MurphyA/hacker-news huggingface dataset:
by wkat4242 | 2025-12-21 01:26:47+00:00
No I agree with you. I think it is bad framing as "S3 open bucket" when people would totally understand an open website :)

I'm not shitting on anything except the wording in the article.

I guess I didn't word it clearly.

In our company we don't really serve directly from open buckets but through cloudfront. Though this is more because we are afraid of buckets marked open by mistake so they are generally not allowed. But I agree there's nothing bad about it. I just meant it sounds much worse (at least to someone in cybersec like me) and I don't like the effect used as such in the article.
by esrauch | 2025-12-21 01:27:45+00:00
There's a lot here, to be honest these things always come back to investment cost and ROI compared to everything else that could be worked on.

Java 8 is still really popular, probably the most popular single version. It's not just servers in context, but also Android where Java 8 is the highest safe target, it's not clear what decade we'll be in when VarHandle would be safe to use there at all.

VarHandle was Java 9 but MemorySegment was Java 17. And the rest of FFM is only in 25 which is fully bleeding edge.

Protobuf may realistically try to move off of sun.misc.unsafe without the performance regressions in a way that is without adopting MemorySegment to avoid the versioning problem, but it takes significant and careful engineering time.

That said it's always possible to have waterfall of preferred implementations based on what's supported, it's just always an implementation/verification costs.
by AYBABTME | 2025-12-21 01:28:25+00:00
The fact that as many engineers are on payroll doesn't mean that "cloud" is not an efficiency improvement. When things are easier and cheaper, people don't do less or buy less. They do more and buy more until they fill their capacity. The end result is the same number (or more) of engineers, but they deal with a higher level of abstraction and achieve more with the same headcount.
by whizzter | 2025-12-21 01:28:37+00:00
Yeah, mgmt (and more than anything, query tools) is gonna be a PITA.

But looking at it in a different way, say building something like Google Sheets.

One could place user-mgmt in one single-threaded database (Even at 200k users you probably don't have too many concurrently modifying administrators) whilst "documents" gets their own database. I'm prototyping one such "document" centric tool and the per-document DB thinking has come up, debugging users problems could be as "simple" as cloning a SQLite file.

Now on the other hand if it's some ERP/CRM/etc system with tons of linked data that naturally won't fly.

Tool for the job.
by TGSSecurity | 2025-12-21 01:30:38+00:00
Recent security incidents keep showing the same failure mode: once signing authority is compromised, execution is irreversible.

Multisig, audits, and formal verification all help — but they still assume that a valid signature implies safe execution. This article explores why that assumption keeps failing, and what it looks like to separate transaction requests from execution authority at runtime.

I’m interested in feedback from people thinking about wallet security, access control, or threat modeling.
by defrost | 2025-12-21 01:31:08+00:00
Cheer up.

If you're still in Sydney I'd argue that large numbers of people paddled out off of Bondi Beach because of a pervasive Australian belief that there's always a few arseholes but most people are fundamentally good and community support is better than nothing.

You likely saw a couple of extremists repeatedly tackled and then dropped by the public and police, and near real time running in to help victims.

That's somewhat contra to the bleak of "humans are inherently evil".

Maybe the message of Lord of the Flies was that nuclear weapons and the Cold War depressed at least one author and that boys need mentors.

Maybe it's an issue in general with the On the Beach genre, from Shute to Winton: https://theshovel.com.au/2025/08/20/tim-winton-wonders-why-n...:
by Arodex | 2025-12-21 01:31:43+00:00
Oh, it is not that software like freecad is not parametric by necessity; it is just that in a parametric design process, you don't set all the parameters at once. Why? Because a) you don't overconstraint a design, and b) your parameters rely on references (a point, a line, the side of another object, a tangent), and you may want to change which reference you choose.

For example, if you put a hole in a box, do you want to reference the center of the sides of the hole? And do you want to place them relative to the left side or right side, and front or back? You never say "it's x mm from the left and y mm from the right and my box is w mm wide" - because the relationship x+y=w is always here! You only define 2 out of 3. But it may happen that you picked the wrong 2 - and a parametric CAD makes it very easy to do so in a few clicks, while a programmatic CAD like OpenSCAD is a large rewrite with calculation you have to do yourself on the side.

My example is silly but start doing big designs, large assemblies, and you "chains of cotations" may need to be redone again and again - especially when tolerances begin to add up.
by AmVess | 2025-12-21 01:32:13+00:00
Yes, it works. The state that I used to reside in has draconian DUI/Traffic laws, and not coincidentally low traffic death rates.

Driving with license revoked or suspended was a serious charge and resulted in impound of vehicle and mandatory jail time. Repeat offenders would have their vehicles seized.

DUI laws similarly brutal. 2nd time offenders faced potentially life-altering charges and penalties. Get into an accident with injury to another person while DUI? Huge jail time. Felony DUI results in permanent loss of driving privileges.

Speeding 20 over the limit? Enjoy your reckless driving charge which is as serious a dui charge.

I read that getting a license back after a 2nd dui carries and average cost of $50k. Getting 2 dui's within 10 years automatically bumped 2nd dui to felony....no more driving for you.

Lax driving laws and penalties do nothing more than get a lot of people killed.
by AnotherGoodName | 2025-12-21 01:32:16+00:00
https://dqydj.com/net-worth-by-year/ See "Median Net Worth by Year".

It's inflation adjusted to 2022 though, not 2025 (hopefully at least that's still in ballpark though). There was a slight spike upwards for median wealth during the pandemic fwiw. This seems to have entirely corrected though.
by Mawr | 2025-12-21 01:32:28+00:00
That's not possible. It's not an SSD thing either, it always applies to everything [0].

Sequential access is just the simplest example of predictable access, which is always going to perform better than random access because it's possible to optimize around it. You can't optimize around randomness.

So if you give me your fanciest, fastest random access SSD, I can always hand you back that SSD but now with sequential access faster than the random access.

[0]: RAM access, CPU branch prediction, buying stuff in bulk...
by ClipNoteBook | 2025-12-21 01:32:31+00:00
Stop keeping dozens of tabs open. Paste links into ClipNotebook and turn them into clean playlists you can open and share in seconds. ClipNotebook is a simple online bookmark manager. Paste links and we turn them into clean visual cards you can revisit anywhere. Create read‑only snapshot links and send them to friends or teammates. Share playlists without exposing your private notebook URL.
by nine_k | 2025-12-21 01:33:37+00:00
T-Mobile, a major phone provider, runs an ISP which is IPv6 only. That is, your phone never gets an IPv4, unless connected to WiFi. They offer home access points with a 5G modem and a router; the external address is also IPv6 only.

It works plenty well. I access everything accessible via IPv6, and the rest through their 464XLAT, transparently.

My LAN still has IPv4, because some ancient network printers don't know IPv6. OpenWRT on my router supports IPv6 just fine. Of course I do not expose any of my home devices to the public internet, except via Wireguard.
by wkat4242 | 2025-12-21 01:34:29+00:00
Exploratory yes but when you're still exploring it's not a great idea to bet a whole company on something that might not pan out. Or to dump stuff on users with lots of promotion that may or not be actually useful.

And yeah for accessibiity a lot of this is hugely useful but that's a very niche usecase.

And yes AI-assisted search (or deep research, even better) is also something I like. But it's also because search engines themselves have become so enshittified and promote bad content first.
by AYBABTME | 2025-12-21 01:34:29+00:00
You can chose to see it as astroturfing, or see it as people actually thinking the superlatives are appropriate.

To be honest, it makes no difference in my life if you believe or not what I'm saying. And from my perspective, it's just a bit astounding to read people's takes that are authoritatively claiming that LLMs are not useful for software development. It's like telling me over the phone that restaurant X doesn't have a pasta dish, while I'm sitting at restaurant X eating a pasta dish. It's just weird, but I understand that maybe you haven't gone to the resto in a while, or didn't see the menu item, or maybe you just have something against this restaurant for some weird reason.
by nkrisc | 2025-12-21 01:35:33+00:00
Not in the literal sense (which would semantically impossible), but we have domesticated ourselves with the advent of farming and the domestication of crop plants. We fundamentally changed our own lifestyle into an agricultural one, the same we changed lifestyle of several large mammal species to co-exist with us in that agricultural lifestyle. So perhaps in some sense, maybe we actually did literally domesticated ourselves.
by mikestorrent | 2025-12-21 01:36:41+00:00
Great addition, but would it really be so hard for Microsoft to ever expose these kinds of options properly like they once did? It should be visible in the Control Panel, it should be named in Group Policy without being gated behind some feature preview MSI. Feels half baked on that side of it; perhaps that kind of thing is harder to actually ship than a major new low level IO feature like this.
by codeslinger | 2025-12-21 01:36:53+00:00
Disclaimer: ex-AWS here.

This article ends up making a compelling case for DynamoDB. It has the properties he describes wanting. Many, many systems inside of Amazon are built with DDB as the primary datastore. I don't know of any OSS commensurate to DDB, but it would be quite interesting for one to appear.

> "Every transaction can only be in one shard" only works for simple business logics.

You'd be quite surprised at what you can get out of this model. Check out the later chapters of the DynamoDB Book [1] for some neat examples.

[1] https://dynamodbbook.com/
by ajkjk | 2025-12-21 01:37:05+00:00
whether or not string theory is at this point grifty and weird, the theoretical basis for it is far stronger than you would think based only on reading critics / pop sci explainers. It is not like, missing any obvious physical facts in its foundation. Rather it is trying to say: look, we have this zoo of particles with seemingly random masses and properties; is there same lower-level framework which can produce the zoo that we see according to a simpler list of rules? The obvious choice for this, especially given some of the "hierarchies" of particles that are observed, is that they are in some way resonant modes of some kind of underlying object. Which is where you get the strings from. (Which might sound like a weird justification if you are not aware of all the other aspects of physics which get explained as resonances of fields; this is a standard sort of justification which there's a lot of good reasons to be interested in, at least initially.)
by qouteall | 2025-12-21 01:37:05+00:00
Thanks for reply.

So in my understanding:

- The transactions that only touch one shard is simple

- The transactions that read multiple shards but only write shard can use simple optimistic concurrency control

- The transactions that writes (and reads) multiple shards stay complex. Can be avoided by designing a smart sharding key. (hard to do if business requirement is complex)
by lanstin | 2025-12-21 01:37:39+00:00
While it is fun to have your code run for 500 days without restart, it is a bad architecture. You should be able to move load around from host to host or network to network without losing any work. This involves graceful draining and then shutting down the old.

For impossible errors exiting and sending the dev team as much info as possible (thread dump, memory dump, etc) is helpful.

In my experience logs are good for finding out what is wrong once you know something is wrong. Also if the server is written to have enough but not too much logging you can read them over and get a feel for normal operation.
by ZeWaka | 2025-12-21 01:39:39+00:00
Since the article asks:

> We're curious about the peaks at whole minutes (particularly 2:00, 3:00, 4:00). If you know why this is, please let us know!

As a hobby video/audio editor, people will start with their track taking up a preset amount and fill up the time - even if it means having some dead space at the end.

The other alternative is algorithmically created music.
Show HN: Eze – AI co‑pilot that turns startup ideas into execution roadmaps
by foolmarshal | 2025-12-21 01:40:04+00:00
Hi HN,

I’m working on eze, an AI‑powered co‑pilot that turns a raw startup idea into a visual, time‑bound execution roadmap.

It’s not live yet; I’m building it in parallel and wanted to test the waters before going too deep.

Shipping a product has become dramatically easier. With modern AI and “vibe‑coding” tools, a solo dev can stand something up in a weekend.

What hasn’t changed is the "execution planning":

Figuring out what to do, in what order, and why still means endless blog posts, podcasts, videos, and conflicting advice.

Most guidance assumes experience, capital, or a team that many first‑time/solo founders don’t have.

The result is messy Notion pages, random diagrams, and a constant feeling of “I’m probably missing something important.”

That gap—between being able to build and knowing how to execute—is what eze is trying to address.

The vision for eze:

- You describe your idea in a chat: problem, target user, B2B/B2C, SaaS/dev‑tool/etc. - You add context: Where you are now (student, full‑time job, already building, solo vs team). - Resources (time per week, money, people). - Target launch horizon (1/3/6 months, etc.).

eze generates a visual roadmap:

- Stages like validation, MVP, GTM, launch, post‑launch, scaling. - Milestones with dependencies and brief descriptions. - Each milestone is editable, trackable, and can have notes/due dates. - You’d get this as an interactive diagram (boxes and arrows), not just a wall of text.

Over time, the plan becomes a guided, time‑bound execution view you can actually work against.

The longer‑term idea is for the AI to increasingly learn from real founder journeys and well‑known startup frameworks, so the recommendations are practical rather than generic checklists.

Right now, this is under active development. I have early prototypes of:

- Chat → structured roadmap representation - Diagram‑style UI concepts - Basic milestone/status model

Before going further, I’d like to know if this is solving a real problem for the kind of people who hang out here.

I’d love your honest take on any of these:

- Is this actually useful, or just a shiny toy? - What would it need to do for you to trust it enough to plan a real project? - What’s obviously missing, naïve, or over‑complicated? - Should I narrow it to a specific niche (e.g., dev‑tools/SaaS only) or scrap the idea altogether?

If this resonates and you’d like to see it evolve, there’s a simple waitlist here:

join waitlist here - https://eze.lovable.app/

Otherwise, any blunt feedback in the comments is extremely welcome. I’d rather course‑correct (or kill it) early than build something that only looks good in demos.
by generic92034 | 2025-12-21 01:41:59+00:00
Well, I am not sure about the newer BTP-based stuff, but the main ABAP-based core of an SAP S/4HANA system certainly does not need those capabilities, as it is still basically the same running in on premise systems. The priority of a couple of BTP apps might be quite low, if they are not starting from scratch.
by nemomarx | 2025-12-21 01:42:03+00:00
I've heard 2:00 is some kinda sweet spot for the Spotify algorithm and payouts? You get paid per play so you don't want to it too long, but if your track is much shorter than two minutes you get penalized or something. I know they've had to remove ambient tracks that were cut into 40 second clips as part of this.

So you might see a lot of anchoring just like YouTube videos kept stretching to almost exactly ten minutes?
by Olu | 2025-12-21 01:44:14+00:00
Thanks for the thoughtful feedback — these are all fair concerns.

The app doesn’t access your production clusters. Previews run in managed, isolated clusters, and each preview gets its own namespace with deny-all NetworkPolicies, quotas, and automatic teardown. That said, if the concern is about installing charts into any external K8 cluster at all, then I agree this won’t be a fit — and that’s a reasonable constraint.

It’s GitHub-first today simply because that’s where I personally hit the problem. GitLab is supported via the REST API using a personal access token that you can scope as tightly as you want, so you can trigger previews from GitLab CI today.

Native GitLab App integration (auto-triggering on MRs, status updates, etc.) is something I’ve thought about, but I wanted to validate the core workflow first.

It is intentionally Helm-only for now. The specific pain I was trying to solve was reviewing Helm changes — values layering, dependencies, and template changes — by seeing them running in a real environment, rather than trying to generalise across all deployment models.

I’m not trying to replace or compete with Flux or Argo CD. The idea is to validate Helm changes before they land in a GitOps repo or get promoted through environments — essentially answering the question of “does this look OK and actually work when deployed, so should be safe to merge?”

It doesn’t expose rendered manifest diffs today, but I agree that would be valuable — especially a readable “what changed after Helm rendering” view tied back to the PR. I’m still thinking through the cleanest way to do that without adding a lot of complexity to the workflow.

Appreciate you taking the time give your feedback. Thanks.
by drweevil | 2025-12-21 01:44:18+00:00
I agree. I use passwords with TOTP whenever possible. Passwords in a locally stored database (such as KeePassXC) can be easily shared. TOTP using Google Authenticator can also be easily shared, not just with my partner, but also among my own devices. Right now I see this as a much better, simpler, and much easier to understand option. BTW, the "easier to understand" is a big feature. Passkeys seem to be complex; just look at all the arguments about them in these comments. And where there is complexity there is vulnerability.
by englishcat | 2025-12-21 01:45:16+00:00
That makes a lot of sense, it really highlights the diffences in learning stages. My current tool if primarily designed for intermediate language learners who have already learned some basic words, but still in the 'accumulation phase' - their main bottleneck is vocabulary size, so they need to see new words frequently.

it sounds like you are at a more advanced stage of learning Chinese, you have moved past simple vocab building and are focusing on flow and fluency reading. For your use case, that 'inverse' approach (Chinese with English safety nets) is definitely superior for pattern-matching, it's a different problem set, but a very valid one.

Appreciate your feedback.
Show HN: ArkhamMirror – CIA's Analysis of Competing Hypotheses, Runs in Browser
by ArkhamMirror | 2025-12-21 01:45:24+00:00
After adding a fully guided, AI-assisted Analysis of Competing Hypotheses (ACH) feature to ArkhamMirror, my privacy-first open-source Investigative analysis platform, I kept hearing the same request: "I just want to try ACH without setting up Docker and databases."

Message received. I built a standalone version that runs entirely in your browser.

Live tool: https://mantisfury.github.io/ArkhamMirror/ach/ Full ArkhamMirror repo: https://github.com/mantisfury/ArkhamMirror

What it does:

Implements Heuer's 8-step ACH methodology (the CIA technique for avoiding confirmation bias) Guides you through identifying hypotheses, gathering evidence, building the consistency matrix, and running sensitivity analysis Exports to JSON, Markdown, or PDF

Privacy model:

All data stored in browser localStorage Zero network calls after initial page load except to/from your AI provider (if applicable) No backend, no accounts, no telemetry Works offline once loaded Built as part of ArkhamMirror, a 100% local investigative platform I made as a non-coder using AI assistants.

Optional AI assistance:

Connect your own API key (OpenAI, Groq) for AI-powered suggestions Or use local LLMs (Ollama, LM Studio, local Anthropic through proxy) if you run it locally The AI helps suggest hypotheses, evidence items, and ratings – but you make all decisions

Why standalone? The full ArkhamMirror platform is powerful but requires Docker + databases. This gives journalists, analysts and anyone who's curious a zero-friction way to try the ACH methodology immediately.

Analysts have been stuck with crappy spreadsheets for a long time. Now they (and you) have a free upgrade. Source: https://github.com/mantisfury/ArkhamMirror/tree/main/ach-sta...

If you try it out, please let me know what you think.
by bilbo0s | 2025-12-21 01:46:49+00:00
That's as may be, but still, remember what Lyndon B Johnson said about controlling the lower classes.

Something about convincing the lowest white person that they're better than the best black guy.

I don't see that ploy failing to work in the US for a long, long time. So maybe the elites will lose control and thus, the "war"? But I doubt it.
by timschmidt | 2025-12-21 01:47:42+00:00
What does this say about the post's author's approach to discussion?

"It suggests the author treats the thread less like a joint search for truth and more like an adversarial contest they intend to win—mainly by controlling the frame, the burden of proof, and the audience’s impression of credibility.

Debate-as-prosecution mindset: They stack demands (“Even better…”) to keep the other person perpetually answering instead of advancing their own case. That’s a control tactic: tempo and agenda stay with them.

High skepticism aimed outward, not inward: They insist on exact wording and dismiss anything not explicitly stated as “speculation,” while leaning heavily on indirect proxies (no lawsuit, no committee action, absence in leaks) that aren’t equally “explicit.” That asymmetry is a tell.

Institutional and procedural gatekeeping: They treat “courts/standing/oversight” as the main truth-filter. This often signals: “If it were real, the system would have validated it,” which can be a genuine heuristic but also a way to end discussion without engaging messy uncertainty.

Status and ridicule as persuasion: The ad hominem (“lunatic ravings,” “middle manager”) and condescension (“Do you know what standing means?”) show they’re comfortable using social pressure and humiliation to delegitimize rather than patiently clarify.

Binary framing of the other side: They recast the opponent’s position as either “conspiracy theory” or “relying on a crazy ex-employee,” leaving little room for nuanced middle ground. That’s more about cornering than understanding.

Net: the author likely values rhetorical dominance and public signaling (“this claim is unserious”) over cooperative interpretation."