MurphyA/hacker-news huggingface dataset:
by maqp | 2025-12-15 22:15:13+00:00
Yup. As the guy who put together the most secure FOSS messaging system*, it's not "impossible to hack". It's a caveat ridden, inconvenient to use, tedious to setup, hardware-isolated, multinode application, with long must-read documentation, and that requires experience with electronics and soldering.

* github.com/maqp/tfc
by therein | 2025-12-15 22:15:47+00:00
It was as inactionable and useless as the ones that ID.me or whatever sends. Also calling it Dark Web report always felt super insincere. It had nothing to do with the "dark web", that just served a way to make it sound cooler and more hackery. Aren't we talking about something that's equivalent to HaveIBeenPwned?
by zahlman | 2025-12-15 22:16:11+00:00
> What LLMs also do though, is use em-dashes like this (imagine that "--" is an em-dash here): "So, when you read my work--when you see our work--what are you really seeing?"

>You see? LLMs often use em-dashes without spaces before and after, as a period replacement.

It would not make any sense at all to use periods in the places where those em-dashes are supposedly "replacing" periods in the example.
by irusensei | 2025-12-15 22:16:13+00:00
They kinda do on Apple Private relay and most services don't block it. Funny thing if you put it in your router and point the tunnel to a certain country is a good way to source address launder since the endpoint will just think its an apple private relay user from local country.

Tradeoff is that it seems to be a browser only thing. Some tools like the default macOS curl seem to be integrated with it.
by mothballed | 2025-12-15 22:16:25+00:00
Even if it is, it's not exactly a head scratcher how things end up like this.

The Jews have their Israeli ethno-state. In Liberia for instance, citizenship is limited to blacks. Armenia has special citizenship progression for Armenians for instance. China is incredibly difficult to be a citizen unless you are ethnic Chinese. Most (arab) gulf states are ethno-states, muslims have countries like Afghanistan where pretty much any Muslim could settle and live in Shariah law.

Musk basically left south Africa around the time segregation ended. There is massive demand for white nationalist state as Western nations open themselves to multi-culturalism and there is basically no 'refuge' left for white nationalists unless you are Serbian or something.

The fact that ethno-states probably aren't defensible doesn't negate the fact white supremacists exist en masse and have demand for something that no longer exists, looking at examples of everyone else getting it, and scheming how they can get it for themselves. The only question is where they will end up focusing their collective energy.
by Tangurena2 | 2025-12-15 22:16:33+00:00
The NSA has a bad historical reputation for this sort of thing - intentionally weakening crypto standards to make things easier for themselves to break, while keeping them "strong enough" that other agencies outside of NSA/GCHQ/GRU can't. The Crypto AG scandal [0] was pretty bad, with Clipper/Skipjack & Dual_EC_DRBG [1] being more recent ones. The NSA could do what you are asking to do, but they probably won't let us know what the really bad holes are because they want to keep using them.

Notes:

0 - https://www.washingtonpost.com/graphics/2020/world/national-...

1 - https://www.scientificamerican.com/article/nsa-nist-encrypti..., https://en.wikipedia.org/wiki/Dual_EC_DRBG
by oconnore | 2025-12-15 22:16:40+00:00
I'm not sure which dimensions you're talking about, but in terms of bed size the F-150 has been very consistent over the years (although I think Crew Cabs — although they always existed — have become more popular). The Ranger still cannot fit a full sized sheet of plywood flat in the bed.

Quick research: the new Ranger's bed size has only increased 0.9" (width) relative to the 1990 version. Bed length seems to be the same.
by credit_guy | 2025-12-15 22:17:13+00:00
It's not quite that easy to flaunt the NPT. If it were, we'd have 50 nuclear nations by now, if not more. The idea of the NPT is that you are given access to peaceful nuclear technology in exchange for accepting inspections by the IAEA (International Atomic Energy Agency). The IAEA inspectors are quite smart, it's not easy to start purifying plutonium out of spent fuel without them noticing. Plutonium is a super-nasty substance to work with, and that's when it's pure. Spent fuel is orders of magnitude nastier, if you plan to do chemical reactions with it. You can't just hide a plutonium purification facility in a janitor's room somewhere. Now getting from zero experience with plutonium to the ability to do a dash for a bomb, that's a huge leap. It is not impossible. In the nuclear proliferation literature there is the concept of "sheltered pursuit". One of the nuclear powers is basically allowing you to disregard the NPT, and pursue nuclear weapons. But guess what? Most nuclear powers are happy to let the nuclear club remain small.

In the particular case of Taiwan, how would sheltered pursuit look like? The US would allow Taiwan to seek nuclear capability. But China would certainly see this as a reason to strike. I think a lot of the world would understand and accept a Chinese preemptive strike if China could show evidence that Taiwan was trying to acquire nukes, and the IAEA concurred.
by notepad0x90 | 2025-12-15 22:17:27+00:00
Not precise, but for example if it's been over a day since the last time update, i start getting errors on various sites, including virtually every site behind cloudflare. (assuming you're referring to the initial issue I mentioned).

One of the setups that gives me issues is machines that are resumed from a historical snapshot and start doing things immediately, if the NTP date hasn't been updated since the last snapshot you start getting issues (despite snapshots being updated after every daily run). Most sites won't break (especially with a 24h window, although longer always have issues), but enough sites change their certs so frequently now, it's a constant issue.

Even with a 10 year cert, if you access at the right time you'll have issues, the difference now is it isn't a once in a 10 year event, but once in every few days some times.

Perhaps if TLS clients requesting a time update to the OS was a standardized thing and if NTP client daemons supported that method it would be a lot less painful?
by kelnos | 2025-12-15 22:17:28+00:00
Interesting; I just flew Virgin Atlantic for the first time a week ago (SFO->LHR) and found the experience aggressively mediocre. Reservation management and check-in experience with their app was the hottest of hot garbage, boarding was slow, in-flight meal below average, general comfort just kinda okay. No complaints about the crew, at least.

I generally fly United (while they are also aggressively mediocre, they mostly fly direct to the places I need them to, and their pricing is generally good on the routes I take), and I'd honestly rate United higher than Virgin Atlantic, which surprised me. Maybe my single experience was a fluke, but it was a really bad first impression.

And I say this as someone who absolutely adored Virgin America back when it existed. Bizarre that the two could be so different.
by frio | 2025-12-15 22:17:34+00:00
It's intent of action vs. actual action.

Elon may not be _intending_ to pay foreigners to cosplay as patriotic Americans.

However, X pays people based on engagement. A number of people outside the USA have figured out that if they post outrageous shit to Americans, they get engagement -- and therefore earn money. So in fact, Elon _is_ paying foreigners to cosplay as Americans, but it might not have been what he meant to do.
by parhamn | 2025-12-15 22:17:34+00:00
Given certificate issuance basically ended up being "do you control the DNS for this domain", I feel like all of it could've been so much simpler if it was designed like that from day one.

While I love Let's Encrypt it feels so silly to use a third party to verify I can generate a Cloudflare API key (even .well-known is effectively "can you run a webserver on said dns entry").

Edit: TIL about https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
by ursAxZA | 2025-12-15 22:18:00+00:00
EUV was just an example — the broader point is that lithography capacity, wafers, gases, and fab-hours all get allocated across product lines.

If GPUs generate dramatically higher margin per wafer-hour than SATA SSDs, fabs will re-shift capacity toward them.

Whether NAND uses EUV specifically doesn’t really change that upstream pressure.
by kiba | 2025-12-15 22:18:06+00:00
Just my opinion as a Georgist amongst many, I would categorize copyright and patents as non-reproducible privilege rather than economic land though non-reproducible privilege also describes private ownership of land. It's very clear that it's artificial, as ideas do not suffer from the exclusivity problem that comes with owning physical land. What IP has in common with owning land is the extraction of economic rent.

Economic land is anything that's fixed, finite, and not man-made, such as land, the electromagnetic spectrum, and orbitals.

Services like amazon and instagram are something of a puzzle to Georgists, but it's at least clear that Amazon and instagram benefits from labor and effort of the platform users. Without people selling on Amazon, there's no amazon. Without users, there's no reasons to be on instagram. To be perfectly clear, platform companies obviously put in labor to build their services, but the network effect isn't entirely of their own making.
by tracker1 | 2025-12-15 22:18:23+00:00
That's kind of the point of making it (relatively easily) accessibly... in order to ensure that secrets are wiped from memory as quickly as reasonable. This reduces a lot of potential surface area for potential attack.

I used to not really see the need for this level of detail on things... then you see useful (IE in the wild exploits) for even complex factors like CPU branch prediction (for a while now), and the need starts to become much more clear.
by api | 2025-12-15 22:18:51+00:00
The only two car companies to make any meaningful profit on EVs were founded as EV companies first?

That’s not that surprising. It’s very hard to make elephants dance.

If that remains true it means all these auto companies will be dead in 25 years, or eternally strung along on government support.

If there were no tariffs or other market barriers I get the impression that BYD would bulldoze the entire world and there would be one car maker with >80% of the market.
by yearolinuxdsktp | 2025-12-15 22:19:01+00:00
+1 I agree 100% use it everywhere and let LS/IDE infer it.

On top of that:

* Reduce refactoring overhead (a type can be evolved or substituted, if it duck types the same, the autos don't change)

* If using auto instead of explicit types makes your code unclear, it's not clear enough code to begin with. Improve the names of methods being called or variable names being assigned to.

I can see explicit types when you are shipping a library, as part of the API your library exposes. Then you want types to be explicit and changes to be explicit.
by pdonis | 2025-12-15 22:19:02+00:00
> Are you arguing that the workers being significant shareholders of companies is a better alternative to unions?

Once the companies start branching out to sell other things besides the service of organized labor, they're no longer just an alternative to unions. In what follows, I'm only talking about the aspect of selling organized labor as a service.

I do believe that workers owning companies that sell the service of organized labor is better for the workers than unions as they exist now in the sense that it would do better at improving the workers' bargaining position with the management of the companies that union workers now work for. But it also exposes the workers to business risks that unions as they are now don't have to face--the companies do. That's an unavoidable tradeoff--if you want more of the upside, you have to be willing to take more of the risk. I think that one of the main obstacles to unions as they are now properly representing workers' interests is their refusal to face that fact. Making the unions into worker-owned corporations would force the workers to face the tradeoff directly and decide which way they want to make it--take the increased risk and get more upside (by becoming owners of the worker-owned company selling organized labor as a service), or give up some upside to avoid the risk (by remaining as traditional employees of the companies they work for now).

> you restrict company ownership to the active employees

I'm not advocating this, at least not as a matter of law. A worker-owned corporation could certainly make it part of its charter that you have to be a worker in the relevant industry or with an appropriate set of skills in order to own a share of the company. In that sense the company would have no employees--every worker-owner's income would be dividends based on share ownership. But other companies would still be free not to do this--to have a more traditional ownership structure in which employees don't usually own any shares.
by johncolanduoni | 2025-12-15 22:19:08+00:00
That’s why the HTTP-01 challenge exists - it’s perfect for public single-server deployments. If you’re doing something substantial enough to need a load balancer, arranging the DNS updates (or centralizing HTTP-01 handling) is going to be the least of your worries.

Holding public PKI advancements hostage so that businesses can be lazy about their intranet services is a bad tradeoff for the vast majority of people that rely on public TLS.
by sfink | 2025-12-15 22:19:10+00:00
Appropriate amount of effort for what purpose? Is it appropriate for me to use ChatGPT on my mathematics test because it is the least effort required to pass the test? Or is it inappropriate because the goal should have been to learn the material?

Even something as straightforward as picking up a coffee mug runs into this. Just enough effort to be able to lift it without dropping, or enough to hang onto it if someone happens to bump into me?

I'm not disagreeing with the article, just pointing out that there is nuance that is easy to miss.

(Ok, I got a little triggered by the title, since I was just thinking about how 80% of my kid's mathematics class made it through by using ChatGPT for all of the homeworks, quizzes, and even the tests. The teacher doesn't want to police it, the administration doesn't care, and those kids learned almost nothing. "Zero effort == good" is a dangerous statement out of context.)
by codedokode | 2025-12-15 22:19:24+00:00
> What’s going on in that user object? The pin field seems suspiciously related to the PIN we were asked to input after creating our account

This might be the fault of opt-out serialization library (by default it serializes the whole object and you need to manually opt-out fields from it). So a programmer adds a field, forgets to add opt-out annotation and voilà.

Or they are just using plain JS dicts on the server and forgot to remove the key before using it in a response.

> The vulnerability they’re talking about was presented in a paper by researchers at the University of Vienna.

This vulnerability (mapping phone numbers to user id via rendevouz API) is old and was exploited in 2016 in Telegram [1] and allowed Iranian govt to build a phone book of 15M Telegram users. The paper also mentions that the vulnerability was known in 2012, still not fixed.

[1] https://telegram.org/blog/15million-reuters
by tastyface | 2025-12-15 22:19:26+00:00
Except "white" is not a race, but a fluid and constantly shifting ethnic category (https://en.wikipedia.org/wiki/White_people#Modern_racial_hie...). The very idea of white nationalism is folly. Irish and Italians (plus other southern Europeans) weren't even considered white until fairly recently, and Jewish whiteness always seems to be first on the chopping block once hardliners are in power. In other words, a white ethnostate is de facto a multicultural state, and once all the indisputably nonwhite people are eliminated, the remaining far-rightists will happily start killing each other.
by baq | 2025-12-15 22:19:49+00:00
Assuming you’re ok with connecting your receiver to the network, you should be able to wake the receiver if you detect the tv is on without any cables at all - if your tv is also on the network (I’ve got a home assistant automation doing exactly that) or you can use a $10 smart plug with power metering.

That said props for actually using HDMI-CEC! And it’s cheaper than most smart plugs (and probably safer, too)
by tredre3 | 2025-12-15 22:19:58+00:00
You misunderstand how licensing works. They can build an entirely closed source OS around the Linux kernel if they want. The only thing they'd have to publish is the changes to the kernel itself. I don't see why they'd need to modify the kernel so they'd have to publish absolutely nothing!

But to answer your question, umbrelOS is debian. You're right that they don't advertise that fact anywhere (that I've seen). They use rugpi to build a preconfigured image that includes their changes and their software. All the details are indeed public and open, if you know what you're looking for:

https://github.com/getumbrel/umbrel/tree/master/packages/os
by ekr____ | 2025-12-15 22:20:02+00:00
> "domain.xyz can request non-wildcard certs for up to 10 days validity"?

You could be proposing two things here:

(1) Something like CAA that told CAs how to behave. (2) Some set of constraints that would be enforced at the client.

CAA does help some, but if you're concerned about misissuance you need to be concerned about compromise of the CA (this is also an issue for certificates issued by the CA the site actually uses, btw). The problem with constraints at the browser is that they need to be delivered to the browser in some trustworthy fashion, but the root of trust in this case is the CA. The situation with RPKI is different because it's a more centralized trust infrastructure.

> For the second note, I think that friction is part of their point. Technically you can, practically that doesn't really do much.

I'm not following. Say you managed to start a new browser and had 30% market share (I agree, a huge lift). It still wouldn't matter because the standard is set by the strictest major browser.
by codepoet80 | 2025-12-15 22:20:22+00:00
Yup, my AppleTV is the only device that gets CEC right. Even my LG TV and LG soundbar get confused. And don’t get me started on the PS4 Pro’s garbage implementation. I’m sad that Logitech killed Harmony because CEC was supposed to make universal remotes obsolete — they’re still the only way my full home theater can function without juggling a dozen remotes.
by dbalatero | 2025-12-15 22:20:41+00:00
Your definition is more correct.

I'm close to some kind of mastery with cello, and broadly we tell students to play with zero tension.

This is useful to say (often they have way too much tension and need to really dial it back), but in reality there is _some_ tension in everything:

- left hand: the fingers are basically a conduit for your back weight, but they need enough strength to stand up and _act_ as a conduit, otherwise they'd collapse. (but they needn't do more)

- right hand: weight flows from the back, down the arm, into the index finger, and all power derives from that + bow speed + how close you are to the bridge. However, the thumb needs to engage enough to counterbalance the weight on top of the stick, otherwise the bow would clumsily fall over.

The key is, as you say, doing the bare minimum.
by phil294 | 2025-12-15 22:21:19+00:00
Depends on your definition of "using" JavaScript. The main difference between common TypeScript and TS-based JSDoc is the need for an additional build step. Being able to ftp-upload your `.js` files and then be done with it is a remarkable advantage over Vite/Webpack/whatever in small to medium-sized projects. If editor based type support is sufficient to you (i.e. no headless checks), you won't need to install any TS packages at all, either. tsserver is still used in the background, but so are thousands of other binaries that keep your editor, OS and computer running, so I don't see that as an argument.
by andrewjk | 2025-12-15 22:22:00+00:00
In my free time this year I've been working on a full stack JS framework called Torpor: https://torpor.dev (https://github.com/andrewjk/torpor)

Components are JS functions, containing UI that is (mostly) HTML, with reactivity only via proxied objects.

To test it out I built a distributed social media/microblog site called Redraft: https://redraft.social (https://github.com/andrewjk/redraft)

It's edge native (with a Cloudflare deploy button in that repo) with your posts stored in an SQLite file. You can log in to your site to post and comment on your own posts, and use a web extension to comment on posts from people you follow wherever they are on the web.

There are many bugs and missing features, the documentation is patchy, and it's probably riddled with security holes. Give it a go if you're feeling brave!
by smithoc | 2025-12-15 22:22:47+00:00
The parent comment, and the series of messages they linked to, are such peak "terminally online" content that I suspect nothing one can write here can help.

The paranoia and distrust is so intense that every statement will be seen as a coded phrase, "dog whistle" or obscure reference to some sinister thing.

Which is particularly unfortunate, because I think Elon's tweet is genuinely wrong and bad. But it kinda feels like these people need to disconnect from the internet and go for a walk. Maybe have a real life conversation with a real life regular person on the other side of the political aisle.
by bobbylarrybobby | 2025-12-15 22:22:53+00:00
Shouldn't most chemicals be assumed unsafe until proven otherwise? How many chemicals have we produced in a lab that have no harmful effects? Even medicine is bad for you, it's just better than the disease it's meant to treat. I don't know why we'd treat something designed to kill animals as safe for humans without studies showing that it's not harmful. (Well I do know why, but I don't know why voters go along with it.)
by red2awn | 2025-12-15 22:23:06+00:00
Very interesting release:

* Hybrid MoE: 2-3x faster than pure MoE transformers

* 1M context length

* Trained on NVFP4

* Open Source! Pretraining, mid-training, SFT and RL dataset released (SFT HF link is 404...)

* Open model training recipe (coming soon)

Really appreciate Nvidia being the most open lab but they really should make sure all the links/data are available on day 0.

Also interesting that the model is trained in NVFP4 but the inference weights are FP8.
by exabrial | 2025-12-15 22:23:15+00:00
I expected the "T word" to come out in the article, however this fails to address any of the practical reasons it isn't a good replacement for the value-engineered F-150:

* The price isn't right for small businesses. These trucks are quite expensive

* They're difficult to repair. A regular F-150 is designed to be repaired; these things are designed like iPhones to be disposable.

* Parts availability is scarce, contrasted with a regular F-150 (even junkyards are full of spare parts, that aren't software constrained)

* They're loaded with useless/barely-functional interior electronics that are poor copies of Tesla

* They're bloated with parts that don't need to exist (excessive exterior accent lighting, badges, over-complicated blinkers)

Oddly enough, single-charge range issues are pretty much non-existent (for non-towing applications).