MurphyA/hacker-news huggingface dataset:
by tptacek | 2025-12-18 22:17:54+00:00
I do not in fact think you would make a lot more than $4000, or even $4000 in the first place, for an Apple XSS bug, unless it was extraordinarily situationally powerful (for instance, a first-stage for a clean, direct RCE). Bounty prices have nothing at all to do with the worst-case damage a motivated actor could cause with a vulnerability.
by janalsncm | 2025-12-18 22:18:14+00:00
As far as I know, there is nothing to prevent Samsung from selling you a TV, then sending out a software update in two years which forces you to accept a new terms of service that allows them to serve you ads. If you do not accept, they brick your TV.

So it’s not a question of being savvy. As a consumer you can’t know what a company will choose to do in the future.

The lawsuit seems to be about using ACR, not the presence of ads.
Show HN: Nautilus – Modern, OSS Linux SSM Built with Tauri/Rust and React
by r2ob | 2025-12-18 22:18:50+00:00
I’m building Nautilus, a cross-platform desktop manager for Linux servers. While there are many SSH clients out there, I wanted something that combined a high-level dashboard, a full SFTP explorer with an integrated editor, and specialized tools like a Cron job manager and Process monitor—all in a modern, lightweight desktop package.

Key Technical Highlights:

Tauri + Node.JS Sidecar: We use Tauri for the native windowing and Rust security, but the heavy SSH/SFTP lifting is done via a Node.js sidecar (using ssh2). This allowed us to leverage a very mature ecosystem while keeping the frontend performant. Security: We don't store passwords in plain text. We use the OS-native secure vault (macOS Keychain, Windows Credential Manager, or Secret Service via keytar). Modern Stack: React 19 and Vite 7. Features: Multi-tab terminal (xterm.js), real-time CPU/RAM/Network monitoring, visual Cron management, and a reusable snippet library with "secure password" sending.
by tastyfreeze | 2025-12-18 22:19:09+00:00
Apparently I made my point poorly. Kama sutra was an example that I think everybody could agree shouldn't be in a children's library. My point was that everybody gets to decide what is in their children's library. Most of the people in that area probably agree. But, everybody can still go to any bookstore and find the same books. They are not banned in any way. As the OP said, without criteria on why a book is "banned" lists like this are pointless. A library or school district deciding they don't want a book doesn't make it banned. The problem is that people thousands of miles away think that those people far away are too restrictive or liberal in their book selections presented to children.

My second point was that since all these "banned" books are still available for sale; getting on a banned book list is just a tactic to sell more books. This list even has affiliate links to the books. Which make the whole page click bait.
by tptacek | 2025-12-18 22:20:25+00:00
I think you're wrong about this. 35 years ago was 1990. Nobody was selling vulnerabilities in 1990 at all. By 1995, I was belting out memory corruption RCEs (it was a lot easier then), and there was no market for them at all. And there has never been a market for web vulnerabilities like XSS.

Building reliable exploits is very difficult today, but the sums a reliable exploit on a mainstream mobile platform garner are also very high. Arguably, today is the best time to be doing that kind of work, if you have the talent.
by kragen | 2025-12-18 22:20:55+00:00
The tweet immediately before this one says:

> There's a weird disconnect in this vaccine mandate debate: many are still pretending that Covid-19 is of natural origin, which gives such mandates a different feel than they otherwise have.

Contrary to your assertion, this is not clearly talking about vaccine mandates in any particular place. And the tweet I quoted previously is claiming (or hinting) that the same "state entity" had caused the pandemic and mandated the "experimental treatment". I'm not familiar with any versions of the lab-leak hypothesis that claimed that covid escaped from a US lab, so I don't think it's a reasonable inference that he's talking about the US vaccine mandate.

On the other hand, he seems to have worked pretty hard to avoid clearly stating any of his positions here, so who knows what he really thinks? Or thought?
by bsimpson | 2025-12-18 22:21:09+00:00
I once had a flatmate who worked in IT at MIT at the time that happened. I don't remember the details, but it was a sad fluke that the feds even got involved - something like it was reported at the wrong time of day/when the person who should have got it was off-shift, or the feds happened to be doing something with the state police when the report came in and wanted to make a big news splash.

Whole thing was incredibly fucked up.

Interesting to see how much more thorough the Wikipedia page is now.
by tomwojcik | 2025-12-18 22:21:25+00:00
People's minds will become even lazier due to prolonged daily use of LLMs. They literally won't be able to think for themselves without AI assistance (that's why OpenAI won't fall, btw). Attention spans will drop even lower, causing severe psychological problems. Think 'Digital Dementia 2.0.'

Later, LLMs will be portrayed as something evil, yet everyone will still use them. Parents will use them, while telling their kinds not to do so.

Leetcode is already standard for SWE interviews, but other industries will need to adopt similar tests to verify that an applicant's brain is functioning correctly and that they're capable of doing the job. Maybe a formal confirmation from a psychologist specializing in 'fried brains' will be required.
by Dwedit | 2025-12-18 22:21:40+00:00
I don't like how translation is only unavailable when the browser "thinks" the whole site is in a particular language. What if there's a single sentence that's not? Or if it guesses the site's language incorrectly? No translation for you.

We need more control over the feature. Even just the ability to select text, right click, and have a "Translation" menu would be huge. Looks like there is such a feature, but it doesn't let you pick the language pairs, which is the most basic requirement of translation.
by ajross | 2025-12-18 22:22:28+00:00
You're preaching to the choir about the fragility of the the "dig the dependency stack all the way down to hell" paradigm. But I don't think it applies in this particular case (neither does attributing it to vibe coding, IMHO).

The component which ultimately executed the payload in the SVG was the browser, and the backend dependency stack just served it verbatim as specified by the user. This is a 1990's style XSS fuckup, not anything subtle.
by MisterTea | 2025-12-18 22:22:49+00:00
Had two GM 3500 cargo vans, one a 2002 Chevy Express, the other a 2001 GMC Savannah. Same vehicle different badges. Noticed the keys were a bit similar and found that the Chevy key could in fact unlock the GMC with some wiggling but not the other way around. It did not work in the ignition lock.
by antonymoose | 2025-12-18 22:23:01+00:00
In my state (South Carolina) this is exactly how they handled it. If a parent or activist wishes see a book banned it goes through reviewed based on school-level appropriateness. A book like The Kite Runner with its deprecations of Bacha Bazi are a bit rough for a 5th grader but considered acceptable for a High Schooler given the cultural significance of the work.
by crazygringo | 2025-12-18 22:23:43+00:00
> If you save each iteration in a different Doc, you might as well use Word.

Funnily enough, that's how I (and a lot of people I know) use Google Docs.

The version history is great if you accidentally delete something and want to go back, but I don't know anyone who relies on the version history as a kind of meaningful archive -- it's just too fragile. Unless you create named versions, changes get collapsed, and when you make a copy, the version history doesn't get copied.

And it doesn't prevent collaboration -- multiple people can still collaborate on one set of changes in one "branch" file, while other people can collabroate on another set of changes in another "branch" file. When collaboration is done on both, they can get merged into the master file.

You've definitely convinced me that Docs doesn't work for law firms, but mainly for other reasons. Using multiple versions of files doesn't defeat the purpose of Docs -- it still makes collaboration much easier, and nobody's stuck e-mailing files back and forth that are out-of-date by the time they're opened.

Your idea of a VCS for .docx is intriguing though. Good luck!
by ugh123 | 2025-12-18 22:24:30+00:00
100%

Additionally, I can't even get claude or codex to reliable use the prompt and simple rules (use this command to compile) in an agents.md or whatever required markdown file is needed. Why would I assume they will reliably handle skills prompts spread about a codebase?

I've even seen tool usage deteriorate while it's thinking and self commanding through its output to say.. read code from a file. Sometimes it uses tail while other times it gets confused on the output and then writes a basic python program to parse lines and strings from the same file to effectively get what was the same output as before. How bizarre!
Show HN: Improved real-time news propagation tracking via source citation graphs
by antiochIst | 2025-12-18 22:24:37+00:00
A few weeks ago I shared Yandori here — a system that tracks how news spreads across ~200k websites in near real time. The main criticism was fair: similarity + RSS timestamps aren’t enough to identify who actually broke a story, and many large sources were missing.

Since then I’ve reworked the core of the system to explicitly model source attribution and article-to-article references, not just textual similarity.

What’s changed:

Clusters still start from full-text embeddings, but are now refined using explicit citations and source mentions inside articles.

External sources (sites we don’t actively crawl) are added as nodes when referenced, so lineage isn’t limited to the monitored set. This captures many large outlets that don’t provide usable RSS feeds.

“First to publish” no longer relies purely on RSS timestamps — publish times are validated against citation order and reference structure.

The flow view now reflects an inferred derivation graph, not just a timeline of similar headlines.

Added search and browsing across historical story archives.

Still English-only for now and not pulling from social platforms yet — trying to get attribution right before expanding.

Happy to answer questions and hear suggestions (they helped a lot already).
by kenjackson | 2025-12-18 22:24:41+00:00
I think you can view it as supply chain as the supply chain is about attacking resources used to infiltrate downstream (or is it upstream? I get which direction I should think this flows).

As an end user you can't really mitigate this as the attack happens in the supply chain (Mintlify) and by the time it gets to you it is basically opaque. It's like getting a signed malicious binary. It looks good to you and the trust model (the browser's origin model) seems to indicate all is fine (like the signing on the binary). But because earlier in the supply chain they made a mistake, you are now at risk. Its basically moving an XSS up a level into the "supply chain".
by mistercheph | 2025-12-18 22:24:46+00:00
Who is inside and who is outside depends on your (subjective) spatial interpretation of the situation.

It could just as well be said that a bunch of scholars disconnected from the culture, history, and technique of fine arts (except as objects of scholarly interest) are wildly speculating from the outside about the nature of the objects, and people interested in these things are starting to ask "Why are these silly things being said about the topic I'm interested in? Are the people behind this pranksters?"

Anyways, if there is a misunderstanding here, which I don't doubt is the case for at least some of the people involved, why can't the discourse be had in public about it? The question has been asked as you suggest...publicly. Polychromic revivalists are free to respond in public, and we can all benefit from hearing the more nuanced perspectives get expressed.
by pas | 2025-12-18 22:25:40+00:00
Money supply management is important for price stability. There's no debt problem in fractional reserve banking. (Exactly because debt is slowly inflated away while real assets keep their value [as their nominal value increases].)

There's a tremendous amount of economic growth. And as long as there are places where we can put in some better technology, a more efficient process or organization, then growth will continue, and the money supply will have to grow, and it's currently done via bank-issued money, because it provides some risk management. (Which is the most important factor of money creation. This is why finance and insurance developed intertwined.)

Energy is one bottleneck, sure, but there's no serious slowdown of growth of electricity generation capacity for example. And GDP growth is decoupling from carbon intensity. (As it should as we started to invest a lot of our economic surplus to do so.)

...

The important thing to remember is that there's a balance between how much money is needed now and how much is issued to be paid back later, and obviously if the growth would be almost zero the interest rate would be almost zero too.

If growth slows down (the fiscal multiplier goes down, there are no more public things to do, no more houses to insulate to get a smaller HVAC bill, no unemployed person to teach skills who would then work) then need for money also goes down, as no one will offer to pay it back with interest, so interest rate will go down, so whatever amount of money we have (as debt) we can keep rolling it over.

And of course the central bank can always exchange debt money to non-debt money. (And every time it wants to increase the interest rate it used to do something similar, it sold assets [US Treasury bonds] which removed debt money from the system. And back in the 90s there was talk about how the US central bank will adapt if the US government starts to run surpluses permanently.)
by LexiMax | 2025-12-18 22:25:42+00:00
A very commonly banned book here in the United States - at least historically - is The Adventures of Huckleberry Finn. There's a specific chapter that my mind has returned to, again and again, in situations where anonymous cowards issue threats from behind the veil of anonymity:

https://americanliterature.com/author/mark-twain/book/the-ad...

The older I get, the more I think that there is wisdom in the words of Col. Sherburn on the cowardice of the average person.

By the way, I wonder if HN is aware of whose alt account this is. If they are, I wonder if they would punish the original poster for issuing threats on an anonymous account. I...admit that I don't have high hopes, but I live to be surprised.
by bccdee | 2025-12-18 22:26:31+00:00
"What happened to Rust" is that it got a lot of coverage for being good, then a few people were annoying about how good it is, and now a large number of other people have become annoying in their complaints about how annoying the first group was. Meanwhile, Rust & its community remain unaffected; adoption continues to grow, and Rust now used in the kernel, Windows, Android, AWS infra, etc.

The problem you've encountered is that people are annoying. I'm afraid that's not specific to any one technology or community. Fortunately, annoying blog posts are easily ignored and would never stop a useful tool from being adopted anyway.
by wahnfrieden | 2025-12-18 22:26:41+00:00
On the contrary, I will always use longer feedback cycle agents if the quality is better (including consulting 5.2 Pro as oracle or for spec work).

The key is to adapt to this by learning how to parallelize your work, instead of the old way of doings things where devs are expected to focus on and finish one task at a time (per lean manufacturing principles).

I find now that painfully slow builds are no longer a serious issue for me. Because I'm rotating through 15-20 agents across 4-6 projects so I always have something valuable to progress on. One of these projects and a few of these agents are clear priorities I return to sooner than the others.
by johnea | 2025-12-18 22:27:00+00:00
> Retired

You and me both, and for many of the same reasons.

I would point out that in your OPs comment, Luddites get the stereotypical dismissal as anti-tech, which is far far from the reality of demanding good conditions for workers.

For the modern s/w engineer, being granted the time and resources for adequate testing could be considered a "worker's rights" issue. In that context the Luddite allegation could be accurate.

My comment is largely along the same lines:

https://news.ycombinator.com/item?id=46313297#46319510
by kmeisthax | 2025-12-18 22:27:05+00:00
Don't forget that the reason why GNU won out over BSD is that the homeless man had already found out the hard way not to start off with someone else's code even if you intend to change all of it. Remember Gosling[0] EMACS?

[0] Funnily enough, James Gosling also made Java, which is why I suspect the FSF was so ready to pounce on "the Java trap".
by stantonius | 2025-12-18 22:27:14+00:00
This happened to me too in an experimental project where I was testing how far the model could go on its own. Despite making progress, I can't bare to look at the thing now. I don't even know what questions to ask the AI to get back into it, I'm so disconnected from it. Its exhausting to think about getting back into it; id rather just start from scratch.

The fascinating thing was how easy it was to lose control. I would set up the project with strict rules, md files and tell myself to stay fully engaged, but out of nowhere I slid into compulsive accept mode, or worse told the model to blatantly ignore my own rules I set out. I knew better, but yet it happened over and over. Ironically, it was as if my context window was so full of "successes" I forgot my own rules; I reward-hacked myself.

Maybe it just takes practice and better tooling and guardrails. And maybe this is the growing pains of a new programmers mindset. But left me a little shy to try full delegation any time soon, certainly not without a complete reset on how to approach it.
by exceptione | 2025-12-18 22:27:20+00:00
I could understand that, as we are inclined to hold this for true: "slow -> not smart".

What we do know is "not smart -> slow", because if you are dumb, you will be (infinitely) slow to answer correctly. But note this might indicate that the first proposition is a common logical fallacy where the modus tollens is applied incorrectly.

The slow but brilliant thinker wouldn't perhaps show up for solving a hard and novel problem, as they might have learned they are stupid, and they might still be slogging trough other problem sets. Other excuses are found in https://almossawi.substack.com/p/slow-and-fast-learners-3-qu...

If you want to test pure ability for deep thought, it will be very difficult to control all variables that affect slow people.
by sega_sai | 2025-12-18 22:27:45+00:00
The natural change from this are the journals with no cost of publication. There is no way that the added value of the journal is thousands of dollars, especially given that the referees work for free.

In astrophysics we already have a journal like that is gaining traction after several publishers switched to golden open access.

The system when the taxpayer subsidizes enormous profit margins of Elsevier etc while relying on free work by referees is crazy
Show HN: Mdgen – A browser tool to unify documentation into static HTML
by ernestobellei | 2025-12-18 22:28:36+00:00
While organizing my studio's various projects, I realized our documentation was a mess: different tools, inconsistent versions, and mismatched layouts. I wondered if it really had to be this complex to have a unified system for simple docs.

For the past couple of weeks, in my spare time, I’ve been standardizing everything into Markdown files within a /docs folder in each repo. To render them as static HTML, I built mdgen.

Initially, I planned a simple CLI to render HTML with a default stylesheet. Then, I remembered a Markdown editor I experimented with a while ago using the browser’s FileSystem API. I decided to dust off that code and create an online generator that requires zero effort. You just point the browser to your /docs folder, it processes everything locally, and you download the generated HTML package ready for your server.

However, I quickly realized that doing this manually for dozens of projects is tedious—so I built a CLI version to automate the process.

I wanted something lightweight that doesn't feel like a heavy static site generator but gets the job done for simple, clean documentation.

Side note: I’m actually thinking of adding some "fantasy" themes to use it for publishing D&D adventures.

Side side note: I'm fully aware that this currently works best for very 'standard' documentation and that the sidebar navigation system, in particular, still needs a lot of improvement... but I'm still having fun building it :)
by fooofw | 2025-12-18 22:28:50+00:00
My version of Firefox (146.0 on Debian) has exactly this. If I select a sentence and right-click, I get the menu item "Translate selection to <LANGUAGE>". In the resulting box, I can change the language pair - but the defaults that I have seen were also reasonable.

https://support.mozilla.org/en-US/kb/website-translation has the text: "A new Translate selection feature has been added starting in Firefox version 128, that enables you to highlight and translate selected text."

Edit: Sorry, I misread the comment to say that there was no such menu item. Edited to reflect this.
by cyberax | 2025-12-18 22:29:13+00:00
> Oo, totally wrong! Fun guess though. The average monthly cost of car ownership is $1,300. The cost of a one-month transit pass is $150. I'm not gonna save $1,150 on rent by moving to a shitty suburb.

The TRUE cost of one month's pass is about $3000 (with capital cost). The pure "just-keep-the-lights-on" cost is around $750. It's that you're paying it from your taxes and rent.

> Yeah, because there's a shortage of apartments—that's what I said. Manhattan Island (being a rather small island) has physically run out of room for buildings, but that's not true of other areas.

Yes, and it is metastasizing into other neighborhoods.

> Ok? So what? Maybe they'll expose private-sector price fixing & maybe they'll just be grocery stores.

Think about it again. If density works so well, why is there a significant number of people too poor to buy groceries?

> Have you heard of industrial parks? It's pretty common for offices in big cities to be outside the city centre—far more common on the whole than downtown offices are.

Not anymore.
by vablings | 2025-12-18 22:29:15+00:00
It makes me feel so gross that these companies are leaving gamers behind. The whole idea of a GPU was from gaming and games. And the whole AI evolution was subsequently born over the fact that gamers/software engineers could toy around with incredibly powerful CUDA without having to shoehorn a weird graphics Api in the middle to do mathematics.

They did the same thing with the COVID crypto era boom. There really is no honor for these companies and I will be buying the first Chinese made silicone out of absolute spite and anger
by foxfired | 2025-12-18 22:29:30+00:00
A while back, I've decided to make time tags dynamic on my website. First of all they have the title tag to show the actual date in UTC. By dynamic I mean, when something is just published, I use relative time that updates in real time. 1 second ago, 2, 3... etc. Then the minutes, then the hours, then daily.

I always get frustrated when I see a 7 months ago, or X years ago, the math is always inconsistent when they round it. So when something is more than 3 days old, I display the actual date.