MurphyA/hacker-news huggingface dataset:
by pjmlp | 2025-12-10 09:37:10+00:00
Unless rules have changed Rust is only allowed a minor role in Chrome.

> Based on our research, we landed on two outcomes for Chromium.

> We will support interop in only a single direction, from C++ to Rust, for now. Chromium is written in C++, and the majority of stack frames are in C++ code, right from main() until exit(), which is why we chose this direction. By limiting interop to a single direction, we control the shape of the dependency tree. Rust can not depend on C++ so it cannot know about C++ types and functions, except through dependency injection. In this way, Rust can not land in arbitrary C++ code, only in functions passed through the API from C++.

> We will only support third-party libraries for now. Third-party libraries are written as standalone components, they don’t hold implicit knowledge about the implementation of Chromium. This means they have APIs that are simpler and focused on their single task. Or, put another way, they typically have a narrow interface, without complex pointer graphs and shared ownership. We will be reviewing libraries that we bring in for C++ use to ensure they fit this expectation.

-- https://security.googleblog.com/2023/01/supporting-use-of-ru...

Also even though Rust would be a safer alternative to using C and C++ on the Android NDK, that isn't part of the roadmap, nor the Android team provides any support to those that go down that route. They only see Rust for Android internals, not app developers

If anything, they seem more likely to eventually support Kotlin Native for such cases than Rust.
by NicolaiS | 2025-12-10 09:37:16+00:00
Got acquired by a Fortune 500 and recieved new laptop. First hour I'm seeing TLS errors everywhere except the browser. They'd half-baked their internal CA rollout, so wasn't trusted properly.

By day two I started validating their setup. The CA literally had a typo in the company name, not a great sign.

A quick check with badssl.com showed that any self-signed(!) cert was being transparently MITM'ed and re-signed by their trusted corporate cert. Took them 40 days to fix it.

Another fun side-effect of this is that devs will just turned off TLS verification, so their codebase is full of `curl -k`, `verify_mode = VERIFY_NONE`, `ServerCertificateValidationCallback = () => true`, ... Exactly the thing you want to see at a big fintech company /s
by nikanj | 2025-12-10 09:37:23+00:00
And many things break in different, exciting ways. For example, we discovered that whilst the JVM can be configured to use system certificate store, that does not apply to websocket connections. So the product seems to be able to connect to the server, but all socket connections bork out with TLS errors.

Fun!

And so many of those products deliver broken chains, and your client needs to download more certificates transparently ( https://systemweakness.com/the-hidden-jvm-flag-that-instantl... )

Double the fun!
by lopis | 2025-12-10 09:37:37+00:00
> 8. avoid typing in code as part of the presentation, most of the time it won't work and it's boring watching somebody type

As usual, thumb rules exist to protect you until you can confidently break them. One of the coolest presentations I've seen was several years ago at a React conference where the speaker live coded an electronic music and light show using React. They were demonstrating how "components" could really render anything.
by nicoborrazas | 2025-12-10 09:37:53+00:00
I built POCsheet because I kept running into the same problem at work: Whenever I had to compare vendors, security tools, SaaS proposals, or technical RFPs, the process was slow, manual, and error-prone.

Most teams still compare PDFs by hand — copy/pasting into spreadsheets, trying to align features, pricing, SLAs, and security clauses. It’s painful and takes hours.
by graynk | 2025-12-10 09:38:39+00:00
And there are simply AMD bugs in the same vein, yes: https://gitlab.freedesktop.org/drm/amd/-/issues/?sort=create.... Again, I'm not saying it's not broken on NVIDIA, I'm saying it's just broken, period.

> official packages

Which is unfortunately not a good thing when it comes to NVIDIA. "Modern" distros package those for you, which is why I install linux-cachyos-nvidia-open [0] now and previously nvidia-driver-${version} [1] when I was using Pop! OS, both of which worked without a single issue for me from the word "go". My point is: it's not all doom and gloom, there's life to be had and it's not that worse than AMD cards.

[0] https://packages.cachyos.org/package/cachyos/x86_64/linux-ca...

[1] https://github.com/pop-os/nvidia-graphics-drivers
by anima-core | 2025-12-10 09:41:43+00:00
I appreciate you taking the time to resond, brother. Let me clarify a few things because your interpretation misses the actual structure of the work.

The paper is short on purpose. It's not meant as a full architecture release. It's a documentation pass on a narrow but surprising empirical result, and I wanted the experimental core to be easy for others to replicate. The repo contains the full pipelines, configuration files, and benchmark scripts, and those show the precise datasets, metrics, and evaluation flows. This is why I didn't inflate the paper with implementation padding that would only duplicate the code.

The student–teacher section refers to CIFAR-10 and SST-2. The benchmarks, seed settings, model specs, and all statistical outputs are in scripts/ and the logged runs. Anyone who actually executes the pipeline will see that nothing is “made up”, and the numbers reproduce across seeds.

On the compression results, nothing is hallucinated. The field similarity numbers come directly from the SVD decay analysis and the cosine-preservation runs that are in right in the repo. If you run compute_field_decay.py and compare_backends.py, you'll see the exact values that appear in the paper. I strongly encourage you to actually try it. The results are surprising, but they're empirical.

The implementation paragraph you quoted is simply standard language acknowledging that optimal deployment settings vary by architecture. It's absolutely not a hand wave. It's just me trying to avoid implying there's a single magic configuration when the repo already exposes all the internal knobs.

I get that the tone of the work is unusual. Trust me, I do. I'm an outsider publishing openly, not through a lab with a standard template. But, nonetheless, the experiments run, the results reproduce, and the repo shows the full details. If something seems unclear, I'm happy to point to the exact script or log line. Just let me know.
by simonask | 2025-12-10 09:41:49+00:00
Using LLVM somewhere in the build doesn't require that you compile everything with LLVM. It generates object files, just like GCC, and you can link together object files compiled with each compiler, as long as they don't use compiler-specific runtime libraries (like the C++ standard library, or a polyfill compiler-rt library).

`clang-cl` does this with `cl.exe` on Windows.
by aquariusDue | 2025-12-10 09:42:15+00:00
I remember in my teens using free trainers from Cheat Happens and trying to figure out how to use Cheat Engine to coast through some games (most of the time when I cared more about the story than the gameplay itself), also around last week I even saw a video on YouTube where the sponsor was a company that provided trainers as a service for a large catalogue of games, all in a neatly packaged client.

It's nice to get a look behind the scenes at how it's done.
by ZeroGravitas | 2025-12-10 09:42:18+00:00
It wasn't a "single year where solar was exceptionally high" because they generated more in 2025 by mid August than they did in the full year of 2024.

https://ember-energy.org/data/electricity-data-explorer/?ent...

The coal line was slightly under the previous year’s and is now overlapping i.e. no growth compared with last year (data up to October)
by unwind | 2025-12-10 09:42:19+00:00
Wow!

I vaguely remember a reference to some balance game as the origin story for the Guru Meditation, but that was so long ago and I never looked it up!

Meta: it would have been nice to include this reference in the submission title, since it's least as interesting as the fact that the peripheral was for the Atari 2600. Something like "The Joyboard: Atari 2600 balance peripheral that inspired Guru Meditation", perhaps. Probably too late now, and this is not exactly tearing down the front page, anyway. :)

Thanks!
by oblio | 2025-12-10 09:43:01+00:00
If you're developing, you generally have control over the development environment (+/-) and you can install things. Plus that already reduces the audience: set of people with oddball hardware (as someone here put it) intersected with the set of people with locked down development environments.

Let alone the fact that conceptually people with locked down environments are precisely those would really want the extra safety offered by Rust.

I know that real life is messy but if we don't keep pressing, nothing improves.
by slig | 2025-12-10 09:43:07+00:00
Puzzleship - a free daily puzzles website with the archives paywalled. Right now it has Logic Grid Puzzles and Zebra Puzzles. I'm pretty proud of the LGP generator algorithm and some experienced players also liked the way the puzzles are constructed. This is my first subscription site and it's been online for less than a week, so I'm learning a lot and trying to figure out the pricing.

https://www.puzzleship.com/
by pjmlp | 2025-12-10 09:43:13+00:00
Why should they?

Other platforms don't have a leader that hates C++, and then accepts a language that is also quite complex, even has two macro systems of Lisp like wizardy, see Serde.

OSes have been being written with C++ on the kernel, since the late 1990's, and AI is being powered by hardware (CUDA) that was designed specifically to accomodate C++ memory model.

Also Rust compiler depends on a compiler framework written in C++, without it there is no Rust compiler, and apparently they are in no hurry to bootstrap it.
by bojan | 2025-12-10 09:43:16+00:00
Russia is neither poor nor failing, and saying that is underestimating the real actual danger they present.

Russia has vast natural resources and enough buyers for those resources even if the EU manages to completely stop (at significant cost). Their industry turned to wartime mode, resulting in the fact that they now have more armored vehicles than in February 2022.

Will they actually physically reach Italy? Probably not. Will they try to buy it out and bring a (even more) fascist autocratic regime there? Probably yes.
by rickdeckard | 2025-12-10 09:43:36+00:00
Well, VP8 was only released as an open codec in 2010, and subject of patent lawsuits until late 2014.

In 2010 the majority of (YouTube and other) videos were still served as H.264, because no major browser supported it back then and the majority of video playback devices were already smartphones (without vp8 decoding capabilities)

iOS for example didn't support VP8 until iOS12 in 2019, Firefox and MS IE only added it in 2011. Even Google only added VP8 to Chrome in September 2010.

So the statement is correct IMO
by arianvanp | 2025-12-10 09:43:46+00:00
Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ...

Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence?

It's so much worse as it's infringing on the privacy and security of billions of innocent people whilst inspection software only hurts some annoying enterprise folks.

I wish we all hopped off the Cloudflare bandwagon.
by pastage | 2025-12-10 09:43:47+00:00
> maelström

Good use of that word.

English has ae in Maelstrom but the contemporary word in Danish, Swedish and Norwegian is Malstrøm/Malström. I wonder when it lost it's ae, I see Mahlströmn from 1698, reading the etymology it says dutch but I wonder if they just wrote it down first. Everything about the sea is always filled with mythology.

I think social media needs a less poetic word though.
by debugnik | 2025-12-10 09:44:24+00:00
Oh I agree the survey has issues, I was just thinking about how each year the stats get more questionable! I just think it shows that interest in Rust doesn't come only from people with a C++ codebase to rewrite. Half of all devs have got less than five years of experience with any toolchain at all, let alone C++, yet many want to give Rust a try. I do think there will be a generational split there.

> Steve Klabnik?

Thankfully no. I've actually argued with him a couple times. Usually in partial agreement, but his fans will downvote anyone who mildly disagrees with him.

Also, I'm not even big on Rust: every single time I've tried to use it I instinctively reached for features that turned out to be unstable, and I don't want to deal with their churn, so I consider the language still immature.
by apexalpha | 2025-12-10 09:44:31+00:00
I largely agree with the author. When our SOC wanted to implement TLS inspection I blocked it. Mostly because we not nearly at the security level for this, but also because it just fucks with so many things.

That said, we are not a business dealing with highly sensitive data or legal responsibilities surrounding data loss prevention.

If you are a business like that, say a bank or a hospital, you want to be able to block patient / customer data leaving your systems. You can do this by setting up a regex for a known format like patient numbers or bank account numbers.

This requires TLS inspection obviously.

Though this makes it harder to steal this data, not impossible.

It does however allow the C-suite to say they did everything they could to prevent it.
by spi | 2025-12-10 09:44:42+00:00
Mmh not really. As OP shows, speed increases with larger batch size, but only initially, until the GPU has high enough utilization; then speed improvements flatten out (although you might get OOM before that and not "really" see the flat part). Using smaller batch size increases _noise_, so quite literally decreases stability. That might be good sometimes: in the limit case, if the batch is as large as your training set, you'll end up in local minima and not be able to get out of it. But this is true for toy datasets like MNIST, here it's an entirely different beast.

With such large corpora as the ones used here, and very noisy ones at that, gradient updates are very noisy and that can harm quality. Or anyway, common lore is that one needs pretty large batch size to have the language model improve steadily.
by immibis | 2025-12-10 09:44:43+00:00
What they were caught doing was opening some local port via TCP sockets (let's say localhost:9000) and then advertisements would connect to localhost:9000 to add themselves to your advertising profile even if you were in a private browser, had cookies blocked, or anything like that. Both Facebook and Instagram apps were caught doing it. Now, if they were formally caught by the legal system, they'd go to prison (,in countries other than the USA) so as soon as it made front page HN, they removed it from the apps.
by K0nserv | 2025-12-10 09:45:09+00:00
1. This doesn't really matter for the argument. Most of the time you can audit unsafe blocks, in some instances the invariants you are upholding require you to consider more code. The benefit is still that you can design safe interfaces around these smaller bits of audited code.

2. I agree it's harder, I feel like most of the community knows and recognises this.

> Maybe Rust proponents should spend more time on making unsafe Rust easier and more ergonomic, instead of effectively *undermining safety and security*. Unless the strategy is to trick as many other people as possible into using Rust, and then hope those people fix the issues for you, a common strategy normally used for some open source projects, not languages.

I don't think there is any evidence that Rust is undermining safety and security. In fact all evidence shows it's massively improving these metrics wherever Rust replaces C and C++ code. If you have evidence to the contrary let's see it.
by lurk2 | 2025-12-10 09:46:26+00:00
> The better I got at competitive RTS's the less interesting the game got for me, it just kinda of felt like chess where there was only going to be one or two interesting interactions in the game if played well, otherwise its just a game of who makes a mistake too early.

I feel the exact same way. The ELO system saves you from getting steamrolled if you’re a casual player but improving just means the game becomes formulaic to the point of no longer being fun. Stronghold 2 was kind of interesting in that it was an unranked lobby with good variation in player ability and team-oriented maps. Most players knew the basic economic and combat metas, but you’d often end up in situations where one of your teammates dropped out on a 3 vs 3 and you’d still win.
by Nextgrid | 2025-12-10 09:46:46+00:00
You've perfectly summarized the entire industry.

There's no actual market pressure to be secure, so nobody cares about threat modeling, cost/benefit of security solutions, etc. The only pressure in case of breach is political blame that you need to deflect. The point of a cybersecurity solution is to be there, remind you it is there, and allow you to deflect blame in case of disaster. Whether it actually increases security is merely a bonus side-effect.
by eeixlk | 2025-12-10 09:47:15+00:00
Literally just got bit by this. I added a wildcard domain to a cert servicing multiple sites. Apparently the verification process for wildcards is more onerous and even when you have it working it wont renew in the same way as a normal cert. It requires specific workarounds based on your dns provider. Appreciative that we moved away from paid certs that required manual work to renew every year but this feels like a mismanaged backslide.
by anima-core | 2025-12-10 09:47:37+00:00
No, the compression result doesn't mean the original 64 GB model can run on a 292 MB card. The teacher model isn’t the thing thats compressed. It still needs to be loaded during training.

What gets small is the student. The tiny head trained on the teacher’s first layer fields. That head ends up a few MB because it's not a transformer at all. It's basically a lightweight function approximator that reproduces the teacher’s behavior on the specific task it was trained for.

So training still requires the usual multi-GB footprint. (Which can be done offline) After training, inference with the student requires only the head. That's why inference is cheap but you can't load the full teacher into 292 MB of VRAM.
by fuzztester | 2025-12-10 09:48:05+00:00
>a seemingly very complex problem that I had no idea how to approach can be made simple by breaking it down into the right primitives.

https://en.wikipedia.org/wiki/Niklaus_Wirth

From the Publications section of that Wikipedia page:

>The April 1971 Communications of the ACM article "Program Development by Stepwise Refinement",[22][23] concerning the teaching of programming, is considered to be a classic text in software engineering.[24] The paper is considered to be the earliest work to formally outline the top-down method for designing programs.[25][26] The article was discussed by Fred Brooks in his influential book The Mythical Man-Month and was described as "seminal" in the ACM's brief biography of Wirth published in connection to his Turing Award.[27][28]
by johncolanduoni | 2025-12-10 09:48:36+00:00
> Unless rules have changed Rust is only allowed a minor role in Chrome.

I believe the Chromium policy has changed, though I may be misinterpreting: https://chromium.googlesource.com/chromium/src/+/refs/heads/...

The V8 developers seem more excited to use it going forward, and I’m interested to see how it turns out. A big open question about the Rust safety model for me is how useful it is for reducing the kind of bugs you see in a SOTA JIT runtime.

> They only see Rust for Android internals, not app developers

I’m sure, if only because ~nobody actually wants to write Android apps in Rust. Which I think is a rational choice for the vast majority of apps - Android NDK was already an ugly duckling, and a Rust version would be taken even less seriously by the platform.
by INTPenis | 2025-12-10 09:48:36+00:00
I wish you the best of luck, truly.

But I have written C in the past, it was almost 20 years ago, and everything seemed to work fine, until the memory leaks.

Of course today I would ask the AI, why is my program leaking memory. I think you have a point, AI would be sort of like having a mentor help you find bad practices in your C code.

You've inspired me to maybe try my hand at Rust, something I've been wanting to do since I heard of it.
by quantized_state | 2025-12-10 09:48:39+00:00
No, it's completely independent of Anki but does support existing Anki decks. Plan is to have a separate syncing system and web interface, as I also think AnkiWeb is a suboptimal experience honestly. If you try it out, I'm interested in any feedback. You can email me at nico@funky-app.com.
by eru | 2025-12-10 09:48:56+00:00
I guess in practice you'd want to have Rust installed as part of your local build and test environment. But I don't think you have to learn Rust any more (or any less) than you have to learn Perl or how the config script works.

As long as you can detect if/when you break it, you can then either quickly pick up enough to get by (if it's trivial), or you ask around.
by yoz-y | 2025-12-10 09:49:05+00:00
Eh. Vibe Coding is best when your “writing code to eyeballing results” is the smallest. It works well when you can “test” that your code works with purely looking at the result and clicking around.

For this it’s the web deployment target and fast compile times rather than the language itself that is useful.

Routinely I am sent code that works, but obviously nobody has looked at. Because they don’t even actually know what the code does.

For prototyping this is quite great. I think it’s the biggest competitor to tools like figma, because writing actually functional program with access to real APIs beats mocks. Now, how often will these end up in production and blow everything up…
by QuantumNomad_ | 2025-12-10 09:49:20+00:00
Reader mode also works.

Or, alternatively reading it via archive.is:

- Part 1: Introduction https://archive.is/RZVBF

- Part 2: Exact Value scanning https://archive.is/OvGy2

- Part 3: Unknown initial value https://archive.is/Tqgx9

- Part 4: Floating points https://archive.is/eAdQn

- Part 5: Code finder https://archive.is/KtwjT

- Part 6: Pointers https://archive.is/PGPnm

- Part 7: Code Injection https://archive.is/mCMRz

- Part 8: Multilevel pointers https://archive.is/GJ486
by benterix | 2025-12-10 09:50:10+00:00
The wiki explicitly mension the typical sans disadvantage: "One potential source of confusion in Calibri is a visible homoglyph, a pair of easily confused characters: the lowercase letter L and the uppercase letter i (l and I) of the Latin script are effectively indistinguishable."

So while I prefer Calibri as TNR has been the default for longer and hence is more boring to me, I can understand people might prefer a serif font for readability.
by raxxorraxor | 2025-12-10 09:50:36+00:00
I only hear justified praises of letsencrypt. Also thanks to the EFF and developers of certbot, which massively improved the toolchain around certificate deployment. Not the favorite activity for admins, but this made processes like certificate renewal/revokation much more convenient.

I think the portion of users that check a certificate after the browser treated it as secure is well smaller than 1%, probably well below 0.1%. And I guess these TLS connoisseurs have a positive inclination to letsencrypt as well.