MurphyA/hacker-news huggingface dataset:
by runtimepanic | 2025-12-18 18:26:05+00:00
I’ve always felt this argument works best in small, stable codebases with low team churn. Self-documenting code is a great goal, but in real systems the why often matters more than the what, and that context rarely survives in variable names alone. In my experience, comments age badly when they restate code, but they age quite well when they capture constraints, trade-offs, or historical decisions. The real smell isn’t comments, it’s comments compensating for unclear design.
by lkbm | 2025-12-18 18:26:14+00:00
I mean, I guess it's fine to mock stuff here, but when I tried clicking the button, I first opened the network tab of devtools, and was confused by the lack of any request being made. (The console explained, showing "[HTMX Demo Mock] fetch: POST /demo/clicked" and "[HTMX Demo Mock] Returning mock for: POST /demo/clicked")

Your demo shouldn't have explicit lies, such as "It worked. That was an actual HTMX POST request. The "server" returned this HTML and HTMX swapped it in."

I mean, I guess maybe it made an HTMX POST request, not an HTTP POST request? But this does reduce my trust in the article.
by NitpickLawyer | 2025-12-18 18:26:16+00:00
> In parallel, we’re piloting invite-only trusted access to upcoming capabilities and more permissive models for vetted professionals and organizations focused on defensive cybersecurity work. We believe that this approach to deployment will balance accessibility with safety.

Yeah, this makes sense. There's a fine line between good enough to do security research and good enough to be a prompt kiddie on steroids. At the same time, aligning the models for "safety" would probably make them worse overall, especially when dealing with security questions (i.e. analyse this code snippet and provide security feedback / improvements).

At the end of the day, after some KYC I see no reason why they shouldn't be "in the clear". They get all the positive news (i.e. our gpt666-pro-ultra-krypto-sec found a CVE in openBSD stable release), while not being exposed to tabloid style titles like "a 3 year old asked chatgpt to turn on the lights and chatgpt hacked into nasa, news at 5"...
by bortbortbort | 2025-12-18 18:26:18+00:00
I sell the canvas space within https://www.minigenitals.com to private parties looking to settle scores. Between the coffee's I'm bought and averaging out the monthly "ad buys", it's just over $500/month, usually 3 or 4 $50 2-day campaigns a month and then a bunch of satisfied fans, apparently ¯\_(ツ)_/¯ We recently had to reset the coffee account due to phishing, but otherwise it's been a riot. I think there are a few backed up in the IA
by runtimepanic | 2025-12-18 18:26:50+00:00
This feels less like an “anti-AI” stance and more like a trust and control issue. For browsers especially, users have very different threat models and performance expectations, and “always on” AI features blur that line quickly. An explicit opt-out makes sense, but I wonder if the more important question is whether these features can be implemented in a way that’s truly local and auditable. If users can’t clearly understand where data goes and what runs on-device, toggles become a necessary safety valve rather than a preference.
by quesera | 2025-12-18 18:26:51+00:00
There's some truth to the incentives angle.

The program manager is responsible for retail placement and packaging. Their share of the revenue is small, but their liability for fraud is high.

Retailers (POS card sellers e.g. Safeway, as opposed to the card-branded merchant e.g. Apple), bear zero risk for fraud. Safeway can't police card validity -- if a customer brings the card to the cashier, they will scan it and the POS will attempt to activate it according to the program manager's backend rules. If it's a new unactivated card, it will get activated. The PM knows which serial numbers were distributed to each retailer, so they will not activate a card at a different retailer (and in some cases, a different location of the same retailer).

Moving the 100+ square feet of unactivated card displays to a retail cashier would destroy sales and impose a burden on retail staff that many can't handle, and none are incentivized to create a process for handling.

FWIW, program managers have gone through a few rounds of tamper-proof packaging upgrades. Obviously, their work is not done. But it is legitimately difficult to mass produce a tamper-proof package that is also consumer-friendly and not exorbitantly expensive.

If cost of packaging were no issue, or if customer friction could be disregarded, then the problem becomes more soluble. But we do not live in that world. And, in the extreme case, the criminals could just produce identical packaging including holograms etc. This is obviously within their capabilities, and if the cost of packaging can be absorbed in the multi-party legitimate sale chain, it will also be low enough for a counterfeiter.

...

More importantly, I agree that _some_ regulation or law should prevent Apple|Google|Amazon|etc from parlaying a minor financial dispute into total lockdown of customer data! But the approach for that is not to inject the requirement into the problem of closed loop prepaid debit card management.

I think this is the only interesting problem here. The card management stuff is well-known and evolving, but also mature and ultimately just some accounting math of risk against cost.

Screwing up a customer's digital life should not be a consequence of the imperfect-by-design card management schemes. FinCEN should regulate the latter. CFPB should regulate the former. The agency doesn't matter of course, but those two groups have very different mandates, and right now merchants are letting the stronger FinCEN regulations dictate their consumer policies in ways they should not.
by johndoeee | 2025-12-18 18:26:57+00:00
mail.h-email.net is a Spamhaus spamtrap.

As far as I've been able to research, these typesquatting domain traps started at the same time as Spamhaus CSS blacklist which was actually a company called Deteque.

If the MX has a large number of Hetzner IPs as mailservers, then it's probably Spamhaus.
by larrymcp | 2025-12-18 18:27:01+00:00
Can anyone elaborate on what they're referring to here?

> GPT‑5.2-Codex has stronger cybersecurity capabilities than any model we’ve released so far. These advances can help strengthen cybersecurity at scale, but they also raise new dual-use risks that require careful deployment.

I'm curious what they mean by the dual-use risks.
by n4pw01f | 2025-12-18 18:27:01+00:00
I have used HTMX extensively with AI agents. It is fantastic for dynamic views.

Agent one: handles the request and does tool calls

Agent two: reads the result and decides on quality vs a re-drive if it’s low quality

Agent three: decides how to present the information to the user, creates a collection of HTMX elements

HTMX hx-get is reliably, and beautifully rendering the result of the Agentic Workflow without any react, etc.

Very happy and passing quality gates. I love not having security alerts every week to patch because of some buried react dependency library
by dang | 2025-12-18 18:27:18+00:00
I'll give you my take on this but it's just my personal take: I think you're right and wrong—right because HN does go through these waves, but wrong because it's a fluctuation process that stays fairly steady in the long run. (At least we're determined to keep it so, if we can - https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...)

That's why people have been experiencing this "HN has gotten a lot more $BAD-QUALITY recently" since pretty much the origin of the site.
by DenisM | 2025-12-18 18:27:21+00:00
Well, some things fade out and some do not. How do we decide which one it is?

The reason I ask is that the pace of new things arriving is overwhelming, hence I was tempted to just ignore it. Not because things had signs of transience, but because I was drowning and didn't know where to start. That is not the same thing as actually observing signs of things being too foamy.
by rchaud | 2025-12-18 18:27:26+00:00
Apple's ad business is estimated to be at $6.5 billion annually as of 2024[0]. Since then, they've decided to bring ads to Apple Maps. And of course there was the infamous ad for some movie on Apple TV injected into Apple Wallet earlier this year.

Just because they're not Google's size doesn't mean they don't have people making product decisions that will eventually sacrifice privacy for profits.

[0] https://digiday.com/marketing/when-it-comes-to-ads-apple-isn...
by nyeah | 2025-12-18 18:27:26+00:00
Ok, but the Honnecourt sketches are kind of strong. Not professional by today's standards, but decent. I'd be happy to have done them--but I'm not an artist. The tapestry can be appreciated, like Klimt's 2-D-ish stuff can be appreciated. The style is fine. It's not fantastic work, I wouldn't hang it up, but it's reasonably accomplished.

In general, though, yes, I think medieval European artists were short on skill compared to artists from Europe in pre-medieval and post-medieval times, and art from other places between ~500 and ~1300. They had some skill, but not as much.

Artists with limited technique are a real thing. Not everything is taste or style.
by bluesnowmonkey | 2025-12-18 18:27:40+00:00
> Your job is to deliver code you have proven to work.

First of all, no it’s not. Your job is to help the company succeed. If you write code that works but doesn’t help the company succeed, you failed. People do this all the time. Resume padding, for example.

Sometimes it’s better for the business to have two sloppy PRs than a single perfect one. You should be able to deliver that way when the situation demands.

Second, no one is out there proving anything. Like formal software correctness proofs? Yeah nobody does that. We use a variety of techniques like testing and code review to try to avoid shipping bugs, but there’s always a trade off between quality and speed/cost. You’re never actually 100% certain software works. You can buy more nines but they get expensive. We find bugs in 20+ year old software.
by tptacek | 2025-12-18 18:28:21+00:00
It's interesting that they're foregrounding "cyber" stuff (basically: applied software security testing) this way, but I think we've already crossed a threshold of utility for security work that doesn't require models to advance to make a dent --- and won't be responsive to "responsible use" controls. Zero-shotting is a fun stunt, but in the real world what you need is just hypothesis identification (something the last few generations of models are fine at) and then quick building of tooling.

Most of the time spent in vulnerability analysis is automatable grunt work. If you can just take that off the table, and free human testers up to think creatively about anomalous behavior identified for them, you're already drastically improving effectiveness.
by bee_rider | 2025-12-18 18:28:28+00:00
Those already occur though.

I wonder if we could form a graph that would make a collusion ring intuitively visible (I’m not sure what—between papers, authors, and signings—should be the edges and the nodes, though). Making these relationships explicit should help discover this kind of stuff, right?

Another problem with my idea is that a lot of famous luminaries wouldn’t bother playing the game, or are dead already. But, all we can really do is set up a game for those who’d like to play…
by scottydelta | 2025-12-18 18:28:29+00:00
I agree with the second part in terms of differentiation you mentioned.

That plus the ability to provide customized solutions that stitch together data extraction and business logics such as reconciliations for vendor payments or sales.

I think both these reasons are what's keeping all the OCR based companies going.

My only advice would be to figure out more USPs before native models eat your lunch. Like Nanonets has its own native OCR model.

Congrats on the launch.
by mrguyorama | 2025-12-18 18:28:30+00:00
Breakage is between 10-20% on average, which is just insane.

However, a significant amount of the spending in gift card promotions is from the marketing budget of these companies. They use gift cards to keep you "engaged". They are used the way companies used to give out coupons basically.

Promotions rarely cost much. Keep in mind that even if breakage was zero, every dollar you spend at a company already has a profit margin baked in. Even if you only pay $9 for that $10 of spend at CompanyPlace, they are likely still making a profit. Promotions also have strong limits, so you can't really profit off of them as a consumer.

Except for one time. Once, IKEA ran a promotion that was "Spend $1000, get $100", and chose to set NO LIMITS. People were banking $10k worth of IKEA giftcards "for my future kitchen renovation" and IKEA found out their gift card fulfillment process was.... antiquated. Did you know old versions of Excel only allow for 65k rows of data?

>As for the fraud risk... do they even care?

We care. The brick and mortar store and Apple themselves don't really care, because they pay our company to take that risk, and our entire business is about preventing credit card fraud to reduce how much that risk costs.

>It would be so easy to make gift cards more secure. Modern technology can do a lot better than an alphanumeric code under a sticky cover.

What? What is your idea for better securing these cards? What "Tech" would help?

Note that I have no clue what apple is doing banning this account. We don't tend to ban victims of fraud or crime or scams, especially not for physical cards bought in a store because who knows what actually happened.
by itchyouch | 2025-12-18 18:28:41+00:00
I generally agree. It's all interconnected, and we could point to a singular cause, but to treat them all as one and of the same class of disease seems reductive and not useful.

Though, to be play devil's advocate for a second, it does seem that diabetes is typically where the symptoms start, and we do understand that diabetes is fundamentally metabolic and/or functional dysfunction in 1 or more of 7-ish different areas.

I think it's the level of perspective zoom + timing we take that makes the article's assertion either useful or not.

If we zoom out, while catching disease early on, and we address the metabolic conditions via lifestyle and/or certain drugs like GLP1, then we prevent the need to intervene on the kidney and cardiac front.

But if we zoom in to a specific issue, after disease has progressed a profound amount, a GLP1 intervention may be too little, too late.

Hopefully though, this may help the messaging to folks that if they are contending with metabolic disease that presents as diabetes, introducing lifestyle and pharma interventions early may be helpful on the larger epidemiological front.
by LorenPechtel | 2025-12-18 18:28:51+00:00
You're not rebutting his point.

Let's assume fate has decreed that patient X will die of lung cancer at 70. Detect it at 68, dies in 2 years. Detect it at 64, dies in 6 years. Your early detection "increased" survival by 200%.

And I think there's a lot to his point. Fundamentally, cancer can be divided into three groups:

1) Slow growth. Leave it alone and it probably never harms the patient. Many prostate cancers fall into this category.

2) Fast growth. These are the ones where the oncologists hitting it hard can make a real difference.

3) Fast growth/fast spread. The oncologists don't have a chance. Some tumors can be slowed.

Unfortunately, our ability to figure these out (other than in hindsight) is limited. Both of my parents died of stuff that spread rapidly, in both cases treatment was a negative. (Although there was some palliative stuff for my father.)
by runtimepanic | 2025-12-18 18:28:57+00:00
“Dual-use” here usually isn’t about novel attack techniques, but about lowering the barrier to execution. The same improvements that help defenders reason about exploit chains, misconfigurations, or detection logic can also help an attacker automate reconnaissance, payload adaptation, or post-exploitation analysis. Historically, this shows up less as “new attacks” and more as speed and scale shifts. Things that required an experienced operator become accessible to a much wider audience. That’s why deployment controls, logging, and use-case constraints matter as much as the raw capability itself.
by rootusrootus | 2025-12-18 18:29:03+00:00
> Do junior developers not take any pride in their work?

Yes. I have lost count of the number of PRs that have come to me where the developer added random blank lines and deleted others from code that was not even in the file they were supposed to be working in.

I'm with you -- I review my own PRs just to make sure I didn't inadvertently include something that would make me look sloppy. I smoke test it, I write comments explaining the rationale, etc. But one of my core personality traits (mostly causing me pain, but useful in this instance) is how much I loathe being wrong, especially for silly reasons. Some people are very comfortable with just throwing stuff at the wall to see if it'll stick.
by subdavis | 2025-12-18 18:29:13+00:00
What a blast from the past. I attempted to build a file-sharing tool for my team when we had video and images strewn across the org. I prototyped embedding filestash for the frontend.

It was basically a backend for generating STS credentials on the fly using a more ergonomic interface. It never went anywhere and I haven't thought about it in years, but I still believe it was a good idea that I just didn't have the organizational clout or time to push forward.

Edit: apparently I contributed at some point too? I *barely* remember that. Glad to see the project is still succeeding!

[1] https://github.com/subdavis/workspaces-io
by IshKebab | 2025-12-18 18:29:21+00:00
This is a very good point. I wonder how hard it would be to get POSIX to standardise a scripting language that isn't awful.

Probably never going to happen. There is a dearth of good scripting languages, and I would imagine any POSIX committee is like 98% greybeard naysayers who think 70s Unix was the pinnacle of computing.
by em-bee | 2025-12-18 18:29:25+00:00
you are not married, are you? that's not how this works. while they certainly need to talk, and not just once, but continuously, you don't have the authority to change your partners behavior. you need to discuss your feelings about this matter and come to a consensus about the activities and the goals for your child.

it won't be easy. if i were in this position, i can't imagine what i would do. i feel even stronger than GP about this, and i'd probably feel quite helpless trying to get my partner to understand how i feel about this. even just trying to get my voice heard. if you don't have a way to communicate openly in your marriage from the start, then talking about things openly can be very hard, seemingly impossible even. with one issue that my wife and me had, it first took me years to notice and understand the issue and start to speak up about it, then it took a few more years for my wife to recognize and acknowledge the issue for herself, and then she still struggled to do something about it. and very time i messed up somewhere in our relationship, it was a setback for her development too. and i can't even blame her. it's something she learned from her parents (which is how she eventually figured it out)
by Deboujee | 2025-12-18 18:29:49+00:00
Creating short, vertical videos for social media is no longer optional. Attention spans are shorter and Snapchat remains one of the top-performing platforms for product visibility and quick conversions. With VidAU's Snap Video Ads feature, you don’t need editing skills or a full creative team to make polished, ad-ready content.

Snap Video Ads for Fast, High‑Converting Snapchat Campaigns Snap Video Ads on VidAU The Snap Video Ads feature in VidAU helps you create conversion-focused Snapchat ads without filming, editing, or long production cycles. Snapchat favors short, vertical videos with clear. messaging and strong calls to action. VidAU aligns with this demand by turning a single product image or URL into a ready-to-publish ad. With VidAU Snap Video Ads Features you get: VidAU enhances Snap Video Ads by combining Snapchat’s native ad format with AI-driven production tools. These features help creators and marketers move from idea to publish-ready ads with speed and consistency. AI Video Generation VidAU turns product images, text prompts, or URLs into vertical Snap-ready videos. You create motion, lighting, and clean scenes without cameras or editing software. Product Image to Video Ads Upload a product image and generate short animated clips with smooth camera movement. This helps showcase products clearly in a format designed for Snapchat feeds. Attention-Grabbing Hooks and Captions VidAU adds short text overlays that capture attention in the first seconds. Clear hooks support higher retention during fast scrolling.

You insert CTAs like Swipe Up, Shop Now, or Learn More directly into the video. This guides viewers toward immediate action. Subtitle and Language Support VidAU includes subtitle tools that improve clarity and support multi-language campaigns. Your message stays clear even when viewers watch without sound. Multiple Ad Variations You generate multiple versions of the same ad with different hooks, visuals, or captions. This supports testing and optimization across audiences. Snapchat-Optimized Export VidAU exports videos in a vertical 9:16 format with optimized resolution and file size. Ads publish smoothly without additional formatting. Fast Production Workflow VidAU removes manual editing steps and production delays. You create Snap Video Ads in minutes, making it easier to launch, test, and scale campaigns. Snap Video Ads for Fast, High‑Converting Snapchat Campaigns
by alerter | 2025-12-18 18:29:58+00:00
Yes, this is well put. I was heavily influenced by Casey back in 2014 and the advice I give juniors now is always that first point about "getting the clowns out of the car". There's a lot of crossover with the "grug brained developer" here too, which is much more aligned with the web/enterprise world.

I find it very hard to convince people though. It runs counter to a lot of other practices in the industry, and the resulting code seems less sophisticated than an abstraction pile.
by jgerrish | 2025-12-18 18:29:58+00:00
I really appreciate the level of discourse here on Hacker News. Thank you to threads like this and the authors of the comments.

I appreciate your argument, and you knowlwdge of economics adds weight to it. I'm wary of putting the burden on workers to remove information asymmetry and power imbalances in bargaining. Just because it's necessary now doesn't mean it needs to be. It could create a cycle of permanent extra work for those most in need of regulatory help.

I don't know if I had the full language of economic inefficiencies ready to flow like you do if that argument would be more effective. Or if there are other blocks, you know?
by otherme123 | 2025-12-18 18:30:05+00:00
> it is often simply because the site is badly written

I find that some techs tend to cause badly written code. I have junior coworkers that can write clear Python after a short intro, but can't write clean R after a year using it daily. I don't know if it is caused by the philosophy behind the language, the community, the tutorials and docs...