MurphyA/hacker-news huggingface dataset:
by BurningFrog | 2025-12-15 21:58:57+00:00
Yeah, that's about it. General Patton, John von Neuman were among those advocating for it, and in hindsight I think it would have been a good thing to avoid the Cold War and the communist era, saving China from the horrific Mao era, etc.

But I agree that turning on an ally, sacrificing millions more of your soldiers etc at that point would have been a very hard sell. I'm sure I would have been opposed to it at the time.
by whoknowsidont | 2025-12-15 21:59:12+00:00
Why does the title not match the article? It's under the character limit.

Original title is: “Super secure” MAGA-themed messaging app leaks everyone’s phone number

I think that's incredibly important context. Instead of conferring with actual experts in the field, the populist, fascist segment of our society just decided to wing it with technology.

They BELIEVED they were more secure, with no evidence to back it up.
by sethhochberg | 2025-12-15 21:59:18+00:00
Shorter lifetimes means more renewal events, which means more individual occasions in which LE (or whatever other cert authority) simply must be available before sites start falling off the internet for lack of ability to renew in time.

We're not quite there yet, but the logical progression of shorter and shorter certificate lifetimes to obviate the problems related to revocation lists would suggest that we eventually end up in a place where the major ACME CAs join the list of heavily-centralized companies which are dependencies of "the internet", alongside AWS, Cloudflare, and friends. With cert lifetimes measured in years or months, the CA can have a bad day and as long as you didn't wait until the last possible minute to renew, you're unimpacted. With cert lifetimes trending towards days or less, now your CA really does need institutionally important levels of high availability.

Its less that LE becomes more of a single point of failure than it is that the concept of ACME CAs in general join the list of critically available things required to keep a site online.
by maqp | 2025-12-15 21:59:23+00:00
SimpleX front page lied by omission about it having no identifiers. The fine print threat model did not mention the server has access to your IP addresses, and the mitigation to create "decentralized" system of users talking via separate servers ran into the problem of there being two VPS companies hosting the entire public server infrastructure. These issues were major as SimpleX advertised itself as an improvement over Cwtch, which should've meant superset of metadata had been protected. But that obviously wasn't the case.

The CEO vanished from the discussion (again) so my proposals to improve ease of use of Tor never reached them. You can catch up on the discussion at https://discuss.privacyguides.net/t/simplex-vs-cwtch-who-is-...
by tallytarik | 2025-12-15 21:59:44+00:00
Working on improving the data pipeline for https://iplocate.io - an IP intelligence service I've worked on since 2017. A couple of recent focuses:

1. VPN and proxy detection. We already track dozens of providers, but we can do better here. There's also a bunch of metadata we collect as part of this process which we don't currently surface, so I'm looking at what else we can bring to our databases and free API.

2. Better detail and evidence on how we build and test our own geolocation database, which we create from scratch. There's been a recent trend of misinformation about geo accuracy, including from some other providers, so I want to better explain the accuracy (and inaccuracy) of various techniques, our policy for when we prefer certain data, and so on.

(Open to partnerships for any folks looking for a new provider!)
by AtlasBarfed | 2025-12-15 21:59:53+00:00
We simply need an engineering generation of 50 mile range PHEV vehicles. It will get a huge percentage of low-efficiency driving electrified, won't be too big of a burden on the grid, educate more people on EV-style driving, adds regen braking, should still be able to provide high-torque towing and driving.
by cvoss | 2025-12-15 22:00:11+00:00
Any headline which reads "X after Y" is clickbait. Such a headline is constructed to imply that Y caused or led to or is in some way related to X. But then you read the article and find no connection at all. In this case the article confesses (rather late):

> The Boeing 777-200 is not an unsafe airplane. As far as I can tell, that is not the issue even after the incident over Dulles over the weekend.

X after Y headlines are always technically correct. Sure, X is presently true. And remember scary/salacious/enraging thing Y that happened recently? So X is after Y. Click me.
by michaelt | 2025-12-15 22:00:30+00:00
Even when communicating ideas, there's a simplicity/nuance trade-off to be made.

I could say "Trump's unpredictable, seemingly irrational policy choices have alienated our allies, undermined trust in public institutions, and harmed the US economy"

Or I could "The economy sucks and it's Trump's fault because he's dumb and an asshole"

They both communicate the same broad idea - but which communicates it better? It depends on the audience.
by bcantrill | 2025-12-15 22:00:55+00:00
Ha ha -- thanks, I think? For whatever it's worth, the most important advice I have for a speaker is: speak from the heart, not from the book. That is, don't tell people what you think they want; be true to yourself and speak your own truth, in a manner that is true to who you are.

To that end: different styles work for different people. Yes, I speak quickly (or can!), but there's a method to the madness: when I am speaking fastest (and... tripping over my words, I guess?), it is likely something that -- while interesting/weird -- is in fact only tangentially related to my main point. For me, it's really important to have my actual points written on my slide: my actual decks[0] are really important to me, and serve to make my main points -- albeit devoid of the visceral metaphors for which I've become (in)famous.

[0] https://speakerdeck.com/bcantrill/
by Andrex | 2025-12-15 22:01:18+00:00
The Maverick used to be the truck but they've jacked it by like almost twice the price since debut. With so much "upmarket momentum" the e-F150's days were numbered.

Now I'm sitting here wondering when we'll get another small Ford truck again. This same exact story played out with the Ranger and the decades without a smaller option sucked then too.
by godelski | 2025-12-15 22:01:29+00:00
Signal publicly shares government requests AND the data that they send them

The data Signal has is: 1) registration time for a given phone number, 2) knowledge of daily login (24hr resolution). That's it. That's the metadata.

They do not have information on who is communicating with who, when messages are sent, if messages are sent, how many, the size, or any of that. Importantly, they do not have an identity (your name) associated with the account nor does that show for contacts (not even the phone number needs be shared).

Signal is designed to be safe from Signal itself.

Yes, it sucks that there is the phone number connected to the account, but you can probably understand that there's a reason authorities don't frequently send Signal data requests; because the information isn't very useful. So even if you have a phone number associated with a government ID (not required in America) they really can only show that you have an account and potentially that the account is active.

Like the sibling comment says, there's always a trade-off. You can't have a system that has no metadata, but you can have one that minimizes it. Signal needs to balance usability and minimize bots while maximizing privacy and security. Phone numbers are a barrier to entry for bots, preventing unlimited or trivial account generation. It has downsides but upsides too. One big upside is that if Signal gets compromised then there's can be no reconstruction of the chat history or metadata. IMO, it's a good enough solution for 99.9% of people. If you need privacy and security from nation state actors who are directly targeting you then it's maybe not the best solution (at least not out of the box) but otherwise I can't see a situation where it is a problem.

FWIW, Signal does look to be moving away from phone numbers. They have usernames now. I'd expect it to take time to completely get away though considering they're a small team and need to move from the existing infrastructure to that new one. It's definitely not an easy task (and I think people frequently underestimate the difficulty of security, as quoted in the article lol. And as suggested by the op: it's all edge cases)

https://signal.org/bigbrother/
by tallytarik | 2025-12-15 22:01:37+00:00
Much of the internet still does not support IPv6, so most providers will give you an IPv4 address. In fact only a few providers even support IPv6 at all.

Even with IPv6 it's not a huge problem. With a few samples we can know that a provider is operating in a given /64 or /48 or even /32 space, and can assign a confidence level that the range is used for VPNs.
by foxyv | 2025-12-15 22:01:41+00:00
IMO, it's never the fault of the kids. It's the fault of the parents, the teachers, and the administrators. They are all too lazy, evil, entitled, or stupid to do the things that are necessary to help kids feel safe at school. Half of them don't even really see it as a problem.

When I look back on my bullies in school I just see a bunch of messed up kids that were given too much leeway to hurt other kids because adults didn't want to take the time or effort to actually raise and supervise them.
by heavyset_go | 2025-12-15 22:01:42+00:00
This is like complaining that they teach the Bohr model in science classes until they reach chemistry.

The ideas, concepts and expectations can be refined after you've learned the foundational knowledge, skills and history required to do so.

A lot of "why do we do things like that" questions students will naturally have can be answered with "because we used to do things like this/we need to avoid things like this/etc"
by tadfisher | 2025-12-15 22:01:55+00:00
Whoever told you that is misinformed, because the power of unions does not stem from forcing all employees to join the union. Even in right-to-work states, unions have the power to negotiate contracts which include protections, and workers who join unions are protected from retaliation under federal law. There is an extreme counterbalance in the form of employers misleading employees that unions do not benefit them, as you helpfully demonstrated with this comment.
by bayindirh | 2025-12-15 22:02:06+00:00
vaxry has a beef with Drew Devault, who called him out and exposed his behavior when not writing code.

Considering a sizeable part of Wayland's low-level stuff is written by Drew back in the day, vaxry won't touch anything written by Drew.

This "protocol" effort is to further decouple Hyprland from Wayland infrastructure.

Like everything, this effort is again driven by ego and spite.
by derektank | 2025-12-15 22:02:08+00:00
No, it’s not true. The bill which banned TikTok (H.R. 7521 Protecting Americans from Foreign Adversary Controlled Applications Act)[1] was introduced by Mike Gallagher and Raja Krishnamoorthi in 2024, but a near identical bill, the ANTI-SOCIAL CCP Act (H.R.1081)[2] was introduced by those same lawmakers in February of 2023, long before the Gaza War began, though it did not make it out of committee at that time. It’s conceivable that the bill’s passage was prioritized by house leadership due to concerns about content on TikTok, but the text of the bill contains no reference to the Israel-Palestine conflict and its very obvious from public statements by both co-sponsors that the primary motivation for this bill was concern with Chinese influence.

[1] https://docs.house.gov/billsthisweek/20240311/HR%207521%20Up...

[2] https://www.congress.gov/118/bills/hr1081/BILLS-118hr1081ih....
by tracker1 | 2025-12-15 22:02:13+00:00
My guess is that the GC will eagerly wipe+free "secret" memory first and completely on the pass as opposed to deferring to the next GC cycle as is the normal use that may otherwise happen on longer GC cycles to keep overall performance characteristics happy.

This is just my own speculation, I don't know the internals of Go beyond a few articles I've read over the years. Somewhat more familiar with C#, JS and Rust, and even then I'll sometimes confuse certain features between them.
by maqp | 2025-12-15 22:02:15+00:00
Short answer is no.

Signal provides content-privacy by design with E2EE. Signal provide metadata-privacy by policy, i.e. they choose to not collect data or mine information from it. If you need metadata-privacy by design, you're better off with purpose-built tools like Cwtch, Ricochet Refresh, OnionShare, or perhaps Briar.
by iLemming | 2025-12-15 22:02:15+00:00
It could be also because, we foreigners learn to write English prose through our reading comprehension, not via our listening circuitry. The text probably feels "normal" to me when I read it back to myself, but there's no "proper" feedback loop from the native speakers - I have zero idea how my written shit sounds to a native ear when they try to read it. I still do agree though, it feels so friggin' annoying these days to have to deliberately butcher some words and make sure there's a typo somehwere in your text, just to convince people that tis indeed a crap straight from my "head to the paper", not a slop.
by SilverElfin | 2025-12-15 22:02:43+00:00
I’ve been noticing this shift in Elon Musk’s Twitter posts ever since the Charlie Kirk incident. It’s not just him but many in that same circle of venture capitalists tracing back to the PayPal Mafia, like Joe Lonsdale or Peter Thiel or David Sacks or whoever. They went from reasonably arguing for certain moderate positions the Trump administration could support. Then they started to become completely sycophantic, which you can see in the change of content on the All In podcast.

But soon after the Charlie Kirk assassination, I saw them start to regularly repeat the talking points first popularized by racist supremacists. I also saw phrases like “Western values” or “Western civilization” or Christian/Biblical analogies appearing more. Then I saw them retweet posts made by supremacist Twitter profiles directly (instead of just borrowing talking points or phrases). And now you have people like Musk straight up calling for “Remigration”, which is the far right’s term for sending people who aren’t white Christian Europeans back to the place they originated from - including taking away the citizenship of current US citizens.

It is very disturbing to see this shift among many Silicon Valley billionaires, especially since there is a collection of powerful companies (Palantir, Anduril, SpaceX, etc) that are being embedded into the government and into defense by the Trump administration.
by foldr | 2025-12-15 22:02:59+00:00
I don't think it makes sense to compare non-invariant-respecting unsafe blocks to compiler bugs. It would make sense to do so if unsafe blocks were only present in a highly-verified Rust stdlib, but we both know that's not the case.

>Crucially unsafe Rust doesn't have weaker rules, it has the same rules, that's my whole thrust here. The change is that the burden of obeying those rules is on you, the programmer, and that's a heavy burden.

Now we're circling back to my argument about C. The C standards committee could declare that 'unsafe C' (i.e. all C) has these very same rules (which C programmers have the heavy burden of obeying). Would this instantly convert C into a memory safe language? Of course not! It's an empty semantic gesture. Similarly, merely saying "Rust programmers are obliged to respect the following invariants inside unsafe blocks!" does nothing to actually decrease the risks associated with unsafe blocks (leaving aside whatever exhortive success such admonitions might have).

What next, if we accept this logic? Is Perl a language with strict static typing, but "the burden of checking the types falls on you, the programmer"?.
by Krish-mal15 | 2025-12-15 22:03:00+00:00
My suggestion is to use prompting tools. Its usually the prompts fault. AI reasoning does exist, but it performs at its best if you spoonfeed actionable steps and provide as much context as possible.

I personally use JSON prompts that follow this format I shared on reddit: https://www.reddit.com/r/vibecoding/comments/1pl4zbr/i_made_...

I actually built a tool for this called Promptify (https://joinpromptify.com/) which is a completely free chrome extension that works with really any AI platform

Use claude code + this extension and you'll be set! Completely free stack unless you buy Claude pro
by moron4hire | 2025-12-15 22:03:00+00:00
Yeah, let's not forget that Arduino was built on a history of being kinda sheisty: https://en.wikipedia.org/wiki/Arduino#History

And Adafruit has been a stalwart of open hardware advocacy. If it were anyone else, I might entertain the idea that they're "just trying to drum up some marketing." But we're talking about Limor "LadyAda" Fried here. She's good people and always has been. Her opinion should count for a lot.
by popalchemist | 2025-12-15 22:03:07+00:00
It is, though. The premises of white nationalism, like any form of fascism, require an "out-group," and at the same time a mechanism for convincing the "in-group" that hating them is morally acceptable. The framing of empathy as a vice does that job. It is literally part of their stochastic terrorism strategy. That's why they're so "anti-woke", despite not ever (literally not once) defining what "woke" is. They don't care what it is, or what their constituents think it means. They only care that there is buy-in on the idea that caring for others and being sensitive to their needs is bad. Because that is the prerequisite of the rest of their plans.
by turtlebits | 2025-12-15 22:03:57+00:00
Downtime and backups is why I don't take self-hosted more seriously. If I could easily be up and running after a hardware failure or software upgrade failure, I would pay for that in a heartbeat and ditch the comparable SaaS.

As for now, I run Immich but keep Google photos around as I'm afraid to upgrade it and don't have confidence on restoring it if my server dies. See how long and full of warning messages their backup and restore page is https://docs.immich.app/administration/backup-and-restore/.
by notepad0x90 | 2025-12-15 22:04:03+00:00
I know this is a good thing, but I've struggled a lot on systems that don't have good/reliable NTP time updates.

Also, at some point in the lifetime graph, you start getting diminishing returns. There aren't many scenarios where you get your private keys stolen, but the bad guys couldn't maintain access for more than a couple of weeks.

In my humble opinion, if this is the direction the CA/B and other self-appointed leaders want to go, it is time to rethink the way PKI works. We should maybe stop thinking of LetsEncrypt as a CA but it (and similar services) can function as more of a real-time trust facilitators? If all they're checking for is server control, then maybe a near-real-time protocol to validate that, issue a cert, and have the webserver use that immediately is ideal? Lots of things need to change for this to work of course, but it is practical.

Not so long ago, very short DNS TTL's were met with similar apprehension. Perhaps the "cert expiry" should be tied to the DNS TTL. With the server renewing much more frequently (e.g.: If the TTL is 1 hour, the server will renew every 15 minutes).

Point being, the current system of doing things might not be the best place to experiment with low expiry lifetimes, but new ways of doing things that can make this work could be engineered.
by reactordev | 2025-12-15 22:04:40+00:00
Certificate rotation/renewal has been the biggest headache of my IT career. It’s always after the fact. It’s always a pain point. It’s always an argument with accounting over costs. It sucks. I’m glad ACME exists but man this whole thing is a cluster fuck.

Whole IT teams are just going to wash their hands of this and punt to a provider or their cloud IaaS.
by notherhack | 2025-12-15 22:04:59+00:00
The other CAs with a free tier that I'm aware of (zerossl, ssl.com, actalis, google trust, cloudflare) require you to have an account (which means you're at their mercy), and most of them limit the number of free certs you can get to a very small number and don't offer free wildcard certs at all.

There really is no alternative to LE.
by kldg | 2025-12-15 22:06:36+00:00
yes, this is also largely how I use it; suiting workflows to my taste in a sort of "artisanal" way. most recent tool is a Windows "omniterminal" for Serial/SSH/SFTP, but there is a handful of bugs and missing wiring left (serial in particular is still in poor shape). 4MB .7z archive; portable binary; Rust source included: https://archivalcopy.com/content/category-utilities/category...

I also agree with comment that it seems silly to try widely releasing something you could just ask an LLM to make. Instead of something taking a team months or years, you can knock out most things in a weekend. I think vibe-coded stuff is best for hobbyists and experimentation.
by Uehreka | 2025-12-15 22:06:50+00:00
I did a video a couple years ago about a thing I did in Factorio[0] and got a couple comments who didn’t ask if I had used an AI voice, they just straight up told me that the AI voice I used was off putting. I didn’t use an AI voice, in fact I appeared on camera at the end of the video in part so that people wouldn’t have to guess, but I guess people who thought I was AI didn’t feel like watching the whole video.

I suppose I don’t mind people using AI voices if they have a thick accent or are shy about their voice, but if I’m watching a video and clock the voice as AI (usually because the tone is professional but has no expression and then the speaker mispronounces a common word or acronym) it does make me start to wonder if the script is AI. There are a lot of people churning out tutorials that seem useful at first but turn out to have no content (“draw the rest of the owl” type stuff) because they asked AI to create a tutorial for something and didn’t edit or reprompt based on the output. The video essay world is also starting to get hit pretty hard, to the point that I’m less willing than ever to watch content unless I already know the creator’s work.

[0] Shameless plug: https://youtu.be/PGiTkkMOfiw
by tracker1 | 2025-12-15 22:07:06+00:00
Guessing it's also taking sure to use assembly calls to zero out and clear the memory region as part of the GC... I would guess the clear/gc characteristics are otherwise the same, but having access to RAM in a non-supported platform could, in theory allow for stale reads of raw memory.

This is likely done for platform performance and having a manual version likely hinders the GC in a way that's deemed too impactful. Beyond this, if SysV or others contribute specific patches that aren't brute forced (such as RiscV extensions), I would assume that the go maintainers would accept it..
by bigbuppo | 2025-12-15 22:07:10+00:00
Doesn't matter. This is a push by the CA/Browser Forum. Google, Mozilla, and all the CAs got together and said, "hey, what if we just made certificates shorter because we're too stupid to figure out a revocation mechanism that actually works other than expiration." They've tried this shit before, but saner heads prevailed. This time they did not.
by dyauspitr | 2025-12-15 22:07:17+00:00
That’s too bad, I love my lightning. I spend about $20/month on home charging, love the acceleration and it’s good enough to haul all the things I need for my small farm.

Also, it’s great for long distance recreational drives (from a very specific perspective)- I like driving 250-300 miles in a day and then parking at an RV spot for the night instead of a hotel room. I can run the heat and AC all night as well as have a “full tank” ready to go.