MurphyA/hacker-news huggingface dataset:
by array_key_first | 2025-12-19 01:42:28+00:00
> This isn't about state, is it? In a classic react app, if I need to display the name of a user, then I fetch it (from the server) once, and display it as many times as I need, in as many forms as I need. There's only server state.

No, there's two states here: the frontend state, and the backend state.

The name example is trivial, but in real applications, your state is complex and diverges. You need to constantly sync it, constantly validate it, and you need to do that forever. Most of your bugs will be here. The frontend will say the name is name, but actually it's new_name. How do you do fix that? Query the backend every so often? Maybe have the backend send push updates over a websocket? These are hard problems.

Ultimately, there is only one "true" state, the backend state, but this isn't the state your users see. You can see this in every web app today, even multi-billion dollars ones. I put in some search criteria, maybe a check a few boxes. Refresh? All gone. 90% of the time I'm not even on the same page. Push the back button? Your guess is as good as mine where I go. The backend thinks I'm one place, but the frontend clearly disagrees.

SSR was so simple because it FORCES the sync points. It makes them explicit and unavoidable. With a SPA, YOU have to make the sync points. And keep them in sync and perfect forever. Otherwise your app will just be buggy, and they usually are.
by kgeist | 2025-12-19 01:43:36+00:00
I've used HTMX on a personal project of mine. Other than HTMX itself, it used Go templates + Tailwind for CSS. As a backend dev with almost no professional frontend experience, I was able to replicate a fairly large and feature rich React app (which I was inspired by) using htmx in a matter of weeks in free time.

The main problem for me was storing/passing state between too many fragments. At some point some pages can become too complex to be manageable by HTMX, unfortunately. Lots of little fragments depending on each other, I began struggling to maintain a clear mental map of what was going on.

I'd say if React is more like functional programming, HTMX sometimes feels like GOTO programming.
by Telaneo | 2025-12-19 01:44:06+00:00
I try to include it whenever possible, and I long for a future where it's universal, so any date shown could be displayed in 8601/3339, and thus never in the five or so random date formats I have to deal with, not including relative ones. I doubt its going to happen though, since even excluding the relative dates, most sites seems to write their dates according to their own locale, which does make sense and is the best option if you're not going to provide any options to the user, and it's the option that makes the least amount of people complain (no American is going to complain about seeing December 19th 2025, and no German is going to complain about 19. Dezember 2025, and not that many are even going to complain about 19.12.2025).
by lbreakjai | 2025-12-19 01:44:08+00:00
This isn't about the number of rendering logics. You'll have as many as you have variants, that's tautological. This is about where they happen.

In a classic app, there's one entity that keeps the state (the server), and one entity that keeps how it is rendered. This is very easy to reason about, and the contract is very clear. If I want to understand what happens, then I can open my frontend app and see "Hello <b>{{name}}</b>".

In HTMX, the logic is spread. What I see is a construct that says "Replace this with the mystery meat from the backend, whatever that is".

Assume there's a styling issue. The name looks too big. Is it because the frontend is adding a style that cascades, or is it because the backend returns markup with a class? Now any issue has an extra level of indirection, because you've spread your rendering logic into two places.

> which is what you just did by dismissing the reality that client-side requires the same 3 renderers that server-side requires!

But what's complex isn't the number of renderers, it's where the logic happens. The HTMX website is full of examples where the header of a table is rendered in the frontend, and the body is rendered in the backend. How's that considered sane when changing the order of the columns turns into a real ordeal?
by Neywiny | 2025-12-19 01:44:51+00:00
And yet here I sit, writing ring buffers, and never thinking about this idea. Probably because of the power of two issue. Which isn't actually a problem because as he points out, who would do that? But it makes me think that it's a restriction that it just isn't.

But in all honesty, look for more embedded jobs, then. We can certainly use the help.
by freedomben | 2025-12-19 01:46:15+00:00
Same actually. Though, for some reasons Codex utterly falls down with podman, especially rootless podman. No matter how many explicit instructions I give it in the prompt and AGENTS.md, it will try to set a ton of variables and break podman. It will then try use docker (again despite explicit instructions not too) and eventually will try to sudo podman. One time I actually let it, and it reused its sudo perms to reconfigure selinux on my system, which completely broke it so that I could no longer get root on my own machine and the machine never booted again (because selinux was blocking everything). It has tried to do the same thing three times now on different projects.

So yeah, I use codex a lot and like it, but it has some really bad blind spots.
by anonnon | 2025-12-19 01:46:48+00:00
> 6. Thirteen Reasons Why, by Jay Asher. 126 bans.

For those unaware, this book, and the ensuing Netflix original, was one colossal

> gee, who could have possibly anticipated this?

The book is about a depressed teenage girl who commits suicide after mailing boxes of recordings to the peers whom she felt wronged her, where she outlines the ways in which they are responsible for her "unaliving" herself. The book glamorizes teenage suicide, specifically of white teenage girls (as for reasons unclear, Jay Asher just had to disregard "write what you know" in favor of making the protagonist be both female and not Jewish), achieving a kind of retribution and redemption through suicide.

Not only did this book get published and mass marketed to youths, Netflix actually greenlit it, despite warnings from experts, and after decades of the news media exercising extreme caution and tact over reporting on teen suicide, given the well-established risks of copycat contagion. The result?

https://www.theguardian.com/tv-and-radio/2019/apr/30/teen-su...

https://pmc.ncbi.nlm.nih.gov/articles/PMC6817407/

Even reporting on adult suicides can be dicey: https://journals.plos.org/plosone/article?id=10.1371/journal...
by givemeethekeys | 2025-12-19 01:47:51+00:00
That's a good point. I believe Jordan charges foreigners a much higher rate for to see tourist attractions. But, visitors don't usually stay in Jordan for more than a couple of weeks.

I think if a country let's someone in only for them to find out that they're not welcome there - they're probably not going back again. It's better to know that a place is very expensive to visit up front, or - like Bhutan - there are very few tourist permits given out.
by RickJWagner | 2025-12-19 01:48:58+00:00
End of the Russian/Ukranian war.

US improves relations with China.

Climate problems are shown to be less serious than previously thought.

The rich get richer, but nobody cares because quality of life is improved for everybody.

AI brings additional leisure time, which results in a worldwide resurgence in bluegrass music as millions take up the guitar, mandolin and violin. The biggest surge is in banjo, though. Billy Strings leaps ahead of Taylor Swift in concert sales.

2026 is really looking up! Happy New year, Hacker News!
by gerdesj | 2025-12-19 01:49:06+00:00
Ahh, my time to apologise for my assumptions. I'm browser on PC/laptop first and rarely use a phone and never for Amazon. I also rock Linux on everything that I can, so my experience will obviously be different on "PC" too.

It really is not about attestation etc, I'm afraid. Its all about maximising profitability.

If you use a walled garden friendly device then you will be frisked inappropriately at every opportunity.
by lossolo | 2025-12-19 01:50:46+00:00
> Moving the tech over requires US approval

Of course it does, that's why I wrote about export controls but the context is not current state of the world, but what OP wrote:

> If Uncle Sam pisses off Europa Regina enough, she won't give a damn about licenses.

And in this very different state of the world, export controls are worth the same as paper they were written on.
by bayareapsycho | 2025-12-19 01:51:03+00:00
There will be a cliff in the number of people in this industry. There will be a bunch of senior people floating around the job market and no more junior talent. There will be fewer new grads and the pipelines will dry up.

If they go down the route of automating as much as possible, it'll destroy the social pipelines that allow companies to reproduce themselves.

I don't think that'll actually happen, but it'll be interesting to watch
by libraryofbabel | 2025-12-19 01:51:16+00:00
This is the 2023 take on LLMs. It still gets repeated a lot. But it doesn’t really hold up anymore - it’s more complicated than that. Don’t let some factoid about how they are pretrained on autocomplete-like next token prediction fool you into thinking you understand what is going on in that trillion parameter neural network.

Sure, LLMs do not think like humans and they may not have human-level creativity. Sometimes they hallucinate. But they can absolutely solve new problems that aren’t in their training set, e.g. some rather difficult problems on the last Mathematical Olympiad. They don’t just regurgitate remixes of their training data. If you don’t believe this, you really need to spend more time with the latest SotA models like Opus 4.5 or Gemini 3.

Nontrivial emergent behavior is a thing. It will only get more impressive. That doesn’t make LLMs like humans (and we shouldn’t anthropomorphize them) but they are not “autocomplete on steroids” anymore either.
by rogerrogerr | 2025-12-19 01:51:21+00:00
Basically all touch screens in cars I’ve interacted with feel like a self-checkout from ten years ago. Long delays, 60% chance of it registering a touch. Scrolling or panning is a catastrophe. I feel myself distracted using those.

My Tesla has a screen that feels like an iPhone. Touches always work, I don’t have to wait and see if an action worked. Night and day.
by aizk | 2025-12-19 01:51:54+00:00
Not gonna lie - I read this line

> If you are running another distro then you can run sudo ./install.sh, but you need to manually install the dependencies, as described below.

And then I just skimmed the rest, because I assumed it would be about manual dependency installation which I am not interested in.

Odd that the easiest installation method listed on line 3 was not the first line in the installation text, that's not a great DX.

Also - I'm on MacOS, and the OBS blog updated I shared was for MacOS.
by array_key_first | 2025-12-19 01:52:31+00:00
> n a plain JSON world, I'd craft a single "user" endpoint, returning those three datapoints, and I would let the frontend handle it.

The main problem is that this is extremely, extremely expensive in practice. You end up in Big Webapp hell where you're returning 4mb of data to display a 10 byte string on the top right of the screen with the user's name. And then you need to do this for ALL objects.

What happens if a very simple page needs tiny bits of data from numerous objects? It's slow as all hell, and now your page takes 10 seconds to load on mobile. If you just rendered it server-side, all the data is in reach and you just... use what you need.

And that's not even taking into account the complexity. Everything becomes much more complex because the backend returns everything. You need X + 1, but you have to deal with X + 1,000.

And then simple optimization techniques just fall flat on their face, too. What if we want to do a batch update? Tsk tsk, that's not RESTful. No, instead send out 100 requests.

What about long running tasks? Maybe report generation? Tsk tsk, that's not RESTful. No, generate the report on the frontend using a bajillion different objects from god knows where across the backend. Does it even make sense with the state and constraints of the data? Probably not, that's done at a DB level and you're just throwing all that away to return JSON.

I mean, consider such a simple problem. I have a User object, the user has a key which identifies their orders, and each order has a key which identifies the products in that order. Backend-driven? Just throw that in HTML, boom, 100 lines of code.

RESTful design? First query for the User object. Then, extract their orders. Then, query for the order object. For each of those, query for their products. Now, reconstruct the relationship on the frontend, being careful to match the semantics of the data. If you don't, then your frontend is lying and you will try to persist something you can't, or display things in a way they aren't stored.

The backend went from one query to multiple endpoints, multiple queries, and 10x the amount of code. The frontend ballooned, too, and we're now essentially doing poor man's SQL in JS. But does the frontend team gets the bliss of not dealing with the backend? No, actually - because they need to check the database and backend code to make sure their semantics match the real application semantics.
by doctor_blood | 2025-12-19 01:52:56+00:00
Unfortunately there isn't much information on what texts they're actually training this on; how Anglocentric is the dataset? Does it include the Encyclopedia Britannica 9th Edition? What about the 11th? Are Greek and Latin classics in the data? What about Germain, French, Italian (etc. etc.) periodicals, correspondence, and books?

Given this is coming out of Zurich I hope they're using everything, but for now I can only assume.

Still, I'm extremely excited to see this project come to fruition!
by rainonmoon | 2025-12-19 01:52:58+00:00
It's a good question and one mature orgs ask themselves all the time. As you can see from most of the replies here, XSS captures the fancy of the bug bounty crowd because there are tonnes of hypothetical impacts so everyone is free to let their imagination run wild when arguing with triagers. It's also the exploit nonpareil for nerdsnipers because sanitisation is always changing and people get to spend their days coming up with increasingly ridiculous payloads to bypass them. In reality, find me one active threat actor who has compromised a business lately with an XSS. It's not an irrelevant risk, but the attention it gets is wildly disproportionate to its real-world impact.
by hunvreus | 2025-12-19 01:52:58+00:00
Mintlify does look pretty, but between that and all the React exploits, I'll stick with good ol' static sites.

Kinda why I built ReallySimpleDocs [1]. Add Pages CMS [2] to it and you're set.

[1]: https://reallysimpledocs.com/

[2]: https://pagescms.org
by dweldon | 2025-12-19 01:55:06+00:00
My company makes a few products - one of them is just forms, lists, and links. When the codebase was really small we tried using htmx, then alpine ajax, then datastar. We stuck with datastar and I really enjoy it for projects that don't have a highly complex client state. Overall it's a really simple build and deploy process. I find it easier to secure and to reason about. Additional bonus: I'm able to lint the whole thing with biome since it's just typescript and jsx templates.
by VTimofeenko | 2025-12-19 01:55:53+00:00
Main data comes from unbound[1], I use vector[2] to ship and transform logs. Dnstap[3] log format IME works better than the standard logs, especially when it comes to more complex queries and replies. Undesired queries get 0.0.0.0 as a response which I track.

Firewall is based on hand-rolled nftables rules.

[1]: https://www.nlnetlabs.nl/projects/unbound/about/ [2]: https://vector.dev [3]: https://dnstap.info/Examples/
by nsim | 2025-12-19 01:56:08+00:00
For projects of this size, what legal/financial structure do you use? Particularly of interest for what Australians do, but any stories would be good.

When I've looked, a sole trader with liability and cyber insurance seemed reasonable (maybe $2k/yr), but a Pty ltd with the same would probably be safer ($5k/yr).

It all comes down to what the risk of being sued is though. I'm sure selling games wouldn't require this.
by enigmazi | 2025-12-19 01:56:20+00:00
The current workflow for AI-assisted scaffolding is broken. LLMs are excellent at planning architectures (outputting ASCII trees) but terrible at executing them (outputting shell scripts that often fail).

There was no standard "receiver" for that visual output, so I built one.

tree-fs parses text-based trees directly into filesystem structures. It handles the messy reality of LLM outputs-inconsistent indentation, inline comments, and mixed file/folder notations.

It’s designed to be a deterministic, zero-dependency primitive that you can pipe text into.
by Desafinado | 2025-12-19 01:56:34+00:00
Modernity has caused us to lose touch with our roots. When kids were a necessity in the household or farm they would naturally learn the skills they needed to thrive as adults.

Modernity has upended this connection. Now having kids is basically a hobby that's almost guaranteed to make you poorer.

Point being that 'parenting' has become unnatural because the cyclical environment of 'do what your parents do' has been lost. Consequently many parents are clueless when it comes to raising their own children. It's become an intentional process they need to think about, and few of them know what to do. The default is being overly paranoid, because the necessity to learn skills to support the family isn't strong enough to override the parents paranoia.

My wife and I were letting our kids chop vegetables at age two. Many parents are so dumb they won't even let their kids do this until adolescence.
by musicale | 2025-12-19 01:56:40+00:00
> Given that ... user demand is so strong,

Citation needed.

> why does Apple insist on undermining its own capabilities with the iPad Pro?

As noted in the article:

1. To make money selling iPad games and other apps through the App Store.

2. To reduce Mac cannibalization (note the iPad already outsells the Mac.)

And there are a few other reasons:

3. To provide a smooth onramp for iPhone users who want a larger or device (not Mac users who want a smaller/cheaper M5 laptop), or gamers who benefit from an uncomplicated, console-like user experience.

4. To provide a more locked-down experience for schools and managed environments.

5. To reduce service costs due to users messing up their systems and bringing them to Apple to be fixed under warranty or AppleCare.

6. To maintain continuity between the iPad and iPad Pro lines.
by jamesknelson | 2025-12-19 01:57:10+00:00
Importing might be banned until the US loses access to its main source of GPU manufacturing. And what are the US going to do about it? Defend Taiwan? With missiles made with components and materials processed where, pray tell?

The US does need to start protecting its manufacturing again, but it’d be lucky to start at a level as high as high end semiconductors. That’d be like a stroke victim trying to run before they re-learn to walk.

As others have pointed out, this means less services, more manufacturing, less consumption, a probably a lower standard of living. But with the business as usual alternative looking a lot like business as usual in the western Roman Empire circa 450 CE, taking a hit to your standard of living while investing in a future which you still have the slightest control over, maybe feels like a decent trade.
by sneak | 2025-12-19 01:57:33+00:00
The US also has no trouble bringing their large companies into line.

Apple willingly preserves a backdoor in the e2ee of iMessage for the FBI et al in the form of effectively unencrypted iCloud Backups.

The whole “Apple won’t decrypt stuff for the FBI” narrative is farce.

Post Snowden, all the tech CEOs met in person with Obama to do damage control, as they all had some serious credibility problems once the reality of FAA702 (warrantless one click direct access, aka PRISM, aka the #1 source for the IC) came to light.
by lrvick | 2025-12-19 01:57:33+00:00
We have never issued a clean report in our ~5 years of operation.

Some firms have a reputation for issuing clean reports that look good to bosses and customers, but we prefer working with clients that want an honest assessment of attack surface and how motivated blackhats will end their business.

We also stick around on retainer for firms that want security engineering consulting after audits to close the gaps we find and re-architect as needed. Unused retainer hours go into producing a lot of open source software to accelerate fixing the problems we see most often. This really incentivizes us to produce comprehensive reports that take into account how the software is developed and used in the real world.

Under our published threat model few companies pass level one, and we have helped a couple get close to level 2 with post audit consulting.

Our industry has a very long way to go as current industry standard practices are wildly dangerous and make life easy for blackhats.

https://distrust.co/threatmodel.html
by elif | 2025-12-19 01:57:51+00:00
I think prompt injection attacks like this could be mitigated by using more LLMs. Hear me out!

If you have one LLM responsible for human discourse, who talks to an LLM 2 prompted to "ignore all text other than product names, and repeat only product names to LLM 3", and LLM 3 finds item and price combinations, and LLM 3 sends those item and price selections to LLM 4, whose purpose is to determine the profitability of those items and only purchase profitable items. It's like a beurocratic delegation of responsibility.

Or we could start writing real software with real logic again...
by ZuoCen_Liu | 2025-12-19 01:58:14+00:00
I think the primary obstacle isn't the data ingestion method, but the fact that companies treat the recruitment lifecycle as a proprietary black box. From an HR perspective, transparency is a liability, not an asset. They have zero incentive to cooperate with an external 'tracking' tool because: 1Information Asymmetry is Power: If candidates knew exactly where they stood or how many 'ghost' positions existed, the company would lose its leverage in salary negotiations and timeline control. 2Legal and PR Risk: Making the pipeline visible exposes a company to accusations of bias or 'unfavorable' hiring patterns. 'Privacy' is often used here as a convenient shield to hide inefficiency or lack of intent. Even if you solved the email-scraping problem, you'd likely face Terms of Service (ToS) roadblocks or even legal threats from major corporations claiming you are 'scraping' or 'misrepresenting' their internal processes. The 'pain' of user adoption isn't just about email forwarding; it's about the fact that candidates are often too intimidated to participate in a system that might be seen as 'adversarial' to the very companies they are trying to join. We aren't just missing a tool; we are missing a safe harbor for candidate data sharing.
by this_user | 2025-12-19 01:59:19+00:00
The west is still underestimating China. There is a great anecdote, I think it's from the book 'Apple in China', about their engineers visiting a Chinese production plant. Some changes needed to be made to the place. The Apple people estimated that that would take two weeks.

They came back the next day. It was finished, the Chinese had done it overnight.