MurphyA/hacker-news huggingface dataset:
by sublinear | 2025-12-19 09:05:26+00:00
> Is this exploitable? No. ... JSON.stringify knows to skip the __proto__ field. ... However, refactors to the code could ... [cause] subtle incorrectness and sharp edge cases in your code base.

So what? This line of what-if reasoning is so annoying especially when it's analysis for a language like javascript. There's no vulnerability found here and most web developers are well aware of the risky parts of the language. This is almost as bad as all the insane false positives SAST scans dump on you.

Oh I'm just waiting to get dogpiled by people who want to tell me web devs are dumber than them and couldn't possibly be competent at anything.
by supernes | 2025-12-19 09:05:33+00:00
> By comparing the photo on an identification card with the holder's actual face on a real-time basis, we can fully prevent the activation of phones registered under a false name using stolen or fabricated IDs.

Don't employees at the POS already check the customer's ID by comparing their face to the ID photo "on a real-time basis" using their eyes? What am I missing?
by tialaramex | 2025-12-19 09:06:30+00:00
> or to cause grievous bodily harm

The GBH (Grievous Bodily Harm) is crucial there. The intent only needs to be GBH which is way easier to prove, for example weapon use. The prosecutors don't need to prove intent to kill, the death is evidence that you killed somebody (except in the rare cases they can't produce a corpse, for which they have to do more work)
by echelon | 2025-12-19 09:06:38+00:00
> people screaming "but AI is the future"

I witnes far more people screaming against AI.

The media started kicking this off in 2021, 2022. It blossomed into a fully distributed, organic, memetic device from there. It has a life of its own now.

Children and young people are practically indoctrinated if you look at social media comments.

I was invited to give lectures to several art schools about using Blender, Unreal Engine, and mocap software with diffusion models. The students weren't very polite. Most of the "questions" I got at each of the campuses were simply statements of affirmation about how much they hate AI.

Good looking and well-reviewed indie games that incorporate AI elements or tools are dumped on by these folks. It's like butting into conversations to say something bad about AI scores points or something.

> Mozilla keeps jumping on fads

Agreed on this point, though. They're rudderless. And Google is probably quite happy about the fact that their antitrust litigation sponge can't steal away their users.
by spwa4 | 2025-12-19 09:07:26+00:00
I've found that this does not match reality. People have strong beliefs in value of specific things, even when that value is not economically there. The value of software is indeed zero, which seems to make people value hiring software engineers greatly over paying for software, and, tbh, that makes approximately zero sense in a lot of cases. The value of medical care is high, even when it's not (meaning there is plenty of medical and "medical" products that don't have real value). The value of houses is high and absolutely certain. Thinks like certain brands (even when the company behind them has disappeared), most obviously of watches.

This tends towards the economic reality but it certainly does not match it.
by Someone | 2025-12-19 09:07:28+00:00
> It seems like maybe the documentation needs to be updated

Looks like it, yes:

/** Enable hash probing to tolerate 32-bit hash collisions. Hash probing configuration (quadratic open addressing for 32-bit hashes: h_i = h_0 + i^2) Limit attempts with `LITE3_HASH_PROBE_MAX` (defaults to 128). Probing cannot be disabled. */ #ifndef LITE3_HASH_PROBE_MAX #define LITE3_HASH_PROBE_MAX 128U #endif #if LITE3_HASH_PROBE_MAX < 2 #error "LITE3_HASH_PROBE_MAX must be >= 2" #endif

> It also means that the spec will ossify around a specific hash function

It is a bit ugly, and will break backwards compatibility, but supporting a second hash function isn’t too hard.

You can, on load, hash a few keys, compare them to the hashes, and, from that, if the input has many keys with high probability, infer which hash function was used.

There also might be spare bit somewhere to indicate ‘use the alternative hash function’.

Reading the code (nice-looking, BTW, for C code, but since it is C code, also full of warnings that other languages can protect you from) I spotted this (https://github.com/fastserial/lite3/blob/acbb97984eca1183ddc...):

> The JSON standard requires that the root-level type always be an ‘object' > or 'array'. This also applies to Lite³.

I don’t think that is true, and https://www.json.org/json-en.html agrees with that. Single values (numbers, strings, booleans, null) also are valid json.
by Imustaskforhelp | 2025-12-19 09:07:56+00:00
> It's this paradox where in order to become a senior engineer, you must get hired as a junior engineer, to learn and observe how production software works, but that is pretty hard these days.

Yes that's true but I would argue this isn't because of AI itself. Sure it might have accelerated it but I have heard that in the 2020's a lot of people got a lot of jobs in the industry and then its that the market did feel saturated and in a sense, a lot of jobs feel this way in the economy where if someone has it, they continue having it but its becoming harder for new people to enter, there are financials reasons for this too mostly if i remember, interests rates are one of the core reasons

That being said, Even though I have used LLM's a lot, I do not agree with your opinion and I am even younger than you most likely (17)

A lot of people my age/people just going into college would use AI a lot to cheat but I will genuinely try to take it slow to learn things. I will try to use it as a learning tool and not as a crutch. Currently I am still in high school and I get ideas which I wish to implement but dont have the time because of exams so I test them out with LLM's but even I find the whole process frustrating at times and its just, maybe its me but there is a good ceiling that I can process. Some basic crud processes can definitely be in that but if your project is novel, even basic things can be hard

I will give you an example, I recently tried creating an api for proton docs which worked by having browser instances. I had two basic scripts that worked on one platform and converted them to puppeteer using LLM and after it worked, I then asked it to simply create a very basic crud api on top of it

Nope, I tried it 5-6 times on the best models on the market but they couldn't actively take two files which had read/write and have it work, either there was an issue in read or an issue in write

I am fine with the project as it is right now and I am fine with the templates it has given me and I am going to build it now on top of it

I had many ideas which could be considered basic crud apps like having a kanban app/github issues like ui on top of bitwarden after I saw a post here by simon saying how he uses github issues and that went semi-viral on hackernews

Another issue is that I think just as how sure writers and similar can generate AI generated, I feel like there would be more trust on the non AI generated code.

Personally I will try my best to create prototypes with AI and if I like them, I will see what it does and then rewrite them myself as an learning experience and also because people say spec driven development etc. but I just want to code things by hand at this point or convert the LLM generated prototypes of idea to something that I later code and understand by hand tbh (most likely when I get into college)
by TekMol | 2025-12-19 09:09:05+00:00
Since even after 2 hours nobody is discussing the actual font, let me tell you what comes to my mind when I read anything about Google and design:

They got phone design right.

I just can't get my head around it that even Apple, which is supposed to be THE design company, is making phones that can't lay on a table without wobbling like a barstool on a crooked floor. It just feels so broken to me. So detrimental to my sense of aesthetics.

Google phones tackled it with an elegant solution. Thanks for that. I wouldn't know what phone to use if Pixels didn't exist.
by Wilder7977 | 2025-12-19 09:09:21+00:00
Working should be a free choice (we can discuss about how much freedom exists for many people), and should always be paid. There is nothing wrong if a prisoner chooses to enagage in (fairly paid) labor. But if they are not free to do so, then they are slaves, not workers.

Prisoners already lack freedom in many aspects. "Sitting on their asses" like if they were sipping cocktails on a beach is a bit a misrepresentation don't you think? I wouldn't exchange the possibility to move and do what I want for possibly any amount of money, nor for being able to "sit on my ass" in that sense. Would you?

Besides the moral arguments - which I will say, they are so obvious that it feels incredible even having to discuss why enslaving prisoners is wrong - you can make economic arguments. For example, that having cheap or borderline unpaid labor compresses the salary in that market, or that this system creates a dysfunctional incentive to increase prison population for private profits.

Maybe that's why the US is one of the countries with the highest incarcerated population in the world. The highest among western and larger countries.

I understand though there is a cultural barrier. I am from Europe and in most countries here prison has a rehabilitation purpose, which is what most benefits society, and prisons are not private entities.
by CopyOnWrite | 2025-12-19 09:09:27+00:00
What really annoys me about Python, is that a lot of problems that the language/infrastructure/community has can easily be tracked back to well understood problems that have been solved for decades in other communities. Some of these problems have been fixed with breaking changes, some others probably never will be fixed.

Just a list of bad/wrong decisions IMHO:

- Reference counting instead of using a real garbage collector

- The pyproject.toml format is under-specified, comes decades too late for a problem that has been solved good enough by Apache Maven more than 2 decades ago

- The absolutely weak support for functional programming, which then was patched by list comprehensions and co later

- venv and other solutions to isolate dependencies for a project

Python is successful because of the community support and a binding to almost everything, and this sadly outweighs a lot of poor choices from the language designers and the implementation. I just always feel frustrated, that during the great breakup from 2-3, they didn't try to fix more of the known issues (which again, have been solved by other communities decades before) instead of breaking the world and still managing to half ass it.
by jackfranklyn | 2025-12-19 09:12:16+00:00
The "going in circles" problem several people mention seems like the key thing to watch for. In my experience it tends to happen when the codebase outgrows what the model can hold in context effectively.

What's worked better for me: treating it like onboarding a contractor. Very specific, bounded tasks with clear acceptance criteria. The moment you're spending more time explaining context than it would take to just write the code yourself, that's the signal to switch back.
by eliasdejong | 2025-12-19 09:12:44+00:00
Author here,

First of all, hello Hacker News :)

Many of the comments seem to address the design of key hashing. The reason for using hashed keys inside B-tree nodes instead of the string keys directly is threefold:

1) The implementation is simplified.

2) When performing a lookup, it is faster to compare fixed-sized elements than it is to do variable length string comparison.

3) The key length is unlimited.

I should say the documentation page is out of date regarding hash collisions. The format now supports probing thanks to a PR merged yesterday. So inserting colliding keys will actually work.

It is true that databases and other formats do store string keys directly in the nodes. However as a memory format, runtime performance is very important. There is no disk or IO latency to 'hide behind'.

Right now the hash function used is DJB2. It has the interesting property of somewhat preserving the lexicographical ordering of the key names. So hashes for keys like "item_0001", "item_0002" and "item_0003" are actually more likely to also be placed sequentially inside the B-tree nodes. This can be useful when doing a sequential scan on the semantic key names, otherwise you are doing a lot more random access. Also DJB2 is so simple that it can be calculated entirely by the C preprocessor at compile time, so you are not actually paying the runtime cost of hashing.

We will be doing a lot more testing before DJB2 is finalized in the spec, but might later end up with a 'better' hash function such as XXH32.

Finally, TRON/Lite³ compared to other binary JSON formats (BSON, MsgPack, CBOR, Amazon Ion) is different in that:

1) none of the formats mentioned provide direct zero-copy indexed access to the data

2) none of the formats mentioned allow for partial mutation of the data without rewriting most of the document

This last point 2) is especially significant. For example, JSONB in Postgres is immutable. When replacing or inserting one specific value inside an object or array, with JSONB you will rewrite the entire document as a result of this, even if it is several megabytes large. If you are performing frequent updates inside JSONB documents, this will cause severe write amplification. This is the case for all current Postgres versions.

TRON/Lite³ is designed to blur the line between memory and serialization format.
by mikae1 | 2025-12-19 09:13:59+00:00
Google broke up with RSS in 2013[1]. :D

To be fair, they re-implemented feeds for YouTube and added feed support in Google Workspace the other day[2]. So perhaps there's hope.

[1] https://en.wikipedia.org/wiki/Google_Reader

[2] https://workspaceupdates.googleblog.com/2025/12/introducing-...
by Someone | 2025-12-19 09:14:28+00:00
> because one should count all CVEs.

That is debatable, and I think untrue. It sometimes takes years to find CVEs in C code, and I don’t know of an argument why that would be different for Rust.

The fairest comparison, I think, would be with other new code of similar complexity in the kernel, and track #of CVEs per equivalent functionality (per line of code might be sufficient, but if one language is verbose than the other, you should correct for that)
by cakealert | 2025-12-19 09:15:32+00:00
when you combine a residential proxy with a tool like curl-impersonate (there are libraries in Go for this type of fingerprint spoofing now) they dont even show up as scrapers anymore, just users. especially when they adjust timings to mimic humans.

clouflare only blocks the most dumb of bots, there are still a lot of them.

this is why cloudflare will issue javascript challenges to you even when you are using google chrome with a VPN, they are desperate to appear to be doing something. and every VPN is used to crawl as well. a slightly more sophisticated bot passes the cloudflare javascript challenge as well, there really is nothing they can do to win here.

i know some teams that got annoyed with residential proxies (they are usually sold as socks5 but can be buggy and low bandwidth) so they invested into defeating the cloudflare javascript challenge and now crawl using 1000's of VPN endpoints at over 100 Gbit/s.
by solid_fuel | 2025-12-19 09:15:58+00:00
> Companies routinely lose money for years in pursuit of long term growth.

But much of that long term growth now is just the company growing to displace competitors in existing markets, often by subsidizing prices and dodging regulations - see: Uber, Lyft, Air BnB, etc.

We've all seen the playbook a dozen times now: move into a market, keep prices artificially low until the existing competitors are displaced, then the raise prices to return the initial investment and more. That kind of growth-by-displacement is genuinely necessary sometimes but in these cases it's more like a fungus than a plant, just metabolizing an existing system.

It's not the same thing as actually expanding a market or investing in concrete assets (steel mills, power plants, boats, railroads) or R&D that compounds future growth. When the actual investment is just spent artificially lowering prices there's no actual efficiency gains and the consumers ultimately pay the price and more when the company hits the peak of the existing market and shift to enshittification mode to really extract wealth.
by gpt5 | 2025-12-19 09:16:15+00:00
Can you clarify what are you talking about? The US has been developing 6th-gen fighter since the mid mid-2010s - not that I'd consider it as an important new original invention.

What I would consider as the most impactful inventions of the last decade would be things like mRNA, Generative AI, and reusable rockets - all came from the US and the US is maintaining the lead in them.
by KronisLV | 2025-12-19 09:16:37+00:00
At this point I’d straight up buy their PC components, because fuck Nvidia for doing that. Same goes for other manufacturers throwing the consumer segment into the dirt because of their greed.

I already got an Intel Arc to support more market competition (A580 was rough, B580 is a decent daily driver) and if the prices weren’t absolutely insane would have gotten the 245K (better than my 5800X, but not for the price).
by throwaway2037 | 2025-12-19 09:18:49+00:00
Wow, this switch (MikroTik CRS812) is scary good for the price point. A quick Google search fails to find any online vendors with stock. I guess it is very popular! Retail price will be <= 1300 USD.

I did some digging to find the switching chip: Marvell 98DX7335

Seems confirmed here: https://cdn.mikrotik.com/web-assets/product_files/CRS812-8DS...

And here: https://cdn.mikrotik.com/web-assets/product_files/CRS812-8DS...

> Switch chip model 98DX7335

From Marvell's specs: https://www.marvell.com/content/dam/marvell/en/public-collat...

> Description: 32x50G / 16x100G-R2 / 8x100G-R4 / 8x200G-R4 / 4x400G-R8 > Bandwidth: 1600Gbps

Again, those are some wild numbers if I have the correct model. Normally, Mikrotik includes switching bandwidth in their own specs, but not in this case.
by mytailorisrich | 2025-12-19 09:19:20+00:00
Unfortunately, as usual no-one replies to what was written but instead go full strawman on a single point because it is easier.

For instance: "You keep claiming there is a moral problem with giving people enough of a basic stipend to actually live out of the gutter."

I have never suggested this...

"... and using that as justification to either browbeat the recipients of minimum-quality-of-life benefits"

Or that.

"A morality that treats work as virtuous for its own sake"

And neither have I that...

Interesting how people have also latched on my mentioning morals and ignored everything else.
by neya | 2025-12-19 09:19:34+00:00
Rather not create a told you so moment, but I switched to Samsung - which has tons of garbage apps pre-installed, and tons of ads - but I'm not atleast buying into a delusion that a private company somehow has my privacy at its best interest just because I paid a premium to them. In the end, I got a good deal with a cheaper price for more features - I can have a real file system access, install apps from anywhere I like, etc.
by bitwize | 2025-12-19 09:21:52+00:00
Safe Rust eliminates some of the more common memory bugs in C. The bug under discussion was written in unsafe Rust—but even that doesn't obviate the huge advantages Rust has over C. Even unsafe Rust, for instance, has far fewer UB gotchas than C. And with Rust, you can isolate the tricky bits in 'unsafe' blocks and write higher-level logic in safe Rust, giving your code an extra layer of protection. C is 100% unsafe—"unsafe at any speed" as I like to say.
by spwa4 | 2025-12-19 09:21:54+00:00
> No, land value tax only makes it more expensive to leave the property empty. It doesn't make anything else more expensive. Indeed, it makes it cheaper for a business to buy up an unused property, because the seller would rather sell at a loss than incur a sufficiently larger loss (land value tax) over time.

You're disregarding everything I said. The problem is that "selling at a loss" is a much, much higher loss than the tax over time, which is what's sustaining the bubble for 1.5 years now. Investors are showing the opposite behavior of what you claim, and you are unwilling to even consider the data.

There effectively a land value tax on commercial property. It's called a mortgage. It's just being paid to banks (and the money "destroyed") instead of going to government. It has the opposite effect of what you claim: it makes land values higher despite no development.

You are also totally not considering what happens if your "forced to sell" shit actually goes through. That money is people's pension money and money that is used for social security. If your tax results in those loans disappearing, yes, you may be able to buy the lot cheaply, but only at the cost of destroying a large amount of people's livelihoods.
by mrweasel | 2025-12-19 09:22:02+00:00
It might open up for a terrifying level of abuse, but if you can have Dtrace and eBPF implemented in the Linux kernel, you can surely design an API for allowing AIs to be plug-able within Firefox.

Firefox is already a really good browser, Mozilla really should be focusing on that. They can design and implement an AI plugin system to go into that core. People who want AI can install an agent and enable the AI sub-system. If the AI companies won't implement it, Mozilla can do it and charge a fee for the plugin.
by atoav | 2025-12-19 09:22:23+00:00
If you build a house out of inflammable bricks instead of magnesium ones you can at least rule out magnesium fires.

Now the question is: If we live in a world where magnesium fires are common, can we afford to not at least try building with the inflammable bricks?

I know this topic stokes emotions, but if you haven't tried Rust as someone with C/C++ experience, give it a go. You will come out wiser on the other side, even if you never use the language for anything.
by throwaway2037 | 2025-12-19 09:22:31+00:00
I'm not trolling here: Do you think that Marvell sells the chips wholesale buy the vendor buys the feature set (IP/drivers/whatever)? That would allow Marvell to effectively sell the same silicon but segment the market depending upon what buyers needs. Example: A buyer might need a config that is just a bunch of 50GB/s ports and another 100GB/s ports and another a mix. (I'm thinking about blowing fuses in the manuf phase, similar to what AMD and Intel do.) I write this as a complete noob in switching hardware.
by squibonpig | 2025-12-19 09:22:58+00:00
Yeah. My iPhone SE finally ran out of steam recently and I decided to go ahead and exit the ecosystem as best as I could. Saw grapheneos had just added experimental support for the Pixel fold 10 and picked one of those up. Some annoyances like no tap payment, but honestly a great experience so far, no regrets. Probably not for people who need the interop with other apple devices tho.
by JumpCrisscross | 2025-12-19 09:23:14+00:00
> that because you credibly could, you're in a much stronger negotiating position in all those mutually beneficial deals you would like to make

Except it doesn't put one in a stronger position. It systematically weakens the economy. It only makes sense for domestic power-consolidation since a poor economy that can't trade with anyone except the state is entirely beholden to whoever controls the state.

Stupid idea. Stupid people.