MurphyA/hacker-news huggingface dataset:
by cyberax | 2025-12-14 22:15:49+00:00
> 1. You don’t have any access keys in plain text

That's not correct. The (ephemeral) keys are still available. Just do `aws configure export-credentials --profile <YOUR_OIDC_PROFILE>`

Sure, they'll likely expire in 1-24 hours, but that can be more than enough for the attacker.

You also can try to limit the impact of the credentials by adding IP restrictions to the assumed role, but then the attacker can just proxy their requests through your machine.
by imperio59 | 2025-12-14 22:16:01+00:00
GraphQL was created to solve many different problems, not just overfetching.

These problemes at the time generally were: 1) Overfetching (yes) from the client from monolithic REST APIs, where you get the full response payload or nothing, even when you only want one field

2) The ability to define what to fetch from the CLIENT side, which is arguably much better since the client knows what it needs, the server does not until a client is actually implemented (so hard to fix with REST unless you hand-craft and manually update every single REST endpoint for every tiny feature in your app). As mobile devs were often enough not the same as backend devs at the time GraphQL was created, it made sense to empower frontend devs to define what to fetch themselves in the frontend code.

3) At the time GraphQL was invented, there was a hard pivot to NoSQL backends. A NoSQL backend typically represents things as Objects with edges between objects, not as tabular data. If your frontend language (JSON) is an object-with-nested-objects or objects-with-edges-between-objects, but your backend is tables-with-rows, there is a mismatch and a potentially expensive (at Facebook's scale) translation on the server side between the two. Modeling directly as Objects w/ relationships on the server side enables you to optimize for fetching from a NoSQL backend better.

4) GraphQL's edges/connections system (which I guess technically really belongs to Relay which optimizes really well for it) was built for infinitely-scrolling feed-style social media apps, because that's what it was optimized for (Facebook's original rewrite of their mobile apps from HTML5 to native iOS/Android coincided with the adoption of GraphQL for data fetching). Designing this type of API well is actually a hard problem and GraphQL nails it for infinitely scrolling feeds really well.

If you need traditional pagination (where you know the total row count and you want to paginate one page at a time) it's actually really annoying to use (and you should roll your own field definitions that take in page size and page number directly), but that's because it wasn't built for that.

5) The fragment system lets every UI component builder specify their own data needs, which can be merged together as one top-level query. This was important when you have hundreds of devs each making their own Facebook feed component types but you still want to ensure the app only fetches what it needs (in this regard Relay with its code generation is the best, Apollo is far behind)

There's many other optimizations we did on top of GraphQL such as sending the server query IDs instead of the full query body, etc, that really only mattered for low-end mobile network situations etc.

GraphQL is still an amazing example of good product infra API design. Its core API has hardly changed since day 1 and it is able to power pretty much any type of app.

The problems aren't with GraphQL, it's with your server infra serving GraphQL, which outside of Facebook/Meta I have yet to see anyone nail really well.
by the_other | 2025-12-14 22:16:20+00:00
I notice it all the damn time.

- If I scroll a web page, and then decide to close it, I have to wait 'til the browser finishes scrolling the page before it'll open the menu with the close button

- every single time I watch a video my eye is drawn to the fucking stupid glass-y diffraction patterns and away from the content I was watching, or the play/pause icon I was interacting with

- every single time I use the home screen on iOS, or CMD+tab in macOS, my eye is drawn to the glass-y highlights around the icons, distracting me from whatever I was trying to do and causing me to think about the OS (and how much I hate the new look)

- I keep noticing the stupidly wide rounded corners on apps

- I keep noticing how the glassy icons and controls and stuff don't consistently change color with dark/light mode. They sometimes change if the content behind them is light/dark (which you'd think is a contrast improvement but it wouldn't be necessary if they had boxed out the toolbars like before). Often half the buttons have changed to contrast with the background and half haven't. This makes all the icons harder to read because I have to interpret the whole set to work out why it's suddenly slightly confusing

- I keep noticing how the toolbar icons have this insane shadows making them appear about 5meters closer to my face than the rest of the scree, which pulls my attention away from whatever I was looking at

- I keep noticing how some icons have those annoying highlighted edges and some don't and wondering why that is, and if they'll all come in sync...

- ... and the glassy-highlighted icons look like shit because the highlights are all the same (same color, same angle, same spread around the edges of the icons), which wouldn't happen if they were actual physical things under natural illumination

- since iOS 26.2, the increase contrast and reduce transparency modes have got worse: they seriously mess with the colors, in many case the light/dark relationship is inverted from what would be most useful (I can't think of examples now - it was so annoying I actually switched back to glassy to allow my eye a sense of comfort when using the thing, and now I try to put up with the "eye candy" distractions instead). I used to have "increase contrast" turned on with the last several major iOS versions. The new scheme has made it slightly harder to use the phone.

And I'm not even getting to how everything is harder to read, harder to see. It's _dreadful_ and they should fire everyone from the C-level who signed it off downwards.
by llbbdd | 2025-12-14 22:16:27+00:00
This is probably just a parallel discussion. I written plenty of successful web scrapers without LLM's, but in the last couple years, I've written a lot more where I didn't need to look at the web markup for more than a few seconds first, if at all. Often you can just copy-paste an example page into the LLM and have it generate accurate, consistent selectors. It's not much different when integrating with a formal API, except that the API usually has more explicit usage rules, and APIs will also often restrict data that can very obviously be used competitively.
by eatonphil | 2025-12-14 22:17:05+00:00
Check out Parity Lost and Parity Regained and Characteristics, Impact, and Tolerance of Partial Disk Failures (which this blog indirectly cites) if you'd like authoritative reading on the topic.

https://www.usenix.org/legacy/event/fast08/tech/full_papers/...

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&d...
by grumblepeet | 2025-12-14 22:17:23+00:00
Building an app that scans file systems prior to being migrated into M365. Looks for common governance issues and file and folder trees that won’t play nice in SharePoint. Not a migration tool as such, just something to scratch a consultancy itch. Python and Tkinter for now until I hit something that requires more complexity. Also a command line version that I’ll use more often. This probably could have been a PowerShell script but this is more fun.
by idoubtit | 2025-12-14 22:17:29+00:00
> Another good book is "Eichman in Jerusalem"

I've read at least two articles authored by historians that thought this book was full of factual errors and misunderstandings. One of them had studied Eichmann's life and correspondance, and found that he was far from the character that Hannah Arendt depicted. IIRC, the other article tried to explain her bias; I remember she hated Jerusalem and despised most people she met in Israel.

It may be good read, but don't expect the book to be fair or truthful.
by austin-cheney | 2025-12-14 22:17:32+00:00
I see this sentiment on here frequently. Yes, content delivery now sucks like it’s written by bots for consumption by bots solely with the goal of supplying mindless dribble for ad impressions.

However the technology is so much better. As a developer I can build web and media applications that you couldn’t ever imagine building 20 years ago. I am not talking about framework garbage like jquery or React. I am talking about things like WebSockets, HTML5 audio/video, Node/Deno, and more.
by joecool1029 | 2025-12-14 22:17:52+00:00
> Spotify is still the only big streaming service with native platform-level scrobbling.

That's not true. It's missing from Apple Music but present in Tidal, Deezer, and Quobuz. It also works well with Plex.

A large list from them: https://support.last.fm/t/more-ways-to-scrobble/192
by xg15 | 2025-12-14 22:19:14+00:00
Even if it were true, it sounds like an obvious loophole if one party could simply refuse to consider the other party a state and instantly get rid if all legal liability.

Which is actually one of the major issues of conflict with the Palestinians. The Palestinians want to be a state and most of the world considers them one. It's just that Israel and the US (together with other countries) don't and that the US also blocks official designation by the UN.
by patcon | 2025-12-14 22:20:50+00:00
Agreed. When cloudflare (ugh, aka the internet) goes down, we can't access information to think and work through. ("the fuel" in some metaphor)

But what about when LLMs go down and a good chunk of a whole generation won't even know how to think, when the remote system goes down? (Is the ability to think "the engine" of self and agency in this metaphor?)

We are building a wildly irresponsible context to exist in.
by simonw | 2025-12-14 22:20:56+00:00
I just had Codex CLI figure out where that first version ended and the new one began.

It looks to me like this is the last commit before the rewrite: https://github.com/EmilStenstrom/justhtml/tree/989b70818874d...

The commit after that is https://github.com/EmilStenstrom/justhtml/commit/7bab3d2 "radical: replace legacy TurboHTML tree/handler stack with new tokenizer + treebuilder scaffold"

It also adds this document called html5ever_port_plan.md: https://github.com/EmilStenstrom/justhtml/blob/7bab3d22c0da0...

Here's the Codex CLI transcript I used to figure this out: https://gistpreview.github.io/?53202706d137c82dce87d729263df...
by billyp-rva | 2025-12-14 22:20:58+00:00
> Writing a Typescript program that takes external input but has no runtime error checking is already a mistake, though.

If it's a service, yes, and that's true no matter what technology the service is using. If it's a library, no, because...

> and if you write type assertions without ensuring that the assertions are accurate, then that's on you, not Typescript.

That's on whoever is using the library, not the library author. If the library author provides type definitions, and you as the consumer choose to ignore them, then it's on you.
by ekipan | 2025-12-14 22:21:06+00:00
This is a tangent on language semantics (of the English kind) instead of engaging with the (interesting!) narrative on miscompiles. Feel free to skip.

> A compiler is a translator that translates between two different languages.

I lament the word "compile" subsuming "translate" for most of tech. Computers interpret instructions and do them now, and translate instructions from one code to another that is later interpreted or translated again.

The English word "compile" means "bring together" and compiler systems usually have lots of interpreting and translating and linking to make some kind of artifact file, to wit:

> taking a step back, a compiler is simply a program that reads a file and writes a file

But not necessarily! You don't even need that much! Just source and target codes.

Forth systems (which I enjoy) for example have a single global STATE variable to switch between _execute this word now_ and _compile a call to this word for later_ directly into memory (plus metadata on words that allow them to execute anyway, extending the compiler, but I digress). You could snapshot the memory of the Forth process with its built target program and reload that way, but the usual Forth way is to just store the source and recompile to memory when needed.

Traditional threaded Forths compile calls to a list of routine addresses for a virtual machine interpreter routine (load address then jump to code, not much more work than the processor already does). I prefer subroutine threading, though, where calls are bone fide CALL instructions and the inner interpreter is the processor itself, because it's easier to understand.

Nowadays even the processor translates the instructions you give it to its own microcode for interpreting. It's code all the way down.

(I'm still reading the article.)
by sureglymop | 2025-12-14 22:21:16+00:00
I graduated high school less than a decade ago and I had to read about 90% of those books. And those are just the German ones, there were at least half as many English and French ones too. I have younger cousins who are in the school system now and I am fairly certain that it is still the same. Actually I think it is probably mandated by the curriculum.
by md224 | 2025-12-14 22:21:38+00:00
Sure, but if the caller is Javascript then you're running Javascript, not Typescript*, so it makes sense that you're not going to get type safety.

I'm also not sure we're actually disagreeing on anything, so perhaps my reply was pointless. I agree that if you mix JS and TS in the way you describe, you'll have problems. My reply was just to say "yes, and that's not really Typescript's fault", but perhaps you weren't implying that to begin with.

* I'm aware that you can't run Typescript directly, but I hope my point here is clear... you're running a program that wasn't type-checked by TS.
by Aaargh20318 | 2025-12-14 22:21:42+00:00
Do you happen to have an app on this list open (https://avarayr.github.io/shamelectron/) ?

There is a bug in Electron caused by the use of a private API that slows down macOS 26 significantly. It’s fixed in Electron but not all Electron apps have updated to the new version yet. Apparently it’s fixed in macOS 26.2
by perching_aix | 2025-12-14 22:21:52+00:00
I read their comment a bit differently; I interpreted what they wrote as a combination of a number of things:

- what you're saying: that people will happily distort the meaning of words and events given enough desperation and/or interest in doing so - i agree

- that people do this commonly with these two topics: i do not see that at all, not from this framing at least - i think if people asked themselves if they disapprove of these things, they'd generally say yes. i think people generally do genuinely believe they are against these.

- that people are doing this maliciously (~ this is exclusively or near exclusively interest driven rather than desperation): i just plain don't think so. i think those who suspect election fraud do by and large legitimately believe it happened or happens. same for your example.

And so what I was more pushing back on was #2 and #3. Like it's not that I don't think the phenomenon of semantic distortion isn't real, I just find focusing on it and framing things around it this way in this context is reductive and asinine, and it overplays it; it implies en-masse intentional malice without evidence. I could do this to their comment just as easily: I could start opining about how they're intentionally publishing divisive ragebait, when maybe they 100% just fully believe what they wrote and have just reached the (a?) boiling point after reading the above article and vented. I cannot actually know.

Long story short, yeah, people do be acting ill faith from time to time, but hyperfocusing on that doesn't make anyone's day better, nor does it help against it. It just plays right into it. That's the whole problem with it in the first place, it's anti-social. I'm pretty sure they could have picked a less instigating framing at least - your comment delivers the same idea but in a much less inflammatory manner, for example.
by robhlam | 2025-12-14 22:22:24+00:00
I treat the spoons and ladles I carve with food grade organic flax/linseed oil and roast in a fan oven at 180 deg C, giving a robust coating that is also very safe. A few coats are required to fill all the pores in the wood for a beautiful satin finish but all the coats can be completed in a couple of hours total. Colours start at a something slightly darker than the natural oil colour and darken to the colour of chocolate depending on how long they’re in the oven for. The smell is of hot cooking oil unless you go for full chocolate brown in which case it starts to smell of burnt oil and a bit smoky. Fully dry your item first and heat it up slowly in the oven to 180 deg C before applying the first coat so that all areas cure and colour equally. Saturate the wood initially then wipe off all excess with a paper towel which you can then use to add the subsequent coats. Check on the spoon and remove any drips that appear during roasting before they harden. Silicone oven mitts are great for handling the spoons while hot.
by steveklabnik | 2025-12-14 22:22:25+00:00
No. Because the tests that don’t pass are edge cases and corners that most people wouldn’t notice. It’s arguably more important to fix bugs that impact actual usage, so it can be a valid strategy to do this even before you hit 100% coverage, to help you prioritize the remaining bugs to fix.

In other words, there may be more serious bugs not in the test suite than the ones that aren’t passing that are in the suite. And you only find that out through real usage.
by pseudalopex | 2025-12-14 22:22:28+00:00
> It is expressly described as an experiment. Making it the default does not preclude it being an experiment.

Calling something an experiment does not make it exempt from criticism.

> It’s how you get broad enough usage to see if it’s ready.

My understanding was it was known not 100% compatible. And what did I say you should assume?

> If it isn’t by the time for LTS, then it’ll be unmade as the default.

People use non LTS releases for non experimental purposes.
by llbbdd | 2025-12-14 22:22:50+00:00
Everybody's experience is different. I've found experientially that anybody who can actually define and describe these things with any degree of seriousness is, at least, aware of the resource constraints that make up the real world and have opinions that at least run in approximate sync with reality, which definitionally excludes them espousing real Redditor crap. I'm willing to engage with anti-capitalists who have at least put in the work to understand capitalism, but it seems like there's not much overlap between "understands" and "disagrees" for that segment.
by stanko | 2025-12-14 22:23:16+00:00
I completely understand what you mean, I often feel like that as well. Like every other skill, it takes time and it feels frightening when you see other people's work. Honestly I don't think I'm that good at pixel art, this is my first pixel art project. To be fair, spaceships and technology are pretty straight forward to draw.

Edit: typo
by protocolture | 2025-12-14 22:24:01+00:00
>No, he violated a trust given to him

He had 2 conflicting trusts, one from the people and one from the government. He chose to honor the people over the government, which is why there's so many bots in this thread who seem very angry with him.

If you read his autobio he was raised with very conservative beliefs, the issue was unlike most conservatives he wasn't able to ignore those beliefs in the furtherance of the state.

>Instead, he's hiding out playing the victim in a country that's actively genociding Ukrainians to a degree beyond anything the Trump or Netanyahu administrations can be accused of.

He would come back if you guys let him. Its not like he has a long list of safe places to go.

>Even if you believe the law is unjust, MLK Jr still had the balls to go to jail for what he believed.

I vastly prefer my anti authoritarians out of jail living their best life with their ~300 kids somewhere in the south of australia.
by devarx | 2025-12-14 22:24:05+00:00
https://chorebound.com

Working on Chorebound - an RPG-style chore/habit app. You do real-world chores, they become quests, you fight monsters, get loot drops, earn XP/gold, and level up. Can be solo or co-op with friends/family.

If you’ve used Habitica and bounced off, this is meant to be more lightweight, simplified, and focused on closer-knit co-op rather than public guilds.

Releasing in the next few weeks.
by rawgabbit | 2025-12-14 22:24:18+00:00
I graduated from public school a long time ago. I hated Shakespeare. The phrasing and Englishness of it was a complete turn off. And I read a lot. I believe I read almost a fourth of the books in my little public library in my rural town in Texas. As far as writing, I admire the writing in the King James Bible more than Shakespeare although I am Catholic. I would say most of the books I read were crap and written poorly.
by sureglymop | 2025-12-14 22:24:26+00:00
I mean what makes it more acceptable is that you have HMR and instant preview during development. So, all the transformations and bundling aside, you do see how it runs during development.

However I have been in a few situations at work where all of a sudden we did have issues that required us to dig deeper. There were also some bundling related issues that caused problems in production deployments. At that point many co workers had no idea how to even approach it to be honest.
by ghaff | 2025-12-14 22:24:30+00:00
Probably a difficult question to answer. My sense is that high quality new hardwood furniture hasn't gotten especially more expensive over recent time (adjusted for inflation) but you'd probably have to ask someone in the industry who is more plugged into various cost inputs.

>seems unrelated to (e.g.) sturdiness or expected lifespan

I'll disagree somewhat. At least in New England, there are smallish manufacturers who make high quality products that you're not going to find in most, if any, of the large retailers.
by kami23 | 2025-12-14 22:24:35+00:00
Oh definitely not, I do it on every system that I've needed it to be synced before I did something. We were just working at a place that had 2k+ physical servers with 88 drives each in RAID6, so that was our main concern back then.

I have been passing my anxieties about hardrives to junior engineers for a decade now.
by MarsIronPI | 2025-12-14 22:24:38+00:00
When I'm not working on college applications, I'm working on my HS senior capstone project: Porting the Bridge Designer[0] to the web. So far we've got bridges rendered statically and the load simulation working in code (no load visualisations yet). I intend to post it here when it's ready.

[0]: https://bridgedesigner.org
by makeitdouble | 2025-12-14 22:24:42+00:00
Definition could be a bigger thing.

I used my son's HP Chromebook for about a year as a third device, and the screen was indeed pretty bad for reading.

Tuning brightness, colors and bumping font sizes helped; but at the end of the day it's a very low DPI screen and intricate letter shapes are that more blurry at the sizes that were easier for me to read.

I have no trouble reading all day on a Surface Pro, for comparison.
by BoorishBears | 2025-12-14 22:25:04+00:00
No the point was quite clear:

> A few years ago we didn't have an imprecise nondeterministic programming language that would allow your mom to achieve SOTA results on a wide range of NLP tasks by asking nicely, or I'm sure people would have taken it.

But that (accurate) point makes your point invalid, so you'd rather focus on the dressing.