MurphyA/hacker-news huggingface dataset:
by EGreg | 2025-12-22 23:02:06+00:00
The authenticator GUI only shows “sign in to your_domain.com”. It never allows a more general “sign this content for your_domain.com”. E.g. “sign this transaction request to move £50 to Bob's account”.

That is why you should ship a pristine HTML+CSS+JS environment that can use subtle web crypto. YOU show what is being signed. And then the device can sign its hash using the secure enclave.

And you CAN do attestation even on consumer devices, by using the Device or AppAttest framework (I think that’s what it’s called). I did it myself in our app. It does show up 100% of the time but when it does it’s useful.

PS: being the web3 / blockchain geek that I am, I will tell you stuff that triggers anticryptobros on HN.

The Web3 ecosystem already has a standard called EIP712 for signing structured data. If you want to stick to standards, use that!

The secure enclaves all use P-256 (sometimes called R-256) while Bitcoin / Web3 uses K-256 (the Koeblitz curve, they distrust the NIST curve or whatever).

So that means you’re going to have to use Abstract Accounts and the new precompiled smart contracts to verify P256 signatures, which only Binance Smart Chain and a handful of other chains have deployed. Luckily BSC is the most widely used chain by volume and has plenty of money sloshing around so you can build your trustless programs there. If you want to be totally trustless — LET THE SMART CONTRACTS GENERATE THE CHALLENGE TO BE SIGNED BY THE AUTHENTICATOR. Then have it sign the temporary k256 public key (from the keypair) to use, as long as your session is open you can then add use your private key to sign transactions. As usual, do this for small amounts per day, transactions that move larger amounts should still require use of multisig keys etc.)
by coryrc | 2025-12-22 23:02:17+00:00
Context is solar and pricing. You can't only build solar, because people will freeze to death. So you can't say "solar+batteries is only $X/W!!!” because you're ignoring that you must also have a rarely-used natural gas, or install a rarely-used long-distance transmission line, or install rarely-used storage capacity. Which is fine, but you're being dishonest about costs if you don't.
by adrianmonk | 2025-12-22 23:02:54+00:00
Interesting. It's basically a compromise between flicker and motion blur, so I assumed they'd pick the phosphor decay time based on the refresh rate to get the best balance. So for example, if your display is 60 Hz, you'd want phosphors to glow for about 16 ms.

But looking at a table of phosphors ( https://en.wikipedia.org/wiki/Phosphor ), it looks like decay time and color are properties of individual phosphorescent materials, so if you want to build an RGB color CRT screen, that limits your choices a lot.

Also, TIL that one of the barriers to creating color TV was finding a red phosphor.
by JackSlateur | 2025-12-22 23:02:54+00:00
"This is the assertion that I think .." - you are showing bad faith;

"OAuth is for authorizing third parties access to client resources, not for authentication" - just like AD, oauth is used for authentication and authorization; See the fields sub, scope, audience etc;

"OAuth/OIDC have a much more pronounced focus on web" - of course, we do not use "web" inside internal enterprise networks;

"When you say issuer" - issuer is a keyword, not a random word; But again: you know it;

"Am I not then using it to execute code on my auth server" : can you execute any kind of code on AWS' IAM servers (any server will do) ? Please share some details;
by miduil | 2025-12-22 23:03:10+00:00
There is also a good write-up [0] by Julia Evans. We ran into this with DICOM storescp, which is a chatty protocol and TCP_NODELAY=1 makes the throughput significantly better. Since DICOM is often used in a LAN, that default just makes it unnecessarily worse.

[0]: https://jvns.ca/blog/2015/11/21/why-you-should-understand-a-...

[1]: https://news.ycombinator.com/item?id=10607422
by FireBeyond | 2025-12-22 23:03:17+00:00
I really despise Spotify's payout algorithm too, since you mention it.

For the longest time I was a big Tidal fan. Still am. But I feel their financials show writing on the wall for their future. But one of the reasons for that appreciation on my part was that they 1) paid a lot more, per stream, to artists (sometimes, 8-10x more than Spotify's nominal purported royalties), and 2) they didn't have an algorithm for payout that heavily favored the 800lb artists in the room over the smaller, struggling acts.
by shimman | 2025-12-22 23:03:17+00:00
This is something I notice often when using these tools (if this is what you are referring too). Like they will grep entire code bases to search for a word rather than search by symbol. I suppose they don't care to fix these types of things as it all adds up to paid tokens in the end.

We have 50 years worth of progress on top of grep and grep is one of the worse ways to refactor a system.

Nice to see LLM companies are ignoring these teachings and speed running into disaster.
by wincy | 2025-12-22 23:03:20+00:00
This news is interesting but this was definitely written by ChatGPT. I’m not just sure — I’m absolutely certain.

It has all the telltale signs, so much “it’s not just this — it’s that”. I don’t mind something augmented or proofread by ChatGPT but this kind of stuff is pretty lame? I could feed the paper into ChatGPT and also get similar text to paste into my Medium blog.

The other day I found myself reading a food critic’s review of a restaurant I had no real interest in purely because it was so refreshingly not AI generated.
by mullingitover | 2025-12-22 23:03:24+00:00
I think this is because when the water table is as saturated as it is in much of the east, there's no sense in trying to conserve. The water pumped out of the river just ends up on the ground, goes in the watershed, and back down the river. Caveat: Note that I'm talking about surface water. Fossil water sources like the Ogallala Aquifer being overused are another story entirely.
by sneak | 2025-12-22 23:04:00+00:00
Every docker image specified in a k8s yml or docker-compose file or github action that doesn’t end in :sha256@<hash> (ie specifying a label) is one “docker push” away from a compromise, given that tags/labels are not cryptographically specified. You’re just trusting DockerHub and the publisher (or anyone with their creds) to not rug you.

The industry runs on a lot more unexamined trust than people think.

They’re deployed automatically by machine, which definitionally can’t even give it a second thought. The upstream trust is literally specified in code, to be reused constantly automatically. You could get owned in your sleep without doing anything just because a publisher got phished one day.
Ask HN: How do you design offline-first flows in large React Native apps?
by samwellx | 2025-12-22 23:04:17+00:00
I’m working on a mobile app where offline-first is a real requirement (not just caching).

The tricky parts are:
– optimistic updates
– temporary client IDs
– retryable request queues
– keeping UI responsive while syncing in the background
– avoiding tight coupling between networking and domain state

I’ve seen apps turn into a mess once these concerns start leaking everywhere.

For those who’ve built offline-first mobile apps at scale:
– how do you usually structure this?
– what breaks first?
– what would you not do again?

I’m experimenting with my own approach, but I’m very curious how others solved this in production.
by alhirzel | 2025-12-22 23:04:32+00:00
Years ago, this very subject was an interview question at a national lab (at an undergrad level). The question was roughly:

> the ends of windmill blades look a lot like a jet on radar. If you were assigned to this project, what would your approach be to avoiding false positives?

This was in 2011/2012. I find it difficult to believe the problem is not solved.
by josephg | 2025-12-22 23:04:53+00:00
> C has unions, but they're not tagged. You can roll your own tagged unions, of course, but that's moving beyond it being a feature of the language.

This feels like a distinction without a real difference. Hand-rolled tagged unions are how lots of problems are approached in real, professional C. And I think they're the right tool here.

> the actual best approach might be totally different, but at least in staying somewhat true to your code: (...)

Thanks for having a stab at it. This is more or less what I ended up with in Go. As I said, I ended up needing about 50% more lines to accomplish the same thing in Go using this approach compared to the equivalent Typescript, rust and swift.

If anyone is curious, here's my C implementation: https://github.com/ottypes/libot

Swift: https://github.com/josephg/libot-swift

Rust: https://github.com/josephg/textot.rs

Typescript: https://github.com/ottypes/text-unicode

I wish I'd kept my Go implementation. I never uploaded it to github because I was unhappy with it, and I accidentally lost it somewhere along the way.

> the actual best approach might be totally different

Maybe. But honestly I doubt it. I think I accidentally chose a problem which happens to be an ideal use case for sum types. You'd probably need a different problem to show Go or C# in their best light.

But ... sum types are really amazing. Once you start using them, everything feels like a sum type. Programming without them feels like programming with one of your hands tied behind your back.
by ViewTrick1002 | 2025-12-22 23:04:54+00:00
But everyone are incentivized to build another wind farm, solar plant, battery etc to make profit on the current fossil gas based margins. Pushing the price lower for more hours.

Equilibrium is met when new production becomes too expensive vs. the existing profit potential.

All resource markets globally run on marginal price. The other option for electricity would be that everyone instead does their own research and predicts the clearing price leading to even higher waste and more volatility.
by BeetleB | 2025-12-22 23:05:47+00:00
> It's very hard to take you seriously after this.

I take it you've not encountered such folks? It must be nice to be shielded. As I said, your comments definitely give off "privileged" vibes.

I don't know your background, but spend some time in various countries - both wealthy and not. Both repressive and not. When people debate the virtues and vices of freedom, much of what we discussed in this thread come into play. The US is very much a country centered on freedom, and the reason many are in a bad state is precisely because the US gives them more freedom by letting them have these choices. Statistically, they will choose poorly, but the fact that their behavior is predictable via statistics doesn't negate the fact that they made those choices.
by hmokiguess | 2025-12-22 23:06:25+00:00
Ah. That makes sense, thanks for clarifying! I play a lot of music, but I find there are gaps in which I require "someone" that this could fill for solo projects. For example, drum programming (I mainly play guitar). I often use Logic Pro Drummer and I enjoy it, but a programming interface and code feels more intuitive to my mental model there. I would love a "hybrid" mode for this.
by roxolotl | 2025-12-22 23:06:56+00:00
While I can’t really comment on how good this specific implementation is simple diff based testing frameworks like this dont get enough press. My first job involved working on an internal programming language. The test suite was just a ton of statements that were executed top down and their output was compared against a single file. Yes that’s a bit absurd but it worked remarkably well. If they’d bothered to add a bit more structure around it I think it would have been perfect.
by badsectoracula | 2025-12-22 23:07:00+00:00
FWIW it doesn't need to become 500k lines of code... or 13k in QWidget's case :-P. The file is large because it contains the full documentation in addition to the code but also in Qt is a QWidget can also be a (toplevel) window so it needs to support everything a window may want to support, including stuff like setting/getting title, maximize/minimize/etc events, etc.

You can avoid this complexity in the base widget class by placing those elsewhere, e.g. FLTK's base widget class[0] is much smaller at around 500 lines of code (+ documentation comments).

[0] https://github.com/fltk/fltk/blob/master/src/Fl_Widget.cxx
by hasperdi | 2025-12-22 23:07:27+00:00
I bought a second‑hand Mac Studio Ultra M1 with 128 GB of RAM, intending to run an LLM locally for coding. Unfortunately, it's just way too slow.

For instance, an 4‑bit quantized model of GLM 4.6 runs very slowly on my Mac. It's not only about tokens per second speed but also input processing, tokenization, and prompt loading; it takes so much time that it's testing my patience. People often mention about the TPS numbers, but they neglect to mention the input loading times.
by nospice | 2025-12-22 23:07:50+00:00
That's more or less the system that exists today? You pay a lower rate up to a certain threshold and then a higher rate kicks in.

The problem with PG&E isn't the rate structure, which isn't all that different from utilities anywhere else in the world. It's that their costs are exceedingly high, through a combination of regulatory pressures and grift. This is exacerbated by municipal and state regulators who are pushing consumers to be more reliant on electric power (bans on gas appliances in new construction, pushes toward EVs, etc).

There are vast swathes of the country where people pay 5-10x less for electricity.
by cxr | 2025-12-22 23:07:51+00:00
At this point, the existence of these attacks should be an expected outcome. (It should have been expected even without the empirical record we now have and the multiple times that we can now cite.)

NPM and NPM-style package managers that are designed to late-fetch dependencies just before build-time are already fundamentally broken. They're an end-run around the underlying version control system, all in favor of an ill-considered, half-baked scheme to implement an alternative approach to version control of the package manager project maintainers' devising.

And they provide cover for attacks like this, because they encourage a culture where, because one's dependencies are all "over there", the massive surface area gets swept under the rug and they never get reviewed (because 56K NPM users can't be wrong).
by _DeadFred_ | 2025-12-22 23:08:24+00:00
How long have the Republicans said the ACA has to go, yet they don't even have the IDEA of a plan? There was an ACTUAL written ACA when the quote you use was said. There is ZERO actual written plan on the Republican side today. The comparison doesn't make sense.

I favor logical progress. I don't favor 'blow it up so magic can do it's work'.
by pmkary | 2025-12-22 23:08:32+00:00
Actually, it's both. I wanted to study media theory, and it was interesting that his work both appeared in compilers and philosophy, so I thought, “Let’s buy some books and dig into them.” The content was stupid, but I didn't need to throw the books away. After writing that comment here, I actually went and sent all of them to paper recycling...
by simonsarris | 2025-12-22 23:08:59+00:00
That article is about emissions, not admixture. If you look at the source of that article, which they link to: https://carbonmonitor.org/variation

First off we can now look at the full year instead of 6 months of data, its no longer US +4.2% and China -2.7%, its US +2.0% and China -2.3%

China's 2025 YoY emissions decline is almost all due to a decline in industry, not power (1.8% of their 2.3% decline, in other words, most of it). It's understandable to have a lower year if you have an economic slowdown. Russia also had a decline, not for green reasons.
by happytoexplain | 2025-12-22 23:09:19+00:00
The tone of the GP and your comment, and wanting to drink for the buzz, are all arguably a little immature. But regardless: Maturity has nothing to do with age.

Regarding opinions: You're not defending the GP when you say "many". The GP implied "all" (or close to it). The GP was in fact overstepping the statement of opinion, whereas you are not.
by kazinator | 2025-12-22 23:09:23+00:00
> Now imagine your doctor is using an AI model to do the reading. The model says you have a problem with your “basilar ganglia,” [basal meaning at the base, ganglia meaning clusters of neuron cells: neuron clusters at the base of the brain] conflating the two names into an area of the brain that [D]oes [N]ot [E]xist[!] [Dramatic, serious stare into the camera.] You’d hope your doctor would catch the mistake and double-check the scan. But there’s a chance they don’t. [And that brings us to the emergency room, where you are now, a forty-nine software developer presenting with a psychotic obsession for fact-checking everything you read on the Internet.]
by embedding-shape | 2025-12-22 23:09:30+00:00
If you have to run it regardless, contain it as good as you could, given the potential impact. If you're not using the same machine for anything else, maybe "good riddance" is the way to go? Otherwise try to sandbox it, understanding the tradeoffs and (still) risks. Easiest for now is just run everything in rootless podman containers (or similar), which is relatively easy. Otherwise VMs, or other machines. All depends on what effort you feel is worth it, so really what it is your are protecting.
Show HN: A repo to turn any model into a reasoning model without training
by Dl1683 | 2025-12-22 23:09:53+00:00
Hey all,

Training AI Models to reason is currently very expensive. You require a lot of data, tons of compute in Reinforcement Learning, and more. And the reasoning infrastructure is not reusable.

On top of all this, we don't really have a way to improve targeted performance and personalize intelligence within the systems.

Over the last year, I've been looking into latent space reasoning as a way to solve this. By doing this, we can create a different reasoning layer that is reusable across models. We created a simple layer for 50 cents, and it already improves performance. We're working with a few people across major AI Labs at exploring this, but I also wanted to open source because intelligence deserves to be open. To that end, our startup has even opened up a small monthly prize pool for top contributors to the repo.

Would love to have you in there. Here is a report we did breaking down the core design philosophy here-- https://www.artificialintelligencemadesimple.com/p/how-to-te...
by coryrc | 2025-12-22 23:10:09+00:00
I'm not sure how often the upper Midwest gets Dunkelflaute. If rare enough, then overbuilding wind is a possible solution (especially combined with additional transmission) but, again, those costs must be accounted for or the solar costs are dishonest.

https://www.ehn.org/europe-faces-challenges-from-low-wind-an...
by aDyslecticCrow | 2025-12-22 23:10:57+00:00
> Adding even more personal information into HTTP headers is NOT the way to go

It's exactly the way to go; because the alternative currently being pursued by half the western world is to attatch your full government ID to every internet request. Some preference flags are pretty harmless in comparison, and very powerful tool to solve some related problems.

The internet is already segmented and will continue to become more segmented (Intellectual property, GDPR, gambling). Adding a method to control that with the power in the hand of the user; is the least bad way to implement it.

It also makes regulating the internet alot less painful for businesses and governments. A buisness can refuse my service if they don't like my http request. No more murky "US company liable for EU user traffic even if unintended" nonsense. (The user can choose to voluntary remove GDPR protection with this method for example)
by fernly | 2025-12-22 23:11:19+00:00
Actually more fun is the "henge near me" page[1] which lets you test alignment on a map of a chosen city. Very nice interactive use of Google Maps, flipping red alignment bars on and off as the date changes.

On March 12, 2026, all the avenues in the Sunset and Richmond districts of San Francisco are Henge candidates. These are the avenues that are named in alphabetic sequence, North to South. Anyone who grew up in The City can recite the whole sequence (Anza, Balboa, Cabrillo... Vicente, Wawona, Yorba).

[1] https://hengefinder.rcdis.co/henge_near_me
by culi | 2025-12-22 23:11:20+00:00
dang won't like me sharing this repo (sorry!) but hn-undocumented has a relevant section on this:

https://github.com/minimaxir/hacker-news-undocumented?tab=re...

> Currently, there is no evidence that non-job submissions about a YC startup receive preferential treatment on the front page, or kill submissions critical of a YC startup. In fact, the moderators have stated that they explicitly avoid killing controversial YC posts when possible.

And also:

> Additionally, founders of YC companies see each other's usernames show up in orange, which — although not an explicit benefit — does allow fellow YC founders to immediately identify one another in discussions.
by toomuchtodo | 2025-12-22 23:11:24+00:00
Flock’s objective is to hope people don’t care long enough to reach IPO. Will enough people care to dis enable this corporate dragnet surveillance apparatus? Remains to be seen. I don’t much care about the grift of dumping this pig onto the public markets (caveat emptor), but we should care about its continued use as a weapon against domestic citizens without effective governance and due process.
by xpe | 2025-12-22 23:11:46+00:00
I'll think out loud... There is a mix of users: (a) individuals (both free and premium); (b) hiring organizations; (c) intermediaries. How much of LinkedIn's revenue comes from the different user types?

It feels like Linked has somewhat "perfected" the social-media-as-networking business model. To me, it looks like another enshittification. But to investors, it probably looks like successful optimization. Ergo, I would not want to try to start a business to "outdo" LinkedIn.

This leaves me wondering, what other business models exist? What would have to happen for each of these other models to have a decent chance of taking off?