MurphyA/hacker-news huggingface dataset:
by jader201 | 2025-12-15 07:14:02+00:00
> Why should your preferences impose on the ones that don't want what you want?

The problem is that I can’t have my preference: a TV that comes without (non-essential) software installed.

This means I have no choice but to deal with required updates — or at the very least, an annoying reminder that software updates are needed — for software I never wanted in the first place.

If the software was optional — could be uninstalled, or disabled so that updates weren’t required — then I would agree with you that having all TVs be smart TVs would be fine.

But not only is it not optional, it often comes with dark patterns of imposed privacy violations and/or unwanted ads.

The OP’s solution is to “jailbreak” it with a Linux install, which the average consumer doesn’t know how to do.

Again, is fine for hackers that want to tinker with things, but the whole point of the linked article is that many people are tired of smart TVs and the annoyances that come with them.
by cyberax | 2025-12-15 07:14:07+00:00
> That’s not on the file system though.

They are. In `~/.aws/cli/cache` and `~/.aws/sso/cache`. AWS doesn't do anything particularly secure with its keys. And none of the AWS client libraries are designed for the separation of the key material and the application code.

I also don't think it's even possible to use the commonly available TPMs or Apple's Secure Enclave for hardware-assisted signatures.

> 8 hours is usually long enough. And in the case of this specific attack, 8 hours would have been sufficient given the attacker probed AWS while the German team were asleep.

They could have just waited a bit. 8 hours does not materially change anything, the credential is still long-lived enough.

I love SSO and OIDC but the AWS tooling for them is... not great. In particular, they have poor support for observability. A user can legitimately have multiple parallel sessions, and it's more difficult to parse the CloudTrail. And revocation is done by essentially pushing the policy to prohibit all the keys that are older than some timestamp. Static credentials are easier to manage.

> In practice this never happens (attacks proxying) in the wild. But you’re right that might be another countermeasure they employ one day.

If I remember correctly, LastPass (or was it Okta?) was hacked by an attacker spying on the RAM of the process that had credentials.

And if you look at the timeline, the attack took only minutes to do. It clearly was automated.

I tried to wargame some scenarios for hardware-based security, but I don't think it's feasible at all. If you (as a developer) have access to some AWS system, then the attacker running code on your behalf can also trivially get it.
by eimrine | 2025-12-15 07:14:18+00:00
My Ukrainian town used to have 3 libraries. Now the only library here is a school one. The reason so much libraries have got destroyed is the censourship. Now Ukrainian govt makes some active progress into censourship of anything printed by Russian language. Since most of the books accumulated for dozens of years were not yet prohibited but definitely unwanted - now I have no libraries at all.

I am very happy to hear that old and cool libraries are still a thing somewhere.

I use to teach local kids how to get pirated books with no DRM but I have a feeling that they will never use my recommendation. They just open their first page with no animated pictures and get lost immediately, their eyes are not even moving through the text in a proper way. They look to me like when I see some new musical instrument which I can not play because I have not observed it earlier.
by cookiengineer | 2025-12-15 07:17:27+00:00
> They argue that SIM card regulation could help “disincentivise” online manipulation, and say their tool can be used to test policy interventions the world over.

In Germany, you have to give ISP customer providers (help centers) a copy of your passport ID in a live video stream to authenticate. That was introduced since 2013, for all SIM registrations.

So explain to me, again, how did this help reduce botnet traffic from Russia that uses proxy services of third parties that installed their proxy backdoors in free apps on the PlayStore under the disguise of marketing and advertisement?

I don't understand why Google does not get any critique for allowing so much malware to be officially deployed via their PlayStore? They don't give a damn, have a history of not caring, and are the only point in the supply chain that is the problem. Every service provider that offers residential proxies is using those backdoors, and bought access for it from the advertisement companies.

If you report their Malware or Spamware, they ignore it. Try it, you will be disappointed. Because AdMob and other agencies are their customers. It's the same problem with Microsoft hosting Azure tenants that do spamming, sorry, "marketing campaigns".

Source: I track these companies and their rotating ASNs with zero tolerance for spam. [1]

[1] https://github.com/cookiengineer/antispam
by mutkach | 2025-12-15 07:19:00+00:00
Before Church there was Peano, and before Peano there was Grassmann

> It is rather well-known, through Peano's own acknowledgement, that Peano […] made extensive use of Grassmann's work in his development of the axioms. It is not so well-known that Grassmann had essentially the characterization of the set of all integers, now customary in texts of modern algebra, that it forms an ordered integral domain in which each set of positive elements has a least member. […] [Grassmann's book] was probably the first serious and rather successful attempt to put numbers on a more or less axiomatic basis.
by maxbond | 2025-12-15 07:20:48+00:00
I don't know if it's real any better than you but they do seem to acknowledge that.

> This is the first time I've had any issues with yolo mode and I've been doing it for as long as it's been available in these coding tool

https://www.reddit.com/r/ClaudeAI/comments/1pgxckk/comment/n...

I don't know what else "yolo mode" would be.
I realized bad lighting is quietly hurting productivity (and no one measures it)
by emmasuntech | 2025-12-15 07:21:41+00:00
We spend a lot of time optimizing tools: keyboards, monitors, IDEs, latency, ergonomics.

But recently I noticed something odd — lighting almost never gets the same level of attention, even though it directly affects focus, fatigue, and decision-making.

I ran a small personal experiment while working long hours:

Removed the main overhead light

Used fewer, lower-intensity, indirect light sources

Let some areas stay intentionally dark

The result wasn’t just “more comfortable” — my working behavior changed:

Less eye fatigue late at night

Longer uninterrupted focus blocks

Fewer impulsive context switches

What surprised me is that most productivity advice assumes “more visibility = better”, while human perception seems to work the opposite way: contrast, shadow, and restraint improve clarity.

It made me wonder:

Why don’t we treat lighting like we treat typography or UI hierarchy?

Why are there almost no tools that measure lighting quality for work, beyond raw lux?

Is lighting an invisible variable in productivity that startups are ignoring?

Curious if others here have noticed similar effects — or if this is just a placebo I’m falling for.
by sersi | 2025-12-15 07:21:42+00:00
Exactly, I have friends from other countries. Friends I really like, I would not give a VPN access to my internet connection to most of them. They have to be the perfect intersection of technically competent (so that their computer doesn't get turned into a botnet) and fully trustworthy.

I do actually give VPN access to my mother that is not technically competent but I have full access to her computer and locked her down as much as possible
by victorbjorklund | 2025-12-15 07:22:05+00:00
It does lead to people loosing their job. If you have a pile of dirt that needs 3 people to move it with buckets but now 1 person can move the same pile with a wheelbarrow then the 2 others are out of a job.

Same as when one developer with AI can do the job of 3 developers and the other 2 are fired.
by Prcmaker | 2025-12-15 07:22:33+00:00
Currently doing the finishing touches on a ww2 era surface grinder, closing out a new little design, and ramping my fitness up again. Next up is some duct work, some reverse engineering, and finishing my part of a paper.

I haven't had this much time off in over a decade and it's amazing. I've been hoping to get inspire for some outdoors or running related mechanical design/prototyping projects, but nothing yet.
by delis-thumbs-7e | 2025-12-15 07:24:12+00:00
>or people could just start to realize that [A] is [B] and stop [C] it.

Possible values for A = heroin, alcohol, tobacco, weed, porn, TV… B = addictive, causes cancer, has an effect on brain health, spreads HIV… C = using, consuming, eating, injecting…

Seems that this “people realizing” does not seem to work with other highly addictive chemicals or electronic media, since healing oneself from addiction requires far more than just “realizing” it is bad for you and the society. Perhaps there is a reason why we limit by law the sale of tobacco, drugs, alcohol and other highly addictive substances.
by amluto | 2025-12-15 07:25:24+00:00
>> The security failure is in an ecosystem that allows packages to run arbitrary code silently.

> No, your security failure is that you use a package manager that allows third-parties push arbitrary code into your product with no oversight.

How about both? It’s conceptually straightforward to build a language in which code cannot do anything other than read its inputs, consume resources, and produce correctly typed output.

This would not fully solve the supply chain problem — malicious code could produce maliciously incorrect output or exploit side channels, but the exposure would be much, much less than it is now.
by Dylan16807 | 2025-12-15 07:25:40+00:00
The doxxing listed here is saying a person's first name? I think? Maybe former name? This is hard to follow. It's so deep in arguing about arguing that I can't tell if he's a 1/10 problem or a 9/10 problem.

I probably missed some of the cross links but this is a mess.

Can you elaborate on "harassing trans people"? From these links at best I can guess at one of them being trans but I can't tell if that's related to the argument; who else is on that list?
by jigsawdesigner | 2025-12-15 07:26:26+00:00
Hi HN! I'm the developer of Jigsaw Designer.

I built this because I saw how painful it was for makers to manually draw puzzle paths in Illustrator/Inkscape—it literally takes hours to get the interlocking tabs right. I wanted a tool that could do this in seconds.

Tech Stack: It's a native macOS/iPadOS app written in Swift and C++.

Core Algorithm: The puzzle generation is powered by a custom C++ engine using Voronoi diagrams and Bezier optimization to create organic, non-repetitive shapes. Rendering: Highly optimized generic C++ geometry converted to native SVG paths. Output: The generated SVGs are strictly optimized for laser cutters (LightBurn, Glowforge) with clean, continuous paths to minimize cutting time. I'd love to hear your feedback, especially if you are into laser cutting or puzzle design! Happy to answer any technical questions.
by johntiger1 | 2025-12-15 07:26:36+00:00
https://bobalearn.org/

Site where you can read and generate graded Chinese stories, in order to learn Chinese. What's a graded story? It's one written with the vocab of a {X} year old. Words are often repeated, so that you can learn from the left-and-right context. I normally pay for book versions of these, so I thought, why not make one that's online and free?
by lylo | 2025-12-15 07:26:50+00:00
Pagecord!

An independent blogging and personal website builder. Source available (Ruby on Rails).

It’s not a novel idea but it’s gaining decent traction because it’s simple and (I think!) makes you want to write more. Which is basically why I built it.

Blog by email, custom domains, internal private analytics, theming and more!

Free forever plan, or only $29/yr for everything. Priced as I think personal/blogging sites should be. Everything is too expensive these days.

https://pagecord.com
by KingMob | 2025-12-15 07:27:21+00:00
Yes, it's the same MST3K as always, honestly. Some great episodes, some weak ones, etc. Everyone's good.

IIRC, they might have been crowdfunding for a fourth new season, but they ran into some major issues with getting backers their rewards on the last one, and I think that made a lot of fans reluctant.
by TacticalCoder | 2025-12-15 07:27:23+00:00
> Currently, I have my ssh key on the laptop ...

My SSH keys aren't on my computer: they're safely hidden on a hardware token, behind a secure element, like a Yubikey.

Devices like the Yubikey do precisely exist because computers aren't things to be trusted. So their reason for being is to offer a minimal attack surface.

When I git fetch/pull/push I just do it. But it requires me to physically use my Yubikey. It's not 100% foolproof but it's way better than having SSH keys only protected by a password.

So Git over SSH, on a Git/SSH server that supports Yubikeys.
by davedx | 2025-12-15 07:27:43+00:00
I'm working on https://techposts.eu - Hacker News for Europe.

Focused on all the interesting and exciting happenings in tech here, from AI to defence to deeptech, and posting the most interesting job openings too. Did you know Europe had two space launch startups? I didn't until I started this project!

Feedback very welcome :)
by tigranbs | 2025-12-15 07:28:04+00:00
This is definitely not applicable to every app, BUT that's a very clever way of solving UX problems with "face"- based animations and expressions, giving users feedback. At the same time, you do stuff in the background. I have seen this for the first time in the Airbnb apps, but only in 1-2 cases, and they use Lottie animations, not directly tied to UI events.
by davidoniumz | 2025-12-15 07:28:16+00:00
I am working on a little browser extension to copy github pull requests into the clipboard to share them in chat apps for reviews. I am used to manually ping people with the link and found that having the pr title and the link format github uses makes it easier for people to understand what they are about to review, and potentially makes for a quicker review :).

https://chromewebstore.google.com/detail/github-pr-pretty-li...
by stevefan1999 | 2025-12-15 07:28:20+00:00
That's not the only stuff you need to manage. Having a system level sandbox is all about limiting the physical scope (the term physical in terms of interacting with the system using shell and syscalls) of stuff that the LLM agent could reach, but what about the logical scope that it could reach too, before you pass it to the physical scope? e.g. git branch/commit, npm run build, kubectl apply, or psql to run scripts that truncate your sql table or delete the database. Those are not easily controllable since they are concrete with contextual details.
by TZubiri | 2025-12-15 07:28:27+00:00
Here's me making a similar argument a month or so ago

https://news.ycombinator.com/item?id=45926849

Besides the political implications, I think we should try to find an objective taxonomy, it's clear that privacy VPNs and network security VPNs are different products semantically, commercially and legally, even if the same core tech is used.

Possibly the configuration and network topology is different even, making it a technically different product, similar to how a DNS might be either an authorative server for a TLD, an ISP proxy for an end user, a consumer blacklist like pihole, or an industrial blacklist like spamhaus. It would be a non trivial mistake to conflate any pair of those and bring one up in an argument that refers to the other.
by drysine | 2025-12-15 07:29:01+00:00
"The illusory truth effect (also known as the illusion of truth effect, validity effect, truth effect, or the reiteration effect) is the tendency to believe false information to be correct after repeated exposure." [0]

And even if that's not another boring propaganda operation, what would you be telling if you went to fight on Russian side and got captured by the Ukrainians? "Please, please, please don't hurt me, they made me do it, I went to Russia to do sports and they send me to the frontline".

[0] https://en.wikipedia.org/wiki/Illusory_truth_effect
by cachvico | 2025-12-15 07:30:06+00:00
https://pistepal.app/ - a ski map app - built at breakneck speed over the last few months. I believe this is the only ski map app that offers turn-by-turn navigation!

Screenshots in the App Stores, e.g. https://apps.apple.com/us/app/pistepal/id6754510927

Still a little bit rough around the edges but hopefully will be / is in decent enough shape for the start of the ski season (just about happening now..)

Currently figuring out the right balance of free tier & daily trial. Priced at $10/month and therefore significantly undercutting the competition, hopefully this is enough to gain entry into the market. (May need a more generous daily trial though, admittedly 10 minutes is not really enough to actually try it out on the mountain).

Seems ad spend is necessary to get any kind of traction...

Feedback welcome!
by darkwater | 2025-12-15 07:31:41+00:00
Vorwerk makes really good hardware and home appliances. Its only negative part is the almost pyramidal sales style. It's not really pyramidal as in the scam, because you actually buy something and you don't need to become a seller, but it uses "regular housewives" [1] as sellers.

[1] at least 30 years ago, now many of them do also another paid work (not Vorwerk-related) on top of unpaid house chores.
by alin23 | 2025-12-15 07:32:07+00:00
Author here, I was mostly referring to the practice of coating the wood in a layer of smooth plastic that makes the wood not feel and look like wood anymore. It's like something that you want to keep encased forever.

I'm of the same opinion as you, drying oil polymers are still plastic, it's just that their method of curing makes them look better on wood, most likely because of the very thin layer that remains at the surface, but also because of the polymer surface texture.

Every epoxy resin, even the more penetrant ones, end up looking like plastic on wood, not sure how else to describe it.

But in terms of chemistry, food safety and how inert they are, they are indistinguishable.

I'm also aware mineral oil is food safe, I was trying to say that it will leak into the hot food and not stay in the wood fibers, which renders the finish useless after just one use.
by hulitu | 2025-12-15 07:32:34+00:00
> The Typeframe PX-88 Portable Computing System

So it is a Raspberry Pi 4 c with 2 microHDMI and a strange keyboard. You need an adapter to connect it to a monitor or TV. Oh, no. It has a very small touch screen as a display.

I'm sure gnome-session will look great on it.
by emptybits | 2025-12-15 07:33:06+00:00
I really appreciated the explanation of what proteins are, in simple terms. I assume (?) it's accurate enough for a layperson.

And I do love the optimism.

But then you must admit this reads like a B-movie intro:

Then AI companies showed up in 2020 and said "we got this" and solved it in an afternoon. ... We're playing God with molecules and it's working.
by dijit | 2025-12-15 07:34:03+00:00
I understand what you mean, but it does match MBA/mckinsey thinking very closely.

Make a metric a goal, work tirelessly towards that new metric.

Does it make the product better? Well, the product is already made- so it doesn’t make a difference.

It’s only software developers who think a product is never “done”- normal MBA thinking is “we have invested in R&D, now there is a product, how do we get as many users of our product as possible”.
by lil-lugger | 2025-12-15 07:34:39+00:00
AI coding IS SaaS. Claude Code is a subscription service I pay to create the exact, niche, I need you to build a form that submits a blog post to Wordpress here’s my api key, here’s the word doc format it comes in, I’ll paste it in the chat and you make a paste from word button so I don’t have to manually enter the form and it works first try. That is the definition of software as a service. And it’s mine and it’s exactly what I need. Tomorrow I’ll need something else…
by ineedasername | 2025-12-15 07:35:35+00:00
Really? We've had easy widespread access to turnkey agentic coding since:

-Feb Claude code

-April OpenAI Codex

-June Gemini Code

And that's not even accounting for the "1 prompt to build your saas business" services popping up.

This isn't Fermi paradox territory, it's just lightspeed lag time.

Take breath. Brace yourselves. The shovelware will be here soon enough.

And SWE's? Take heart. The more there is, the more the difference in quality will be easily seen between giving a power tool to a hobbyist and giving it to an expert that knows their craft.
by wtcactus | 2025-12-15 07:36:43+00:00
In a world where many western states extort their subjects for almost half the wealth they produce (OECD average is 34% and in countries like France the state extorts 46% of all GDP in taxes and other mandatory contributions and an insane 82% of all gross salary), some people first thought when they think of AI, is: “but how are we going to tax it?”.

People on the left love to say “true communism has never been tried”.

Well, when you live in a world where supposed capitalist countries forcibly take 46% of the GDP to be controlled by the government, it’s more accurate to state that “true capitalism has never been tried”.

https://en.wikipedia.org/wiki/Taxation_in_France
by jader201 | 2025-12-15 07:37:33+00:00
The common solution is to just buy the cheapest Roborock that does a great job at vacuuming, even if it has a mop (that you never have to use).

I got a Q7 M5+ for this exact reason, for $265 shipped. (And yes, that includes a self-emptying bin.)

For the vacuum function, it seemed to be highly rated.
by simonjgreen | 2025-12-15 07:38:01+00:00
This is the cost of complacency. They were ahead for so long then the likes of Roborock just left them in the dirt. I remember the first time I tried one of the Roborock devices, and until then I have been a long time Roomba user (like, 20 years). I just couldn’t believe how much better it was. And iRobot just stubbornly refused to iterate on their fundamental products.
by procaryote | 2025-12-15 07:38:38+00:00
The raspberry pico is much nicer to work with, if you're looking for an alternative. It has dual core if you need it, and the fun little IO coprocessors if you want to get really low level. The pico2 even has a risc-v mode

The process of getting a binary onto the board is just dragging a file, and on linux at least you can script it with picotool
by bigcloud1299 | 2025-12-15 07:38:41+00:00
I have built a AI powered home improvement platform with live consultation with pros.

I am not sure if I will go live with it.

It allows those professionals experts across the USA provide help to Do It yourself consumers for a fee. Consumers can be anywhere.

So I married sort of like Uber (rent skills) + upwork (rent + fees) + FaceTime + e-commerce. realtime audio transcription that identifies parts you need and builds a list for pros and you to review which you then go shop.

: Meet Handy — AI + Live Experts for Every Fix.

: Instant, intelligent home-improvement help — see it, solve it, and shop for it, all in one live session.

Live Video Calls with Pros Instantly connect with verified experts via real-time video. No scheduling hassle — just point your camera and get help.

AI-Powered Visual Assistance HandyLens AI analyzes what the camera sees, highlights problem areas, and guides both consumer and pro with contextual prompts.

Domain Expertise Specialized AI Packs (Plumbing, Electrical, HVAC, Painting, etc.) ensure every session applies the right technical and safety knowledge.

Actionable Fix Path Each call ends with a clear, AI-generated “Fix Report”: what to do, parts needed, and next steps.

Commerce & Trust Built-In Integrates with retailer catalogs for instant part links, and captures verified pro ratings and summaries for quality assurance.