MurphyA/hacker-news huggingface dataset:
by levelZero | 2025-12-27 09:49:36+00:00
A dev laptop running Ubuntu 24.04 got hit by a classic PostgreSQL cryptojacking attack while on public Wi-Fi (port 5432 exposed, UFW temporarily off).
Detection started with fan noise → btop tree view revealed 70-99% CPU under the postgres user.
The recovery was fully scripted, transparent, and driven by a local coding agent (Codex-Max-5.2) turned into a paranoid remediation specialist via a custom AGENTS.md directive.
Highlights:

Generated dozens of timestamped audit/cleanup scripts
Captured rogue sshd binary → 24/64 detections on VT as Linux trojan/rootkit hider
Ended with UFW timed rules, auditd watches, LAN-only services

Full play-by-play, verbatim scripts, and takeaways — no hype, just level zero truth.

https://open.substack.com/pub/layerzero0/p/surviving-a-2025-...

Would love feedback from anyone who's dealt with Postgres miners or AI-assisted IR.
by firesteelrain | 2025-12-27 09:50:03+00:00
Lack of stronger trust controls are part of the larger issue with npm. Pip, Maven and Go are not immune either but they do things structurally better to shift the problem.

Go: Enforces global, append-only integrity via a checksum database and version immutability; once a module version exists, its contents cannot be silently altered without detection, shifting attacks away from artifact substitution toward “publish a malicious new version” or bypass the proxy/sumdb.

Maven: Requires structured namespace ownership and signed artifacts, making identity more explicit at publish time; this raises the bar for casual impersonation but still fundamentally trusts that the key holder and build pipeline were not compromised.
by zokrezyl | 2025-12-27 09:50:21+00:00
Thanks for the suggestion. Indeed, that would be the first approach. That is how I started. This is however not considering the state (am I inside a 'statement' or not)

statement meaning string from first non-space till next EOL or EOF.

Problem starts when you need to cover the "corner cases". Without the corner cases the algo is not algo.
by woile | 2025-12-27 09:50:24+00:00
nah, a lot of people working on `uv` have a massive amount of experience working on the rust ecosystem, including `cargo` the rust package manager. `uv` is even advertised as `cargo` for python. And what is `cargo`? a FLOSS project.

Lots of lessons from other FLOSS package managers helped `cargo` become great, and then this knowledge helped shape `uv`.
by tasuki | 2025-12-27 09:50:35+00:00
Lisp is the cleanest language out there! It has one construct: parentheses. It's simpler than Ruby.

Wrt "forgetting" parentheses, the Lisp people have ways around that: they set up their editors so they operate on the expressions and can't "forget" a paren. They operate on the logical blocks (which is easy (because of the parentheses)).
by godelski | 2025-12-27 09:52:46+00:00
I think you're reaching. Justifying the answer you want rather than the answer that is.

No, graphs do not need come from text. I've frequently hand generated graphs as my means of recording experimental output. This is a common method when high precision is not needed (because your uncertainty level is the size of your markers). But that's true for graphs in general anyways.

Importantly, graphs are better at conveying the relationship between data, rather than information about a single point. (something something - Poincaré ;)

Besides, plots aren't the only types of graphs. Try network graphs.

Besides, graphs aren't the only visual communication of data.

I'll give you an even more obvious one: CAD. Sure, you can do that in text... but it takes much more room to do and magnitudes more time to interpret. So much so that everyone is going to retranslate it into a picture. Hell, I'll draw on paper before even pulling up the software and that's not uncommon.
by mcny | 2025-12-27 09:53:38+00:00
I write really poopy commit messages. Think "WIP" type nonsense. I branch off of the trunk, even my branch name is poopy like

feature/{first initial} {last initial} DONOTMERGE {yyyy-MM-dd-hh-mm-ss}

Yes, the branch name literally says do not merge.

I commit anything and everything. Build fails? I still commit. If there is a stopping point and I feel like I might want to come back to this point, I commit.

I am violently against any pre commit hook that runs on all branches. What I do on my machine on my personal branch is none of your business.

I create new branches early and often. I take upstream changes as they land on the trunk.

Anyway, this long winded tale was to explain why I rebase. My commits aren't worth anything more than stopping points.

At the end, I create a nice branch name and there is usually only one commit before code review.
by ck45 | 2025-12-27 09:53:50+00:00
Is this based on your experience or is it just an assumption?
I only have anecdotes, but it does not reflect your claims, rather the exact opposite.
A lot of the boilerplate code doesn’t need to be type annotated, but annotating the main business logic doesn’t take more time and is not more complicated, but instead type annotations help write code that is more clear, more obvious, and it adds some kind of documentation.
by sixhobbits | 2025-12-27 09:54:02+00:00
I have time machine and just let them fly with --dangerously-skip-permissions on my Mac. Worst thing it's done is back up a database, delete the database, and then run git clean locally which also wiped out the backup, so I'm not saying there are no dangers but honestly I've made worse mistakes and probably more frequently so I generally trust Claude with about the same level of access as me now.

Most common is deleting files etc but if you're using git and have backups it's barely noticeable
by drunx | 2025-12-27 09:54:10+00:00
Alastair is on my S tier for sci-fi. Read so much of him. But didn't read Eversion. Adding it!

In your reading journey, which other authors/books have similar grand space scale as how Alastair writes? I mean, there are a lot, I know, but some overdo it and others oversimplify it. I find Alastair striking perfect balance of being "hardcore" in a way, but still making sense:)
by hopelite | 2025-12-27 09:56:34+00:00
That is an aspect I had not considered in my assumptions that AI/robots will eventually go through the same/similar social justice process as all the other causes, i.e., women’s suffrage, racial equality, gay rights, etc. because it will ultimately and, arguably, more than all the other prior social justice causes célèbres, serve the ruling class that has risen to dominate through social justice causes far more than anything prior.

It’s going to be interesting to see the state propaganda against the bigots and evil bioists (or whatever the word smithing apparatchiks will devise) so want to bar the full equality in society of AI/robots who look just like you and me after all and also just want equal rights to love each other, and who are you to oppose others since we are all just individuals?

Shoot the messenger all you want, but it’s coming.
by aebtebeten | 2025-12-27 09:57:02+00:00
In games where any given strategy is potentially exploitable, I guess the meta is (a) rapidly decide if you're playing against a fish, or if you are the fish; then (b) if against a fish, exploit their strat, or (c) if you are the fish, run a mixed strat, to at least avoid yours being exploitable.

Bottom box as primordial "third person" would go along with egolessness in various traditions (including 李小龙's "be water, my friend")?

Note that solidarity from roman law was directly taken up by civil codes, but HN's home country is a common law jurisdiction: https://en.wikipedia.org/wiki/List_of_national_legal_systems...

("joint and several liability" seems to cover passive, but not active, solidarity?)
by realitydrift | 2025-12-27 10:01:23+00:00
The lack of visible timestamps feels small, but it actually creates a subtle fidelity problem. Conversations imply continuity that may not exist. Minutes, hours, or days collapse into the same narrative flow.

When you remove temporal markers, you increase cognitive smoothing and post-hoc rationalization. That’s fine for casual chat, but risky for long-running, reflective, or sensitive threads where timing is part of the meaning.

It’s a minor UI omission with outsized effects on context integrity. In systems that increasingly shape how people think, temporal grounding shouldn’t be optional or hidden in the DOM.
by mcny | 2025-12-27 10:02:26+00:00
Moto g stylus 2025 - Android 15 - metro by T-Mobile stock os

Firefox nightly

148.01a

I'll check for updates

Edit: still broken

148.0a1 (Build #2016134322), 757b8230f44e4152aeb7b9031ff95219471ab993
GV: 148.0a1-20251226204324
AS: 148.20251224050247
OS: Android 15

Edit: also same on OnePlus Nord N30

147.0b7 (Build #2016133535), 455e50920c4926534376b719df4cf1ed714bc61d
GV: 147.0-20251222164020
AS: 147.0
OS: Android 14
by aebtebeten | 2025-12-27 10:05:30+00:00
> The WWW seemed to take over so fast because it was actually delayed ten years and the technology to realize it had been sitting around latent and underutilized.

Not so sure about this point: IIRC modem development was going on in a big way during the initial growth phase of the WWW?

Thanks for the pointer to "Legitimation Crisis"; 'a conflict between "expertise required to make decisions concerning complex science and technology" and "public participation"' sounds like the fundamental problem of anarchism as well.

As for household formation, I think the root lies deeper: take a look at "Democracy in America": https://www.gutenberg.org/files/815/815-h/815-h.htm#link2HCH... ; my experience has been that the voluntary associations described (thus forming a "felt", not a "fabric" of society) are way more alive on this continent than I recall them being, back across the Atlantic in the Old World of America.
by abigail95 | 2025-12-27 10:05:44+00:00
Completely depends on how much you've "mixed in", and facts specific to that individual work.

Fair use doesn't get thrown out the window because GPL authors have a certain worldview.

Second, there are a lot of non-copyrightable components to source code - if you can't copyright it - you certainly can't GPL it. These can be copied freely by anyone at any time.
by Lio | 2025-12-27 10:07:58+00:00
The problem I see with low-code is that it lacks static analysis to evaulate type usage before runtime and, I don't think, it has any support for tooling so you can't get method usage information in the editor.

I think that static analysis could be done with an extension to rubocop via Prism though. Same for documention features via Ruby-LSP tooling.

I think if they worked on those they would very quickly pick up support as the syntax is quite nice.

Until then I think that Sorbet, possibly using RBS-Inline, is probably the best solution. I'd give a notable second to YARD annotations and Solargraph. Solargraph is a much underated project IMHO.
by ACCount37 | 2025-12-27 10:08:37+00:00
There's a lot of indications that robotics AI is in a data-starved regime - which means that future models are likely to attain better 0-shot performance, solve more issues in-context, generalize better, require less task-specific training, and be more robust.

But it seems like a degree of "RL in real life" is nigh-inevitable - imitation learning only gets you this far. Kind of like RLVR is nigh-inevitable for high LLM performance on agentic tasks, and for many of the same reasons.
by andy12_ | 2025-12-27 10:09:37+00:00
If you were capable of time travel and you could go to the past and convince world government of the evil oil and gas industries, and that their expansion should be prevented, would you have done it? Would you have prevented the technological and sociatal advances that came from oil and gas to avoid their ecological consequences?

If you answer yes, I don't think we can agree on anything. If you answer no, I think you are a hypocrite.
by godelski | 2025-12-27 10:11:20+00:00
> The gold-medal task is to hang an inside-out dress shirt, after turning it right-side-in, which we do not believe our current robot can do physically, because the gripper is too wide to fit inside the sleeve

You don't need to fit inside the sleeve to turn it inside out...

Think about a sock (same principle will apply, but easier to visualize). You scrunch up the sock so it's like a disk. Then you pull to invert.

This can be done with any piece of clothing. It's something I do frequently because it's often easier (I turn all my clothes inside out before washing).
by ajb | 2025-12-27 10:11:32+00:00
Those seem to be for drywall. The strongest option is using resin to install some threaded rod, eg fis-v which is rated to 43kgf (shear load) in the lower of the two rated aircrete classes. That's because it spreads through the holes and therefore has a larger surface area of interface. The downside is that it's not removable.
by officialchicken | 2025-12-27 10:13:40+00:00
Not only that, but the symptoms for hypoglycemia do change over your life, so that what is felt today (e.g. excessive sweating, blurred vision) may be totally different in the future (e.g. confusion, tingling thighs). Or you lose that sense of feeling entirely and never notice a problem until it's way too late to easily remedy.
by Thorrez | 2025-12-27 10:15:05+00:00
I believe in CA, the reason for pulling out is that CA limits the amount the companies can increase premiums[1]. So less crashes is one way to bring them back. Allowing them to increase premiums more is another way to bring them back.

[1] https://old.reddit.com/r/explainlikeimfive/comments/1c7lm5b/...
by jcgl | 2025-12-27 10:15:20+00:00
This doesn’t track for me. How can text have lower bandwidth but higher meaning-per-bit? How does that jibe with entropy resistance (in an information theoretic sense)?

Text seems worse to me. First of all, binary encodings are a superset of text encodings. But less abstractly, binary enables content-transparent compression and error correction.

Like other commenters have pointed out, the downside of binary is needing sufficient tooling. Depending on the domain, that can indeed be a downside. But if that critique isn’t relevant for a given context, it’s extremely unlikely that plaintext (ASCII?) is superior.

Text seems more like the answer to a plea for lowest common denominator of tooling.
by geon | 2025-12-27 10:18:44+00:00
To get a commit history that makes sense. It’s not supposed to document in what order you did the work, but why and how a change was made. when I’m knee deep in some rewrite and realize I should have changed something else first, I can just go do that change, then come back and rebase.

And in the feature branches/merge requests, I don’t merge, only rebase. Rebasing should be the default workflow. Merging adds so many problems for no good reason.

There are use cases for merging, but not as the normal workflow.
by binaryturtle | 2025-12-27 10:20:14+00:00
I fully agree. It's not only the waste of time when you have to confirm you're a human (that adds up to multiple hours per month).

It's also the entire blockage of older or less mainstream systems that no longer can access, sometimes critical, websites at all when the Cloudflare check blocks things entirely because the "browser is out of date" or not on their whitelist. Therefore causing excessive discrimination of poorer folks that can't afford upgrading to never/ other systems that still are legible to pass Cloudflare's "grace".
by uplifter | 2025-12-27 10:21:45+00:00
> how to square the idea that evolution produces knowledge with the idea that it doesn't optimize even for reproductive fitness

Its really fairly simply: natural selection requires two things: heritable genetics and a source of variation in the genetics between individuals. Mutation is the most basic source of variation, and that produces new information. But new information isn't necessarily knowledge. Assuming a scientific testing gloss, each new genetic code variation X can be considered as a hypothesis, that "variant X is fit", and then natural selection events that act on copies of X (for or against) serve as experiments testing the hypothesis. Through iterative experiments, we weed out the copies of the variants where the hypothesis of them being fit was proved by natural selection to be false, and what remains should be those copies of genetic variants which have (mostly) proven to be true. Learning and understanding which variants are fit (where the hypotheses are true) is knowledge, and in this way evolution produces knowledge while not having any optimization goal (in the intent sense, which I agree is a requirement for something to be meaningfully "optimizing" anything, because you can't aim in a direction without a sense for that direction).
by adrian17 | 2025-12-27 10:22:26+00:00
It's more complex and heavier than using uv. I see docker/vm/vagrant/etc as something as something I reach for when the environment I want is too big, too fancy or too nondeterministic to manually set up locally; but the entire point is that "plain Python with some dependencies" really shouldn't qualify as any of these (just like build environment for a random Rust library).

Also, what do you do when you want your to locally test your codebase across many Python versions? Do you keep track of several different containers? If you start writing some tool to wrap that, you're back at square one.
by jomcgi | 2025-12-27 10:22:42+00:00
I have a web ui for managing / interacting with opencode sessions.
Everything runs as a pod in my homelab cluster so I can let them "bypass" permissions and just restrict the pods.

I wanted something like Claude code web with access to more models / local LLMs / my monorepo tooling, so far it's been great.

The output is a PR so it's hard for it to break anything.

The biggest benefit is probably that it makes it easier to start stuff when I'm out - feels like a much better use of downtime like I'm not waiting to get home to start a session after I have an idea.

The monorepo tooling is a bit win too, for a bunch of things I just have 1 way to do it and clear instructions for them to use the binaries that get bundled into new sessions so it gets things "right" more often.
by gt0 | 2025-12-27 10:22:45+00:00
Swift is probably less than 1% of the what it takes to run iPhone apps, you can get Swift for Windows too, but it is nowhere near able to run iPhone apps. The problem is all the libraries an iPhone app expects to be available on the host OS, all the multimedia stuff and so on, those libraries on iPhone are large and advanced, and not available for porting to any OS outside of Apple.
by kiicia | 2025-12-27 10:24:27+00:00
MP4 is container, not format, so if you have unsupported format packed into MP4 container it won’t be played. Example is trying to play AV1 video codec on devices with M2 chip or older. It won’t play. But it will play on devices with M3 chip and newer. Easiest solution is to use other player so that you can watch any MP4 file but with software decoding where hardware decoding is not available. Examples of such players are MPV or VLC.
by ggm | 2025-12-27 10:25:06+00:00
I am drawn to Upton Sinclair's quote "It is difficult to get a man to understand something when his salary depends on his not understanding it"

Because very few incumbents with expenditure controls have a motivation to alter the trajectory of US military capital investment.

I do not like this articles use of "it is certain" regarding a drone attack inside continental USA. It's certainly a risk. Not much else is certain.
by eviks | 2025-12-27 10:26:08+00:00
Yeah, no, that's a pale imitation that only addresses the one specific example given. But, like, how would you even know what target formats are supported? Break the flow and look it up or simply read the drop-down list?
The free type-any-text interface with poor helpers is the worst in accessibility

Which format is the default if no argument is given?

Or more complicated contextual knowledge - if you cut 1sec of a video file, does fish autocomplete to tell you whether the video is reencoded or cut (otherwise) losslessly

Also, what does fish complete to on Windows?
Show HN: Snapalabra – A daily exercise for learning new vocabulary
by detectivestory | 2025-12-27 10:26:10+00:00
Disclaimer: This is not a language course and it will not bring you to full fluency. Please join a class if you are serious about learning a new language, and do not count on any app for fluency.

However, this will act as a great supplementary tool in your language learning journey. The concept is simple: describe a new image in your target language each day. That's pretty much it.

The app provides some helpful features to assist in your learning. There are clues mapped to the image, some LLM feedback (if you are into that), and it generates some smart flashcards based on your spelling mistakes.

App Store: https://apps.apple.com/us/app/snapalabra/id6747401847

Google Play: https://play.google.com/store/apps/details?id=com.whatever55...
by adrian_b | 2025-12-27 10:26:38+00:00
I use a Dvorak-based layout on Qwerty keyboards, so in normal usage they could as well have blank keycaps.

Despite that, the Qwerty keycaps remain useful for me, because my keyboards are not programmable, so the key mapping is done by the operating system. When I have to unlock the computer with a password, after booting, the keyboard still works as Qwerty and the keycaps help me in entering the password, because nowadays I touch-type only on Dvorak, while on Qwerty I must return to hunt-and-peck, as there are many years since I stopped using Qwerty.

So only because of this password entering, I prefer to not have blank keycaps, even if I ignore them in normal usage.
by dvdarkin | 2025-12-27 10:27:23+00:00
Economics at times gets dismissed as pseudo-science. The criticism isn't 100% wrong - macro models fail to predict recessions, policy prescriptions conflict, economists famously disagree about everything. When people hate economics, they're hating the outputs - the semi-working modelling of complex reality, but not engaging with the tools that economists actually use. Opportunity cost isn't a model as such, it's a thinking tool: "What's the next-best use of this resource?" That operation remains valuable whether or not any particular economic model works. Comparative advantage, marginal thinking, stock-flow distinctions, mechanism design - all of these are lenses to look at reality that transfer to problems far outside economics.

So I used Claude to extract the tools from economics domain and then realized the pattern applied everywhere. This became a project: 32 domains, 450+ reasoning tools. Bayesian statistics, system dynamics, operations research, evolutionary biology, classical rhetoric, military strategy and 26 others.

The extraction principle: separate the mental operations from the domain-specific content. Keep the moves that survive even when the specific models fail.

Each tool follows the same structure: what it is, why it matters, the key mental move, where it originated, where it surprisingly transfers, how it fails when misapplied, and where to go deeper.

These tools are now published on GitHub: https://github.com/dvdarkin/reasoning-tools packaged and ready for use as a knowledgebase with metadata, original extraction prompt and navigational structure.

There are more domains in the pipeline, which hold their own thinking primitives, not as easily transferrable perhaps, but maybe worth doing later.

Pls let me know if you find this useful, share your criticism, or submit a PR.