MurphyA/hacker-news huggingface dataset:
by fc417fc802 | 2025-12-26 22:13:12+00:00
You're trying to analyze an entirely different game played by an entirely different set of players by the same set of rules. It's a contextual error on your part. The decision to recognize or not recognize a given body of rules held by an opposing party on the international level is an almost entirely separate topic.

> A choice to enforce laws against small entities they can easily bully, and to not do it on a larger scale.

That's a systemic issue, AKA the bad regulatory regime that I previously spoke of. That isn't some inherent fault of the tool. It's a fault of the regulatory regime which applies that tool.

Kitchen knives are absolutely essential for cooking but they can also be used to stab people. If someone claimed that knives were inherently tools of evil and that people needed to wake up to this fact, would you not consider that rather unhinged?

> To add insult to injury, you will find these choices were almost never made by parliaments, but in international treaties and larger organizations like the WTO, or executive powers of large trade blocks.

That's true, and it's a problem, but it (again) has nothing to do with the inherent value of IP as a concept. It isn't even directly related to the merits of the current IP regulatory regime. It's a systemic problem with the lawmaking process as a whole. Solve the systemic problem and you can solve the downstream issues that resulted from it. Don't solve it and the symptoms will persist. You're barking up the wrong tree.
Ask HN: What's still broken in SoC 2 readiness and audit prep?
by asdxrfx | 2025-12-26 22:13:27+00:00
Hi HN,

I’m working on a SOC 2 readiness platform and wanted to get perspectives from people who’ve actually been through SOC 2, either in-house or while helping other companies.

From what I’ve seen, teams still struggle most with task planning over time, follow-ups, and turning evidence into something that’s actually audit-ready. Many end up with a mix of spreadsheets, shared folders, and last-minute report building, even when they’re using dedicated tools.

I’m curious:
- Where did SOC 2 preparation break down most for you?
- What parts felt overly manual or fragile?
- If you’ve used tools like Vanta, Drata, or others, what did they do well and what didn’t they?

I recently launched a new version of a platform I’m building (https://www.lumoar.com) that focuses on automating task scheduling and generating pre-audit / gap analysis reports directly from controls and evidence, but I’m more interested in learning where the real gaps still are.

Would appreciate any candid experiences or advice.
by cm2012 | 2025-12-26 22:13:43+00:00
Happy to provide. I will say that literally all these sources are already available in this HN thread, but its hard to find and many of the comments are down voted. So here you go:

This link has a great overview of why generative AI is not really a big deal in environmental terms:
https://andymasley.substack.com/p/a-cheat-sheet-for-conversa...

GenAI is dramatically lower impact on the environment than, say, streaming video is. But you don't see anywhere near the level of environmental vitriol for streaming video as for AI, which is much less costly.

The European average is 56 grams of CO2 emissions per hour of video streaming. For comparison: 100 meters to drive causes 22 grams of CO2.

https://www.ndc-garbe.com/data-center-how-much-energy-does-a...

80 percent of the electricity consumption on the Internet is caused by streaming services

Telekom needs the equivalent of 91 watts for a gigabyte of data transmission.

An hour of video streaming needs more than three times more energy than a HD stream in 4K quality, according to the Borderstep Institute. On a 65-inch TV, it causes 610 grams of CO2 per hour.

https://www.handelsblatt.com/unternehmen/it-medien/netflix-d...

Here is another helpful link with calculations going over similar things: https://nationalcentreforai.jiscinvolve.org/wp/2025/05/02/ar...
by dang | 2025-12-26 22:13:57+00:00
Related. Others? (and how did we miss 2023, 2018, and 2016?)

Fogus: Things and Stuff of 2024 - https://news.ycombinator.com/item?id=42495077 - Dec 2024 (44 comments)

The best things and stuff of 2022 - https://news.ycombinator.com/item?id=33969300 - Dec 2022 (47 comments)

The Best Things and Stuff of 2021 - https://news.ycombinator.com/item?id=29702698 - Dec 2021 (23 comments)

The best things and stuff of 2020 - https://news.ycombinator.com/item?id=25593828 - Dec 2020 (37 comments)

Things and Stuff of 2019 - https://news.ycombinator.com/item?id=21932647 - Jan 2020 (11 comments)

Great things and people that I discovered, learned, read, met, etc in 2017 - https://news.ycombinator.com/item?id=16075626 - Jan 2018 (24 comments)

Best things and stuff of 2015 - https://news.ycombinator.com/item?id=10807501 - Dec 2015 (85 comments)

The best things and stuff of 2014 - https://news.ycombinator.com/item?id=8809710 - Dec 2014 (26 comments)

The best things and stuff of 2013 - https://news.ycombinator.com/item?id=6971351 - Dec 2013 (29 comments)

The best things and stuff of 2012 - https://news.ycombinator.com/item?id=4969569 - Dec 2012 (13 comments)

The best things and stuff of 2011 by Fogus - https://news.ycombinator.com/item?id=3410990 - Dec 2011 (20 comments)
by FridgeSeal | 2025-12-26 22:14:10+00:00
Current link points straight to the Python code without a lot of context, so here’s the top of the readme:

> CVE-2025-14847 - MongoDB Unauthenticated Memory Leak Exploit

> A proof-of-concept exploit for the MongoDB zlib decompression vulnerability that allows unauthenticated attackers to leak sensitive server memory.
by SpicyLemonZest | 2025-12-26 22:14:54+00:00
I would point towards Oracle v. Rimini, where the Ninth Circuit has specifically ruled (inside a complex and yet-unresolved case) that a system built to interoperate with a copyrighted program does not constitute a derivative work of that program. (https://cdn.ca9.uscourts.gov/datastore/opinions/2024/12/16/2...)

They reference a less on point but better known case (https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_Inc._v._Nin...., for some reason you have to manually add the period at the end of the link) about whether NES cheat cartridges were copyright infringement. If a work that directly links to and interoperates with a program is a derivative work of that program, the Game Genie really was illegal after all. To me that doesn't seem right, and given the FSF's general opinion on console restrictions (https://www.fsf.org/bulletin/2025/winter/new-nintendo-drm-ba...) I kinda feel like they'd have to agree.
by johngossman | 2025-12-26 22:15:10+00:00
It depends on who and what you read. Since they became controversial, I notice them more. Charles Dickens used them both regularly--most pages seem to have both.

Virginia Woolf's writing has the most semi-colons I've seen and almost as many em-dashes. It fits her stream of consciousness style where there are very few hard stops.

Jack Vance used semi-colons in almost the opposite fashion to increase the tempo by having short clauses without using conjunctions. His action scenes are sometimes almost staccato.

Just today I'm reading Patricia McKillip and noticed she also used a lot of em-dashes.
by tsol | 2025-12-26 22:15:15+00:00
Parasites used to be ubiquitous before we had medication to kill them. There's even a (not very well supported) theory that these parasites helped with allergies by moderating immune system. They releasing chemicals to lower immune activity in order to protect themselves, so the idea that we had these for thousands of years and basically are made to have them is intriguing. It's called "helminthic therapy" and it's considered alternative medicine but there is some academic interest. Results in clinical trials have been mixed. Perhaps the future is just synthetic hookworm proteins that regulate your immune system as our ancestors once had.
by kylecazar | 2025-12-26 22:15:20+00:00
Albert Camus -- The Plague, The Fall, Exile and the Kingdom, and Selected Essays

I'll pick the one(s) I read most recently. Camus and his absurdism resonate with me. His writing is simple and precise, but his ideas are big. Some of these essays were rereads, but I gained something new, as I have more life experience to integrate with the subject matter.

If you ever find yourself wondering what the point of effort and progress is given the realities of life, you may enjoy his work. I suspect there are some of his (and peers Sartre and de Beauvoir) readers floating around here on HN.
Mouse: Computer Programming Language
by gappy | 2025-12-26 22:15:52+00:00
https://en.wikipedia.org/wiki/Mouse_(programming_language)

https://archive.org/details/byte-magazine-1979-07/page/198/m...

https://www.amazon.com/MOUSE-Language-Microcomputers-Peter-G...

The Mouse Programming Language on CP/M - https://news.ycombinator.com/item?id=41400380 - Aug 2024 (14 comments)
by zzo38computer | 2025-12-26 22:16:04+00:00
Git already has a blockchain; what you will need to do next is to make copies of the objects of the repositories on other servers as well. (However, I don't know if the blockchain includes tags on git (it seems to me that it might not but I don't know enough about it), although it does include objects. Fossil includes tags in the blockchain as well as files, commits, etc.)
by jopsen | 2025-12-26 22:16:17+00:00
You don't need fully distributed database, do you?

You could just make a registry hosted as plain HTTP, with everything signed. And a special file that contains a list of mirrors.

Clients request the mirror list and the signed hash of the last entry in the Merkel tree. Then they go talk to a random mirror.

Maybe, you central service requires user sign-in for publishing and reading, while mirrors can't publish, but mirrors don't require sign-in.

Obviously, you'd have to validate that mirrors are up and populated.
But that's it.

You can start by self hosting a mirror.

One could go with signing schemes inspired by: https://theupdateframework.io/

Or one could omit signing all together, so long as you have a Merkel tree with hashes for all publishing events. And the latest hash entry is always fetched from your server along with the mirror list.

Having all publishing go through a single service is probably desirable. You'll eventually need to do moderation, etc. And hosting your service or a mirror becomes a legal nightmare if there is not moderation.

Disclaimer: opinions are my own.
by anthk | 2025-12-26 22:16:20+00:00
You would love the readings from Mckenna and the DMT, and the concept of Fractal Time.

https://serendipity.li/trypt.html

List:

https://serendipity.li/dmt/dmtart00.html

Yeah, I know, pseudoscience and the like, but biology it's weird and with the current scientific discoveries (and even reusing quantum mechanics for profit, such as chlorofilla with leafs and photons), Nature itself it's 'magical'. Not actually something from fairy tales, but from weird mechanics we are actually grasping a little today.

Instead of my comment from I-Ching being taken as numerology, I would think of the universe as something being 'computed over', kinda like numeric towers under Lisp. Because in the end nothing exists per se; it's just fields generating matter, waves, energy and probably, information.
Thus, the Mckenna theory on Fractal Time (and the Chinese paper from Vixra) might be related to hypercubic equations (because of Hamming distance between changes) that we aren't fully aware.
by XorNot | 2025-12-26 22:16:43+00:00
I'd say it'd just Kubernetes in general should've shipped with a storage engine and an installation mechanism.

It's a very hacky feeling addon that RKE2 has a distributed internal registry if you enable it and use it in a very specific way.

For the rate at which people love just shipping a Helm chart, it's actually absurdly hard to ship a self contained installation without just trying to hit internet resources.
by fc417fc802 | 2025-12-26 22:16:49+00:00
We want to encourage intellectual endeavors that are desirable to society as a whole but which otherwise face barriers. Making them monetarily favorable is an easy way to accomplish that. Similar to how not speeding is made monetarily favorable, or serving in the military is made monetarily favorable, etc. Surely you don't object to the government using monetary incentives to indirectly shape society? The historical alternatives have been rather brutal.
by consp | 2025-12-26 22:17:45+00:00
> People who purposefully made a choice in this matter.

I am convinced most people never had or ever will have this choice actively. Considering pillarisation (this is not a misspelling) was already a thing in most political systems well before the advent of mass media and digital media it only got worse with it, effectively making choices for people, into the effective hands of few people, influenced by even less people. Those people in the government you mention do not make the choices, they have to act on them as I read it.
by sheepscreek | 2025-12-26 22:18:00+00:00
Use Claude Opus in Antigravity. Google is very generous with the limits. The best part is, if you hit your limit, you can switch to Gemini Pro High.

I think Google is able to do this because they host Claude on their own TPUs in their datacentres (probably for Vertex AI customers). So they can undercut just about anyone include Anthropic on costs!

No matter which model you start with, having the other frontier model as a backup is fantastic. Essentially you’re getting 2x the limit.
by breischl | 2025-12-26 22:18:41+00:00
I read the article as saying it ignores all upper-bounds, and 4.0 is just an example. I could be wrong though - it seems ambiguous to me.

But if we accept that it currently ignores any upper-bounds checks greater than v3, that's interesting. Does that imply that once Python 4 is available, uv will slow down due to needing to actually run those checks?
by VorpalWay | 2025-12-26 22:19:19+00:00
CI: I changed a pipeline at work from pip and pipx to uv, it saved 3 minutes on a 7 minute pipeline. Given how oversubscribed our runners are, anything saving time is a big help.

It is also really nice when working interactivly to have snappy tools that don't take you out of the flow more than absolutely more than necessary. But then I'm quite sensitive to this, I'm one of those people who turn off all GUI animations because they waste my time and make the system feel slow.
by decimalenough | 2025-12-26 22:19:26+00:00
You're likely referring to the death cap (Amanita phalloides), which is reportedly quite tasty. But there's also a mushroom that's both deadly poisonous and a sought-after, commercially sold delicacy, the only difference being the method of preparation:

https://en.wikipedia.org/wiki/Gyromitra_esculenta

Although recent research suggests that some poison remains even after careful preparation, and that consumption may even be linked to ALS (Lou Gehrig's disease).
by paddw | 2025-12-26 22:19:50+00:00
> Thinking of Kubernetes as a runtime for declarative infrastructure instead of a mere orchestrator results in very practical approaches to operate your cluster.

This is a pretty good definition.

I think part of the challenge is the evolution of K8s over time sometimes makes it feel less like a coherent runtime and more like a pile of glue amalgamated from several different components all stuck together. That and you will have to be aware of how those abstractions stick together with the abstractions from your cloud provider, etc...
by DonHopkins | 2025-12-26 22:20:18+00:00
Otherwise you might confuse it with the HN mod tomhow.

Same reason they remove "dang" if the post starts with it, like the discussion about "Dang! Who ate the middle out of the daddy longlegs".

https://ifunny.co/picture/dang-who-ate-the-middle-out-of-the...
by WarOnPrivacy | 2025-12-26 22:20:22+00:00
"Here is your next iPhone" presupposes I have ever owned an iPhone.

Accepting this, I infer the video speaks to a point so distant in my future that I can not envision it. And in that future, 1-2 people think [highly/lowly] of me and gift me iphones.

Sadly the title does not reveal whether I ever use these devices. If I did, we'd know that the iphone ecosystem will be radically different one day.
by mythrwy | 2025-12-26 22:20:23+00:00
Great hobby!

A couple of things about corn. It might not be soil at issue. Germination depends on correct temperature and moisture. Too much moisture the seed will rot or not have enough air to germinate. Too little moisture it won't trigger germination. Too deep it won't germinate, too shallow and germination won't happen either because it will dry out instead of staying moist. Seeds vary in depth they require and some even require light to germinate (doesn't apply to corn). It's a bit of an art figuring out what "even moisture until germination" is, and this varies based on soil type. Timing of planting with correct temperature is important.

Each kernel of corn has one silk. The silk is analogous to a Fallopian tube with pollen traveling down into the ovary (or kernel of corn in this case). If you have an ear of corn with only a few kernels it's often because pollen didn't land on all the silks. For this reason corn is usually planted in blocks. It's wind pollinated so wind shakes pollen off the tassels or male flowers at the top, down onto the silk. But if you just have one corn plant in isolation, or a row in isolation it's easier for the pollen to just blow away or miss. Planting in blocks or "array of arrays" configuration helps the pollen to reach the silk more uniformly as pollen from the surrounding plants is released.
by culi | 2025-12-26 22:20:25+00:00
Spinach too is mildly toxic because of its oxalate content yet we eat it all the time. Some of those toxic saponins even have certain health benefits. There are plenty other examples of toxic foods we regularly consume: legumes contain deadly saponins, beets contain oxalates, and potatoes contain glycoalkaloids

From what I read Suillellus luridus (见手青) is completely fine when cooked
by robertclaus | 2025-12-26 22:20:28+00:00
At Plotly we did a decent amount of benchmarking to see how much the different defaults `uv` uses lead to its performance. This was necessary so we could advise our enterprise customers on the transition. We found you lost almost all of the speed gains if you configured uv behave as much like pip as you could. A trivial example is the precompile flag, which can easily be 50% of pips install time for a typical data science venv.

https://plotly.com/blog/uv-python-package-manager-quirks/
by whytevuhuni | 2025-12-26 22:20:37+00:00
> What's the really simple K8s?

I think K8s couples two concepts: the declarative-style cluster management, and infrastructure + container orchestration. Keep CRDs, remove everything else, and implement the business-specific stuff on top of the CRD-only layer.

This would give something like DBus, except cluster-wide, with declarative features. Then, container orchestration would be an application you install on top of that.

Edit: I see a sibling mentioned KCP. I’ve never heard of it before, but I think that’s probably exactly what I’d like.
by w10-1 | 2025-12-26 22:21:00+00:00
I like the implication that we can have an alternative to uv speed-wise, but I think reliability and understandability are more important in this context (so this comment is a bit off-topic).

What I want from a package manager is that it just works.

That's what I mostly like about uv.

Many of the changes that made speed possible were to reduce the complexity and thus the likelihood of things not working.

What I don't like about uv (or pip or many other package managers), is that the programmer isn't given a clear mental model of what's happening and thus how to fix the inevitable problems. Better (pubhub) error messages are good, but it's rare that they can provide specific fixes. So even if you get 99% speed, you end up with 1% perplexity and diagnostic black boxes.

To me the time that matters most is time to fix problems that arise.
by zsoltkacsandi | 2025-12-26 22:22:19+00:00
It's right there:

> the source of most of the problems I've seen with infrastructures using Kubernetes came from exactly this kind of approach

But some more concrete stories:

Once, while I was on call, I got paged because a Kubernetes node was running out of disk space. The root cause was the logging pipeline.
Normally, debugging a "no space left on device" issue in a logging pipeline is fairly straightforward, if the tools are used as intended.
This time, they weren't.

The entire pipeline was managed by a custom-built logging operator, designed to let teams describe logging pipelines declaratively. The problem? The resource definitions alone were around 20,000 lines of YAML. In the middle of the night, I had to reverse-engineer how the operator translated that declarative configuration into an actual pipeline.
It took three days and multiple SREs to fully understand and fix the issue. Without such a declarative magic it takes usually 1 hour to solve such an issue.

Another example: external-dns.
It's commonly used to manage DNS declaratively in Kubernetes. We had multiple clusters using Route 53 in the same AWS account. Route 53 has a global API request limit per account.
When two or more clusters tried to reconcile DNS records at the same time, one would hit the quota. The others would partially fail, drift out of sync, and trigger retries - creating one of the messiest cross-cluster race conditions I've ever dealt with.

And I have plenty more stories like these.
by ostashenkods | 2025-12-26 22:22:49+00:00
I've founded and closed multiple companies over 14 years. Each time, hard-won lessons just disappeared into nothing.
Medicine advanced when doctors started doing systematic autopsies. Aviation safety improved after black boxes became mandatory. But for organizations? 90% of startups fail, and we collect almost no structured data about why.
SOIL collects "autopsy" data from founders of dead companies - functional state at peak, financial trajectory, timeline of events, environmental factors, founder context. Framework-agnostic: we gather data first, then analyze through multiple lenses to see which theories actually predict failure.
The goal: build enough cases to identify patterns, early warning signals, eventually predictive models. Each company gets a digital memorial (cenotaph) - you can browse existing ones without signing up.
Looking for the first 100 founders willing to document their dead companies. Feedback on the approach welcome.
by cxr | 2025-12-26 22:22:56+00:00
That's not what they're saying.

On the shelves are three insulin pumps: one with a 5-year warranty, one at a bargain barrel price that comes with no warranty, and one accompanied by a written offer allowing you to obtain the source code (and, subject to the terms of the GPL, prepare your own derivative works) at no additional charge any time within the next three years.

Weighing your options, you go with pump #3. You write to the company asking for the GPL source. They say "nix". They're in breach.