MurphyA/hacker-news huggingface dataset:
Ask HN: Post-CVE-2025-55182 – should we be auditing for backdoors?
by Just_Clive | 2025-12-10 12:45:26+00:00
Vercel Agent just auto-patched 800K+ projects for CVE-2025-55182 (React2Shell), which is great for stopping future attacks.But I'm curious: is anyone auditing their codebases for malicious artifacts that may have been planted during the 9-day exposure window (Dec 5-9)?

The issue: Patching updates your dependencies to remove the vulnerability. But if attackers exploited it during that window, they could have:

Injected backdoors into components or middleware Added obfuscated malicious code (eval/atob patterns) Planted crypto miners or data exfiltration hooks Modified server actions to leak credentials

Patching doesn't retroactively remove this code. Our experience: We patched immediately on Dec 9. Then spent 6 hours manually auditing our Next.js codebase and found 2 suspicious modifications we didn't write (obfuscated eval calls in middleware). What we built: An AST-based scanner to automate this. It checks for 80+ Indicators of Compromise:

Code obfuscation patterns Unauthorized network calls Modified Next.js internals Crypto mining signatures CVE-2025-55182-specific exploit artifacts

Runs in 30 seconds vs. our 6-hour manual audit. Questions for HN:

Are companies doing post-patch audits, or assuming they're clean? Is there existing tooling for this that we missed? For high-value targets (fintech, healthcare), what's the recommended approach?

We open-sourced the scanner here: [https://github.com/Alcatecablee/Neurolint-CLI/] Curious how others are approaching this, seems like a blind spot in the patching narrative.
Show HN: I wrote an open source package manager for AI coding, OpenPackage
by hyericlee | 2025-12-10 12:45:36+00:00
I got tired of needing to copy my AI coding files and configs across multiple projects...

So I created OpenPackage, the open source CLI tool that packs your specs, rules, commands, subagents, skills, plugins, and more, into reusable, composable, and shareable packages.

It's basically a hybrid of npm, GitHub, and Claude Code Plugins for AI coding files.

As an example, here's one of my favorite commands to use for code cleanup: https://openpackage.dev/@awesome/f/.openpackage/commands/cle... And my NextJS project scaffolding package: https://openpackage.dev/@hyericlee/nextjs

Would love to see the packages you all come up with to power your AI coding workflows!

P.S. Will be launching a TUI for OpenPackage soon, so drop a star on GitHub and stay tuned.
by joshfraser | 2025-12-10 12:45:38+00:00
You're telling us that data centers are more sensitive to downtime than airplanes??? That makes no sense.

All of the aeroderivatives were designed in the 70's before we had computer modeling to help optimize the designs. It's not that crazy to assume that we can design a better and more efficient turbine today with all of the help of modern technology.
by bravetraveler | 2025-12-10 12:45:43+00:00
... and my point remains: he's fine. Could be better. If he does grace us, he can choose to bait the hook more effectively. Or not. The stakes are silly-low.

This interaction is, effectively, a link dropped with an announcement of an announcement. For what has already occurred. Over-fitting, training? You don't say.

If I wanted to be more of an ass, I'd look to argue about hype generation. But I don't, I appreciate any honest effort, which I believe for Simon.
by mzl | 2025-12-10 12:45:44+00:00
A better reason why wine glasses are not filled like that is that wine glasses are designed to capture the aroma of the wine.

Since people look at a glass of wine and judge how much "value" they got based partly on how much wine it looks like, many bars and restaurants choose bad wine-glasses (for the purpose of enjoying wine) that are smalle and thus can be fulled more.
by a2128 | 2025-12-10 12:46:45+00:00
The market today is extremely different to what the market looked like at the time Amazon worked their strategy, it was dominated mainly by physical retailers that may have required a long drive, things were not always stocked, limited choice on what's stocked on shelves. And ordering over a phone from paper catalogs had long delivery times and limited information beyond just a picture and short description. Amazon disrupted the industry by changing all of this and becoming the first major online retailer.

You won't be able to just replicate their strategy, and they've spent ridiculous amounts of money on next-day/same-day delivery infrastructure that nobody's gonna be able to invest that much. But if you do have any ideas on how to disrupt Amazon and be more convenient than them in 2025 let me know :)
by Aldipower | 2025-12-10 12:49:55+00:00
Yes, it seems to be everywhere. Like an epidemic. When I pick up my daughter from school, I have to wait outside the entrance for about 10 minutes with other adult parents. Nine out of ten parents just stare at their smartphones and don't even look at me. In the past, people would have started a conversation out of boredom and gotten to know each other. We are really losing so much.
by randomtoast | 2025-12-10 12:49:57+00:00
At some point, no matter how something is mentioned, someone will offer criticism. I guess that in roughly 20% of all HN front page posts, at least one person comments on the terminology used. I do not see this as an argument against using accurate terminology, but rather as a reminder that it is impossible to meet everyone's expectations.

There are other terms that are similarly controversial, such as "thinking models". When you describe an LLM as "thinking", it often triggers debate because people interpret the term differently and bring their own expectations and assumptions into the discussion.
by sinuhe69 | 2025-12-10 12:50:04+00:00
Very interesting. But I wonder how much Google (and other) Maps can actually shape the scene. For tourist hotspots with a lot of visitors, it IS clearly the driving force. But for locals, I don’t think it has an overwhelming effect. Locals know their restaurants and they visit them based on their own rating. They could explore total strange and new ones, but then they will form their own rating and memory immediately and will not get fooled/guided by algorithm (the next time)
by nephihaha | 2025-12-10 12:50:20+00:00
I can't remember the titles offhand unfortunately. Bear in mind that a lot of details didn't come out until the 1990s due to Soviet censorship. The BBC did a great documentary on Korolev about thirty years ago when some details came out.

Whatever one thinks of the Soviet political system, they did have some great achievements. Some of the ones that people forget include first probe and first automated rover on the Moon, first space station, first probe on Mars, first rover and picture from Mars (albeit scrambled), also first pictures from the surface of another planet (Venus)

NASA tried to claim recently it had the first sound from another planet (Mars) and airborne probe (helicopter). The Soviets had already transmitted audio from Venus in the 1980s and had a balloon there.
by SideburnsOfDoom | 2025-12-10 12:51:39+00:00
> what sort of whiplash will we have if a democrat gets in next time?

Hopefully the lesson is learned from the last time a democrat got in and proclaimed that "America is back (1)": That the USA is a part-friend time at best, inconstant, not a dependable full-time ally. Plan Bs are needed, since when someone fools you twice, you can't get fooled again.

No-one is saying that this will be quick, easy or 100%. They're saying that it's a necessary direction. Claiming that it's "impossible" doesn't refute the argument that it is necessary. "necessary but very hard" is a likely summary.

1) https://apnews.com/article/biden-foreign-policy-g7-summit-mu...
by f1shy | 2025-12-10 12:51:41+00:00
Please remember we are coming from "set warnings to errors", which I interpret as: I know better than the people doing the compiler. There is a good reason for the two. If not, there could be no warnings at all, all would be an error.

My rationale: if you do set warn->error, then there are 2 ways around it: change the code to eliminate the warning, or pacify the compiler. Note, the measure to set it to error, is to instigate lazy programmers to deal with it. If the lazy person is really lazy, then they will deal with it with a pacifier. You won nothing.

There is no one recipe for everything. That is why, even if I do not like to treat warnings as errors, sometimes may be a possible solution.

I think you should deal with warnings, you should have as few as possible, if any at all. So if you have just a couple, is not a problem to document them clearly. Developers building the project should be informed anyway of many other things.

In some projects I worked, we saw warnings as technical debt. So hiding them with a pacifier would make us forget. But we saw them in every build, so we were reminded constantly, we should rework that code. Again, it depends on the setup you have in the project. I know people now are working with this new trend "ci/cd" and never get to the see the compilation. So depending on the setup one thing or another may be better.
by linuxfax | 2025-12-10 12:51:49+00:00
He also said in that same email regarding Rust that:

> nobody is forced to suddenly have to learn a new language, and that people who want to work purely on the C side can very much continue to do so.

So any argument that Rust would ever fully replace C in such a way that C would go away and be banned in the kernel is NOT what Linus said.

https://lkml.org/lkml/2025/2/20/2066
by Xylakant | 2025-12-10 12:52:37+00:00
Why? It depends on what you want to replace, but the Rust project has a long history of using tools written in other languages. Python is used a lot in build tooling, bors-ng was written in Elixir, llvm is written in c, ... gcc-rs doesn't contain a lot of rust code either, it's purely other languages according to https://github.com/Rust-GCC/gccrs

Fundamentally, if a tool is good and provides benefits then why not use it? You'll be met with concerns about maintainability if you just airdrop something written in Ada/SPARK, but that's fair - just as it was fair that the introduction of Rust in the linux kernel was indeed met with concerns about maintainability. It seems that those were resolved to the satisfcation of the group that decides things and the cost/benefit balance was considered net positive.
by freeopinion | 2025-12-10 12:52:39+00:00
I don't think C should be disparaged at all. Just because I prefer torx screws doesn't mean phillips screws were a horrible idea. They were brilliantly simple and enormously effective. I can't think of a single situation in which I wouldn't prefer torx, but torx wasn't an option historically and phillips was not the wrong decision at the time. Times change.
Show HN: CVora – I built an AI to tailor resumes specifically for ATS filters
by jaumapv | 2025-12-10 12:53:43+00:00
Hi HN,

I'm a solo dev. I built this because I found manual keyword matching for ATS systems to be a huge time sink.

It's a Next.js app that takes a PDF resume + Job Description text, analyzes the semantic gap, and rewrites the bullet points to match the target keywords.

Tech stack: Next.js, Vercel AI SDK, Tailwind.

There is a free interactive demo (no signup/login required) to test the parsing speed.

Link: https://cvora.net

Feedback on the parsing accuracy is welcome.
by alberth | 2025-12-10 12:55:45+00:00
> Power generation turbines are designed to work at ambient sea level conditions. They don't rely on ambient air being especially cold for cooling, they can keep cool thanks to the large mass flow rate

What could be contributing to this is recently Vertasium did a whole video on how jet engines operate at temperatures above their components melting point.

And how the cold air at altitude is what keeps it from melting.

https://youtu.be/QtxVdC7pBQM
by danaris | 2025-12-10 12:55:51+00:00
I'm with saubeidl—while I, too, am deeply suspicious of anyone who comes from that level of privilege, and I've heard some shady stuff about Varoufakis in the past, you are refusing to present a) any meaningful criticism of his actual arguments, or b) any specific causal link between aspects of his background and reasons to doubt his work.

You just keep pounding on the fact that he is from privilege, but that alone is not enough to be suspicious.

At the very best, you are arguing guilt by association.
by articlepan | 2025-12-10 12:56:23+00:00
I agree with your first paragraph, but not your second. Models can still hallucinate when temperature is set to zero (aka when we always choose the highest probability token from the model's output token distribution).

In my mind, hallucination is when some aspect of the model's response should be consistent with reality but is not, and the reality-inconsistent information is not directly attributable or deducible from (mis)information in the pre-training corpus.

While hallucination can be triggered by setting the temperature high, it can also be the result of many possible deficiencies in model pre- and post- training that result in the model outputting bad token probability distributions.
by esel2k | 2025-12-10 12:56:28+00:00
Pebble user here - the old ones:).

I use the todo app to speak to create my shopping list before going to the store. I look into the fridge and little room to check whats needed. In the shop I tick off stuff.

It is life changing? No, but one central place that is intelligent would be nice:

- remind me off - add to shopping list - etc
by littlestymaar | 2025-12-10 12:56:35+00:00
> let humans think in the way they're used to thinking: in natural language

Writing a program means stating unambiguously what you want, but natural language is ambiguous which is why legalese exists.

So you need to have an unambiguous source language for what's end up being executed by your machine (which is what programming languages are), otherwise you have no way of knowing if the machine does what you want it to do.

Of course you can use an LLM to translate natural language to unambiguous language, but at the end of the day you must read the generated language because that's the only way to dispel the fundamental ambiguity of the natural language.

I saw a webcomic ten years ago where a project manager discussing the future automation of programmer's jobs:

PM: “In the future, there will be no developers, just project manager. We will just give the machines very complete and precise specifications and it will make the software on its own. Without needing you”.

Dev: “You know how we call a "very complete and precise specification"? It's called code”.
by styanax | 2025-12-10 12:57:20+00:00
IMHO based on my use of the fediverse, fundamentally it's about porn and curtailing unwanted porn in your domain. I'm a user of mastodon.social in the "wee US hours" (before US mods are awake) and run across a lot of hit-and-run porn being pushed to Trending (and I report, etc.).

It's a thing, it happens a lot and Lemmy instances have the same problems to fight. Unwanted porn in my eyeballs is sadly a not uncommon experience until you've put in effort to set up blocks and filters on your personal accounts. Peertube being explicitly video based is a natural target for porn pushers.
by cmeacham98 | 2025-12-10 12:57:44+00:00
Didn't Hector step down essentially as a direct result of that behavior? https://www.phoronix.com/news/Asahi-Linux-Lead-No-Upstream

Do you have an example of other R4L maintainers harassment? Because you've spammed the same single example 3-4 times on this post alone.
by danaris | 2025-12-10 12:58:27+00:00
Sure, "a competitor" with hundreds of billions of dollars and a few decades to burn could, in theory, do that.

But what would be the payoff? Getting to compete head-to-head with Amazon? Amazon, that's a well-established incumbent, with a well-known pattern of ruthless dealings, including leveraging their ties with governments, to protect their monopoly?

No one's going to be able to make a profit doing that.
by dylanbeattie | 2025-12-10 12:58:43+00:00
Stallman can give a talk about "how to invent free software and build a movement around it" because Stallman has invented free software and built a movement around it. For Stallman, there is a significant overlap between "what it's like to be me" and "how to invent free software" - his version of that story is exactly the story nobody else can tell.

It's not about telling a better story. It's about telling a story better.
by masfoobar | 2025-12-10 12:58:58+00:00
My only gripe is with Vec3_new() function in "Memory Ownership" section.

It assumes you want a single malloc of Vec3. It tries to behave as if you are doing a 'new' in an OOP language.

Let the programmer decide the size of it.

Mock example (not tested)

struct Vec3* Vec3_new(size_t size) { if(size <= 0) { // todo: handle properly return NULL; } struct Vec3 *v = malloc(sizeof(struct Vec3) * size); size_t i; for(i = 0; i < size; i++) { v[i].x = 0.0F; v[i].y = 0.0F; v[i].z = 0.0F; } return v; }
by lucasfdacunha | 2025-12-10 13:00:07+00:00
Working on https://greatreads.dev/ A place to aggregate and find articles from developers' blogs. Right now, I'm building a submission form for people to submit new sources.

There is also a way to search for articles using vectors, it's called "Semantic Search". So basically you can ask, for example, "Postgresql and how to best optimize it." and it would search for articles touching that subject, or at least related to it.

Wondering about the best way I can add a weekly newsletter built on top of the content currently being ingested, and still looking for more sources to add to the database (let me know if you have any good recommendations).
by trollbridge | 2025-12-10 13:00:36+00:00
A 2 GW DC only needs 48 of those things. About 11.5M tons of CO₂ per year. It’s always on full blast so everything must be calculated 100%.

A new Civic going 8,000 miles a years at will produce 2.4 tons. So yeah one new DC is 4,700 cars. Which you’re supposed to replace with electric cars that will be fed with a non-existent power source, which means apparently even more gas turbine power plants.

Most assumptions about renewables don’t account for continuous 24/7 loads. Stuff like storage doesn’t help with that. I have noticed very little talk about AI DCs varying their loads to match renewable generation from solar/wind.
by SkyArrow | 2025-12-10 13:00:39+00:00
With Temporal, your activity logic still needs to ensure idempotency e.g. by checking if an event id / idempotency key exists in a table. It's still at-least-once delivery. Temporal does make it easy to mint an idempotency key by concatenating workflow run id and activity id, if you don't have a one provided client-side.
by Bender | 2025-12-10 13:02:30+00:00
I know this will be an unpopular comment but this totally makes sense to me. As much as I want a right-to-repair for my own consumer goods, forcing all the defense contractors to uptake this all at once especially for top secret systems is highly unlikely to ever happen as it would increase exposure risk of secret leakage via enlisted people working on these systems and would put service members at higher risk of compromise. I think this part of the bill would have to be teased apart and resubmitted.
by josephg | 2025-12-10 13:03:04+00:00
I’m not really sure what point you’re making. All I see there is - or was - some unclear management within Linux itself.

- There was an experiment to have rust in Linux. It got provisional approval from Linus.

- Some people in the Linux kernel blocked essentially any changes being made to make the rust experiment able to succeed.

- Some people who were trying to get rust into Linux got frustrated. Some quit as a result.

- Eventually Linus stepped in and told everyone to play nice.

This whole drama involved like 5 people. It’s not “the majority of the rust community”. And it kinda had nothing to do with rust the language. It was really a management / technical leadership challenge. And it seems like it’s been addressed by leadership stepping in and giving clearer guidelines around how rust and C should interoperate, both at a technical and interpersonal level.

So what’s your point? Is rust bad because some people had an argument about it on the Linux kernel mailing list about it? ‘Cos uh, that’s not exactly a new thing.
by Cthulhu_ | 2025-12-10 13:03:20+00:00
But would the responses be any different back then? Energy innovations like battery tech were also looked at critically back then. There's even a template doing the rounds with a checklist for supposedly revolutionary battery tech.

Using a turbine to generate electricity isn't innovative or brave, it's been done, the technology has been around for over a hundred years, but it's not widely used because there's better ways to generate electricity.
by jodrellblank | 2025-12-10 13:03:43+00:00
You'd think, but while I was looking for the video I mentioned, I found one of their conferences from ~2022 with audience questions like "omg omg you've got huge cash reserves GIVE IT TO SHAREHOLDERS WHEN?? GIMME GIMME <money_mouth_emoji>" and Buffet gave the answer even I could have predicted: "we want cash reserves for the next market crash, whenever that is. If a big company gets into debt trouble, there aren't many people they can pick up the phone and call who could do a $50 - $100 billion deal like Berkshire can".

I can't imagine how often he's repeated "We want enough cash to be able to buy something, and we're waiting until something is cheap" over the last 40 years, but people going to their investor conferences don't all seem to have internalised it.
by dist1ll | 2025-12-10 13:04:40+00:00
As long as your target language has a strict define-before-use rule and no advanced inference is required you will know the types of expressions, and can perform type-based optimizations. You can also do constant folding and (very rudimentary) inlining. But the best optimizations are done on IRs, which you don't have access to in an old-school single pass design. LICM, CSE, GVN, DCE, and all the countless loop opts are not available to you. You'll also spill to memory a lot, because you can't run a decent regalloc in a single pass.

I'm actually a big fan a function-by-function dual-pass compilation. You generate IR from the parser in one pass, and do codegen right after. Most intermediate state is thrown out (including the AST, for non-polymorphic functions) and you move on to the next function. This give you an extremely fast data-oriented baseline compiler with reasonable codegen (much better than something like tcc).
by treesknees | 2025-12-10 13:04:48+00:00
Security takes many forms, including Availability.

Having branch offices with 100 Mbps (or less!) Internet connections is still common. I’ve worked tickets where the root cause of network problems such as dropped calls ended up being due to bandwidth constraints. Get enough users streaming Spotify and Netflix and it can get in the way of legitimate business needs.

Sure, there’s shaping/qos rules and dns blocking. But the point is that some networks are no place for personal consumption. If an employer wants to use a MITM box to enforce that, so be it.
by general1465 | 2025-12-10 13:05:52+00:00
That's a tough talk, but it is unlikely to be. I have been in USA few months ago. There were 2 (two) people processing ESTA queue despite having like 10 booths in there, it took me almost 2 hours to get through it.

Now they want to scrutinize social media? Who is going to do that?
by Cthulhu_ | 2025-12-10 13:07:20+00:00
Yeah, if (BIG if) they actually generate demand for it, mass producing power generators will be easier to do than mass producing planes. Starlink was SpaceX's way to generate their own demand - they have a vision of scaling up rocket launchers, but without Starlink there wouldn't be enough demand for it. Likewise I can imagine there won't be much demand for hypersonic airplanes, not enough to run a business. At least the Concorde was only one of several models that the manufacturers produced, so it wasn't their only product.