MurphyA/hacker-news huggingface dataset:
by godelski | 2025-12-15 22:52:26+00:00
The problem is you're victim blaming.

> snickerbockers > No, your security failure is that you use a package manager > you > It isn't victim blaming. People like you make it impossible to avoid attacks like these because you have no appetite for a better security model.

I'd wager a large portion of people with `npm` don't actually realize they have `npm`. I'd also wager that most people that know they have `npm` aren't aware of the security issues.

Under those conditions, people are not in fact making choices. These are not people "that have no appetite for a better security model". These are people who don't even know they are unsafe!

Yes, this is victim blaming. Just in the same way people blame a rape victim for what they wear. Does what you wear modify the situation? Yes. Does it cause the situation? No. We only really blame a victim if they are putting themselves directly, and knowingly, in harms way. This is not that case! This is a case where people are uninformed, both in the dangers present as well as the existence of danger.

FFS, on more than one occasion I've installed a package only to see that it bundles `npm` along with it. And I'm more diligent than most people, so I know tons of people don't know it's happening. Especially because you can't always run `which npm` to find if it is installed. But the fact is that you can do something like `brew install foo` and foo has a dependency that has a dependency that has node as a dependency.

Dependency hell is integral to the problem here! So you can go ahead and choose a package manager that doesn't allow 3rd parties to push arbitrary code and end up with a package manager that allows 3rd parties to push arbitrary code! That's even what made left-pad a thing (and don't get me started on the absurdity of using a module for this functionality!).

> Nobody has the appetite to be held accountable for who they put their trust in

That is jut not the reality of things. In the real world nobody can read all the lines of code. It just simply isn't possible. You aren't reading everything that you're running, let alone all the dependencies and all the way down to the fucking kernel. There just isn't enough time in the day to do this within your lifetime, even if you are running a very cut down system. There's just too many lines of code!

So stop this bullshit rhetoric of "know what you're running" because it is ignoring the reality of the situation. Yes, people should do due diligence and inspect, but the reality is that this is not possible to do. Nor is it bulletproof, as it requires the reader to be omniscient themselves, or at least a security expert with years of training to even be able to spot security mistakes. Hell, if everyone (or just programmers) already had that kind of training then I'd wager 90+% of issues wouldn't even exist in the code in the first place.

So stop oversimplifying the situation because we can't even begin to talk about what needs to be done to solve things if we can't even discuss the reality of the problem.
by j45 | 2025-12-15 22:52:30+00:00
You don't need RAM to run LLMs. Your graphics card does.

The best price for dollar/watt of electricity to run LLMs locally is currently apple gear.

I thought the same as you but I'm still able to run better and better models on a 3-4 year old Mac.

At the rate it's improving, even with the big models, people optimize their prompts so they run efficiently with tokens, and when they do.. guess what can run locally.

The dot com bubble didn't have comparable online sales. There were barely any users online lol. Very few ecommerce websites.

Let alone ones with credit card processing.

Internet users by year: https://www.visualcapitalist.com/visualized-the-growth-of-gl...

The ecommerce stats by year will interest you.
by GMoromisato | 2025-12-15 22:53:03+00:00
True, but businesses don't care about regulations except where it costs them money. Also, remember that time is money, so any regulatory delays cost real money to a business.

My point is that you can actually reduce it all to dollars. And I believe that the cost of orbital data centers will come down due to technological advances, while the cost of regulation will only go up, because of local and global opposition.
by pixelatedindex | 2025-12-15 22:53:11+00:00
> the only thing that matters is that TikTok is an open door to unduly influence public opinion in America. The immense scale of data collection, from personal information to location tracking data, is also a clear concern.

I understand where you’re coming from - “they ban us so we’ll ban you” is a valid sentiment. But this grandstanding is like slapping a bandaid on a leaky tub and calling it “Job done”. I’m almost being transported to the 1940s with this McCarthy-lite take.

Everything that TikTok is doing is being done by Meta, Snap, Instagram, etc. If it’s not done through TikTok it’ll be done somewhere else. But sure, instead of passing real privacy laws let’s just also be authoritarian - I’m sure that’ll solve the problem.
by AndrewKemendo | 2025-12-15 22:53:11+00:00
This is exactly why I left the US intelligence community and all public service starting in 2011.

It’s all about the data. Used to be that the govt had the best data about the world and could theoretically use it to help the citizens (though almost never in practice). That flipped around the year 2000 and the Govt spent a decade to catch up to the ISPs post 9/11. However the govt investment into data/AI couldn’t match private investment even barely. I saw this up front and personal and NOBODY in congress or the White House cared about data or AI - arguably they still don’t and have no real data/AI talent left in the government.

It was very clear by then that Automation broadly was going to consume the planet, and that whomever controlled the data flow behind it would control the levers of power, overthrowing the veneer of “rule by the consent of the governed” (which is an impossible fantasy that can’t actually ever exist).

When Hintons lab won ILVRC in 2012 based on a data focused approach - that was the time that everyone should have sat up and realized what was about to happen. Many in AI did exactly that and that’s why we’re in the state of tech we are in.

Kurzweil predicted it, everyone in the singularity and transhuman communities saw it and the rest of the world has not changed their behavior and have accelerated this process.

Unless society as a whole gets her act together and organizes this planet for the benefit of humans and ecology, this is not going to the way anybody wants it.

Everything that removes the last vestiges of human directed action and control is accelerating rapidly.
by maqp | 2025-12-15 22:53:27+00:00
>proof-of-work scheme using a memory-hard hash function like scrypt

So who's doing the computation? The spammer can't afford to run 3 second key derivation time per spam device? Or how long do you think normal user will wait while you burn their battery power before saying "Screw it, I'll just use WA"? Or is this something the server should be doing?

>Captcha

LLMs are getting quite good at getting around captchas.

>invite-code system

That works in lobste.rs when everyone can talk together, and recruit interesting people to join the public conversation. Try doing that with limited invites to recruit your peers to build a useful local network of peers and relatives. "I'm sorry Adam, I'm out of invites can you invite my mom's step-cousin, my mom needs to talk to them?"

>Signal's architects already knew that when they started designng it.

I think they really did, and they did what the industry had already established as the best practice for a hard problem.

The only reasonable alternative would've been email with heavy temp-mail hardening, or looking into the opposite end of Zooko's triangle and having long, random, hard-to-enumerate usernames like Cwtch and other Tor-based messengers do. But even that's not removing the spam-list problem of any publicly listed address ending up in a list that gets spammed with contact requests or opening messages with spam.
by K0balt | 2025-12-15 22:53:46+00:00
He didn’t leave until years after the mother had moved to Belgrade (where he cannot enter due to his military service) The estrangement from his son was devastating to him and was one of the motives for his journey.

It’s remarkable how eager people are to jump to conclusions about the role of the mother in the estrangement.

In my observation estrangement of fathers from children is usually forced by mothers who don’t want strings attached. I’ve been in the periphery of several such situations, and never in one where the father walked away… but that also probably has to do with my cultural background. I have heard it is alarmingly common in some cultural circumstances.
by LightBug1 | 2025-12-15 22:53:58+00:00
>> "VW electric van but that's more of a gimmick than anything else."

Really? ... I'm seeing them adopted more widely in Europe now by businesses. Perhaps as second hand or lease prices are coming down. Maybe that doesn't translate to the US ...

Quite nostalgic seeing them run around Central London with business signs on their side... much like the originals. My point: not a gimmick in my experience.
by psc | 2025-12-15 22:54:29+00:00
It's actually partly built, still in beta testing (has some bugs) but here's a nice example: https://live.orcasound.net/bouts/bout_031YiYO7OqPbPhcmP3mQeb

Requirements are pretty flexible, but the inspiration is largely iNaturalist, and also this very cool project put together by Google Creative Lab back in 2019 https://patternradio.withgoogle.com/

Best place to learn more is to stop by the community Zulip chat (https://orcasound.zulipchat.com/) and ask questions, it's full of really knowledgeable people. Also you can explore the entire codebase here: https://github.com/orcasound/orcasite
by maxglute | 2025-12-15 22:54:31+00:00
When look past liberal world order propaganda, aka the libtard bubble, a lot of geopolitical reality seem to bias toward PRC, not because PRC is extra prescient or competent (even though they kind of are) but because libtard delude themselves into false models of how world works.

Pertaining to topic, current reality is HK isn't going to be rebellious stain on 1C2S like LIO types wanted, it's thoroughly cowed and new gen of HKers are going to be patriotic as fuck. For the simple reason that patriotic education / indoctorination actually works really well as statecraft tool. TW democratic disallusionment is growing YoY, and eventually they're going to have to reckon between being privledged cowed like HKers or becoming Gaza - it wasn't Israel begging for ceasefire and Israel has less autonomy over Gaza than PRC over TW in a cross strait scenario.
Is "Negative Reinforcement" (fear of banning) a valid strategy for learning?
by shrutisingh18 | 2025-12-15 22:54:37+00:00
I’ve been mentoring junior devs (and looking at my own habits), and I’ve noticed a pattern: "Consumer Developers."

We have endless access to high-quality tutorials (freeCodeCamp, YouTube, documentation), yet the ability to build from scratch seems to be dropping. We optimize for the feeling of learning (watching a video) rather than the pain of debugging.

I tried standard "discipline" techniques (Pomodoro, blocking apps) to force myself to build, but they failed.

So I ran an experiment: I wrote a discord bot that tracks my GitHub activity. The Rule: If I don't push a commit or ship a project update in 30 days, the bot permanently bans me from my own community.

Result: The fear of "social rejection" and losing access worked instantly. I’ve shipped more in 7 days than in the last 6 months.

I documented the logic and the "NPC Trap" theory here: https://youtu.be/i2xdJ5ISoTI

My Question: Is relying on "fear/stakes" sustainable for long-term engineering growth, or is this just a recipe for burnout? Curious to hear if others use "high stakes" commitments to ship side projects.
by Scoundreller | 2025-12-15 22:54:42+00:00
I get the joke, but LRs/RRs had the top theft rates in Canada, for shipping overseas.

Like, 4% theft rate per year nationwide. 1 in every 25 jacked in a year: https://www.equiteassociation.com/top-10-archives/top-10-mos...

And pushed 7% in Ontario: https://www.equiteassociation.com/top-10-archives/top-10-mos...

(And not those stupid “Honda Civic is the most stolen car” publications that fail to control for popularity. When you do, Civics are middle of the pack).

Of course the industry only published the frequency rates for a few years because it probably didn’t instil the fear factor that journalists failed to point out in their slop.

https://www.equiteassociation.com/top-10-most-stolen-vehicle...
by aleph_minus_one | 2025-12-15 22:54:56+00:00
> I consider myself fluent in English, I watch technical talks and casual youtubers on English daily, and this is the first time I encounter this word lol.

> The only "stride" I know relates to the gap betweeb heterogeneous elements in a contiguous array

I am also not a native English speaker, but I got to know the verb to "to stride" from The Lord of the Rings: Aragorn is originally introduced under the name "Strider":

> https://en.wikipedia.org/w/index.php?title=Aragorn&oldid=132...

"Aragorn is a fictional character and a protagonist in J. R. R. Tolkien's The Lord of the Rings. Aragorn is a Ranger of the North, first introduced with the name Strider and later revealed to be the heir of Isildur, an ancient King of Arnor and Gondor."
by hexad74 | 2025-12-15 22:55:03+00:00
This might not exactly be the place for it but what I struggle with regarding Claude Code is that it doesn't seem to listen to me. I will give it a specific example of code to use as a guide and it just wants to start searching the code base for similar patterns instead of just using the example that has everything it should need. I know claude.md can help but I am not having much luck with a large .NET project using internal nuget packages. I am able to get results decently well but this is a repeated problem I have and if I am not careful, it will blow through my limits.
by soulofmischief | 2025-12-15 22:55:54+00:00
Is Facebook's, or Twitter's? This is about the US federal government wanting to exert control over a popular information portal, nothing more, nothing less.

I don't think the CCP should be in control of it either. Of course, I don't think the UK should be able to backdoor services and devices, and I don't think the EU has any business hurling Chat Control around year after year. I also know that age verification is a similar tactic being employed globally to ensure the same degradation of rights.

That doesn't mean that amplification can't sometimes be a good thing, or that it wasn't a good thing that TikTok allowed so much anti-Israel content even though Instagram and other platforms routinely manipulated discoverability of anti-Israel content. Even if it was part of a plan by China to destabilize the US-Israeli imperial regime; If the US wasn't busy funding and encouraging genocide, we wouldn't have all this rope laying around with which to hang ourselves.

The truth is, the current state of international foreign affairs is so complicated, so messy, that we are not going to be able to have a nuanced yet condensed discussion which fully accounts for everything currently in motion.

So it can be true that TikTok is a tool of China meant to best America in a culture war and destabilize it from within, and that the US Corpgov is still totally in the wrong here and leveraging the usual excuses in a bid to continue the mass consolidation of media distribution under oligarchical control. Everyone is in the wrong here, and you and I are paying for it.
by shrutisingh18 | 2025-12-15 22:56:23+00:00
OP here.

I built this because I realized I was stuck in a loop of 'Passive Learning.' I’d watch 3 hours of system design videos but write zero code. I call it being a 'Consumer Developer.'

I tried willpower/blocking apps, but I always relapsed. I realized I needed Negative Reinforcement (High Stakes).

The Mechanism: It’s a Discord bot I wrote in Python.

It tracks the last time a user posted in the #ship-or-die channel.

If last_post_date > 30 days, it automatically kicks/bans the user.

There is no appeal process.

It’s a ruthless system, but it’s the only thing that has kept me consistent for the last month.

Curious to hear if anyone else has experimented with 'Fear-based' productivity vs. 'Reward-based' systems?
by sudobash1 | 2025-12-15 22:56:57+00:00
I am using a raspberry pi pico with a modified pico-cec program to control my Jellyfin-client media PC. CEC is actually really fun to hack on, and once you get a custom setup working, it is (at least in my experience) rock solid.

Jellyfin even has a TV mode that you can enable in a normal desktop browser. So my media PC runs the browser in kiosk mode, and it has CEC buttons mapped to keyboard presses. Guests have used it, and I don't think anyone could tell that it wasn't a "smart" TV.

https://github.com/gkoh/pico-cec
by mikkupikku | 2025-12-15 22:57:38+00:00
> What you're saying, "There are shows on TV worth watching and the art form is still evolving, and one person not liking it doesn't mean that it is bad"

That's not even remotely what I'm saying!

I would instead say that media is only "evolving" insofar as it is being optimized by media corporations for reliable fiscal return. No risks allowed, everything needs to be cookie cutter, no risks, barely any new IPs even, the industry just wants to get committees of nepo hire "writers" to remix shit they can be reasonably confident will find reliable audiences, and that means pandering to viewers instead of challenging them. Every decision gets run through test audiences, opinion polls, and legions of executives and their consultants. Art cannot be created in such an industry environment. All they can make is base slop.
by neilv | 2025-12-15 22:58:01+00:00
I was thrilled when I saw a Reddit comment about this, and it actually worked with my Sony dumb TV + PS5 + Sony RM-VZ320 universal remote.

(I was sad at having to give up my nice PS4 universal remote, and not finding an equivalent for the PS5.)

However, I couldn't find a button on the remote that was the equivalent of pressing a PS5 controller's PS Button, and that's pretty important to the messy PS5 UI. But the TV had menus that could simulate pressing that button. So I upgraded to a Sony RM-VLZ620, which added programmable macro buttons, which I kludged hard to navigate the TV menus. From my notes:

### Programming PS Button 1. SET(Hold 3 seconds, for LED, then keep holding) 2. middle-circle 3. (Release SET) 4. System-Control-1 5. 9, 8, 1 6. Options 7. Up 8. Down, Down, Down, Down 9. middle-circle, middle-circle 10. SET Note: The **Up** is a timing NOP, since otherwise the TV usually only sees only 3 Down rather than 4.
by pixl97 | 2025-12-15 22:58:06+00:00
>That must mean the Sun also has its fair share of that Uranium?

That's a good question. I would assume the sun captured a whole pile of uranium around the time the earth was forming. And it likely sunk to the core. The question is what happened then. The core area is dense enough to fuse hydrogen into helium, without any calculation I'd guess a lot of this is now in much smaller elements as there are a lot of neutrons to break it apart.
by asadotzler | 2025-12-15 22:58:25+00:00
It's "let's not take your picture inside of the office because everyone hates the inside of offices. let's take your picture outside instead, near the office, but not featuring the office. oh, that tree over there is nice, but darn, the lighting underneath its branches isn't great. hey, that hedge over there reads great in light test and it works with what you're wearing, so, yeah, that'll do just fine."
by galkk | 2025-12-15 22:58:33+00:00
I think that trucks are in worst position for moving to EV.

Customer base is quite conservative in how the truck should look like. For example,F150 lightning had to look like F150.

While a look of truck (and even ordinary car) is defined by the function - need to have beefy, but somewhat serviceable/accessible engine in the front. There is no need for this in the ev truck like at all. It's all dead space now.

I suspect that proper EV trucks eventually will look like current box-over-engine trucks (similar to kei trucks). Like Super crew truck with standard bed will probably have the same dimensions as current short bed truck, with better turn radius. But it won't look cool, and probably have the same stigma as minivans.
by XOPJ | 2025-12-15 22:59:08+00:00
I bought an F-150 last year and compared the lightening to their new Hybrid-Powerboost models. The hybrid was better in every single way. I have the same 30amp generator hookup in the bed of the truck, but instead of finding a charger to refuel the truck I can simply put another 25gallons in the tank and head to another job/project.

If they hadn't made the hybrid truck so effective the lightning would have had a chance. I get around 20+mpg on average with a ~600lb load always in the bed.
by sheepscreek | 2025-12-15 22:59:11+00:00
Not being dismissive of your experience (or that of a civil servant with 10s of years of experience). I have a deep respect for that kind of work and folks who give up more lucrative opportunities in order to serve their country and fellow citizens.

> whose primary qualification was being hired at a "friendly" tech company and making the right kind of joke around the CEO

That’s being awfully dismissive of the individuals skill set. Nobody gets the job by making the right kind of jokes around the CEO. Nobody. Getting in the door takes hard work, talent and some amount of luck.
by bdcs | 2025-12-15 22:59:36+00:00
>Oh, an EREV is fancy way to say "hybrid" ok

Kind of. EREVs are what locomotives have been doing for a century (and to a lesser extent barges), which is called diesel-electric in that field. I agree the terminology is lacking, but EREVs are quite compelling (and their high market share in China supports consumer demand).

Hybrid: * ICE must run during regular operation (except for ~very short distances at ~very slow speeds) -- this increases operational costs (oil changes, economy, engine designed for torque and wide RPM range). * Complex drivetrain with wheels moved by electric motors and ICE, axles, etc. * Generally 10-40 miles of EV range

EREV: * Basically an EV with a short range, and whenever you want to charge the battery on the go (or use the waste heat from the ICE) it can use an efficient (Atkinson cycle) engine to do so. (Though american EREVs have used poorly suited engines for parts availability and enormous towing numbers) * Generally 50-200 miles of EV range * Think "EV for daily commute; ICE for road trips (and heating)"

IMO EREVs would've been a better development path than hybrids or pure EVs.[0] Immediately lower TCO in various interest rate environments via highly-flexible battery sizes, no cold or range anxiety issues, technically simple drive train and BTMS.

[0] I mean the Prius made a lot of technical strides given the battery technology/costs and familiarity the industry had with ICE at time. Tesla went full EV which is a very optimistic approach, and works well enough if you stick around the charging network, but the batteries are still expensive and heavy compared to a small ICE + tank.
by SimianSci | 2025-12-15 22:59:49+00:00
While indeed a positive outlook, I think alot of Americans are beginning to wonder what the benefit will be to them.

The isolationist and xenophobic rhetoric of recent years is mostly a reaction to a growing sense that increasingly few Americans are benefiting from global goodwill and development. While I dont agree with the sentiment, its not entirely incorrect to describe such relationships are parasitic more then symbiotic when they become increasingly one-sided. Why should Americans be exporting PHDs to other countries when they dont seem to be reaping the benefits?