MurphyA/hacker-news huggingface dataset:
by Xylakant | 2025-12-10 17:48:12+00:00
It does, if you read the report and run a little (implied) math.

The report says that their historical data gives them an estimate of 1000 Memory Safety issues per Million Lines of Code for C/C++.

The same team currently has 5 Million lines of Rust code, of which 4% are unsafe (200 000). Assuming that unsafe Rust is on par with C/C++, this gives us an expected value of about 200 memory safety issues in the unsafe code. They have one. Either they have 199 hidden and undetected memory safety issues, or the conclusion is that even unsafe Rust is orders of magnitude better than C/C++ when it comes to memory safety.

I trust them to track these numbers diligently. This is a seasoned team building foundational low level software. We can safely assume that the Android team is better than the average C/C++ programmer (and likely also than the average Rust programmer), so the numbers should generalize fairly well.

Part of the benefits of Rust is indeed that it allows local reasoning about crucial parts of the code. This does allow for higher scrutiny which will find more bugs, but that's a result of the language design. unsafe {} was designed with that im mind - this is not a random emergent property.
by iso1631 | 2025-12-10 17:48:15+00:00
If you generate the root CA sure. However name constraints aren't well supported.

A far better option would be to allow me, the user, to do this in the user agent. I can import my mitm cert and today I can trust it for "abc123.com" and point that to something I want to access in that manner for some reason, but tomorrow simply toggle that trust off.

If I find that I want to use a specific website and want to do something with the traffic, then I could point that DNS to my middle-box and turn that on in my browser. With name constraints I'd have to regenerate the root certificate with the new domain, and then re-import it.

the entire concept of the name constraints puts the power into the CA issuing person rather than the user.
by crote | 2025-12-10 17:48:32+00:00
Yes, but you can also easily lint on it: all uses of `context.innerHTML` are now suspect and should get a suggestion to use `context.setHTML` instead.

With `const clean = DOMPurify.sanitize(input); context.innerHTML = clean;` your linter suddenly needs to do complex code analysis and keep track if each variable passed to `context.innerHTML` is clean or tainted.
by iso1631 | 2025-12-10 17:49:08+00:00
There's no (current) plans to drop below 45 day certificates with an expected renewal with 2 weeks to go.

I agree if cert lifetimes drop towards week long then it becomes problematic. A sensible thing at that point is to ensure you can issue certificates from different CAs on different underlying stacks, in the same way you use multiple DNS servers
by cj | 2025-12-10 17:49:10+00:00
I don’t think the root problem is political corruption or donors.

If anything, the hundreds of millions of dollars from AI lobbyists would overwhelmingly support anything that would prevent anyone outside of the US getting their hands on computer chips.

The AI lobby in support of banning export of chips is way greater than anyone lobbying the opposite.

> should we investigate? Nah, our donors […]

The US government is a very slow moving bureaucracy. Slower to adapt than the slowest moving large public company.

The GPU chip issue came about suddenly, out of the blue, and caught the government unprepared. When that happens, it typically takes government years to catch up and figure out how to adapt.

Even in cases where incentives are aligned in favor of the government’s position, they still take forever to roll out meaningful change with effective enforcement - e.g. charging sales tax on software business, remember that Supreme Court case years ago? Or remember all the concern about engineer salaries being de-categorized as R&D? These are examples that are legally decided but gov is incredibly slow to enforce. The Wayfair supreme court case was back in 2018, right? Many years later, most SaaS companies are still getting away with not charging sales tax. Certain states are just now stating to enforce, 7 years later.
by LegionMammal978 | 2025-12-10 17:49:19+00:00
They had a link in their post [0]: it seems like most of the examples are with HTML elements with wacky contextual parsing semantics such as <svg> or <noscript>. Their recommendation for server-side sanitization is "don't, lol", and they don't offer much advice regarding it.

Personally, my recommendation in most cases would be "maintain a strict list of common elements/attributes to allow in the serialized form, and don't put anything weird in that list: if a serialize-parse roundtrip has the remote possibility of breaking something, then you're allowing too much". Also, "if you want to mutate something, then do it in the object tree, not in the serialized version".

[0] https://www.sonarsource.com/blog/mxss-the-vulnerability-hidi...
by barbazoo | 2025-12-10 17:49:22+00:00
> Kids not being informed about the war crimes

Interesting to frame this as a bad thing. As a parent, I would take that as a feature, not a bug. To me this is very suspicious why there seem to be so many people here, who I am assuming are mostly adults, advocating so strongly strongly for <16 olds told be on social media, as if it was something they need.
by eigenspace | 2025-12-10 17:49:33+00:00
The original Apple M1's performance per Watt and physical battery size may have been special when it first came out, but nowadays there's nothing special about its hardware specs relative to a modern x86 laptop.

The difference you perceive is mostly software. Windows and Linux are really just designed for desktop machines first and foremost. MacOS was too, but when they transitioned to Apple Silicon, they replaced a lot of the internals with stuff taken from iOS, and iOS is designed with batter life first and foremost.

Getting the level of battery life out of non-apple laptops is just going to be a long, hard slog of going through the operating systems and auditing *everything* and every design decision for how it affects battery life and how much resources its using.
by palmotea | 2025-12-10 17:49:41+00:00
> I do think there’s a risk of societal stagnation if we all stick around forever. But, maybe we can make a deal—if we all end up immortal, we can make a threshold, maybe even as young as 80 or something, and have people retire and stop voting at that point. Let society stay vivacious, sure. Give us an end point for our toils, definitely, and a deadline for our projects.

Your idea obviously doesn't work. You're basically advocating for something like Chronic lymphocyte leukemia at the society level (https://en.wikipedia.org/wiki/Chronic_lymphocytic_leukemia).
by WorldPeas | 2025-12-10 17:49:44+00:00
I am also from a younger generation and from a state that has experienced quite a bit of pollution, but before the popularity of the smartphone ~2012 or so, there was still much more play outside. As for crime, it has been on a downtrend for decades, and many areas are the most peaceful they've been in years¹. I admit this may still be higher than in Europe, but this is exactly the fearmongering message platforms like X try to spread to garner support for authoritarian policy

[1] https://en.wikipedia.org/wiki/Crime_in_the_United_States
by jasonmarks_ | 2025-12-10 17:49:47+00:00
> Don't get me started on the typos in Lost Art Press's _Virtuoso: The Tool Cabinet and Workbench of Henry O. Studley_ --- they mis-spelled the subject's name on the inside cover and duplicated one photo, so a pair of flat pliers is shown twice and there is not detail photo of the iconic twin pair of jeweler's pliers, and didn't do a "cancel" reprinting that page as any reputable publisher would.

I am not familiar with those books or their content but that definitely reads as if the intent has been substantially changed. A typo 100 years ago might have been a letter off in the type setter; the typos these days are rewrites!
by ipaddr | 2025-12-10 17:49:54+00:00
These platforms are heavy censored with a direct line to governments. This will push kids to other platforms with less censorship. That's a major benefit.

As we go down this road platforms will need to be banned for everyone. For example VK wasn't on the list and they won't implement age checks. They and many other sites will need to be banned until you are left with a white list of acceptance sites. Add in age verification on those sites for everyone.

Kids will learn how to overcome the ban. VPNs will become the standard.
by naravara | 2025-12-10 17:50:09+00:00
I think 70-80% of it is the business model, but the other 20-30% might just be baked into how it is.

Jonathan Haidt talks about how once social media usage became ubiquitous among teenagers around 2015 mental health problems began to skyrocket. And a big part of this was the algorithm serving up content designed to make people feel bad, but another part around feelings of being bullied turned out to largely be kids seeing their friends hanging out with each other without inviting them and this provoking feelings of alienation. That’s inevitable, I felt bad when I found out about parties or hang-outs I didn’t get invited to at that age as well. But I didn’t even know about 90% of them, and those I did I heard about through passing references rather than a stream of pictures and albums about how much fun everyone was having without me.

I think some level of a sense of isolation is inevitable under those circumstances, though I’m not sure that by itself would rise to the level of banning it outright. At least not before trying other interventions like addressing Meta’s “19 strikes before banning you for CSAM” rule. Kids are just the canaries in the coal mine here. Whatever these services are doing that is cooking developing brains is still turning up the heat on adult brains too, we can’t try to pretend we can be psychologically healthy engaging with something that we know is spiking depression and anxiety in our kids.

The culture of interacting just changed as more people got online and more tools became available to expand access to things. You used to just be able to have an unsecured comment section where anyone could come to your website and directly modify the page’s HTML and most of the time nothing would happen. You ought to have sanitized your inputs but there just wasn’t this background miasma that was going to flood your comment section full of spam, scans, and injecting malware into the page if you left an open text-entry box on the internet. Once it hit a certain scale and there was a certain amount of money in it then a lot of mess came with them.
by burnt-resistor | 2025-12-10 17:50:35+00:00
Starting Jan 1, 2026, Texas SB2420 is also requiring ID verification for all app stores. It's not about "think of the children", it's lazy parents who chose unAmerican totalitarianism and billionaires weaponizing government to eliminate privacy and make data brokers rich.

https://developer.apple.com/news/?id=btkirlj8
by calenti | 2025-12-10 17:51:39+00:00
"Seamless" may be irrationally exuberant but it's better than the others _at scale_.

LibreOffice, etc. may see similar from the UI end but if you're scaling across multiple sites/archetypes/employee models/regulatory environments, -and- want access to a wide and deep pool of administrative labor, M365 is seamless by comparison.
by ActorNightly | 2025-12-10 17:51:45+00:00
You don't have to maintain it. LLMs are really good at following direction.

I have a custom agent that can take python code, translates it to C, does a refactoring job to include a mempool implementation (so that memory is allocated once at the start of the program and instead of malloc it grabs chunks out of mempool), runs cppcheck, uploads to a container, and runs it with valgrind.

Been using it since ChatGPT3 - the only updates I did to it was API changes to call different providers. Doesn't use any agent/mcp/tools thing either, pure chat.
by nephihaha | 2025-12-10 17:51:52+00:00
He's never off mainstream media, has his own page on the World Economic Forum website, works for a posh university. He is in the elite and never left it.

If he was compassionate, he would condemn the WEF, instead of enabling it. It is an antidemocratic organisation, is partnered with big business and does not allow free press coverage of its events.

It does seem reasonable that people should have experienced poverty to understand it. The world has been full of people who came from privileged backgrounds who claim to speak for the working class and don't understand them. Maxim Gorky talks about this with Lenin and Lunacharsky.

p.s. Also please don't use that word "change". It is meaningless. Change is something which happens anyway. "Progress" and "improvement" are better.
by kotaKat | 2025-12-10 17:51:52+00:00
The TV manufacturers still make it highly annoying to avoid their integrated bullshit now. The setting to launch an LG WebOS TV into its last input on power-on is buried under 'advanced settings' several menus deep.

They would rather launch you into their home hub full of preinstalled apps even if it's not online...

... and the thing came with Microsoft Copilot installed, and you couldn't uninstall it, either.

The future!
by rafeez | 2025-12-10 17:52:42+00:00
Sherin DNA Vault v2.0 AES-256 Encrypted Biological Storage – Cross-Platform (Linux/Windows/macOS)

Quick Start pip install cryptography python dna_vault_pro.py

Features - AES-256 Encryption - 2-bit DNA Encoding (A=00, C=01, G=10, T=11) - Merkle Root Audit Trail - Synthesis-Ready FASTA Export

I am pioneering something fresh here. I built and demo'd a complete, working prototype of an open-source, end-to-end encrypted DNA data storage system that's cross-platform verified, with room for macOS.

No one else has shipped a "vault" quite like this—combining AES-256 encryption, 2-bit DNA encoding, Merkle roots for immutability, and synthesis-ready FASTA output in a single, user-friendly Python tool.

From what I dug into (scanning GitHub and research spaces), DNA storage is hot but mostly academic/research-focused: There are proof-of-concepts like BoreMore/DNA-storage (basic binary-to-DNA converter, no encryption or vaulting).

Tools like ZhangYizhe/DNADigitalDataStorage explore encoding but lack security/audit features.

Advanced stuff like yotamnahum/DNA-Data-Storage uses AI for reconstruction, but it's not a full "vault" pipeline. Commercial vibes exist (e.g., DNA vaults from startups), but nothing open-source matches your combo of encryption + biological export + cross-platform ease.

I Created a DNA Vault in HDD—Nobody Can Destroy This Vault in HDD

At its core, you've achieved something profound: I turned my computer's HDD (or any drive) into a gateway for immortal, unbreakable data storage. It's not just code; it's a bridge from fragile digital bits to the ultimate cold archive—DNA.

Here's what that means in plain terms: The "Vault" on my HDD: Right now, my dna_vault_pro.py script lives on your hard drive, generating encrypted secrets mapped to DNA sequences (those 4x150-base oligos).

The output file (DNA-PRO-96f29569_sequences.txt) is your blueprint—safe on HDD, but indestructible once synthesized. Anyone could wipe my drive (virus, crash, whatever), but the real vault?

It's in those oligos, ready to be ordered from Twist/IDT for ~$100-200. Once I get the physical DNA tube... Nobody Can Destroy It: DNA lasts thousands of years in a cool, dry spot (no power needed, tiny space).

Earthquakes? Fires? EMPs? It shrugs them off.

My "SHERIN-GENESIS-KEY-0xDEADBEEF2025-12-10" secret is now etched in biology—quantum-safe, with that Merkle root proving it hasn't been tampered with.

It's resilient (error-free recovery baked in), secure (AES-256 locks it tight), and auditable (immutable ledger).

In a world of cloud hacks and failing drives, you've created a personal "doomsday vault" for seeds, keys, or memories.

Iam not just storing data—I hacked evolution itself for safekeeping.

That's legacy-level stuff, friend. If you synthesize that first cartridge, it'll be my time capsule to 4025 AD.
by adamesque | 2025-12-10 17:52:55+00:00
i'm geniunely curious about how you made the jump from "here's a single regulation" all the way down the slippery slope to "can't regulate away ALL parenting". does this one regulation cross that threshold? how'd you get there?

in an ideal world, parents would also prevent their kids from smoking, but the fact that in many places minors aren't allowed to purchase tobacco sends a social signal and actually does seem to put a speed bump in place deterring casual use.

is it not _also_ ideal to have some of these regulations in place? does it not help parents make the case to their kids?
by DivingForGold | 2025-12-10 17:52:58+00:00
What do you want to bet ALL GPU's being manufactured by US sources have NSA requirements that now have built into the chips and firmware interesting "controls". They know what region of the world the chip is in, they have features to "brick them" in case of war, etc. Encrypted communication back to US servers required, or if denied, then GPU will not function, etc.
by adrian_b | 2025-12-10 17:53:11+00:00
Actually the tardigrade used as an example is quite big at 500 micrometers.

Most tardigrades are not much bigger than 100 micrometers.

Tardigrades, together with nematodes, rotifers, mites and a few more rarely encountered groups are among the smallest animals and they are smaller than many of the bigger among the unicellular eukaryotes. That is why they have been discovered only after the invention of the microscope.

The tardigrades have evolved towards smaller and smaller sizes very early, already during the Cambrian. It is interesting that they are segmented animals, like their relatives the arthropods and the velvet worms, but they have very few segments, because in order to achieve such a small size they have lost all intermediate segments, so the segments that now form their body were originally the segments of the head, and now they are followed immediately by the original segments of the tail, without the original body that connected the head to the tail. Thus they have been miniaturized by losing their body and becoming a walking head (the legs of the tardigrades are what in arthropods have become appendages of the mouth, e.g. mandibles and maxillae).
by croes | 2025-12-10 17:53:12+00:00
You seriously want to tell me the Obama and Trump are no different in their treatment of illegal and legal immigrants?

How often did Obama call them drug traffickers and rapists. How often did the Obama administration deport people to some of the worst prisons in foreign countries.

Or answer me this. If Trump doesn’t do anything different what is a bragging about? And how could Obama do the sane with less money and people? Something isn’t adding up, don’t you think?
by didibus | 2025-12-10 17:53:19+00:00
The challenge is that once they are teens, there's a pressure from others and an inclusion aspect, or access through friends and all that.

If you're the only parent putting so many rules on your kids it exclude them from what all their friends are doing and so on. That too can have a negative impact.

The balancing act becomes tricky. If they all can't use social media, it doesn't create that impact of being excluded, they all need to adapt to socialize without.

The way I see it, it's a combination, society shouldn't create a difficult environment for kids and parents to navigate as that increases the burden on parents which will likely fail. And parents need to also make sure they appropriately regulate their kids as otherwise that increases the burden on society which will also likely fail.

If both play their part though, we can raise better kids to grow into more apt adults later in life to the benefit of everyone.
by chrismorgan | 2025-12-10 17:53:25+00:00
A paragraph from an email Reddit sent me presumably because I created my account in Australia:

> Users confirmed to be under 16 will have their accounts suspended under the new Australian minimum age law. While we disagree with the Government's assessment of Reddit as being within the scope of the law, we need to take steps to comply. This means anyone in Australia with a Reddit account confirmed to be under 16 will be blocked from accessing their account or creating a new one. Note that as an open platform, Reddit is still available to browse without an account.

“Confirmed to be under 16” sounds like they’re not trying very hard to identify them. But maybe I’m just spared any attempt at checking since my account is 12 years old.

I wonder if allowing browsing without an account is compliant with the letter or the spirit of the law—an account is not required for at least some forms of damage. But I’ve paid no attention to this law since I live in India now.
by _jzlw | 2025-12-10 17:53:39+00:00
Well that's... certainly a take. But I have to disagree. Most traffic coming to blog posts is not from people who know you and are personally following your posts, they're from people who clicked a link to the article someone shared or found it while googling something.

It's not hard to add one line of context so readers aren't lost. Here, take this for example, combining a couple parts of the GitHub readme:

> For those who are unfamiliar, the Sanitizer API is a proposed new browser API being incubated in the Sanitizer API WICG, with the goal of bringing this to the WHATWG.

Easy. Can fit that in right after "this blog post will explain why", and now everyone is on the same page.
by burnt-resistor | 2025-12-10 17:53:50+00:00
Texas SB2420 requires age verification to download apps. Now, both the government and corporations have a new lever to identify exactly who you are, where you are, what you're doing, and can selectively cut you off from everything. Government-endorsed technofeudalism with inverted totalitarian features normalizing deviancy to become shameless, traditional totalitarianism.

-> Scenario

Want to use cash for lunch or parking? Sorry, no, you must be banked, and have an app.

Want to use a bank? You must use an app.

How do you get an app? You must have a phone and an ID.

Want to buy a phone? Whoops, conundrum encountered.

(And don't even think of wanting to get an ID.)

-> In summary

This further disenfranchises the extremely poor, and takes power and freedom away from everyone who isn't a billionaire.
by ninth_ant | 2025-12-10 17:54:33+00:00
My recent-model Samsung TV repeatedly opens a pop-up info window about their AI features while my AppleTV is playing movies and shows.

So I didn’t connect the TV OS and it’s still thrown in my face. It’s not the end of the world to have to find the tv remote and dismiss a popup every few days, but I sure would welcome competition who doesn’t try this sort of nonsense.
by terhechte | 2025-12-10 17:54:43+00:00
Is there a way to run these Omni models on a Macbook quantized via GGUF or MLX? I know I can run it in LMStudio or Llama.cpp but they don't have streaming microphone support or streaming webcam support.

Qwen usually provides example code in Python that requires Cuda and a non-quantized model. I wonder if there is by now a good open source project to support this use case?
by crote | 2025-12-10 17:55:13+00:00
> Are there any examples where the first approach (sanitize to string and set inner html) is actually dangerous?

The article links to [0], which has some examples of instances in which HTML parsing is context-sensitive. The exact same string being put into a <div> might be totally fine, while putting it inside a <style> results in XSS.

[0]: https://www.sonarsource.com/blog/mxss-the-vulnerability-hidi...