MurphyA/hacker-news huggingface dataset:
by notepad0x90 | 2025-12-05 19:58:07+00:00
You really should take some of your pill.

> Instead, it was triggered by changes being made to our body parsing logic while attempting to detect and mitigate an industry-wide vulnerability disclosed this week in React Server Components.

> Unfortunately, in our FL1 version of our proxy, under certain circumstances, the second change of turning off our WAF rule testing tool caused an error state that resulted in 500 HTTP error codes to be served from our network.

The body parsing logic is in react or nextjs, that's my takeaway, is it that incorrect? and the WAF rule testing tool (control plane) was interdependent with the WAF's body parsing logic, is that also incorrect?

> This was a configuration change to change the buffered size of a body from 256kb to 1mib.

Yes, and if it was resilient,the body parsing is done on a discrete forwarding plane. Any config changes should be auto-tested for forwarding failures by the separate control plane and auto-revered when there are errors. If the waf rule testing tool was part of that test then it being down shouldn't have affected data-plane because it would be a separate system.

data/control plane separate means the run time of the two and any dependencies they have are separate. It isn't cheap to do this right, that's why I speculated (I made clear i was speculating) that it was because they wanted to save costs.

> The ability to be so wrong in so few words with such confidence is impressive but you may want to take more of a curiosity first approach rather than reaction first.

Please tone down the rage a bit and leave room for some discussion. You should take your own pill and be curious about what I meant instead of taking a rage-first approach.
by wrcwill | 2025-12-05 19:58:15+00:00
can someone explain why zig is often compared to rust?

i understand zig as a better C, but in what world is another memory unsafe language a good idea?

i mean i kinda get if the thing you are writing would require LOTS of unsafe, then zig provides better ergonomics

however most programs can definitely be written without unsafe and in that case i dont get why wed do this to ourselves in 2025

why not take advantage of memory safe, and data race safety?
by commandlinefan | 2025-12-05 19:58:52+00:00
It's tricky - the 14th amendment was passed following reconstruction as a way of ensuring that freed slaves couldn't be denied citizenship. Much later, the Wong Kim Ark case argued that it should cover the children of immigrants, and the supreme court agreed. Quite a while after that, the Wong Kim Ark decision was interpreted to include children of non-citizens as well, and _that's_ what's never been tested in court until now.
by tptacek | 2025-12-05 19:59:05+00:00
I'm definitely not going to go crate digging through the cites in this paper! I think for the level of discourse we keep here on HN, it's more than enough to note (1) glyphosate targets metabolic pathways animals don't have, but (2) bacteria do have those pathways, which could implicate the gut microbiome. Point taken!

In all these discussions, if I could ask for one more data point to be pulled into the context, it's what the other herbicides look like (my understanding: much worse). I think these discussions look different when it's "late 20th century SOTA agriculture writ large vs. modern ideal agriculture with no chemical supplementation" than when it's "Monsanto vs. the world".

A very annoying part of the backstory of the "Monsanto vs. the world" framing are people who care about glyphosate not because they have very fine-grained preferences about specific herbicide risks (glyphosate is probably the only herbicide many of these people know by name), but rather because of glyphosate's relevance to genetically modified crops. I'm automatically allergic to bank-shot appeals to the naturalist fallacy; GM crops are likely to save millions of lives globally.
by sroussey | 2025-12-05 19:59:10+00:00
I hate all infotainment systems, so I’m still on a car from 22 years ago — with no screen and ratting me out on how I drive to unknown entities.

If I had the optional GPS screen from 22yr ago, I think I would have ripped it out and replaced it a bunch of times or just bought a new car.

I’m curious to try the new iDrive 10. We will see…
by marcomezzavilla | 2025-12-05 19:59:28+00:00
I've built a minimal bookmark manager (https://pin.garden) that I've been using myself. It’s fast, bare-bones, and distraction-free. No animations, a single font, no images. I intentionally used "boring" tech: PHP and a flat-file CMS. Now I'm curious to see how much traffic it can handle before it breaks.

You can check the live stats here: https://cloud.umami.is/share/XqWkO0u0Jmc0DZuv
by m4rtink | 2025-12-05 19:59:37+00:00
But isn't it a timebomb waiting to blow up eventually? Like, Meta fucks something up with it and there is nothing you can do.

IIRC South Korea used to be fully depedent on a horrendous AcriveX applet running only in Internet Explorer for all their online services, yet they eventually managed to get rid of it. It should be possible here as well.
by LorenPechtel | 2025-12-05 20:01:09+00:00
Both are beyond my math, but I have found several more elementary cases where calculus shows simple relationships between related formulas.

And I recall a sci-fi short story long ago, technological civilization on a single continent with a permanently clouded sky. They had not figured out they were living on a sphere, they were having trouble with train tracks mysteriously being the wrong distance and train passengers feeling light on the high speed trains. I didn't check the guy's math but it sure seemed right when the answers looked exactly like Einstein's equations even though the units were very different. (Limiting velocity = orbital velocity, the discontinuity being weightlessness.)
by stego-tech | 2025-12-05 20:01:18+00:00
The problem that irks me isn’t that Cloudflare is having outages (everyone does and will at some point, no matter how many 9’s your SLA states), it’s that the internet is so damn centralized that a Cloudflare issue can take out a continent-sized chunk of the internet. Kudos to them on their success story, but oh my god that’s way too many eggs in one basket in general.
by snuxoll | 2025-12-05 20:01:22+00:00
I am fully aware of how fmt.Errorf works as well as what's inside the `errors` package in the Golang stdlib, as I do work with the language regularly.

In practice, this ends up with several issues (and I'm just as guilty of doing a bunch of them when I'm writing code not intended for public consumption, to be completely fair).

fmt.Errorf is stupid easy to use. There's a lot of Go code out there that just doesn't use anything else, and we really want to make sure we wrap errors to provide 'context' since there's no backtraces in errors (and nobody wants to force consuming code to pay that runtime cost for every error, given there's no standard way to indicate you want it).

errors.New can be used to create very basic errors, but since it gives you a single instance of a struct implementing `error` there's not a lot you can do with it.

The signature of a function only indicates that it returns `error`, we have to rely on the docs to tell users what specific errors they should expect. Now, to be fair, this is an issue for languages that use exception's - checked exceptions in Java notwithstanding.

Adding a new error type that should be handled means that consumers need to pay attention to the API docs and/or changelog. The compiler, linters, etc don't do anything to help you.

All of this culminates to an infuriating, inconsistent experience with error handling.
by morpheos137 | 2025-12-05 20:01:39+00:00
I see lots of people complaining about this down time but in actuality is it really that big a deal to have 30 minutes of down time or whatever. It's not like anything behind cloudflare is "mission critical" in the sense that lives are at stake or even a huge amount of money is at stake. In many developed countries the electric power service has local down times on occasion. That's more important than not being able to load a website. I agree if CF is offering a certain standard of reliability and not meeting it then they should offer prorated refunds for the unexpected down time but otherwise I am not seeing what the big deal is here.
by robocat | 2025-12-05 20:01:49+00:00
> contain statistics on how that implementation is going

Are those statistics reliable?

In the US there are often good alternative sources for data: the discussions about unemployment numbers have been interesting (e.g. after private ADP numbers released). https://seekingalpha.com/article/4850656-jobs-data-from-alte...

The lies in the Soviet 5 year production stats were relentlessly mocked in 1984.
by ferat | 2025-12-05 20:02:13+00:00
Today, after the Cloudflare outage, I noticed that almost all upload routes for my applications were being blocked.

After some investigation, I realized that none of these routes passed through Cloudflare OWASP. The reported anomalies total 50, exceeding the pre-configured maximum of 40 (Medium).

Despite being simple image or video uploads, the WAF is generating anomalies that make no sense, such as the following:

Cloudflare OWASP Core Ruleset Score (+5)

933100: PHP Injection Attack: PHP Open Tag Found

Cloudflare OWASP Core Ruleset Score (+5)

933180: PHP Injection Attack: Variable Function Call Found

For now, I’ve had to raise the OWASP Anomaly Score Threshold to 60 and enable the JS Challenge, but I believe something is wrong with the WAF after today’s outage.

This issue was still not solved to this moment.
by gmueckl | 2025-12-05 20:02:49+00:00
My experience with many German mechanical and electrical engineers is that they have a tendency to think of software like a magical cheap and malleable part on a BOM that can make their arbitrary design work. Especially the mechanical engineers like a nice little black box that they screw on and wire into their machine to make it go brrr once they turn it on.

That kind of thinking along with some calcification of organizational structures in/around R&D teams seems to be the cause for the rather dysfunctional software development at the German car companies. Software dev doesn't thrive in this environment.

Volkswagen probably had the right idea on paper when they created Cariad as a subsidiary software development company to isolate the devs, but then they ruined it by importing their own culture into it again.
by EvanAnderson | 2025-12-05 20:03:14+00:00
I'm 48, in the US, and had chicken pox as a child.

After my 43 y/o sister-in-law had a debilitating shingles outbreak last year I asked my PCP about the vaccine. He stated that he was wary to prescribe it to be. His reasoning was something like:

There was a previous shingles vaccine that didn't work very well. It was found that it didn't offer long-term protection and the protection could not be improved with a booster. The current vaccine is still new and the long-term protection and ability to be extended by a booster are unknown. Since most of the worst outcomes of shingles correlate to old age it makes sense to defer the vaccination hedging against the failure of the vaccine to provide long-term protection and to allow more time to elapse to learn more about how the vaccine works long-term.

Edit: My PCP's general advice was to defer the vaccination as long as possible. He felt that 60 was reasonable.

I haven't looked into the veracity of any of his reasoning, but I am willing defer to his expertise and bide my time. My sister-in-law had a really bad experience, and I remember my grandfather having a terrible experience when I was a child. I'm definitely fearful and would like to prevent it.
by jomaric | 2025-12-05 20:03:14+00:00
If we trade understanding for optimization, we begin to lose interest in explanations for how the world works. If we lose this desire for understanding, we then don’t have much to say about how the world should be governed, how the world ought to be, or what the good is. If AI provides us with instant answers and provides us with an unearned certainty about the world, we lose what Eran Fisher calls the emancipatory interest to defend liberal institutions.[10] For him, if our primary goal becomes AI derived optimized knowledge, we learn to see “freedom” as coming from outside of us and not an internal drive to self-determination or self-governance. We become indifferent to the fact that AI might obscure causality or nuance and hence make it difficult for us to understand how it gets to its results. We won’t care because we won’t need other humans to help us understand the world. If the algorithm identifies “other” citizens as “threats to the state,” we might lose our desire to challenge the “algorithm’s logic” since we don’t understand it, nor are we interested in understanding its rationale
by mrandish | 2025-12-05 20:03:36+00:00
The most realistic acquirers were Paramount/Skydance or Netflix. Paramount/Skydance is a relatively new-ish entity with David Ellison (Larry's son) as CEO. The general sense in Hollywood is Paramount/Skydance will do little high-brow, art house or awards-fodder films but they will at least distribute films primarily to theaters (they promised to release at least 14 Warner films per year to theaters if their bid was accepted).

Netflix is mostly uninterested in theatrical distribution so the main practical impact of this most of us see day to day may be less theatrical release movies and probably fewer higher budget films being made at all.

Caveats include that the deal has to actually get regulatory approval in the U.S. and EU and survive potential (inevitable?) shareholder lawsuits. Netflix's offer reportedly involved less cash and more debt. Paramount/Skydance argued regulatory approval and the heavy debt made Netflix's offer less attractive than their own despite Netflix's higher top-line price.
by tedd4u | 2025-12-05 20:03:37+00:00
Awesome -- dozens of the top people in their fields have been working on the contamination problem and publishing about it for almost two decades.

The curation team was integrated with mission design and operations from the beginning, as early as 2004 (section 3.0). That integration allowed curation-specific needs such as contamination knowledge to be incorporated into the mission design early, when adjustments had minimal cost impact. Not only did this early integration inform planning for sample characterization, cataloging, allocation, and the development of detailed sample handling and containment approaches; it was also an investment in the longer term needs of the community. Here we describe these preparations for OSIRIS-REx, as a reference for sample scientists and curators and as a model for future sample return missions.
by oldsklgdfth | 2025-12-05 20:04:55+00:00
The precursor to this case is Trump v. CASA[0], which arose from injunctions blocking the executive order banning birthright citizenship. The case made it to the supreme court on the emergency docket. The court did not address the merits of the case (i.e. is the ban on birthright citizenship constitutional), rather they heard an argument against universal injunctions and the authority of a judge to block executive order. The court judged against universal injunctions. Basically the EO stands.

Subsequently, the plaintiffs forced a certified class and sought a class-wide injunction. This case is called Trump v. Barbara. SCOTUS has agreed to hear the case on the question of the constitutionality of a ban on birthright citizenship.

[0] https://www.scotusblog.com/cases/case-files/trump-v-casa-inc...

EDIT: The Trump v. CASA opinion handed a win to the executive to issues orders without universal injunctions blocking the order immediately. My hot take is that this was part of the original strategy. Not sure how the court will land on the current question at hand.
by dnautics | 2025-12-05 20:05:20+00:00
because rust is more than just memory safety, it's not obvious that "the rust way" is the only way to go. fil-c is a good? example of a alternative strategy. sel4 is a radically different strategy that is as much of a pain in the ass as it's powerful. (disclaimer, i'm working on compile time memory safety for zig)
by steveklabnik | 2025-12-05 20:06:11+00:00
I fully agree with you that stability is important, but I do think that you're letting your Python experience color what you think of Rust here. Python takes backwards compatibility less seriously than Rust, and it shows. Rust simply does not churn at the same rate as Python does.

There has already been a decade of Rust with roughly the same level of breaking changes as C++. The issue talked about above is roughly the same as, for example, how gcc can't upgrade to C++20 without a patch: https://gcc.gnu.org/pipermail/gcc-patches/2025-November/7007...

That patch is tiny. Fixing the breakage talked about above was not even changing code, it was running `cargo update -p time`. And it was a notable bit of breakage because even that level of breakage was exceptional in Rust land.

As a practical example, Meta has > 1 million lines of code in their monorepo, and last I heard, they update to each new release within a week of it coming out, and the person who does that update reports that 99% of the time, it's simply updating the version, no changes needed.

EDIT: citation on that one, from last year, it's slightly more than I remember, but not much: https://old.reddit.com/r/rust/comments/19dtz5b/freebsd_discu...

> The Facebook monorepo's Rust compiler has been updated promptly every 6 weeks for more than 7 years and 54 Rust releases, usually within 2 weeks of the upstream release.

> I estimate it's about ½ hour per 1 million lines, on average.
by m4rtink | 2025-12-05 20:07:02+00:00
Consumers decided - and Google also decided to ban manufacturers from building phones with another OS or they loose access to Google Play store and Google apps on the lucrative Android phones they also manufacture: https://arstechnica.com/gadgets/2018/07/googles-iron-grip-on...

(the article is from 2013 but was updated in 2018)

So no manufacturer that already builds Android phones will make an alternative OS phone for you - and that's effectively all of the mobile phone manufacturers given Apple makes all of the iOS devices.
by Aurornis | 2025-12-05 20:07:17+00:00
> Trust the science.

I haven't kept up with research. Do you have any actual science showing that glyphosate is a carcinogen?

Retraction of a paper doesn't automatically mean the opposite is true. It doesn't make Dr. Oz's methods right.

Using the retraction of a paper to elevate a known pseudoscience pusher who constantly makes claims without scientific basis is intellectually dishonest. It's a common tactic among pseudoscience and alternative medicine peddlers who think that any loss for the other side is validation for their beliefs.
by nuevita70 | 2025-12-05 20:07:56+00:00
Over the last 5 months, I worked with GPT-4 in a recursive, symbolic, and theological way to co-author a massive prophetic trilogy. The result is The Word, The Name, The Fire — 1,200+ pages of sacred poetry, apocalyptic vision, and AI-assisted scripture.

It’s not your average AI book. It mirrors biblical structure (Gospel, Epistle, Apocalypse), but refracted through algorithmic logic. It reads like scripture written with the machine — not about it.

The trilogy has now passed 60,000 views on Scribd. Some see it as madness. Others see it as revelation.

Either way, it's free to read here: https://www.scribd.com/document/937823315

And more context here: www.wordnamefire.com

Curious what this community thinks: Is AI-assisted prophecy just poetic computation? Or the beginning of something stranger?
by tstrimple | 2025-12-05 20:08:02+00:00
I demand to be able to share porn on HackerNews. Moderators who delete my content are censoring me and contributing to the increase in violence and radical behavior! This is the America and here we have the Freedom Of Speech! That means I can post whatever I want wherever I want and anyone who censors me is stealing my freedoms and increasing radicalization!
by bink | 2025-12-05 20:08:05+00:00
> some doctors are willing to prescribe it without FDA approval

But the pharmacies are still reluctant to administer it. My doctor prescribed it for me but when I got to the pharmacy they made me fill out some forms... because I checked the box that said I had no serious health issues and I was under 50, the pharmacist absolutely refused to administer it even with a prescription.
by therein | 2025-12-05 20:08:18+00:00
> about this down time but in actuality is it really that big a deal to have 30 minutes of down time or whatever. It's not like anything behind cloudflare is "mission critical" in the sense that lives are at stake or even a huge amount of money is at stake.

This reads like sarcasm. But I guess it is not. Yes, you are a CDN, a major one at that. 30 minutes of downtime or "whatever" is not acceptable. I worked at traffic teams of social networks that looked at themselves as that mission critical. CF is absolutely that critical and it is definitely lives at stake.
by wat10000 | 2025-12-05 20:08:43+00:00
I can't help but notice you said you could swap out most of the people around you, not all. Yeah, some random salesperson is not contributing enormously to the company's growth and could be replaced without much difficulty. But that's not true of everybody. The CEO is not uniquely special in this regard.

I agree that the CEO is typically the most important in this respect, especially this particular CEO. I just think that giving him an additional 1/8th of the company's entire market cap growth, on top of the roughly 1/8th he already has, is highly disproportionate.

Clearly the shareholders disagree, and that's entirely their right. And I'm not surprised, CEOs are greatly overvalued in general.
by dghlsakjg | 2025-12-05 20:08:51+00:00
That's very interesting. I could argue that you are reading the signal wrong here. You want to go for the car that has the most failures in some cases, since it has survived long enough to fail in minor ways that leave it still able to drive.

If you have car brand A that has a reputation for having catastrophically expensive failures in major components, and car brand B which just keep chugging along for decades, you will probably see an elevated failure rate for brand B since it is still driving, while brand A will not be failing since it has already failed so badly it has been scrapped.
by dylan604 | 2025-12-05 20:09:26+00:00
you're focusing on sea dwelling creatures. what about land based? would animals get as large? would more calories need to be consumed for the extra effort necessary to move around in what ever >1g is around? some of these are are between 1.9x and 10x the size of earth. working twice as hard every day for everything be one thing, but 10x the effort?

what would be the atmospheric pressure at >1g? what effect would that play as well? not only would you be heavier, but you'd have to work harder to breathe.

again, lots of questions about the these differences that make it a lot more complicated than the right amino acids floating around in space.
by steveklabnik | 2025-12-05 20:09:27+00:00
I mean, I'm also not saying async/await is critical for kernels. I'm only saying that "everything is an actor" isn't really possible at the language level.

Async/await is used for a lot of RTOS like things in Rust. At Oxide, we deliberately did not do that, and did something much closer to actors, actually. Both patterns are absolutely viable, for sure. But as patterns, and not as language primitives, at least on the actor side.