how far the scanner’s heuristics go vs where red-teaming still wins.

Overall, a much-needed tool as LLMs go from experiment to core business logic. Would love to hear from others about how they’ve integrated this kind of scanning or what other categories of LLM security risk they’re watching for.
by mlloyd | 2025-12-17 17:56:17+00:00
One thing I'd point out is that there are only so many ways to write a document or build a spreadsheet. There are a ton of business processes that are custom enough to that org that they have to decide to go custom, change their process, or deal with the inefficiency of not having a technical solution that accomplishes the goal easily.

Lotus Notes is an example of that custom software niche that took off and spawned a successful consulting ecosystem around it too.
by mattsears | 2025-12-17 17:56:25+00:00
Yay, another HN post confidently claiming "everyone’s doing X wrong."

"Everyone’s using AI wrong." Oh, we are? Please, enlightened us thought leader, tell us how we’ve all been doing it wrong this entire time.

"Here’s how most people use AI." No, that’s how you use AI. Can we stop projecting our own habits onto the whole world and calling it insight?
by tracker1 | 2025-12-17 17:56:31+00:00
I use Docker a lot myself... even outside Kubernetes, I just find it easier to work with Compose for semi-complex apps, dev environment or production.

I think VS Code is probably more responsible for TypeScript acceptance than any other project. Just having good interactions with the editor I think brought a lot of the requests to add type definitions to projects.

I'm with you on Next/Mongo... while as a Dev I liked a lot about Mongo, I'd never want to admin it again, I'm fine with PostgreSQL's JSONB for when I need similar features. On Next specifically, usually avoid it... fatter clients aren't so bad IMO.

Edit: +1 for Hono too... Beyond that, Deno has become my main scripting environment for all my scripting needs.
by jijji | 2025-12-17 17:56:44+00:00
I tried Gemini CLI the other day, typed in two one line requests, then it responded that it would not go further because I ran out of tokens. I've hard other people complaint that it will re-write your entire codebase from scratch and you should make backups before even starting any code-based work with the Gemini CLI. I understand they are trying to compete against Claude Code, but this is not ready for prime time IMHO.
by vel0city | 2025-12-17 17:56:56+00:00
In my county, tax rates have to be renewed every year. So every year there's a chance for the rates to change. There is an automatic suggestion of a "no new revenue" option formulated by the appraisal district based on their new assessments, there are then voter approved changes, and then the county (or taxing entity) decides.

My property taxes have practically only gone up over the years, but the tax rates from the various entities have mostly trended downwards.
by fxn-m | 2025-12-17 17:57:23+00:00
Damn, that’s unfortunate. We found the logs and looks like apollo returned empty for your domain. I just pushed an update that uses the same enrichment workflow as the rest of the app and looks like it correctly IDed your co. we're using gemini 2.5 flash-lite under the hood, and if it's not grounded it can come up with some whacky results! we'll shortly be shelving it for flash-3-lite as soon as we can
by Hutrecht | 2025-12-17 17:57:28+00:00
There are plenty of developer jobs in Europe paying 70k+ €. While salaries may be lower than in the US, your real quality of life can be much better because:

1. Lower food costs. Groceries are cheaper and healthier and eating out is more affordable (+ tipping is not necesary)

2. Generally lower rent. Unless you live outside a few very expensive cities (but it would compensate with higher salaries)

3. No need for a car. Public transport usually costs around 40 to 60 € per month.

4. No need to save for college. Public universities are free or very cheap

5. Healthcare is covered. No huge insurance premiums or surprise medical bills.

6. Less working time. Shorter workweeks, fewer unpaid overtime hours, and stronger limits on burnout.

7. More paid vacation. 25 to 30 days off per year is standard plus public holidays

8. Paid parental leave for both parents without risking your job.

9. Stronger worker protections including notice periods and unemployment benefits.

10. Child benefits and subsidized childcare in many countries.

11. Lower overall stress due to less financial anxiety around health and education.

12. Better work life balance and healthier company culture.

13. High quality public services and safer cities.

14. Easy and cheap travel across many countries. ...

I guess I will stop here.

Lower salary does not mean lower standard of living.
by redthrow | 2025-12-17 17:58:20+00:00
I’m a native Japanese speaker, so you don’t need to explain that writing kana with spaces is non-standard in most media (although some people -- both native speakers and non-natives -- erroneously claim that no native media uses that form of writing).

The people at Kanamoji Kai (all native speakers) are well aware of this too, and their website even has a section on 分かち書き (word separation). They use the example スモモ モ モモ、モモ モ モモ、モモ ニ モ イロイロ アル。 to illustrate that using spaces is a must if we switch to kana-based writing.

>> these full kana games would be harder even for natives if they used a more standard space-free style

This is true, but I take issue with your use of the word “more standard,” as USING SPACES IS THE STANDARD in full kana games.

Any form of writing reform, by definition, involves moving from the current standard to something that is initially non-standard, right? Korea got rid of kanji and now uses spaces with Hangul. In my opinion, it’s way easier to adapt than most people think.
by reliefcrew | 2025-12-17 17:58:22+00:00
Can you comment on the notion that Turnstile's primary goal isn't to keep bots out 100% but instead to slow them down to "human" speeds.

Asking because as a dev I hate when sites don't allow bots... however can appreciate that automation should be rate-limited. IOW, isn't preventing bot access actually an anti-pattern since rate-limiting is sufficient?

I see a lot of marketing which bashes Turnstile [detection] rates and tries to leverage this misunderstood nuance. And, it seems to be a dishonest point of contention but am willing to hear opposing arguments.

Thanks.
by sfink | 2025-12-17 17:58:23+00:00
> This is not true, based on what I've read about it. Do you have personal experience with these orgs that suggests otherwise?

Yes, I work for MoCo.

> Regardless, nothing is stopping Foundation funds from being directed to Firefox development. If someone gave them, for example, $1M that could only be spent on Firefox, they could pay Corporation or an external consultancy to contribute to the open-source Firefox repositories.

I don't really understand the whole setup, but I believe tax law is what is stopping this. What you are describing would be fraud (or something like it; IANAL). Money flows MoCo->MoFo (via dividends). Paying MoCo for something directly or hiring consultants to provide value would be "private inurement" [1], a phrase which here means that lawyers like scary words. It is using tax-exempt money to enrich private individuals.

But the tl;dr is that the MoFo/MoCo split was created specifically so that money could flow MoCo->MoFo and not the other way around, in order for MoCo to do business-y stuff without jeopardizing MoFo's non-profit status. Nvidia's game where it pays companies to buy their chips would not fly in the non-profit sector.

> This is already happening, either through Foundation or Corporation. One of the biggest Servo contributors works for a FOSS consultancy.

Servo was split out from Mozilla during COVID, and sadly is now completely unaffiliated. It is in the Linux Foundation Europe now. (Igalia is great, though!)

[1] https://legalclarity.org/private-inurement-definition-exampl...
by moralestapia | 2025-12-17 17:59:19+00:00
You can't beat a Caltech-tier lecture, for sure. But you know many people have access to that? You do know. Thousands, and I'm being generous.

LLMs level the playing field for the other 8 billion people.

Reminds of this article[1] that was featured yesterday and which I think was great!

1: https://news.ycombinator.com/item?id=46254794
by saltcured | 2025-12-17 17:59:26+00:00
This gets off topic of Firefox, but I don't see how any middleware can address your concern.

It is the very information you feed to the AI to get results that is in danger. No matter how you mask some metadata or account info, the actual in-band content is a problem.

The only solution is self-hosting of a model so the input and output cannot be monitored. And this also means running it offline, since a "black box" model that can do RAG or MCP or anything like that could also use covert channels to leak the information you are trying to control.
by bostik | 2025-12-17 17:59:51+00:00
Your CI has to be fully codified, stateless and possible to redeploy with a single command. That's the only way it can remain sustainable. No persistent hidden state, no manual configs (even as an option!) and automatically rebuilt on every release as the new version is deployed.

As a really big bonus, that also makes your CI testable.

In the previous job, we built such a thing: https://smarketshq.com/building-a-reproducible-ci-system-for...
by freehorse | 2025-12-17 18:00:25+00:00
Brave's funding model always included ads [0], but these are supposed to "respect privacy" (ie not collecting personal data and targeting). Not sure how they are there right now. I know there was controversy in the past due to their "ads replacement" scheme where they were replacing ads in websites with their own ads, and my impression is that all this "brave rewards" thing did not go through much.

Similar notion of "privacy respecting advertising" has also been stated in mozilla's texts about firefox several times, eg [1], and that goes a long time back in general [2]. I don't think that any of these attempts from brave or firefox have actually worked.

In general, this is the business model (or part thereof) of many/most "privacy focused" services, ie serving ads while "respecting users' privacy". Duckduckgo does that for example. A few of them are even owned by advertising companies (eg startpage). Alternative models are subscriptions (eg kagi) and/or sponsorship/donations (eg ladybird?).

[0] https://brave.com/about/#:~:text=Brave%20Ads,-Brave

[1] https://blog.mozilla.org/en/mozilla/mozilla-leadership-growt...

[2] "we want to show the world that it is possible to do relevant advertising and content recommendations while still respecting users’ privacy and giving them control over their data" https://blog.mozilla.org/advancingcontent/2015/05/21/providi...