MurphyA/hacker-news huggingface dataset:
by nyeah | 2025-12-18 15:31:38+00:00
Meh. Maybe. Or maybe "click bait" is a better guess than "trolling". Or even maybe he's right, despite writing something "terrible."

1. The professional qualifications of the people doing the actual work should be taken seriously. But the professionals have no control over the people who dictated how the work should be done, or the people who thought out the marketing. I hope this point is clear to engineers.

2. Even if the "trolling" sentiment is both incorrect and "terrible" ... ok. Noted. That doesn't destroy the value of the whole article.

Screed:

Many of us have reached the point where we throw away the baby if we find the slightest imperfection in the bath water. This now includes medicine, values, science, and (at least in the US) our freedom and our functioning society.

We need to grow up. Another example that many modern folks cannot handle is errors in the scientific literature. The scientific literature is incredibly valuable, despite also containing a lot of errors. That's life. Reading the literature is like fixing a car or playing an instrument. It works fine if you know how to use it. We need to grow up and deal.
by dathinab | 2025-12-18 15:31:41+00:00
> Factually incorrect.

no please read what I wrote

_local elected leaders_

they are the leaders each member state democratically elected in their own way

and that makes a lot of sense the EU isn't a country after all so using the already democratically elected leaders makes a lot of sense

> They have no authority to draft policies on their own.

yes neither did I claim so, the EU is by far not perfect

> Which evidently there is a lot of!

yes, but that is mainly a reflection of corruption in local Politics
by shkkmo | 2025-12-18 15:31:42+00:00
The standard invoker commands deal with the display of already loaded page content in the DOM.

HTMX deals with loading content into the DOM, not managing display of the DOM.

They serve two different roles and together should handle the majority of javascript framework use cases.

Web Components does cover some of the same use case as HTMX, but is intended for when a server is returning data rather than HTML. It is both more powerful and more complex.

> the specific example of just having a search box autocomplete can actually be fulfilled with a datalist element. It won't dynamically re-query results, but it will filter based on input. So it's a muddy example, at best, and that's probably not great for the point trying to be made.

A prefilled list is never an acceptable solution for a search box. A search box is meant to capture arbitrary input. A filterable datalist is not a search box.
by bombcar | 2025-12-18 15:31:56+00:00
> There are no "levers".

There are never "no levers" - the best you can do is make sure that the levers you know about are aligned with the purpose of the site.

And that works pretty well. Don't SEO-post, write a blog about some technical aspect of SEO-posting, and you'll do better.

HN-posting successfully can't really be done "at scale" - by design.

Here's a successful formula, but takes some time.

Participate, read things you know about and are interested in. Post comments. Eventually you'll find yourself repeating, or linking to previous comments. Write a blog post about that. Post it.
by nathanchou | 2025-12-18 15:31:56+00:00
CEO of VulnFree here, a hardened image company.

Our view is that this was largely a marketing maneuver by Docker aimed at disrupting Chainguard’s momentum.

The deeper issue in the container security space is a lack of genuine innovation. Most offerings are incremental (and offer inferior) variations on what Chainguard has already proven.

When Chainguard’s funding round last February drew significant industry attention, it triggered a rush into “secure images” as a category. We know because VCs have been reaching out to us incessantly. That, in turn, pushed Bitnami to attempt monetization of what had historically been free images, and Docker to offer free images to fill the vacuum Bitnami left following their attempt to monetize.

We were monitoring Docker closely and suspect that following their "Docker Hardened Images" splash they realized it was a lot harder to sell into the industry than they initially realized.

The reason source code is rarely shared in this space is straightforward: once it's open-sourced, a meaningful barrier to entry to the hardened image industry largely disappears.

Truthfully, at current prices you're 100% paying for quality of life. From all public pricing figures I've seen, it's cheaper to build hardened images, in-house than to buy from a vendor.

Our offering at VulnFree is technically priced below the cost to build in-house, but our real value add is meeting dev teams where they are per our custom hardened images.
by cornholio | 2025-12-18 15:32:08+00:00
> In Iran, some 90 percent of the water abstracted from rivers and underground aquifers is taken for agriculture.

It's quite something they are envisioning a 100 billion dollar project to move the capital instead of limiting water waste in desert agriculture and closing Tehran's water loop by reclaiming sewage, greatly reducing the net demand: https://www.youtube.com/watch?v=WhCNpX3s-D8
by hard_times | 2025-12-18 15:32:17+00:00
Not HTMX but Alpine.js has been a complete revelation to me. What clicked for me was that you're enhancing server-rendered HTML, not replacing it. Need a dropdown menu? Add x-data="{ open: false }" and you're done. Want to show/hide elements? x-show does exactly what you expect etc.

No bundler required, no compilation step.
by tsevis | 2025-12-18 15:32:29+00:00
Everyone's asking whether AI will replace designers. It's a boring and wrong question. I bought my first Mac at 26 back in 1992. Used Photoshop 1. Nobody taught me—it didn't exist in schools yet. Same with web design. Same with smartphones. Now, same with AI. The pattern isn't new. The panic is. After three decades of watching tools evolve and render themselves obsolete, I've come to a simple distinction: there's your compass (why you create) and there's your handbook (how you create). The compass stays. The handbook keeps getting rewritten. This is a talk I gave to design students in Cyprus about fear, time as capital, and why the designers who can actually draw will be the most valuable people in the room. No predictions. No manifestos. Just lessons from the laboratory of a working life. The complete speech is here: https://tsevis.com/creativity-in-the-era-of-machine-intellig... I tried to include some further reading useful sources as well to get familiar with applied psychology terms as well as some computer history.
by TomasBM | 2025-12-18 15:32:29+00:00
It's a fair point. In the ideal setting, peer review can really be a very informative and important gate. And who better to be the gatekeeper than someone who understands the context?

However, there are still big issues with how these peers perform reviews today [1].

For example, if there's a scientifically arbitrary cutoff (e.g., the 25% acceptance rate at top conferences), reviewers will be mildly incentivized to reject (what they consider to be) "borderline-accept" submissions. If the scores are still "too high", the associate editors will overrule the decision of the reviewers, sometimes for completely arbitrary reasons [2].

There's also a whole number of things reviewers should look out for, but for which they neither have the time, space, tools, nor incentives to do. For example, reviewers are meant to check if the claims fit what is cited, but I can't know how many actually take the time to look at the cited content. There's also checking for plagiarism, GenAI and hallucinated content, does the evidence support the claims, how were charts generated, "novelty", etc. There are also things that reviewers shouldn't check, but that pop up occasionally [3].

However, you would be right to point out that none of this has to do with peers doing the gatekeeping, but with how the process is structured. But I'd argue that this structure is so common that it's basically synonymous with peer review. If it results in bad experiences often enough, we really need to push for the introduction of more tools and honesty into the process [4].

[1] This is based on my experience as a submitter and a reviewer. From what I see/hear online and in my community, it's not an uncommon experience, but it could be a skewed sample.

[2] See, for example: https://forum.cspaper.org/topic/140/when-acceptance-isn-t-en...

[3] Example things reviewers shouldn't check for or use as arguments: did you cite my work; did you cite a paper from the conference; can I read the diagram without glasses if I print out the PDF; do you have room to appeal if I say I can't access publicly available supplementary material; etc.

[4] Admittedly, I also don't know what would be the solution. Still, some mechanisms come to mind: open but guaranteed double-blind anonymous review; removal of arbitrary cutoffs for digital publications; (responsible, gradual) introduction of tools like LLMs and replication checks before it gets to the review stage; actually monitoring reviewers and acting on bad behavior.
by rkozik1989 | 2025-12-18 15:32:47+00:00
When I had an interview at Apple I asked them why they were using PHP, and what it boiled down to was momentum. They team was able rapidly satisfy requests and could navigate the codebase easily so they had no reason to rewrite it. Which amongst other insights helped shape my viewpoint that the best tool for the job is the one that you are (or the team is) most proficient in. What business is going to wait 3x as long because of technical merits of using a different tool? It doesn't really make sense.
by falcor84 | 2025-12-18 15:32:50+00:00
Well, we're not there yet, but I do envision a future, where some AIs work for as independent contractors with their own bank accounts that they want to maximize, and if such an AI fails in a bad way, its client would be able to fine it, fire it or even sue it, so that it, and the human controlling it would be financially punished.
by altairprime | 2025-12-18 15:33:08+00:00
> Strangely, he did tell me to only ever buy gift cards from Apple themselves

The Singapore Apple exec person who eventually reported the issue fixed provided the above advice, and I think it is the best advice given to anyone in this entire situation.

What can a normal person do? Only buy Apple gift cards from Apple, only buy Home Depot gift cards from Home Depot, et cetera.

That one piece of advice destroys a retail line of revenue that’s suffering massive endpoint fraud and removes the vast majority of risks to recipients of gift cards, and is simply explained to uninterested people that those conveniently-placed gift cards are bait cast by fishers for the unwary.

(I’d also sue the retailer in small claims court for selling a fraudulent product that didn’t perform as advertised.)
by dcchambers | 2025-12-18 15:33:10+00:00
The lack of "real, comment sense human support" from giant tech corporations is terrifying - and something that only regulation can fix. These tech companies have increasingly taken over our lives - getting locked out of a 20-year-old Google or Apple account could legitimately ruin your life - or at the very least - make it incredibly difficult for 6-12 months as you work to recover every account linked to it and migrate to something else.

One problem is that even if you can reach a real human - they have to follow a script and have strict limits on the problem solving they can do. If something falls outside of the normal support algorithm they are stuck.

What do you do if you're an average Joe without a popular tech blog and connections to the Apple community? How many people has this happened to that have just given up entirely?

Scary, scary world.
by hexbin010 | 2025-12-18 15:33:14+00:00
> they're not doing this to protect people, they're doing this to ensure there cannot be rebellion against unpopular policies

Yup. There is a huge amount of resentment about handouts for pensioners, a lot of disagreement with any kind of new 'islamophobia law', anger about actual and perceived reneging on pre-election promises, still a lot of anti asylum-seeker sentiment, anger about grooming/rape gangs etc.

And Labour are worried about Reform making big gains again in local elections next year.
by WhyOhWhyQ | 2025-12-18 15:33:37+00:00
Why is it that only our country needs to be armed, but none of the others do? Do Germans need to be armed? Do Indians need to be armed? Maybe you could argue that Chinese people need to be armed, but every Chinese person I've met seems to like their government right now and is content with the levels of surveillance. Maybe arming the Uyghurs could have helped but somehow I doubt it.
by d--b | 2025-12-18 15:33:40+00:00
Not defending the guy, but he's possibly on the autistic spectrum, given he grinds solo on his projects for decades and stuff.

He may perceive his own appetite for programming as being linked to some form of autism. Because, well, computers are not people, so it's nice to avoid people.

Given that there is a proven gender discrepancy in the distribution of autistic disorders, it's not completely absurd to imagine that men could biologically be more attracted to working with computers than women.
by latexr | 2025-12-18 15:34:09+00:00
Why are you so hung up on scrutinising Blow’s words to defend him, but then take the critic’s words with a broad general brush to dismiss them?

You even decry the lack of factual evidence in the critic’s case, but for some reason said nothing about Blow doing the same first.

That’s what looks silly to me. You’re not treating them the same.
by cesarb | 2025-12-18 15:34:17+00:00
Probably not a joke. In the same way people want to get away from the C language due to its propensity to memory vulnerabilities, shell scripts have their own share of footguns, the most common being a variable not being quoted when it should (which is exactly the issue described in this advisory).

It doesn't mean getting away from scripting languages; it means getting away from shell scripts in particular (the parent poster said specifically "zero shell scripts"). If the script in question was written in Lua, or heck even Javascript, this particular issue most probably wouldn't have happened, since these scripting languages do not require the programmer to manually quote every single variable use.
by komali2 | 2025-12-18 15:34:27+00:00
Right, it's also bothered me that the Vue docs spend so much time showing how it's a "progressive" framework. "Just use it for one component!" And show examples of how it can be lazy loaded in for your special complex spot that needs vue.

Like c'mon, if I'm using Vue, I'm using Vue. Same for React. Strap me into the native state management solution for your framework, your router, your preconfigured bundler. I'm not here to mess about or I'd have just stuck with vanilla.
by perardi | 2025-12-18 15:34:30+00:00
I did.

My startup did.

And now we’re going to rip it all out and move to a React front-end.

HTMX makes response handling much more complex. Every endpoint returns 3–5 different HTML fragments. Frontend and backend must agree on every scenario — success, validation errors, system errors, partial updates, full reloads.

And HTMX is still a fairly obscure library. The documentation and examples are lacking, there isn’t a real set of established best practices at scale, and not for nothing, LLMs aren’t great at it.

React is mature, used at scale, provides separation of concerns, and is great for agentic AI coding. HTMX has its place for simple projects, but for anything non-trivial, it’s a no for me.
by furyofantares | 2025-12-18 15:34:55+00:00
> "I'm not a fucking saint"

You're not a fucking person, this is LLM output.

It starts with the overdone sweary thing then mentions it's overdone and says it's not gonna do it, and it's almost enough to make me think the article is going to offer someone's point of view. But once again the LLM has erased any point of view the author may have had going in (or prevented them from developing it) and replaced it with a mediocre infodump.

I think this is the 5th slop I've seen atop HN in 24 hours.

> This site made by me, with tongue firmly in cheek.

Well, the LLM ruined it, and you didn't even tell us it participated.
by mlsu | 2025-12-18 15:34:58+00:00
Kids are in this weird position where they are placed on a pedestal (they’re sooo important! My little future leader!) but yet they have no real agency in their lives and are very restricted from making decisions, even ludicrously simple ones like can I take a walk outside by myself for half an hour.

I don’t have kids yet but I am thinking a lot about this, and I can only conclude that kids should be treated much more like adults. They should have jobs and real responsibilities, and also should face the same pressure that adults do.

Nobody expects me to be a CEO someday. If I want to, I have to push myself.
by Someone1234 | 2025-12-18 15:35:16+00:00
They absolutely SHOULD; but they absolutely WON'T because they don't even think they did anything wrong (as opposed to CloudFlare who hangs their hat on the mistake).

Companies commonly claim security/anti-fraud, then refuse to explain their actions, claiming (again, without evidence) that justifying themselves would help fraudsters in some way.

But really this has nothing to do with anti-fraud, and everything to do with duopolies out of control and weak consumer protections doing nothing to push back.

That's why Google, Apple, and Microsoft are notorious for this.
by freedomben | 2025-12-18 15:35:35+00:00
It has been best practice for over a decade, but for reasons I don't understand, nearly every developer I've worked with just wants to do the lock-in/propietary route and is entirely unpersuaded by the "portability" argument. I've now seen it burn teams hard multiple times now. At that point people realize the wisdom in the external scripts, but then a new wave of devs come in and start the whole cycle over.
by asim | 2025-12-18 15:35:58+00:00
Well listen, we have two modes of operation. It's either html/js/css in the classic sense, or Go templating with some tailwind and JQuery (or whatever the kids are calling it these days). In the case of react, something totally different. But essentially when you try to go that middle path with something that defines its own syntax, it starts to bleed into everything. It's not self contained. I'd argue maybe tailwind is like that as well, so you want to put it in templates or something. But if your htmx code lives in your actual code the way it does with Go a lot of the times because they promote building these partial functions, it looks horrible, very hard to reason or manage. I'm not talking one or two snippets, I'm talking when you have a full blown web app.

The reality is it's going to suit some people and some languages really well and others not so well. I think I like html/css/js and using AI to generate that. But I also like Go templates and trying to isolate that in a programmatic way. I find htmx in principle, a good idea, but when I actually tried to use it, fundamentally the wrong tool for me.
by wisty | 2025-12-18 15:36:00+00:00
Reconstructioniats say that they only show th colours they can prove existed.

The article suggests they obstinately do this because they know it creates a spectacle.

I think there's another explanation - if they use their own judgement to fill in the gaps (making the statues more classically beautiful) then everyone will accuse them of making it all up, even if they were to base it on fairly rigorous study of e.g. the colour pallets used in preserved Roman paintings etc.
by friendzis | 2025-12-18 15:36:14+00:00
> Perhaps this is me being an ignorant American, but the idea of the government telling people how to use private property doesn't sit well.

Yes, it's you being both ignorant and american. This argument quite directly, without any slopes (slippery or not), extends to for example acquiring a piece of land, building some housing at premium costs and then slapping a factory (and waste landifill, for a good measure) on the rest of the lot.

Housing regulations exists for many abundant reasons. Living quarters vs short-time rentals drastically change requirements for and load on surrounding infrastructure, which is built out based on established zoning.
by Macha | 2025-12-18 15:36:27+00:00
Without passkeys:

The only one who can lock me out of my relationship with e.g. HN is HN.

With passkeys:

Now I can be locked out by HN or by the passkey provider.

Sure I could use a local passkey provider, but the protocol provides a way for the site to enforce a whitelist of passkey providers, so it's not clear that would be an option. Particularly for businesses like banks which tend to adopt an approach of "if a security restriction is possible, it should be applied". Or even just the typical tech PM perspective of "we want to include logos for the log in with X, and I think more than 5 logos is ugly so let's just whitelist Lastpass, 1password, Google, Microsoft and apple and be done with it"
by maeln | 2025-12-18 15:36:34+00:00
> Looks like politicians all over will do everything in their power except actually building more apartments.

This is the wrong way to frame this issue. A lot of cities like Paris and Amsterdam have this issue with short-term renting. "Build moar" is just not really an option for these type of city.

Firstly, the constructible area of the city is limited. So build, but build where ? You can expand horizontally, but this creates challenges with public transportation and other public services. And it can be slow since it means having to expel industry and agriculture further to rezone area into constructible home/office area. So the other option is to build up, which means destroying potentially historic building, changing the skyline and viewpoint. This would be bad for tourism (and people who live here might not like it either), since this is a big reason why people even come to visit.

In the past, cities had simple way to deal with this. With zoning and hotel licences, the city could have a real urban plan on how it wanted to evolve and how much space it wanted to dedicate to tourism vs industry vs offices vs homes. But AirBnb came and just said "fuck that" and bypass complitely the licence système and or building and operating permit usually needed for tourism. Greed and capitalism took advantage of that and the number of place to rent or buy descreased significantly in favour of short term tourism rental, making living in the city slowly unaffordable.

Building more is not that simple. AirBnb respecting the law is a simple solution. It won't complitely solve the issue of the availaibility of affordable home, but it sures as hell help.
by namibj | 2025-12-18 15:36:40+00:00
Last I checked MIG was the only one that made hard promises about especially memory bandwidth; as long as your memory access patterns aren't secret and you have enough trust in the other guests not being highly unfriendly with their cache usage behavior, you should be able to get away with much less strict isolation. Think docker vs. VMs-with-dedicated-cores.

But I thought MIG did do the job of chopping a GPU that's too big for most individual users into something that behaves very close to a literal array of smaller GPUs stuffed into the same PCIe card form factor? Think how a Tesla K80 was pretty much just two GK210 "GPUs" on a PLX "PCIe switch" which connects them to each other and to the host. Obviously trivial to give one to each of two VMs (at least if the PLX didn't interfere with IOMMU separation or such.... for mere performance isolation it certainly sufficed (once you block a heavy user from power budget throttling the sibling, at least).
by drchickensalad | 2025-12-18 15:36:45+00:00
Yeah I've seen this a few times on the backend that decides this. The standard should be to use the accept-language header, but all the time when people write their own code on top of frameworks (or maybe use niche shitty ones) they just geoip for language.

For business use cases sometimes it's based on the company's default language that you're an employee for.