MurphyA/hacker-news huggingface dataset:
by josephg | 2025-12-22 23:52:12+00:00
> i dont know what the solution here is other than stop using npm

Personally I think we need to start adding capability based systems into our programming languages. Random code shouldn't have "ambient authority" to just do anything on my computer with the same privileges as me. Like, if a function has this signature:

function add(a: int, b: int) -> int

Then it should only be able to read its input, and return any integer it wants. But it shouldn't get ambient authority to access anything else on my computer. No network access. No filesystem. Nothing.

Philosophically, I kind of think of it like function arguments and globals. If I call a function foo(someobj), then function foo is explicitly given access to someobj. And it also has access to any globals in my program. But we generally consider globals to be smelly. Passing data explicitly is better.

But the whole filesystem is essentially available as a global that any function, anywhere, can access. With full user permissions. I say no. I want languages where the filesystem itself (or a subset of it) can be passed as an argument. And if a function doesn't get passed a filesystem, it can't access a filesystem. If a function isn't passed a network socket, it can't just create one out of nothing.

I don't think it would be that onerous. The main function would get passed "the whole operating system" in a sense - like the filesystem and so on. And then it can pass files and sockets and whatnot to functions that need access to that stuff.

If we build something like that, we should be able to build something like npm but where you don't need to trust the developers of 3rd party software so much. The current system of trusting everyone with everything is insane.
by ursAxZA | 2025-12-22 23:52:30+00:00
I get the intuition behind fully socializing it,
but I wouldn’t go that far.
Single-operator systems lose redundancy fast, and that’s dangerous for infrastructure.

A layered mix — county-level public utilities, some private operators, and some hybrid/municipal entities — might be closer to a resilient structure.

Not clean or elegant, but fault-tolerant.
by userbinator | 2025-12-22 23:52:53+00:00
Meanwhile locking down those apps so the only apps with a certain signature can read from your WhatsApp means that if you want to back up your messages or read them for any legitimate purpose you're now SOL, or reliant on a usually slow, non-automatable UI-only flow.

...and this gives them more control, so they can profit from it. Corporate greed knows no bounds.

I'm glad that modern computers are more secure than they have been

I'm not. Back when malware was more prevalent among the lower class, there was also far more freedom and interoperability.
by FireBeyond | 2025-12-22 23:52:57+00:00
I have absolutely zero faith in any of this.

Multiple cases have revealed that it seemed like police and Shotspotter worked hand-in-glove to tweak Shotspotter data and demographics to help shore up a case and make things appear more reliable than they were.

And multiple cases where, sufficiently pushed, DAs have dropped cases or dropped Shotspotter as evidence rather than have the narrative challenged too closely.
by mlhpdx | 2025-12-22 23:53:15+00:00
I see your point but that’s not mine at all.

People use these tools for a variety of reasons (as diverse as people’s experiences). One can use an LLM to help express a perspective or develop and opinion (very important for those who struggle to communicate), or one can fake a picture or voice for fraud, or a million other purposes. It’s just a tool. How it gets used is about the people, not the tool.
by schmuckonwheels | 2025-12-22 23:53:20+00:00
Nothing to do with my comment or your reply specifically. I suspected bot voting manipulation and this entire discussion is filled with absolutely stupid Reddit-style comments. People posting substantive comments were being downvoted.

Some of the dumbest, low quality comments I read here come from 10+ year old accounts so account age has no correlation to discussion quality.

I can't argue in good faith when everyone is acting like children.
by ahachete | 2025-12-22 23:53:27+00:00
Thank you for your feedback. I'm trying to extract possible improvement actions from your comment, and here are my thoughts.

That certificate expiry issue was unfortunate, but was resolved (if I'm not mistaken) a couple of years ago.

StackGres is just a control plane, your database is as stable as a standalone one. StackGres itself may fail and it won't affect your database, it's not on the data plane. Indeed, it has a feature to "pause it" if you need to perform some manual operations (otherwise everything is automated).

There are procedures to reconstruct a database from PVC. It's arguably tedious, but should be much simpler than running a Postgres pod without the help of an operator like StackGres.

As for the ratio of issues: most of the issues that we get are feature and/or extensions requests, and certainly we can't tackle them all. Most, if not all, outstanding issues are addressed within a reasonable time frame. Is there any particular issue that would itch you that is open? I'd be happy to personally review it. Yet, there are as of today more than 2K closed issues, I won't call that a small number.

I'd also weight the importance of issues, like the split brain that CNPG suffers [1] and that apparently won't even be solved. StackGres relies instead on the trusted and reputed Patroni, which is known NOT to risk split brains that could lead to severe data loss.

[1]: https://github.com/cloudnative-pg/cloudnative-pg/discussions...
by mlinhares | 2025-12-22 23:53:56+00:00
There's also the surprise factor that it just never gets cheaper, the newly formed monopolies quickly take over and push prices up beyond what they were before and milk the cow they were given until all customers are bled dry.

People that missed the solar bandwagon during the Biden admin are going to regret dearly not having installed it at the price and interest it was back then, we'll never see that again.
by hallole | 2025-12-22 23:53:57+00:00
"Stop calling it soy MILK! There's no such thing as oat MILK! Milk comes from COWS."

What should they call it, then? Oat beverage? Soy water? No, that's silly. They are, functionally, milks. That's an apt descriptor.

Ditto for other vegan alternatives.
by mechagodzilla | 2025-12-22 23:54:00+00:00
I've been running the 'frontier' open-weight LLMs (mainly deepseek r1/v3) at home, and I find that they're best for asynchronous interactions. Give it a prompt and come back in 30-45 minutes to read the response. I've been running on a dual-socket 36-core Xeon with 768GB of RAM and it typically gets 1-2 tokens/sec. Great for research questions or coding prompts, not great for text auto-complete while programming.
by koito17 | 2025-12-22 23:54:01+00:00
This reminds me of a story where an OCR error[1] likely contaminated training data (and the English language) with the term "vegetative electron microscopy". The article I linked also shows that some journals defended the legitimacy of the terminology.

I'm not sure if this class of error really counts as a hallucination, but it nonetheless has similar consequences when people fail to validate model outputs.

[1] https://news.ycombinator.com/item?id=43858655
by default-kramer | 2025-12-22 23:54:39+00:00
I formerly worked for a travel company. It was the best codebase I've ever inherited, but even so there were select N+1's everywhere and page loads of 2+ seconds were common. I gradually migrated most of the customer-facing pages to use hand-written SQL and Dapper; getting most page loads below 0.5 seconds.

The resulting codebase was about 50kloc of C# and 10kloc of SQL, plus some cshtml and javascript of course. Sounds small, but it did a lot -- it contained a small CMS, a small CRM, a booking management system that paid commissions to travel agents and payments to tour operators in their local currencies, plus all sorts of other business logic that accumulates in 15+ years of operation. But because it was a monolith, it was simple and a pleasure to maintain.

That said, SQL is an objectively terrible language. It just so happens that it's typically the least of all the available evils.
by Tarean | 2025-12-22 23:54:57+00:00
Intellij also has structural search and replace, where you can do full subgraph isomorphism search in the code and with patterns like

$x$.foo($args$)

Where you add filters like x's type is a subclass of some class, and args stands for 0-n arguments.

You can also access the full intellij API via groovy scripts in the filters or when computing replacement variables, if you really want.

Though most of the time built in refactors like 'extract to _' or 'move to' or 'inline' or 'change type signature' or 'find duplicates' are enough.
by gethly | 2025-12-22 23:55:31+00:00
You can hardly beat the first one to market due to momentum, time, data, user base ...

LinkedIn flipped the job hunting from job offers DB to CVs DB with networking aspect and added jobs and more social aspect later.

On the other hand, the web is insanely oversaturated and in the end everything turns to steaming pile of shit because of it. so even if something new came, it too would suck sooner or later.
by cromka | 2025-12-22 23:55:33+00:00
That package wasn't any more random than any other NodeJS package. NPM isn't inherently different from, say, Debian repositories, except the latter have oversight and stewardship and scrutiny.

That's what's needed and I am seriously surprised NPM is trusted like it is. And I am seriously surprised developers aren't afraid of being sued for shipping malware to people.
by coder543 | 2025-12-22 23:55:40+00:00
No… that’s not how this works. 96GB sounds impressive on paper, but this model is far, far larger than that.

If you are running a REAP model (eliminating experts), then you are not running GLM-4.7 at that point — you’re running some other model which has poorly defined characteristics. If you are running GLM-4.7, you have to have all of the experts accessible. You don’t get to pick and choose.

If you have enough system RAM, you can offload some layers (not experts) to the GPU and keep the rest in system RAM, but the performance is asymptotically close to CPU-only. If you offload more than a handful of layers, then the GPU is mostly sitting around waiting for work. At which point, are you really running it “on” the RTX Pro 6000?

If you want to use RTX Pro 6000s to run GLM-4.7, then you really need 3 or 4 of them, which is a lot more than $10k.

And I don’t consider running a 1-bit superquant to be a valid thing here either. Much better off running a smaller model at that point. Quantization is often better than a smaller model, but only up to a point which that is beyond.
by tom_ | 2025-12-22 23:56:01+00:00
It's not absurd at all (in my view). A test checks that some obtained result matches the expected result - and if that obtained result is something that got printed out and redirected to a file, and that expected result is something that was produced the same way from a known good run (that was determined to be good by somebody looking at it with their eyes), and the match is performed by comparing the two output files... then there you go.

This is how basically all of the useful tests I've written have ended up working. (Including, yes, tests for an internal programming language.) The language is irrelevant, and the target system is irrelevant. All you need to be able to do is run something and capture its output somehow.

(You're not wrong to note that the first draft basic approach can still be improved. I've had a lot of mileage from adding stuff: producing additional useful output files (image diffs in particular are very helpful), copying input and output files around so they're conveniently accessible when sizing up failures, poking at test runner setup so it scales well with core count, more of the same so that it's easy to re-run a specific problem test in the debugger - and so on. But the basic principle is always the same: does actual output match expected output, yes (success)/no (fail).)
by NoPicklez | 2025-12-22 23:56:27+00:00
I don't know whether Spotify could agree to provide its entire library of music to an archive for Torrenting by anyone.

Its not just about Spotify, but the record labels and the artists themselves.

For a community that usually wants to allow artists control over their music, or better yet people control over their own information in general. It surprises me that people are now okay with music being scraped and freely put online.
by theamk | 2025-12-22 23:56:40+00:00
"leaking" is the wrong word here - it implies some sort of inefficiency, process which is not working as well as it needs to. Leaky bucket, leaky faucet...

That's not the case here, that center is __dumping__ heat into environment - it is by design, all that electricity is being converted into the heat. By design, it's enormous electric heater.
by AJ007 | 2025-12-22 23:57:40+00:00
PG&E emerged from their most recent bankruptcy with more debt than they entered with! This was largely because of the wildfire liabilities - $30 billion. In more direct terms, the lucky Californians are paying the unlucky Californians, and it was financed by bonds which used PG&E's existing assets as collateral (which for some reason weren't already collateralized.)

The best case for Californians overall would have been PG&E's debt and equity to go as close to 0 as possible, and all that extra debt have been used to actually upgrade the aging electricity infrastructure. Instead you are paying interest on past fire damage claims.

In 2018 PG&E had about $18b of long term debt, they now have just under $59b. Their outstanding shares also quadrupled. The bankruptcy didn't wipe out the equity, but investors got f'd hard if they thought they were acting conservatively. Would you accept a 1.25%ish dividend with the prospects of the stock going to 0 higher than it doubling in the next 10 years?

For all of the whiners about how utility investors shouldn't make any money, and possibly earn below their cost of capital, -- I spent some time looking at the utility industry over the last few years (including PG&E.) These are basically money pits which more money goes in than comes out over decades.

The other layer here is if the billions of dollars being borrowed are to build new infrastructure results in billions more in future liabilities to maintain everything. The first layer looked so bad I didn't go any further.

The petty dividend payouts utilities make just keep the equity investors from examining what they really own. Higher equity valuations let utilities borrow money cheaper than they really should be able to.

Functionally the whole thing looks like a ponzi scheme that perhaps could only happen with the 40 year run of ever shrinking interest rates. If the bond bull market is over then this utility ponzi scheme is going to blow too.

Bottom line, if investors were paying attention, your utility bills would be a lot higher. If utilities ever have a big problem getting Wall Street to keep funding their debt ponzi, they will be.

The alternative is the state owns the utility. Given how ugly the math is for utilities right now, I doubt it would be cheaper.

On the other hand, if the US is going 100% EV (AI datacenters or not), then there trillions of federal dollars are inbound and maybe utilities will be ok. One thing is for certain, the utilities, their investors (debt & equity) their customers, and the US states don't have the money to pay for all that has to be built.
by archi42 | 2025-12-22 23:57:41+00:00
It's a siren call for us techies, but reality is less pretty than our fantasies of "cheap base load".

I got an offer for a "essentially free" residential turbine including the pylon (8 to 10 meters, the legal limit for a "Kleinwindanlage") in SW Germany - just had to dismantle it and put it on my lawn. And of course pour a huge foundation [2x2m?] and have an accredited electrician do the necessary alterations. Nope. It didn't even produce enough electricity to offset the maintenance costs - no idea how I should offset the costs for moving it, even with the free capex.

And I did the math about 3 years ago: Prices for both PV and batteries dropped a lot since then. For late fall/early spring I would be better off by adding a PV carport (2 cars). I could also finally automate charging my batteries while electricity is cheap during Dec/Jan, might even be worth bumping my existing battery from 28 kWh to 42 kWh.

To be fair: The math might work out in the Northern Germany; but I would not bet on it.
by josephg | 2025-12-22 23:58:32+00:00
> When people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ ...

It does though! The JS stdlib even includes an entire wasm runtime. Its huge!

Seriously. I can barely think of any features in the C++ stdlib that are missing from JS. There's a couple - like JS is missing std::priority_queue. But JS has soooo much stuff that C++ is missing. Its insane.
by kawfey | 2025-12-22 23:58:40+00:00
That makes a lot of sense… I’m in the rich/middle class north Atlanta burbs visiting family, and the entrance to every cul-de-sac has a flock LPR pointing inwards.

I didn’t notice it at all last year but the cameras were there. Benn blew the cap off and now they’re omnipresent.
by belorn | 2025-12-22 23:59:11+00:00
Green hydrogen is prohibitively expensive and are still way more expensive than using fossil fuels to create hydrogen (called black hydrogen). Burning green hydrogen for electricity when we have yet to make green steel economical viable is not a good idea. Nuclear is still a magnitude cheaper than that.

Green hydrogen has to first prove itself that it can become economical viable. One of the biggest test trials for that is the Swedish initiative, and that one is mostly paid through subsidies and grants. Sadly it isn't looking very great even if the government did decide to continue sending more billions into the project.
by Verdex | 2025-12-22 23:59:30+00:00
I had Hosking as a professor. Iirc, it was an okay experience. Compilers course I believe.

When the handbook came out, I bought it because "hey, I know that guy". Ultimately, I don't think it's necessary, but having a more in depth knowledge of garbage collection and the problems in the space occasionally comes in handy.

For example, what implication do finalizers have on garbage collection design? Reading about that was kind of an eye opener.
by cromka | 2025-12-23 00:00:26+00:00
No, package manager actually DOES play into this. Or, rather, the way best practices it enforces do. I would be seriously surprised if debian shipped malware, because the package manager is configured with debian repos by default and you know you can trust these to have a very strict oversight.

If apt's DNA was to download package binaries straight from Github, then I would blame it on the package manager for making it so inherently easy to download malware, wouldn't I?
by benced | 2025-12-23 00:00:39+00:00
California's average residential electricity rate is almost twice the US average (32 cents vs 18 cents) despite being in a state with abundant energy resources.

Even if advocates got everything they wanted here (6% margin vs 10% margin), that would lower rates by... 1.2 cents. PG&E desperately needs to be reformed into a competent organization, something that nobody in (Newsom) or adjacent to (these advocates) power in California seems to want to do.

https://www.eia.gov/electricity/monthly/epm_table_grapher.ph...
by jandrewrogers | 2025-12-23 00:00:47+00:00
Yes, the watersheds but also the prevalence of mountaintop aquifers that don't go beyond their part of the range. These can be extremely fragmented. You'll have ample water for the taking in one area and none a few kilometers away. AFAIK, you can still acquire revocable water rights to some of this without much fuss since it doesn't interact with any official watershed. It just isn't located anywhere remotely convenient or useful.

Sometimes the valleys have good wells but that isn't guaranteed due to the geology of Nevada. Lots of brine, sulfur, hydrocarbons, hot springs, etc. You never know what you are going to get and the fresh water eventually mixes into this underground.
by stefan_bobev | 2025-12-23 00:00:50+00:00
I am a big fan of Bazel and have explored Nix (although, regrettably not used it in anger quite yet) - both seem like good steps in the right direction and something I would love to see more usage/evolution of. However, it is important to recognize that these tools have a steep learning curve and require deep knowledge in more than one aspect in order to be used effectively/at all.

Speed of development and development experience are not metrics to be minimized/discarded lightly. If you were to start a company/product/project tomorrow, a lot of the things you want to be doing in the beginning are not related to these tools. You probably, most of the time, want to be exploring your solution space. Creating a development and CI/CD environment that can fully take advantage of these tools capabilities (like hermeticity and reproducibility) is not straightforward - in most cases setting up, scaling and maintaining these often requires a whole team with knowledge that most developers won't have. You don't want to gatekeep the writing of new software behind such requirements. But I do agree that the default should be closer to this, than what we have today. How we get there - now that is the million dollar question.
by Muromec | 2025-12-23 00:01:52+00:00
>The issue I have is that I don't really have a good idea for a solution to this problem - on one hand, I don't expect everyone to roll the entire modern stacks by hand every time. Killing collaborative software development seems like literally throwing the baby out with the bath water.

Is NPM really collaborative? People just throw stuff out there and you can pick it up. It's the least commons denominator of collaboration.

The thing that NPM is missing is trust and trust doesn't scale to 1000x dependencies.
by mrbonner | 2025-12-23 00:02:14+00:00
I tried this on OpenRouter chat interface to write a few documents. Quick thoughts: Its writing has less vibe of AI due to the lack of em-dashes! I primarily use Kimi2 Thinking for personal usage. Kimi writing is also very good, on par with the frontier models like Sonnet or Gemini. But, just like them, Kimi2 also feels AI. I can't quantify or explain why, though.

For work, it is Claude Code and Anthropic exclusively.
by derriz | 2025-12-23 00:02:18+00:00
Yes but you’re not paying for the area the blade covers - you’re paying for the blade. Simplifying (to an extreme) for the sake of illustration - a 20m blade costs twice as much as a 10m one but produces 4 times the energy.

Obviously, cost scales more than linearly with blade length but it’s a bit like big O - the n^2 factor dominates. This is why wind turbines have been getting bigger and bigger. And why the cost of domestic or small-scale wind turbines remains stubbornly high despite the dramatic fall in the average cost per MW seen for wind turbines - as the falls are largely driven by the ability to manufacture larger and larger turbine blades. While falls in costs for solar PV can be seen at every scale.