MurphyA/hacker-news huggingface dataset:
by _menelaus | 2025-12-18 16:29:26+00:00
Yes, because the idea is to establish an armed populace before society succumbs to tyranny, not in response to it. The central tenet is that even if a society is run by Quakers now, it won't always be, because in the absence of proper inputs societies tend to decay to their stable basal state which is despotism. When that happens, the population must be armed in order to revolt and restore a democratic system. I would even say its better to arm the populace while the government is still Quaker because that would establish the proper cultural mores surrounding gun ownership in an enlightened environment - e.g. knowing that gun ownership is a responsibility and right, connecting it with ideas of liberty and civic duty, viewing them as a last resort, learning about guns from your father and not your homie on the corner.

You need to have the population armed beforehand. Its not practical to try to dynamically adjust how armed the populace is in proportion to perceived governmental Attila-ness.

To your last point, an armed populace makes revolt feasible, and there is a spectrum here. The key is that the oligarchy will need to convince the army to stay on its side and punish the revolting populace. The more sacrifice and violence that is required, the harder it is to keep convincing them. Also, look at the insurgencies in Iraq and Afghanistan: an armed, hostile populace is just much harder to control than an unarmed one. It dramatically increases the cost of every excursion from a military base, the number of soldiers required to subjugate an area, etc, and the grand lesson from those conflicts is that boots on the ground are still needed to control an area, and that technological solutions like drone strikes still don't scale well enough and aren't cleanly targeted enough to change that. Perhaps that will change in the future, but I actually suspect that the prevalence of consumer drones will maintain the power of the public to resist the military. Look at Ukraine and Russia; the dominant weapon system now is the consumer drone, eclipsing even artillery, which has democratizing implications for the future of the tug-of-war between societies and their governments.
by PaulHoule | 2025-12-18 16:29:35+00:00
My experience with AI coding is mixed.

In some cases I feel like I get better quality at slightly more time than usual. My testing situation in the front end is terribly ugly because of the "test framework can't know React is done rendering" problem but working with Junie I figured out a way to isolate object-based components and run them as real unit test with mocks. I had some unmaintainable Typescript which would explode with gobbledygook error messages that neither Junie or I could understand whenever I changed anything but after two days of talking about it and working on it it was an amazing feeling to see that the type finally made sense to me at Junie at the same time.

In cases where I would have tried one thing I can now try two or three things and keep the one I like the best. I write better comments (I don't do the Claude.md thing but I do write "exemplar" classes that have prescriptive AND descriptive comments and say "take a look at...") and more tests than I would on my on my own for the backend.

Even if you don't want Junie writing a line of code it shines at understanding code bases. If I didn't understand how to use an open source package from reading the docs I've always opened it in the IDE and inspected the code. Now I do the same but ask Junie questions like "How do I do X?" or "How is feature Y implemented?" and often get answers quicker than digging into unfamiliar code manually.

On the other hand it is sometimes "lights on and nobody home", and for a particular patch I am working on now it's tried a few things that just didn't work or had convoluted if-then-else ladders that I hate (even if I told it I didn't like that) but out of all that fighting I got a clear idea of where to put the patch to make it really simple and clean.

But yeah, if you aren't paying attention it can slip something bad past you.
by scottydelta | 2025-12-18 16:29:39+00:00
I have a similar setup but with following additional security configurations:

- Hetzner firewall (because ufw doesn't work well with docker) to only allow public access to 443.

- Self-hosted OpenVPN to access all private ports. I also self-host an additional Wireguard instance as a backup VPN.

- Cloudflare Access to protect `*.coolifydomain.com` by default. This would have helped protect the OP's Umami setup since only the OP can access the Umami dashboard. Bypass rules can be created in Cloudflare Access to allow access to other systems that need access using IP or domain.

- Cloudflare Access rules to only allow access to internal admin path such as /wp-admin/ through my VPN IP (or via email OTP to specified email ids).

- Traefik labels on docker-compose files in Coolify to add basic auth to internal services which can't be behind Cloudflare Access such as self-hosted Prefect. This would have also added a login screen before an attacker would see Umami's app.

- I host frontends only on Vercel or Cloudflare workers and host the backend API on the Coolify server. Both of these are confirmed to never have been affected, due to decoupling of application routing.

- Finally a bash cron script running on server every 5 minutes that monitors the resources and sends me an alert via Pushover when the usages are above the defined thresholds. We need monitoring and alert as well, security measures alone are not enough.

Even with all these steps, there will always be edge cases. That's the caveat of self-hosting but at the same time it's very liberating.
by pas | 2025-12-18 16:29:54+00:00
Yep, all 4 charges remained in the superseding indictment (filed Aug 27 in 2024 by Smith).

One of the problem is the "the DOJ's policy of not prosecuting sitting Presidents", while it's understandable it's definitely not great for the rule of law.

And the other is it took too many years for the whole shit shower to drip down. (Garland appointed Smith in November of 2022, and it took ~10 months for the indictment.)
Show HN: A lightweight DLP browser extension to prevent data leaks in LLM tools
by __alberto | 2025-12-18 16:29:55+00:00
Hi HN, I’m a student working at a small company. I noticed some of my colleagues were accidentally pasting sensitive data and internal docs into ChatGPT, Gemini, etc.

Enterprise DLPs were a bit too expensive and complex for us, so I built this browser extension. It scans prompts and docs in real-time, alerts the user, and can anonymize data before it’s sent.

I’d love to hear your thoughts on the technical approach (browser-native vs network level) and if you find this useful.
by pklausler | 2025-12-18 16:29:57+00:00
> Fortran functions correspond to "pure" functions in C/C++ and other languages, i.e. idempotent functions that do not modify arguments or global variables.

This is nonsense. Fortran functions aren't pure. They can have side effects.

HPF/Fortran '95 added the PURE attribute for subprograms, but it's not the default.
by ZeroConcerns | 2025-12-18 16:30:13+00:00
LLMs know nothing about Unpoly, and quite a bit about htmx. This requires you to actually learn Unpoly, because, well, even pointing your LLM-of-choice at the Unpoly docs (which are quite okay!) makes it regress-to-the-ugly-Javascript-workarounds-mean pretty much on try #1.

I'm not yet sure whether this is a good thing or not -- I'll let you know once my latest iteration of my web framework is finally working as I envisioned, he-said sort-of-jokingly, which should be Soon Now.

But yeah, either alternative still beats React by a country mile, since everything related to that descends into madness right away.
by kr99x | 2025-12-18 16:30:30+00:00
You can look through my comment history here, if you like, to see that I've been consistently banging the same drum at least since 2020, but unfortunately without connecting this profile to others I can't show you I've been on it for much longer. Internet evidence might go back as far as perhaps 2010, but before writing a word about it online I'd already had some years under my belt telling people in person that W's national security letters including a gag order was hideously wrong or that the DMCA and its exception list process was unacceptable on first amendment grounds. I assure you, regardless of who is being officially censored or "just" denied a platform or communication tool to which they would otherwise have claim but for the content of their speech, by any government or corporation in any nation in any decade, it is, was, and always will be wrong. It was even wrong to try to suppress ISIS recruitment drives, and if THAT doesn't convince you I'm principled about it I don't know what will. And again, I admit we're rare, but I tell not vanishingly so. In my real life circle I know two others and online several more. I think we're at LEAST as common as principled vegans.
by CodingJeebus | 2025-12-18 16:30:35+00:00
I worked on a large commercial AlpineJS app and grew to really, really hate it. It's great for smallish projects where the limits of the tool are known, but it is in no way a drop-in replacement for something like React (and I am no fan of React). People like to throw around how easy it is to do basic things, but building a real app using Alpine is an absolute nightmare.

Alpine data objects can grow to be quite large, so you wind up inlining hundreds of lines of JS as strings within your HTML template, which often limits your editor's ability to do JS checks without additional config.

State management in Alpine is implicit and nested and not a serious solution for building commercial apps IMO.

And don't even get me started on unsafe-eval.

If it's your hobby app and you are the developer and the product owner, go for Alpine. If you're working at a company that is asking you to build a competitive web product in 2025, use a more robust tool. Hotwire and Stimulus has scaled much better from an organization standpoint in my experience.
by belter | 2025-12-18 16:30:35+00:00
"... a benchmark of 156 open-ended problems across diverse areas of computer science, designed and reviewed by experts, including CS PhDs and top-tier competitive programming participants and problem setters. Unlike existing benchmarks that focus on tasks with known optimal solutions, FrontierCS targets problems where the optimal solution is unknown, but the quality of a solution can be objectively evaluated..."
by alistairSH | 2025-12-18 16:30:40+00:00
Idealy, for me as a layperson who is only going to see these in a museum, I'd love to see a series of pieces...

First, the original, untouched (preserved but not restored?) sculpture.

Second, the reproductions highlighted in the article. With appropriate notations about "these are the base layers, not complete, etc"

And third, a best-guess at what the original could have looked like, based on the first two. Yes, this might be wrong and need to change over time.
by pjc50 | 2025-12-18 16:30:47+00:00
That sounds harder?

There's a lot of pedantry here trying to argue that there exists some feature which doesn't need to be "manually" tested, and I think the definition of "manual" can be pushed around a lot. Is running a program that prints "OK" a manual test or not? Is running the program and seeing that it now outputs "grue" rather than "bleen" manual? Does verifying the arithmetic against an Excel spreadsheet count?

There are programs that almost can't be manual, and programs that almost have to be manual. I remember when working on PIN pad integration we looked into getting a robot to push the buttons on the pad - for security reasons there's no way of injecting input automatically.

What really matters is getting as close to a realistic end user scenario as possible.
by rimunroe | 2025-12-18 16:31:02+00:00
>To be clear, the prisoners aren’t literally forced to do this work. It’s a job they can choose to apply for and do while in prison.

Sorry, do you have a source for that? The requirement to work is a major point of contention, and a very quick check with this[1] directly contradicts your claim in the federal system: "Sentenced inmates are required to work if they are medically able. Institution work assignments include employment in areas like food service or the warehouse, or work as an inmate orderly, plumber, painter, or groundskeeper. Inmates earn 12¢ to 40¢ per hour for these work assignments."

[1] https://www.bop.gov/inmates/custody_and_care/work_programs.j...
by Someone | 2025-12-18 16:31:08+00:00
Yes, they do, but if what goes in is insufficient by a wide margin, people who can afford to will start drilling for water.

Assuming that the water taken through qanats would eventually make it into aquifers (fat from unlikely, I think, as it takes water from underground that’s less likely to evaporate) one could even argue that tapping rainwater with qanats prevent aquifers from getting refilled, so it’s taking from the same water source.
by 9rx | 2025-12-18 16:31:09+00:00
> Without explicit instruction, LLMs are really bad at this

They used to be. They have become quite good at it, even without instruction. Impressively so.

But it does require that the humans who laid the foundation also followed consistent patterns and conventions. If there is deviation to be found, the LLM will see it and be forced to choose which direction to go, and that's when things quickly fall off the rails. LLMs are not (yet) good at that, and maybe never can be as not even the humans were able to get it right.

Garbage in, garbage out, as they say.
by langleyi | 2025-12-18 16:31:20+00:00
A thought I had halfway through reading this article: if, hypothetically, early Medieval European art had been lost, how would it be reconstructed by modern scholars?

Would they accurately capture the lack of 'naturalism' (i.e. that flat, almost cartoonish quality) that often strikes modern viewers of Medieval art, or would they make it 'better', interpolating the gap between Roman and Renaissance styles?

This article hints at the idea that classical sculpture can't have been painted like that, because _it looks bad_ and Romans couldn't possibly have thought it looked good, yet early Medieval art was — presumably — perfectly acceptable to the tastemakers of Medieval Europe.
by thayne | 2025-12-18 16:32:01+00:00
> if your local life is being inconsiderate and having parties till 3 because you're on holidays

I would expect that to be the minority of visitors.

I certainly don't do that when I stay in Airbnbs.

> The biggest problem here in Barcelona is that most airbnbs / short term rentals are companies buying housing as an investment and so are stealing the opportunity from actual people and families trying to live.

Sure, the problem is balancing that with the desire of tourists that want something better than a hotel.
by PaulHoule | 2025-12-18 16:32:04+00:00
It's a frustrating situation. I had a stretch in my career when I was the clean up person who did the 90% of work that was left after management thought a junior had gotten in 90% done. It's potentially very satisfying but very easy to feel unappreciated in (e.g. they wish the junior could have gotten it done and thought I was "too slow" though in retrospect one year of that was an annus mirabilis where I completed an almost unbelievable number of diverse projects.)
by embedding-shape | 2025-12-18 16:32:30+00:00
Limiting rent increase does not mean "Rent can never change", it just means the rate of change is limited. Owners can still raise the prices each year, it's just limited based on a lot of factors, the main one being a local index. But renovating the property for example lets owners raise the rent higher, as just one exception.

> People with a rent controlled unit will not leave even when they should, because they have it so good.

... What do you mean "when they should"? If they don't want to leave because the rent is OK and they like living there, why should they move?

I guess one fundamental difference with Spain VS US or probably many other countries, is that here in Spain we have "the right to housing" enshrined in our constitution. This makes it so it's more important for residents and citizens to be able to find housing, than it is for owners to be able to make profits on owning properties/land.

The laws in the country should reflect this, and thankfully, they're starting to, albeit slowly.
by lunar_mycroft | 2025-12-18 16:32:35+00:00
(Disclaimer: I haven't actually run into a case where I had to move from HTMX to a SPA framework, even partially, so this is largely an educated guess)

I think this scenario would either be very apparent early on in the project, or wouldn't actually be that challenging. There are a couple ways you could run into the limits of HTMX:

1. You require purely client side interactivity. The right (IMO) way to use HTMX is as a replacement for sending JSON over the wire and rendering it into HTML on the client, so if your app has features that _wouldn't_ be done that way, you should reach for something else. Fortunately there's lots of solutions to this problem. You can use built in browser features to achieve a lot of the basics now (e.g. the <details> tag means you don't really need custom scripts if you just want an accordion), write simple vanila scripts, or adopt light weight libraries like alpinejs or the creator of HTMX's (only slightly deranged) hyperscript.

2. Maybe your purely client side interactivity needs are complex enough that you do need a SPA framework. At that point you can adopt the islands architecture and create interactive components in your fraemwork of choice, but continue to use hypermedia to communicate with the backend.

3. If you can't easily separate client side state (handled with javascript, potentially with the aid of frameworks) from server state (handled on the server and sent to the client via hypermedia), you can again adopt the islands architecture and have your islands manage their own network requests to the backend.

4. If the above applies to all of your app, then hypermedia/HTMX is a bad fit. But this should generally be pretty obvious early on, because it's about the basic, fundamental nature of the app. You probably know you're building google docs when you start build google docs, not mid-way through.
by ndriscoll | 2025-12-18 16:32:49+00:00
Unless they've changed recently, I thought GOG's platform itself does not have DRM? Steam does provide DRM and doesn't tell you if a game uses it, though as far as I know there are generic tools to bypass it.

GOG also specifically advertises games that don't have DRM, e.g. [0]. Steam versions of the same game (e.g. Skyrim) often require Steam to be running and enforce mandatory updates that aren't always desirable with no rollback ability.

[0] https://www.gog.com/en/game/the_elder_scrolls_v_skyrim_anniv...
by xp84 | 2025-12-18 16:33:15+00:00
Banks can’t legally just take your money and lock you out permanently. There are some actual regulations. Plus they have a proper handle on your actual human identity, which means you ought to always have a route to going somewhere in person and proving you’re the rightful owner of your money.

“Online” accounts have zero regulatory requirements, plus many of them aren’t necessarily directly paid-for, so they frame themselves as doing you a favor by letting you have it in the first place. And they usually don’t have a route to prove identity because they don’t record a legal identity (passport/SSN/etc) to begin with (not that that was an issue here, of course - in this case Apple didn’t dispute that they were the owner, just asserted that they were some kind of criminal.)
by kemayo | 2025-12-18 16:33:18+00:00
I'm not sure they've got Apple targeted so much, because Apple has been so thoroughly not-invested in gaming. The place they're closest to colliding is VR, but Apple's Vision headset is doing something really different from Valve's VR products, which are far more directly lined up against Meta's Oculus.

Valve could branch into Apple's areas, but they don't seem particularly interested in doing so yet.

EDIT: rather, Apple cares a lot about phone gaming, but that's an area that Valve has shown few signs of moving in on.
by MrDOS | 2025-12-18 16:33:22+00:00
You're looking in the wrong place. They don't need to be listening for mail on the machine behind the A/AAAA records for the domain, because they have an MX record indicating that mail should be delivered elsewhere:

$ dig MX gmai.com +short 1 mail.h-email.net.

Port 25 is very rare these days, as it implies the possibility of unencrypted traffic; legitimate SMTP traffic uses port 587. That said, I checked a couple of the hosts that that name resolves to, and they all listen for both SMTP and secure SMTP traffic:

$ nmap -p 25,587 mail.h-email.net Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-18 16:31 UTC Nmap scan report for mail.h-email.net (165.227.159.144) Host is up (0.093s latency). Other addresses for mail.h-email.net (not scanned): 91.107.214.206 165.227.156.49 167.235.143.33 5.75.171.74 5.161.194.135 178.62.199.248 5.161.98.212 162.55.164.116 49.13.4.90 rDNS record for 165.227.159.144: mail2.h-email.net PORT STATE SERVICE 25/tcp open smtp 587/tcp open submission
by dbdr | 2025-12-18 16:33:23+00:00
It would indeed be better to have the separate counts. It's also wrong to attribute to only one case what is a actually a larger category, unless there is actual evidence that it's the overwhelming majority anyways. Both can be true at the same time.

I'm not trying to win anything, and I do support privacy. I just think any argument, especially those citing specific numbers, should be based on an accurate description of reality.
by furyofantares | 2025-12-18 16:33:28+00:00
My theory is that a lot of people skim articles and then go to comments, or even just skip to comments once there are a few, and that these are "good enough" when skimming to produce a jumping off point for some commentary.

But now that it's very easy to produce articles that pass that test but don't have much value beyond that, we're seeing a lot of low quality stuff make it.
by jconley88 | 2025-12-18 16:33:34+00:00
In CO, there isn't an online search. When you apply, you have to list your top options and hope one is available. I'm also not a normal person. I'm an engineer and this was not good enough for me.

I emailed government employees until I figured out who was responsible for license plate records. I submitted a CORA (Colorado Open Records Request) for the entirety of their dataset. I had hoped to get the data on some regular cadence to build a simple online service for others. Unfortunately, they flat out refused and wouldn't discuss options.

When I told my family what license plate I wanted, they laughed at me and said "No one has that, just go get it". And so I did and it worked. I now have what I consider to be the best possible license plate in Colorado: "LCNZPLT"

Occasionally I'll see someone walk by my car, see the plate, think for a few seconds and then start laughing. Mission accomplished!
by mattlondon | 2025-12-18 16:33:47+00:00
Same here. Modern angular is pretty nice to work with.

Yes It has a "learning curve" but so does everything (even React).

Also Angular is now about twenty thousand times simpler than it was in the past as you can use Signals for reactivity, and basically ignore Observables for 95% of things.

Angular also removes the a lot of the negatives outlined in the page - no npm, no node_modules, no ecosystem fatigue, no debates on state management etc etc. Everything you need is included in one dependency you can load from a CDN.

I never liked that in react you are mangling the presentation and business logic in one tsx file (separation of concerns? React ignores that lesson for some reason). Htmx feels even worse in this way because now you also have html snippets and templates in your backend code too! Nightmare! Angular let's you leave the templates as standalone files and not mushed into your typescript like react (although you can inline them into the typescript if you want to, but obviously no one does that for anything apart from the most trivial of components)