MurphyA/hacker-news huggingface dataset:
by bottlepalm | 2025-12-18 19:58:14+00:00
I’ve used jquery which is very heavy into html fragments. It can get unwieldy compared to keeping all your rending logic in one place and applying data to it like in React. Other comments here validate the suspicion that HTMX can fall apart in large systems.

Unless you’re saying the components returned by HTMX are using the shadow dom for isolation, you can very easily run into styling problems by changing a style and not realizing some injected fragment of HTML somewhere relies on it being a certain way. I hope you’re using a monorepo because unlike typescript APIs, those HTML fragments and CSS styles are not type checked.
by colechristensen | 2025-12-18 19:58:18+00:00
My point is we all need to moderate our reactions to things based on actual scale, across the political spectrum rare events are being amplified to make people think they're prevalent disasters and it distorts too many peoples' reality.

There are much worse, much bigger problems and we need to constantly be reminding people of how big issues actually are. Book bannings are concerning but what is the size of the actual impact? I see this issue more of as an embarrassment for a handful of schools and boards who are bowing to moralizing fools, people are acting like they're afraid of an escalation to Fahrenheit 451 when we really should be mocking the book banners for their foolishness instead of being afraid of them.

This is far from the only issue suffering from a lack of sense of scale.
by extr | 2025-12-18 19:58:31+00:00
I think Claude is more practically minded. I find that OAI models in general default to the most technically correct, expensive (in terms of LoC implementation cost, possible future maintenance burden, etc) solution. Whereas Claude will take a look at the codebase and say "Looks like a webshit React app, why don't you just do XYZ which gets you 90% of the way there in 3 lines".

But if you want that last 10%, codex is vital.

Edit: Literally after I typed this just had this happen. Codex 5.2 reports a P1 bug in a PR. I look closely, I'm not actually sure it's a "bug". I take it to Claude. Claude agrees it's more of a product behavioral opinion on whether or not to persist garbage data, and offer it's own product opinion that I probably want to keep it the way it is. Codex 5.2 meanwhile stubbornly accepts the view it's a product decision but won't seem to offer it's own opinion!
by dlahoda | 2025-12-18 19:58:47+00:00
i was living in the same country with him, but i did not get any political context back then. my brain was washed by propaganda of ussr, usa and eu, and in state general ignorance of well fed burgeosy.

now i see how bad things going to north korea scenario. so what is better to live 4 generations of people in north korea or few years of turbulence?

for person who was intrested all was clear 25 years ago, were country was going. from these, 20 years were pleasing dictator by world. after is not better (even after his is not pleased anymore).
by andypants | 2025-12-18 19:59:13+00:00
Jai, odin and zig's creators are all part of the handmade network, a community of programmers. You are vastly underestimating blow's reach/influence.

Odin's creator has credited Jai as an influence. You can see him in the comments of old jai youtube videos (videos that go into a lot of depth about the language design). Odin's syntax and features are very similar to Jai, the influence is pretty clear. Odin has other influences of course but you could say it's "jai but open source".

Lastly, jai is not open source but it doesn't mean it's not available. You can message blow to get access to it. Many programmers have used it. There are third party jai libraries on github.
by glenstein | 2025-12-18 19:59:14+00:00
The creator of VLC has publicly noted dollar amounts they could raise if they either sold or compromised VLC, but it came and went without controversy. OBS Studio, 7-Zip, Notepad++, and Nextcloud have all published offers they've received and declined, or quoted per-install payment figures. In fact, it's practically a rite of passage for open source projects to talk about the value of their work in terms of what they could monetize but choose not to.

Communicating about what you're knowingly rejecting is a point of pride, not a confession. But since there's no such thing as an OBS, or Nextcloud, or VLC Derangement syndrome, nobody grabs the pitchforks in those cases.
Show HN: A native iOS client for managing Cloudflare
by Jeramo | 2025-12-18 19:59:24+00:00
I've been working on a native iOS app called Clouder. The goal is to provide a better experience than the mobile web dashboard for managing your infrastructure on the go.

The app supports a wide range of services. You can manage Compute resources like Workers deployments, Pages projects, Durable Objects, and Queues. It connects to your Storage and Data to let you query D1 databases, browse R2 buckets, and manage KV namespaces. It also handles Media features like Stream and Images, as well as AI products like Vectorize and Workers AI.

For general networking, you can manage DNS records, Tunnels, WAF rules, and view Zone analytics. The app supports multi-account setups, includes home screen widgets for traffic and database stats, and is localized in five languages. You log in directly using your Cloudflare API token.

I'd appreciate any feedback or feature requests.
by giraffe_lady | 2025-12-18 19:59:34+00:00
I don't know, I didn't come in here with particularly strong feelings about what "ban" means or should mean re books but people keep coming at me extremely hot for saying not much about it at all.

Personally I think using banned for "actively prevented from accessing in ways other books are not" makes plenty of sense even if you can effectively circumvent those attempts somehow.

The strict meaning that people seem to want to apply in here does not seem particularly useful to me. Almost no books have ever been banned by that standard, but there is a clearly organized movement in the US to remove all reference to queerness from public life. Flexible on nomenclature here but that context is very important.
by TimorousBestie | 2025-12-18 20:00:32+00:00
Much like the Hundred Flowers campaign led to the Anti-Rightist campaign, an Archipelago model makes it easier for the ambient sovereign power to crush and destroy the various micro-societies that interfere with its agenda.

Scott (redacted)’s original fictional instantiation of this theory worked around this problem, as I recall, by pretending no pre-existing sovereign power was around.
by autoexec | 2025-12-18 20:00:57+00:00
Seems like good practice to me to keep digital backups in your safe deposit box. Probably a good idea to check/refresh them every couple years too. When it comes to things like house fires and getting screwed by cloud providers everybody thinks that it can never happen to them even when examples of it happening to others exist. The important thing to make sure that you're covered in the event that the rare but catastrophic event does occur. Especially when the cost of doing so is so low. For back ups it amounts to little more than a thumb drive and a visit to your bank every couple years.
by AndrewKemendo | 2025-12-18 20:01:01+00:00
What crypto purists don’t appreciate is that money, commerce and economic activity is all a social function they’re not “technical problems”

When I first read the Satoshi white paper the immediate response I had as somebody who has studied political economics is that “this will never work because governments will never allow for disintermediation of their currency because it’s one of, if not THE, primary sources of control over a population”

The promise of crypto fundamentally misunderstands how humans work, relate, exchange, and negotiate energy and power.

Contracts are just an extension of politics, digital contracts are no different
by spicymaki | 2025-12-18 20:01:12+00:00
Librarians actually read the books and are experts in the curation of the books. It is not actually about moral authority it is about expertise.

Special accommodations are made for students. Parents can ask for their child not to participate in activities they deem inappropriate. I see this happen all of the time during Halloween events. It would be nice if Christian conservatives would do the same.
by catapart | 2025-12-18 20:01:16+00:00
As you should be able to tell from the other comments, this is not a library for me. If I had ever looked into it past trying to actually implement it, I would have realized that it's actually specifically for server-rendered content and using it for front-end development doesn't actually add much. The author made that very clear in the supporting documentation, I just never bothered to check.

So I relayed my personal experience with it and then, because of this great comment section, I became aware that I was trying to use it for things that it isn't helpful for. Because, yes, I would have to write custom JS for the functions I would try to invoke with invokers, but I would also have to write custom JS for the functions I would try to invoke with htmx. There's no change, for me, other than including 14kb that I do not need to run a PWA.

So you can take whatever issue you want with my impatience and my myopia in disregarding it as not useful, but my complaints are not immaterial. It doesn't do what I said it doesn't do, and you seem pretty happy to confirm that. I shouldn't have expected a cat to bark, and I regret it. Hell, I'd apologize if someone felt mislead, or if someone feels I'm misleading people in my aspersions. But - like any app - my apps swap out html all of the time and there's nothing that htmx provides that helps me with that in a way that's worth the weight.
by eps | 2025-12-18 20:01:28+00:00
Don't need to run studies to understand that.

If it's off be default it will stay off unless the user is somehow made to try it. Default opt-in is one option to do that, the simplest one, but it's not the only one. The rest require explaining clearly what the user will get out of enabling it ... and that often is difficult to do succinctly, or convincingly. So shovelling it down everyone's throat it is.
by slg | 2025-12-18 20:01:33+00:00
It's interesting that people are responding like this rather than answering my question. I know how democracy works and that includes the occasional instances of tyranny of the majority.

That still doesn't address my original question. Is there historic precedent for this type of micromanaging of school libraries (if you're adamant that we shouldn't use the B word) that most of us would still agree with today? Because many of the books on the list seem more likely to follow the path of eventual school classics like The Grapes of Wrath or To Kill a Mockingbird than they are to continue to be banned decades into the future.
by jfindper | 2025-12-18 20:02:10+00:00
>The school won't kick you out for having the book, but they won't buy it.

You keep saying this all over this thread, can you please tell me how you are reaching this conclusion?

I have linked you to at least one entire state (covering 40+ school districts) where what you are saying is completely false.

Typically, if a school bans something, it also means that the children are not allowed to bring the banned thing onto the school premises.
by ls612 | 2025-12-18 20:02:11+00:00
I enjoyed the Witness for a while but I bounced off it pretty hard in the Mountain. It wasn’t until I watched a let’s play on YouTube that I learned there was a film room, a hidden cave complex under the mountain, a time trial, and other optional secrets. I can absolutely understand a certain type of gamer liking this but for me Talos Principle (both 1 and 2) is peak puzzle genre.

That said I’ll probably buy this game if it comes out next year.
by bonesss | 2025-12-18 20:03:07+00:00
Pure speculation, but I feel the inference money is tiny compared to the speed and permanence of Office integrations MCP enables through the consultancy swarm.

MCP lets you glue random assed parts of services to mega-ultra-high critical business initiatives with no go between. Delivered through a personalized chat interface that will tell you how sexy you are and how you deserved to win at golf yesterday… from salesman to auto interface to forever contract in minutes.

MS sells to insecurities of incompetent management and facilitates territory marking at the expense of governments and societies around the world for mega bucks. MCP, obvious as it is technically, also lets them plug a library into existing services for a quick upgrade then an atomized upsell directly to the chat interfaces of upper management.

Microsoft’s CEO has talked about his agent swarm. Much like RPA this woo appeals strongly to the barely technical.
by ramon156 | 2025-12-18 20:03:18+00:00
> Option B: React (or Vue, or Svelte, or Angular if you're being punished for something).

> And suddenly you've got:

> A package.json with 847 dependencies

> A build step that takes 45 seconds (if the CI gods are merciful)

> State management debates polluting your pull requests

> Junior devs losing their minds over why useEffect runs twice

> A bundle size that would make a 56k modem weep

No? React is surprisingly small, and if you're in dependency hell then fix that. The alternative is another idiom.
by LorenPechtel | 2025-12-18 20:03:26+00:00
I don't think number interviewed is relevant--I don't care so much about exactly how their screening works, just that it lead to hires. The rest of it, though, definitely, and any job ad must include a link to the database.

But I would add one field: filled internally/externally/H1-B, rather than just "filled".
by chuckadams | 2025-12-18 20:03:26+00:00
I checked out stagex and hit `make`, and after the delightful initial bootstrap phase, I sat for hours watching eleventy thousand attempts to download gnulib (and many other gnu packages) time out and fail. Is there perhaps a tarball or other image available that collects all these packages together? Seems it would only add up to as much as the source packages of a small Linux distribution.

I've also noticed it's downloading many different versions of the same set of packages, which seems odd for bootstrapping a build. I finally lost patience and stopped it. Sure, in the real world I'll probably start from a stage3 container, but so far, trying it out for myself has been pretty disappointing.
by marpstar | 2025-12-18 20:03:45+00:00
It goes far beyond that. The Iowa legislature has already moved to make changes to how libraries work in Iowa as a result of all of the attention these issues are getting here. They're essentially trying to condense the power to the state level instead of at the municipal level, where it belongs. It's a power grab that'll have repercussions that may very well cause the smallest of libraries here to cease existing.

And it all started with people complaining about books in the library.
by necovek | 2025-12-18 20:04:41+00:00
Wow, that's a very arbitrary practice: do you remember roughly when was that?

I was in a team in 2006 where we did the regular, 2-approve-code-reviews-per-change-proposal (along with fully integrated CI/CD, some of it through signed email but not full diffs like Linux patchsets, but only "commands" what branch to merge where).
by ChrisArchitect | 2025-12-18 20:05:05+00:00
Episode 001 - Fingal Ferguson, Master Knifemaker

https://www.youtube.com/watch?v=eD1bI4LGobw

Episode 002 - Christophe Laudamiel, Master Perfumer

https://www.youtube.com/watch?v=DwyOvhRIpu4
by koolala | 2025-12-18 20:05:23+00:00
Is it just as easy to make an extension that runs a local AI translation model? Translation would benefit from having a community continuously updating and tuning local models for languages.

If it was an extension it would be nice if people could fork it with other models. Just like their AI Tab Grouping feature would be much better forked with a deterministic non-AI grouping system.
by FeepingCreature | 2025-12-18 20:05:24+00:00
If only there was a widely used vector format that had script support and also decades of work on maintaining a battle-tested security layer around it with regular updates on a faster release cycle than your browser. That'd be crazy. Sure would suck if we killed it because we didn't want to bother maintaining it anymore.

(Yes I'm still salty about Flash.)
by ok_dad | 2025-12-18 20:05:45+00:00
> Yes. I have lost count of the number of PRs that have come to me where the developer added random blank lines and deleted others from code that was not even in the file they were supposed to be working in.

That’s not a great example of lack of care, of you use code formatters then this can happen very easily and be overlooked in a big change. It’s also really low stakes, I’m frankly concerned that you care so much about this that you’d label a dev careless over it. I’d label someone careless who didn’t test every branch of their code and left a nil pointer error or something, but missing formatter changes seems like a very human mistake for someone who was still careful about the actual code they wrote.
by theshrike79 | 2025-12-18 20:05:48+00:00
A coworker had this anecdote decades ago.

There's a difference between 10 years of experience and 1 year of experience 10 times.

YOE isn't always a measurement of quality, you can work the same dead-end coding job for 10 years and never get more than "1 year" of actual experience.
by dymk | 2025-12-18 20:06:22+00:00
Oh, yes, the Rust team does "market research" and interviews people to see how they use the language, where the pain points are, etc. They have talks at Rustconf about how they gather information on how the language is used. Never seen them mention Jai.

https://www.youtube.com/watch?v=f0N3m8U0b2k
by da_grift_shift | 2025-12-18 20:06:22+00:00
>Also not much excuse for xss these days.

XSS is not dead, and the web platforms mitigations (setHTML, Trusted Types) are not a panacea. CSP helps but is often configured poorly.

So, this kind of widespread XSS in a vulnerable third party component is indeed concerning.

For another example, there have been two reflected XSS vulns found in Anubis this year, putting any website that deploys it and doesn't patch at risk of JS execution on their origin.

Audit your third-party dependencies!

https://github.com/TecharoHQ/anubis/security/advisories/GHSA...

https://github.com/TecharoHQ/anubis/security/advisories/GHSA...
by haileybayliss | 2025-12-18 20:06:48+00:00
Corti (research lab and infrastructure for healthcare) has developed a new interpretability method, Gradient Interaction Modification (GIM), and it ranked #1 on the global Hugging Face MIB benchmark, outperforming approaches from Meta, Harvard, Cambridge, and DeepMind-affiliated researchers.

Why this matters: Why it matters: This is one of the first methods that can reliably inspect the internal “circuits” behind a model’s decisions at modern scale. Regulators, enterprise safety teams, and researchers have flagged the lack of visibility into model reasoning as a mounting risk. (Gartner recently noted that many enterprises are delaying broad AI deployment until these transparency gaps are resolved.)

What’s new:

GIM reveals causal neural pathways in seconds instead of months

Works on real-world, billion-parameter models

Identifies the interactions behind a model’s behavior — where traditional tools miss key mechanisms

Corti is open-sourcing the method
by blturner | 2025-12-18 20:06:56+00:00
This is one of the reasons the used market for Apple devices is absolutely fraught with danger. If an Apple ID is left active on the device, only Apple can reset it. In most cases, they will only do that if they are provided the original purchase receipt for the serial number associated with the device. So in theory, removing the activation lock from owned devices is possible in a situation where a locked apple ID cannot be recovered if you are the original owner. IMO, there should be a process to release devices that haven't been used for a certain amount of time AND haven't been reported stolen. But there's very little incentive for Apple to do this.
by verdverm | 2025-12-18 20:06:59+00:00
Claude did not say don't use MCP because it pollutes the context

What they said was don't pollute your context with lots of tool defs, from MCP or not. You'll see this same problem if you have 100s of skills, with their names and descriptions chewing up tokens

Their solution is to let the agent search and discover as needed, it's a general concept around tools (mcp, func, code use, skills)

https://www.anthropic.com/engineering/advanced-tool-use
by tristor | 2025-12-18 20:07:31+00:00
> it dawned on me that what I was doing was basically indistinguishable from money laundering. Of course it was NOT money laundering

But it is money laundering, that's what manufacturing spend is. It's not money laundering to hide evidence of a crime, but it is money laundering for the purpose of hiding the fact that you didn't engage in commerce in the process of spending money on a credit card to earn a reward. It's indistinguishable, only because we criminalize behavior not only on its base but due to its intent.
by LorenPechtel | 2025-12-18 20:07:56+00:00
I don't think it's a non-competitive environment, but that the interests are out of alignment. The penalty for the manager who makes a bad hire is a lot worse than the manager who fails to make a hire.

And we also have the same problem that plagues modern life: the glut of choices leading people to think they can do better than they can. The pool is effectively infinite, there must be a better option somewhere. Companies don't hire. Dating has become very hard. Both lie behind very superficial screening gates that do not represent actual value.
by poorman | 2025-12-18 20:08:03+00:00
All SVGs should be properly sanitized going into a backend and out of it and when rendered on a page.

Do you allow SVGs to be uploaded anywhere on your site? This is a PSA that you're probably at risk unless you can find the few hundred lines of code doing the sanitization.

Note to Ruby on Rails developers, your active storage uploaded SVGs are not sanitized by default.
by llmslave2 | 2025-12-18 20:08:44+00:00
This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k.

If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending like they were doing real engineering, when it turns out nobody there seems to know what they're doing, but they've managed to convince some big names to use them.

Man, it's like everything I hate about modern tech. Good job Eva for finding this one. Starting to think that every AI startup or company that is heavily using gen-ai for coding is probably extremely vulnerable to the simplest of attacks. Might be a way to make some extra spending money lol.
by tgsovlerkhgsel | 2025-12-18 20:09:03+00:00
No, it wouldn't. Because the average user might actually want the features, and if you default to "no" without asking people even once, the users who want it won't find it.

That's why it should ask - once. And offer a "FUCK OFF NEVER ASK ME AGAIN" button rather than "Ask me again later".