MurphyA/hacker-news huggingface dataset:
by dvt | 2025-12-15 20:27:10+00:00
> It's so strange to hear you and GP talking as if no one has ever learned a foreign language without moving to another country.

I speak three languages fluently (two prior to moving to said country; English, for example, is not my native tongue), so that's a weird assumption to make. With that said, I still think it's the most efficient way to learn a language, especially given how almost everyone's a nomad (especially in tech) these days.
by bloomingeek | 2025-12-15 20:27:13+00:00
Most modern home AC systems have, as a rule of thumb, ten percent fresh air intake. This varies, depending on the home size and state and local codes. On my home the fresh air vent is high up in my attic, which should protect me from over spraying of chemicals. However, if you have a window unit or an on ground system this will affect your exposure.

In an effort to save money, some will close their fresh air vent, this is not recommended because of the lack of air trade out in the system.
by zzo38computer | 2025-12-15 20:27:18+00:00
I do not like D-Bus either, and I do not like JSON either. Some of the problems are the ones mentioned there, and it has many other problems as well (one of these is that its use of Unicode can cause problems, but there is a lot more problems than just that). I do not agree with the solutions mentioned there either, although they do make some improvements, there are also some problems.

A better way would be a different operating system design, although without that, you can still improve it on Linux. I think putting secrets in the message bus is not really the way to do sandboxing properly, and I think there should not be a global message bus (it should be specific to a program; if the program is properly sandboxed it can be limited what it can access, and possibly they can be declared by the use of environment variables, although).

There are also problems with the existing sandboxing systems; e.g. some do not work properly with character sets and might not support such things as: popen, command-line arguments of the program to restrict which files can be read/written, etc.

For security for programs running on the same computer communicating with each other while they are running, cryptographic algorithms are probaly not the way to do it; the operating system should handle the security to prevent programs from seeing and/or tampering with something that it is not supposed to do, so that the communication between programs is prevented unless it is configured to allow it.

For the data format, I might use DER (or SDER for the fields that are not required to be in canonical form, since canonical form does not matter for all fields but for some it might matter).

(The implementation would prevent messages from being sent to or received from whoever it is not supposed to be allowed to do, by checking the permissions and/or by just blocking access, forwarding the messages to proxies that might modify and/or log them, etc; such things can potentially make the system more versatile.)
by 1718627440 | 2025-12-15 20:27:28+00:00
> What do you mean it is not a source of bugs?

I think what they mean, and what I also think is that the bug does not come from the existence of uninitialized variables. It comes from the USE of uninitialized variables. Making the variables initialized does not make the bug go away, at most it silences it. Making the program invalid instead (which is what UB fundamentally is) is way more helpful for making programs have less bugs. That the compiler still emits a program is a defect, although an unfixable one.

As to my knowledge C (and derivatives like C++) is the only common language where the question "Is this a program?" has false positives. It is certainly an interesting choice.
by peanut-walrus | 2025-12-15 20:27:43+00:00
So everyone has wanted "year of the Linux desktop" for a while. This year, since Microsoft has decided to call open season on their own feet and Valve has taken a break from swimming in their money pool to make sure absolutely any piece of software ever written can run on Linux, it looks like this might actually be happening. I am seeing a massive influx of new users, driven by distros like Cachy, Nobara, Bazzite. A lot of them don't have previous Linux experience and are generally not the most technically savvy users.

This absolutely terrifies me. Linux desktop security is, to put it politely, nonexistant. And the culture that goes with Linux desktop users just makes things worse, there's still a lot of BOFH gatekeeping going on, laughing at the new users when they inevitably mess something up and worst of all, completely refusing to admit that the Linux desktop has security issues. Whenever a new user asks what antivirus they should run, they are usually met with derision and ridicule, because the (oldschool) Linux users genuinely think their computers are somehow immune and can never be hacked.

The first cybercriminals to put some development effort into Linux ransomware/stealers are going to wreak havoc and a lot of people are going to be in for a rude awakening. The D-Bus issue with secrets in the article is just one of many many many ways in which Linux desktops are insecure by design.

There are of course distros out there that take security seriously, but we are not really seeing new users migrating to Qubes en masse.

Edit: not calling out the distros above in particular, all 3 are doing very good work and are not really any worse in security than most other distros.
by mahkoh | 2025-12-15 20:28:22+00:00
>Back when I was writing xdg-desktop-portal-hyprland, I had to use a few dbus protocols (xdg portals run on dbus) to implement some of the communication. If we go to the portal documentation, we can find the protocols.

>[...]

>None of the apps, I repeat, fucking none followed the spec. [...]

>Fun fact: THIS IS STILL THE CASE! The spec advertises a "restore_token" string prop on SelectSources and Start, where no app does this and uses "restore_data" in "options".

Wrong. xdg-desktop-portal has a client API and a compositor API. In the client API the property is called restore_token [1]. In the compositor API the property is called restore_data [2]. Clients do not talk directly to the compositor, they talk to the xdg-desktop-portal application which then talks to the compositor. It is not surprising the the properties would not be called the same.

In the documentation the APIs for app developers and desktop developers are clearly separated on the left hand side [3]. Not only does this have nothing to do with DBus (it would apply to every API where a middleware is used to translate messages), it also shows that the author did not do his due dilligence.

[1]: https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.fr...

[2]: https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.fr...

[3]: https://flatpak.github.io/xdg-desktop-portal/docs/
by froggit | 2025-12-15 20:28:29+00:00
> (just a hypothetical, I assume most parents can't afford to buy one)

It used to be that high school students were required to have a graphing calculator. These had to be purchased by the student (iow by their parents) and without factoring in 20+ years of inflation costed more than some Chromebooks available today. I suspect there were (and still are) financial assistance programs as i've known students living below the poverty line and they were able to meet that requirement.
by kgeist | 2025-12-15 20:28:31+00:00
Some additional cases we encounter quite often where UUIDs help:

- A client used to run our app on-premises and now wants to migrate to the cloud.

- Support engineers want to clone a client’s account into the dev environment to debug issues without corrupting client data.

- A client wants to migrate their account to a different region (from US to EU).

Merging data using UUIDs is very easy because ID collisions are practically impossible. With integer IDs, we'd need complex and error-prone ID-rewriting scripts. UUIDs are extremely useful even when the tables are small, contrary to what the article suggests.
by andatki | 2025-12-15 20:28:33+00:00
Hi there. Thanks for the feedback. I updated that section to hopefully convey the intent more. The type of ordering we care about for this topic is really B-Tree index traversal when inserting new entries and finding existing entries (single and multiple values i.e. an IN clause, updates, deletes etc). There's a compelling example I re-created from Cybertec showing the pages needed and accessed for equivalent user-facing results, comparing storing PKs as big integers vs. UUID v4s, and how many more pages were needed for v4 UUIDs. I found that to be helpful to support my real world experience as a consultant on various "medium sized" Postgres databases (e.g. single to 10s of millions of records) where clients were experiencing excessive latency for queries, and the UUID v4 PK/FKs selection made for reasons earlier was one of the main culprits. The indexes wouldn’t fit into memory resulting in a lot of sequential scans. I’d confirm this by showing an alternative schema design and set of queries where everything was the same except integer PKs/FKs were used. Smaller indexes (fit in memory), reliable index scans, less latency, faster execution time.
by rozap | 2025-12-15 20:29:27+00:00
The funny thing here is that the short (often 1-3 years) tenure that's so common in the industry leads to some absolute dogshit software. Good things take time. By limiting terms to 2 years you almost guarantee that outcome.

The biggest red flag on engineering resumes is never sticking at something for more than 2 years. Your bad decisions never catch up to you.
by firefax | 2025-12-15 20:30:03+00:00
>I've read at least two articles authored by historians that thought this book was full of factual errors and misunderstandings.

Feel free to provide these citations if you dislike the book

>It may be good read, but don't expect the book to be fair or truthful.

It's creative nonfiction -- a literary telling of a factual event. And no one is required to be "fair" to anyone, especially Nazis. Some things don't have "both sides".
by luxpir | 2025-12-15 20:30:06+00:00
The discussion has devolved to such a point that people from outside the UK keep parroting this (likely Kremlin originated) line that the UK is now a Muslim stronghold with no free speech when in reality it just continues to uphold the values it has influenced the world with, one of the few positives from its dark past, of protecting those unable to protect themselves. Hate speech and punching down. As if inciting violence is completely harmless and no bad ever comes of it.

Many freedom-focused people without direct experience of disability, bullying or discrimination have no way to relate to that concept, and the echo chamber amplifies the intellectually dishonest takes until they take hold. Which is exactly what the angry, seething, downtrodden richest people in the world seem to want right now. I wonder why. What a sorry, hopeless state we've allowed to happen. Everyone is entitled to an opinion, sure, but the ones who've worked hardest to develop theirs should be weighted the most. Now a Russian bot has the same value on a platform as a nuclear scientist or, dare I say it, a real journalist. Because it's entertaining and tickles some dangling dopamine receptors. I'm sure people will wind their necks in when the ultimate result has finally played out and we'll cycle back to cooler heads prevailing, but I fear we'll have to go there first before we get back.

Yes I took the bait, but no regrets, I'll die on this hill. Hate bullies and liars with a passion.
by pragadeesh21 | 2025-12-15 20:30:36+00:00
Hey HN,

I built this because i kept running into the same bottleneck on data projects: staging environments are always either empty or dangerous. Using production dumps always puts you at risk of PII leaks, but generating meaningful test data with python tools (like faker or SDV) often hit OOM errors or took hours once I tried to simulate anything complex.

I spent the last week writing replica_db to solve this. its a CLI tool written in rust that reverse engineers your existing Postgres schema and foreign key topology, then creates a "statistical genome" of your data using reservoir sampling.

The cool part (for me) was implementing Gaussian Copulas to handle correlations. Most generators treat columns independently, which creates non correlated data (like a user with age 5 earning $200k). I used nalgebra to compute the covariance matrix of numeric columns, so the engine actually learns the shape of the data.

I tested this on Uber NYC trip dataset, and it automatically detected the correlation between latitude and longitude. When i generated 5 million fake trips they respected the actual geography of NYC instead of placing points randomly in the ocean.

Benchmarks on my laptop have been encouraging. Scanning 564k real world rows takes about 2.2 seconds and generating 10 million synthetic rows takes under 5 seconds (~49k rows/sec) with constant memory usage. The output streams standard COPY format directly to stdout so you can pipe it straight into psql.

The repo isn't licensed yet. Its my first project involving this level of systems programming and statistical math in rust. So i'd appreciate any feedback on the implementation or the math strategy!

https://github.com/Pragadeesh-19/replica_db
by phkahler | 2025-12-15 20:30:51+00:00
Put OS calls on the bus. IMHO we need to add permissions to most user-space APIs so apps don't need to be sandboxed in a VM for security. Is this what SE Linux is? But I sometimes want permission to be granted by the user. For example, I don't want programs to be able to access files unless the user specifies the file - this might be through direct interaction with a GUI, or if we're really smart/tricky enabled if a filename comes on the command line typed by the user. I hope this makes sense, a way to gate system access via normal user input. Is this a reasonable possibility, or am I dreaming too big?
by c-hendricks | 2025-12-15 20:31:11+00:00
God I loved kparts, but wasn't that more the idea that everything should be embeddable?

> KPart technology is used in kde to reuse GUI components ... By using kparts in applications developers can spend less time implementing text editor or command line features, for example and just use a katepart or a konsolepart instead.

https://techbase.kde.org/Development/Tutorials/Using_KParts
by ethbr1 | 2025-12-15 20:31:29+00:00
That sweat doesn't lessen dealing with nightmare fly-by-night vendors for whatever business application a department wants.

Sometimes, the devil you know is preferable -- at least then you control the source.

Folks fail to realize the status quo is often the status quo because it's optimal for a historical set of conditions.

Previously... what would your average business user be able to do productively with an IDE? Weighed against security risks? And so the point that was established.

If suddenly that business user can add substantial amounts of value to the org, I'd be very surprised if that point doesn't shift.

It matters AND...
by btown | 2025-12-15 20:31:30+00:00
The certificate lifetime decrease, to 45 days, was discussed in: https://news.ycombinator.com/item?id=46117126

This isn't LE's decision: a 47 day max was voted on by the CA/Browser Forum.

https://www.digicert.com/blog/tls-certificate-lifetimes-will...

https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-sch...

https://groups.google.com/a/groups.cabforum.org/g/servercert... - public votes of all members, which were unanimously Yes or Abstain.

IMO this is a policy change that can Break the Internet, as many archived/legacy sites on old-school certificates may not be able to afford the upfront tech or ongoing labor to transition from annual to effectively-monthly renewals, and will simply be shut down.

And, per other comments, this will make LE the only viable option to modernize, and thus much more of a central point of failure than before.

But Let's Encrypt is not responsible for this move, and did not vote on the ballot.
by gamblor956 | 2025-12-15 20:31:34+00:00
Nations that wholeheartedly embrace AI and destroy their economies won't survive very long when all of their citizens are out of work and too broke to afford food or housing.

The nations that survive will be the ones that control the use of AI.

And to be quite blunt, any comment that suggests that AI is relevant to more than a handful of jobs doesn't understand how the world actually works.
by kllrnohj | 2025-12-15 20:31:45+00:00
> Most of binder is in outright Java

None of binder is in Java. The Java binder code is just JNI bindings to the native implementation.

Things like permission manager are in Java, but that's not part of binder. It's just a service published on binder, and one that wouldn't translate to current desktop Linux anyway.

> Compared to _unix sockets_ , which is the other transport used by almost every other local IPC mechanism, and what both D-Bus, TFA's proposal, and literally any other reasonable desktop IPC proposal out there, there is just no contest.

unix sockets are not an equivalent, which is why protocols are bolted on top to turn it into dbus, etc...

EDIT:

> The other libbinder (openbinder) is dead since 2006ish.

The libbinder I meant is the one in AOSP hence why I said "AOSP is right there":

https://cs.android.com/android/platform/superproject/main/+/...

That one is very definitely not dead since 2006ish.
by slig | 2025-12-15 20:32:05+00:00
Thanks for sharing! I want to have some sort of agentic "helper" to my new puzzles website [1], and I've learned some tips from your post/code, thank you!

Have you given any thought about how to create the puzzles? Do you think it'd possible to create them using LLMs?

[1]: https://www.puzzleship.com
by tclancy | 2025-12-15 20:32:35+00:00
For me, it was in the linked blog post

>"Now, anyone who has read Mindset by Carol Dweck, Grit by Angela Duckworth, or The Brain That Changes Itself by Norman Doidge, M.D., knows that you can be, do, and have whatever you want."

The gap between "read" and "understood" swallows so many. Also, did he use TR's "Man in the Arena" quotation? Reader, of course he did.
by gorgoiler | 2025-12-15 20:32:43+00:00
It feels like there’s a big vacuum of a federal level privacy judgement waiting to be filled. SCOTUS abhors a vacuum, though you could argue it’s already been filled in that the past two decades of rulings on cell phone records (phone=you) are directly applicable to photos of your car (car=you).

Maybe the argument against is that ALPR can’t constantly track you like cell towers can?
by vel0city | 2025-12-15 20:32:43+00:00
So we'll move the datacenters from the tiny town to just outside of a giant city which will probably move that percentage down to only a few percent if even that. Problem solved!

You're looking at the wrong metrics to compare here if we're trying to just gauge how efficient a datacenter is or is not. This metric could be useful if the datacenters are attached to the municipal water system and thus begin to be a massive load compared to what was originally planned/built, but in terms of understanding the total water use compared to other industrial users its kind of a meaningless statistic.
by gaurav12342345 | 2025-12-15 20:32:58+00:00
A single agent request can fan out across sub-agents, tools, model calls, retries, and external APIs. When something goes wrong, logs aren’t enough and raw traces aren’t very helpful unless you can actually understand them.

The hard part isn’t emitting OpenTelemetry spans. That’s easy.

The hard part is turning high-cardinality agent traces into something a human can reason about.

In our agent framework at Inkeep, we use OTEL end-to-end. The linked post is by SigNoz, because that’s the OTEL backend we use underneath- but we don’t expect developers to debug agents by staring at raw span trees or waterfall views alone.

On top of raw OTEL traces, we expose an agent-aware timeline view that makes a single request’s execution path across agents, tools, and model calls easy to follow. The underlying trace data is still standard OTEL. The extra work is in making it understandable.

We ended up using SigNoz largely because: - It exposes a programmatic trace API, which makes building custom views possible - It can actually query high-cardinality traces without falling over - It’s OTEL-native, so nothing is proprietary or locked in

A few opinions we formed along the way: - Instrument everything by default - Make observability automatic, not opt-in - Treat observability as part of the product, not a separate tool

If you’re building AI agents and observability isn’t shaping your UX yet, you’re going to feel it in production.
by firefax | 2025-12-15 20:33:08+00:00
> Also worth checking: comp.lang.* Usenet groups (surprisingly active)

Do you know of a newbie friendly FAQ on how to access usenet in the modern era?

>Reddit's niche programming subreddits (r/rust, r/golang)

Even less niche places like /r/python seem pretty open to writing code by hand. (Though I like how python has libraries for many things)
by derefr | 2025-12-15 20:33:46+00:00
> Drilling the average student on trying to make their language superficially “smarter” is a comically bad idea, and is indeed the opposite of what almost all of them need.

I mean, it seems like it could work if you get to follow it up with a "de-education" step. Phase 1: force them to widen their vocabulary by using as much of it as possible. Phase 2: teach them which words are actually appropriate to use.
by ErroneousBosh | 2025-12-15 20:34:09+00:00
> People forget that the US is still the #2 manufacturer in the world

Manufacturer of what, exactly, though?

What do you export? What do you sell?

Food? Nope, illegal in most of the world.

Cars? Nope, uncompetitive in most of the world. "High end" American cars lack even basic features fitted to poverty-spec cars in the EU, like heated windscreens.

Computers? I'm typing this on a computer assembled in Scotland onto a Latvian-made chassis using a Chinese-made motherboard populated with Korean memory chips and an Israeli microprocessor.

What does the US actually make and sell, any more?
by bakugo | 2025-12-15 20:34:33+00:00
> Why can't the LLM refrain from improving a sentence that's already really good?

Because you told it to improve it. Modern LLMs are trained to follow instructions unquestioningly, they will never tell you "you told me to do X but I don't think I should", they'll just do it even if it's unnecessary.

If you want the LLM to avoid making changes that it thinks are unnecessary, you need to explicitly give it the option to do so in your prompt.
by matthewkayin | 2025-12-15 20:34:55+00:00
It's most likely that they are. As farfetched as this sounds, the CIA and the Iowa Writers' Workshop influenced American writing a great deal, encouraging writing to be taught in the "American" / Hemingway style.

> “the American MFA system, spearheaded by the infamous Iowa Writers’ Workshop” as a “content farm” first designed to optimize for “the spread of anti-Communist propaganda through highbrow literature.” Its algorithm: “More Hemingway, less Dos Passos.”

https://www.openculture.com/2018/12/cia-helped-shaped-americ...