MurphyA/hacker-news huggingface dataset:
by ursAxZA | 2025-12-22 23:24:37+00:00
My point was simply that electricity has a “civilization tax” aspect to it, and lower baseline access feels closer to the kind of future-proof system we should be aiming for.

If the floor is gentle, people can actually reduce usage without feeling punished for doing the right thing.

At the moment the baseline tier feels… maybe a “C-rating” version of what a real baseline could be?
by The_President | 2025-12-22 23:24:56+00:00
Recently audited a software plan created by an AI tool. NPM dependencies as far as the eye can see. I can only imagine the daunting liability concerns if the suggested "engineering" style was actually put forth to be used in production across the wide userbase. That said, the process of the user creating the "draft" codebase gave them a better understanding of scope of work necessary.
by cogman10 | 2025-12-22 23:25:25+00:00
> I won't be interested in working for the state for basic necessities while the state takes the rest.

Better contributions lead to better rewards. You might be able to buy more things if you setup an underground business, but you'd still be stuck in whatever house you currently live in (for example). You can get much nicer accommodations and a higher salary with bigger and better contributions to the state. That's the motivation for people to not just be farmers.

> I'd rather barter with others for the useful things they produce. My friend, for example, grows excellent tomatoes.

That's fine. Communism wouldn't stop simple bartering.

> Over time, if we have many friends, we will live comfortable lives, while loners will wither away.

Loners would be taken care of by the state. They don't wither.

The place where the communist state would step in is if you moved from simple barter to actually owning and operating businesses (where you employ people, give them a salary, etc). Again, mopsi's scarf business wouldn't be allowed without state approval. But you making scarfs for your community in exchange for the communities homemade stuff would not only be welcome but encouraged.

> Is this an acceptable outcome for you as the dictator of the Bestest Communist Paradise on Planet Earth (BCPPE), or will you do something about it?

I don't understand your snark. I get that you hate communism.

Again, as I stated elsewhere, I'm not a communist. I don't think misunderstanding and misrepresenting the position of communists does you any good if you are trying to convince others that it's a bad ideology.

I should also state that I'm basically just talking about simple marxism. However, I think what I'm describing applies to most forms of communism.

If you like I can give you my critique of communism.
by hamdingers | 2025-12-22 23:25:27+00:00
> "as a background character in a ride somewhere" or "seen in the distance surrounded by handlers"

I can see why you're confused. Either of those possibilities would be acceptable and exciting, neither are going to happen.

Olaf (like the walking droids, flying x-wings, etc. before it) has so far made one single appearance in the parks on an off day, which was treated like a photoshoot. The photos from that shoot will be used in park promotional materials for years, incorrectly giving casual observers the impression that this is something that happens regularly.

If Walt Disney had advertised the Lincoln animatronic as being a part of the 1964 worlds fair, but only exhibited it for a few hours one time, he would have been ridiculed too.
by vkou | 2025-12-22 23:25:44+00:00
At the same time as pardoning the Jan 6 insurrectionists, he's seeking multi-year felony convictions for... People standing in front of an ICE bus.[1]

https://www.spokesman.com/stories/2025/jun/12/stuckart-relea...

[1] Apparently, if Tank Man[2] was present in the US in 2025, he'd be guilty of 'Unlawful imprisonment'.

[2] https://en.wikipedia.org/wiki/Tank_Man
by brendoelfrendo | 2025-12-22 23:27:06+00:00
> you are showing bad faith

No, I'm not. You haven't proven it.

> just like AD, oauth is used for authentication and authorization

In a sort of roundabout way, but in those cases what the relying party is accessing are the user's identifying details.

> of course, we do not use "web" inside internal enterprise networks

That's not really what I mean. I would never expose an AD domain to the internet, that's not what it's for.

> can you execute any kind of code on AWS' IAM servers

That's not what I was saying, I was saying it in the context of a self-hosted identity provider. If all you've meant by this entire exchange is that OAuth means you don't have to worry about security because you've outsourced it to someone else, then I've really wasted my time.
by tekacs | 2025-12-22 23:27:32+00:00
Just to talk about a different direction here for a second:

Something that I find to be a frustrating side effect of malware issues like this is that it seems to result in well-intentioned security teams locking down the data in apps.

The justification is quite plausible -- in this case WhatsApp messages were being stolen! But the thing is... that if this isn't what they steal they'll steal something else.

Meanwhile locking down those apps so the only apps with a certain signature can read from your WhatsApp means that if you want to back up your messages or read them for any legitimate purpose you're now SOL, or reliant on a usually slow, non-automatable UI-only flow.

I'm glad that modern computers are more secure than they have been, but I think that defense in depth by locking down everything and creating more silos is a problem of its own.
by uplifter | 2025-12-22 23:27:47+00:00
Makes sense, thanks. I guess it would only feel like a slant if the "force" causing the odd shape, the gravity of the pulsar, was removed. Then all the extended gas would fall back towards the center, while a solid planet might be able to maintain its odd shape. Then that pointy end would be like a giant mountain, in terms of how it would feel to be on.

Now I'm wondering if the planet is tidally locked, otherwise the forces on the extended and retracted bits of the lemon would shift widely as the planet rotates. Actually we could then model the extended bit as a giant tidal wave, er, tidal cloud. What a world.
by hristov | 2025-12-22 23:27:56+00:00
Any electricity produced by turning generators will require rare earths. This includes, every current non-trivial electricity source with the exception of solar. Gas, oil, coal and nuclear all work by heating steam and running it through a turbine that turns a generator that makes electricity. For hydro, the falling water turns the turbine/generator.

So any source of electricity that may replace these wind turbines (other than solar) will require about the same amount of rare-earths. And lets face it, Trump is doing his best to hamstring solar as well. He has cancelled all solar subsidies and has hit solar with major tariffs.

I think Occams Razor would lead to a very different conclusion.
by performative | 2025-12-22 23:28:04+00:00
this is a really incredible effort. but, for the developers and analysts currently working with music metadata in a world where so much of music is being consumed thru streaming services that keep a tight hold on how their metadata and album art can be used, i am constantly yearning for a way to link streaming releases to public metadata sources that can be manipulated, embedded, and queried. i've done my best to build my own w/o a background in data science, but it's a hole that desperately needs filling to enable the new generation of scrobbling/music listening habit exploration.
by rynn | 2025-12-22 23:28:08+00:00
> Please do give that a try and report back the prefill and decode speed.

M4 Max here w/ 128GB RAM. Can confirm this is the bottleneck.

https://pastebin.com/2wJvWDEH

I weighed about a DGX Spark but thought the M4 would be competitive with equal RAM. Not so much.
by superultra | 2025-12-22 23:28:09+00:00
I live in an Atlanta neighborhood where one of the founders lived. A prototype for Flock Camera was designed by three Georgia Tech grads because someone kept breaking into their car (not uncommon in our neighborhood tbh).

The trick is that the camera was pointed towards a middle school. Which means they were constantly recording kids without adult consent.

Now, years later, Atlanta is the most surveilled city in North America and one of the most in the world. Flock cameras are everywhere. There are 124 cameras for every 1,000 people. Just last week, a ex-urb police chef was arrested for using the Flock network to stalk and harass citizens.

I know a lot of people who work at Flock. I’m shocked that they do though.

I don’t know when it stops.
by josephg | 2025-12-22 23:28:43+00:00
> They're an end-run around the underlying version control system

I assume by "underlying version control system" you mean apt, rpm, homebrew and friends? They don't solve this problem either. Nobody in the opensource world is auditing code for you. Compromised xz still made it into apt. Who knows how many other packages are compromised in a similar way?

Also, apt and friends don't solve the problem that npm, cargo, pip and so on solve. I'm writing some software. I want to depend on some package X at version Y (eg numpy, serde, react, whatever). I want to use that package, at that version, on all supported platforms. Debian. Ubuntu. Redhat. MacOS. And so on. Try and do that using the system package manager and you're in a world of hurt. "Oh, your system only has official packages for SDL2, not SDL3. Maybe move your entire computer to an unustable branch of ubuntu to fix it?" / "Yeah, we don't have that python package in homebrew. Maybe you could add it and maintain it yourself?" / "New ticket: I'm trying to run your software in gentoo, but it only has an earlier version of dependency Y."

Hell. Utter hell.
by saghm | 2025-12-22 23:28:44+00:00
I first ran into this years ago after working on a database client library as an intern. Having not heard of this option beforehand, I didn't think to enable it in the connections the library opened, and in practice that often led to messages in the wire protocol being entirely ready for sending without actually getting sent immediately. I only found out about it later when someone using it investigated why the latency was much higher than they expected, and I guess either they had run into this before or were able to figure out that it might be the culprit, and it turned out that pretty much all of the existing clients in other languages set NODELAY unconditionally.
by codeddesign | 2025-12-22 23:29:57+00:00
It’s a little amusing that you bring up the current admin, without saying anything about the Biden admin in which the article timeframe occurs or the Obama admin that created a lot of the havoc we have now in personal health care.

Unfortunately, the U.S. has never had the best doctors in the world (outside of cancer treatment). Japan and Russia for example have much better healthcare. However, it has certainly gotten worse now that hospitals are taking advantage of the visa system and bringing over doctors/nurses from other countries to increase their own bottom line.

The regular cost increases are due to immigration (no insurance), medical coding system, and govt subsidies.

You would have to blow up the system and restart to make it affordable, but then that also means millions of jobs gone overnight, a historic market crash, and then no one would want to work in that field as pay would have to be substantially lower.

You also can’t go down the free healthcare route based on the above, along with govt being horrible with everything it touches that we would have a $50 trillion debt in a few years time.
by conqrr | 2025-12-22 23:30:01+00:00
> With one key difference - it's not a gravity. It's just currently popular and dominating style in IT corporate culture. Mainly because it worked once for few successful companies and others cargo-culted it without much thought.

Sadly this is majority of tech industry. Cargo-cult whatever the big players are doing. But all is not lost. Lots of interesting smaller companies with highly technical people advocate for a tech culture that rewards real Engineering over Salesman/Politician.
For instance, a FAANG resume with business impact bullet points will be pretty useless for a small team building a database. Someone with PR commits to open source Databases would hardly need to prove themselves.
by steveklabnik | 2025-12-22 23:30:37+00:00
Yeah, that stuff is very much a sketch of the area I want to play in. It’s not final syntax nor semantics just yet. Gotta implement it and play around with it first (I have some naming tweaks I definitely want to implement separate from those ADRs.)

I don’t struggle with lifetimes either, but I do think there’s a lot of folks who just never want to think about it ever.
by hunterpayne | 2025-12-22 23:30:38+00:00
This is completely wrong. The SQL spec isn't Turning complete but multiple DBs provide Turing complete extensions (like pgplsql) that make it so. Also, even without the extensions, it is still very much a programming language by any definition of the term. Like most takes on SQL, it is more about your understanding (or lack thereof) of SQL.
by stefan_bobev | 2025-12-22 23:31:51+00:00
I am slowly waking up to the realization that we (software engineers) are laughably bad at security. I used to think that it was only NPM (I have worked a lot in this ecosystem over the years), but I have found this to be essentially everywhere: NPM is a poster child for this because of executable scripts on install, but every package manager essentially boils down to "Install this thing by name, no security checks". Every ecosystem I touch now (apart from gamedev, but only because I roll everything myself there by choice) has this - e.g Cargo has a lot of "tools" that you install globally so that you get some capability (like flamegraphs, asm output, test runners etc.) - this is the same vulnerability, manifesting slightly differently. Like others have pointed out, it is common to just pull random Docker images via Helm charts. It is also common to get random "utility" tools during builds in CI/CD pipelines, just by curl-ing random URLs of various "release archives". You don't even have to look too hard - this is surface level in pretty much every company, almost every industry (I have my doubts about the security theatre in some, but I have no first hand experience, so cannot say)

The issue I have is that I don't really have a good idea for a solution to this problem - on one hand, I don't expect everyone to roll the entire modern stacks by hand every time. Killing collaborative software development seems like literally throwing the baby out with the bath water. On the other hand, I feel like nothing I touch is "secure" in any real sense - the tick boxes are there, and they are all checked, but I don't think a single one of them really protects me against anything - most of the time, the monster is already inside the house.
by coldpie | 2025-12-22 23:32:23+00:00
The passkey spec authors think websites should be able to ban clients which allow users to manage their own data[1,2]. It makes me really hesitant to adopt passkeys if my client could get banned because it's open source and lets me control my client how I want to. It appears to be more useful for vendor lock-in than anything else[3]. A shame, since it could've been a cool tech if they had built it to be resilient to this kind of abuse, but it's clear they think vendor lock-in is actually a core feature of the protocol.

[1] Spec author quote: "To be very honest here, you risk having KeePassXC blocked by relying parties." https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

[2] https://www.smokingonabike.com/2025/01/04/passkey-marketing-...

[3] https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
by nospice | 2025-12-22 23:32:28+00:00
So who pays the tax? I mean, California already has some of the highest income taxes, corporate taxes, extra capital gains taxes, sales taxes, etc, etc. If you want to lower the cost of electricity for tens of millions of people without addressing systemic problems that make it ridiculously expensive in the first place, you gotta tax someone.

The effective income tax rate for many SF Bay Area techies is around 50%. Do we jack it up to 65% so that PG&E bills can go down from $400 to $100, like almost everywhere else in the country?
by sgillen | 2025-12-22 23:33:51+00:00
You are correct, NTP prefers to jump first (if needed) and then slew afterwards (which is exactly what we want!), although it can jump again if the offset is too large.

In our case the jumps where because we also have PTP disciplining the same system clock, when you have both PTP and NTP fighting over the same clock, you will see jumping with the default settings.

For us it was easier to just do a one time NTP sync at the beginning/boot, and then sync the robots local network with only PTP afterwards.
by anonzzzies | 2025-12-22 23:34:09+00:00
I have been using 4.6 on Cerebras (or Groq with other models) since it dropped and it is a glimpse of the future. If AGI never happens but we manage to optimise things so I can run that on my handheld/tablet/laptop device, I am beyond happy. And I guess that might happen. Maybe with custom inference hardware like Cerebras. But seeing this generate at that speed is just jaw dropping.
by AlotOfReading | 2025-12-22 23:35:31+00:00
There are two problems with passwords. Reuse, and site breaches. The solution to the former is the same as passkeys: credential managers. Passkeys genuinely solve the second, in exchange for a vastly less comprehensible system (see all the uncertainty people have even here on HN) that doesn't support many of the ways people want to use authentication tokens.
by ashishb | 2025-12-22 23:37:01+00:00
> In what way is it harder to write a library that exfiltrates credentials passed to it in those languages?

It is not harder to write.
It is more challenging to execute this attack stealthily.

Due to the myriad behaviors of runtimes (browser vs. backend), frameworks (and their numerous versions), and over-dependency on external dependencies (e.g., leftpad), the risk in JS-based backends increases significantly.
by josephg | 2025-12-22 23:37:33+00:00
Sure it does. The JS standard library these days is huge. Its way bigger than C, Zig and Rust. It includes:

- Random numbers

- Timezones, date formatting

- JSON parsing & serialization

- Functional programming tools (map, filter, reduce, Object.fromEntries, etc)

- TypedArrays

And if you use bun or nodejs, you also have out of the box access to an HTTP server, filesystem APIs, gzip, TLS and more. And if you're working in a browser, almost everything in jquery has since been pulled into the browser too. Eg, document.querySelector.

Of course, web frameworks like react aren't part of the standard library in JS. Nor should they be.

What more do you want JS to include by default? What do java, python and go have in their standard libraries that JS is missing?
by sltr | 2025-12-22 23:37:35+00:00
I can empathize with the author. I'm trying to get my first software business off the ground, and one of my moats was well, having written software. For 20 years. I know that writing software is a small part of a software business, but it was a differentiator. I'm still better off than a vibe-coder, but I think about that.

On the flip side, there's a story of an adventurous young couple who drove through the Democratic Republic of Congo [1]. They reported an incident where the road dipped and was submerged in water. Local men were standing around ready, for a fee, to chuck rocks in the water. The rocks piled up so the travelers' tires were able to grip the bottom and they were able to proceed on their journey. After they passed through, they observed in their rear view mirror the men now removing the rocks so the next driver would also have to pay.

I think wishing AI away to keep my moat is like wanting to remove those rocks. It's human to look out for #1 but it's a kind of tragedy of the commons.

[1] https://geoff.greer.fm/congo/
by kayo_20211030 | 2025-12-22 23:37:36+00:00
> replace each instance with right wing instead

and what would that give you? Some ahistorical analog, I suppose. It's seems more like historical memoir than propaganda - a sign of different times.
Honestly, I don't know what to do with the jewish reference. I'm sure you mean something in particular, but I'm not sure what it is you mean.
by brailsafe | 2025-12-22 23:38:03+00:00
I think this question gets asked periodically, but in addition to all the other answers, it's worth noting that LinkedIn essentially "stole" everyone's address book by tricking people with dark patterns[0] before people were readily catching on, it's not like they grew organically on merit, although they've since sort of needed to find a plausible reason to exist. So a competing service would just have to do the same; trick people who sign up into importing their entire LinkedIn contact list, scrape all of the available secondary connections and tell each of them that ___ is already on the platform, and then make it seem like if they're not on this new one, their career will stall.

The question of an alternative to LinkedIn is like asking if there's a better hell with less satan (but that may be a bit cynical)

[0] https://time.com/4062519/linkedn-spam-settlement/
by estimator7292 | 2025-12-22 23:38:07+00:00
It's slop all the way down. If it's not AI slop it's human slop. If you have a LinkedIn account you must fill it with a constant stream of something. Way too many meaningless middle managers won't hire you if your LinkedIn profile doesn't have enough shit in it.

You shouldn't work for those asswipes but a job is a job, so the slop must flow
by jandrewrogers | 2025-12-22 23:38:07+00:00
In some desert areas there is no other use for the water because the aquifers are fragmented. People don't live there, you can't readily move the water to somewhere useful, and it won't flow anywhere useful on its own. Agriculture is a way to convert water into something easily transported.

This doesn't apply to many places but in the desert Mountain West this is often the case. Also, while it may seem surprising, a few crops really thrive in the high desert e.g. onions.
by parliament32 | 2025-12-22 23:38:19+00:00
Yes, but it requires people. Typically, you identify a package you want (or a new version of a package you want) and you send off a request to a separate security team. They analyze and approve, and the package becomes available in your internal package manager. But this means 1) you need that team of people to do that work, and 2) there's a lot of hurry-up-and-wait involved.
by anonzzzies | 2025-12-22 23:39:09+00:00
Shrinking and speed; speed is a major thing. Claude Code is just too slow, very good but it has no reasonable way to handle simple requests because of the overhead, so then everything should just be faster. If I were Anthropic, I would've bought Groq or Cerebras by now. Not sure if they (or the other big ones) are working on similar inference hardware to provide 2000tok/s or more.
Ask HN: Migrating old Substack posts to my own blog, have a question
by Praddy | 2025-12-22 23:39:23+00:00
I’m moving my older posts from Substack to my personal blog and I want Google to treat my blog as the primary source going forward.

Constraints:

- Substack doesn’t support canonical URLs (so I can’t point Substack → my blog).

- I don’t want to use a custom domain on Substack.

- Going forward, I want Substack only as the newsletter, and my blog as the SEO winner.

I’ve seen the “ghost post” approach (replace most of the Substack post with a teaser + link), but I don’t want to delete/gut the original Substack content because I still want readers there to have the full post.

Is there any way or a hack to get this donee??