MurphyA/hacker-news huggingface dataset:
by lawrjone | 2025-12-30 22:24:16+00:00
I hadn't come across GPTZero before and wondered if it worked. Just testing on a sample of my blog posts (I do one each year) I got a 100% AI generated mark for a post in... 2022, and 2023. Both before AI tools were around.

Not to say this post isn't AI generated but you might want a better tool (if one exists)
by Humphrey | 2025-12-30 22:25:06+00:00
Yes — PMTiles is exactly that: a production-ready, single-file, static container for vector tiles built around HTTP range requests.

I’ve used it in production to self-host Australia-only maps on S3. We generated a single ~900 MB PMTiles file from OpenStreetMap (Australia only, up to Z14) and uploaded it to S3. Clients then fetch just the required byte ranges for each vector tile via HTTP range requests.

It’s fast, scales well, and bandwidth costs are negligible because clients only download the exact data they need.

https://docs.protomaps.com/pmtiles/
by bikenaga | 2025-12-30 22:25:22+00:00
Abstract: "This paper explores vulnerabilities in RSA cryptosystems that arise from improper prime number selection during key generation. We examine two primary attack vectors: Fermat's factorization method, which exploits RSA keys generated with primes that are too close together, and the Greatest Common Divisor (GCD) attack, which exploits keys that share a common prime factor. Drawing from landmark research including Heninger et al.'s 'Mining Your Ps and Qs' study, which discovered over 64,000 vulnerable TLS hosts, and Böck's 2023 analysis of Fermat factorization in deployed systems, we demonstrate that these vulnerabilities remain prevalent in real-world cryptographic implementations. Our analysis reveals that weak random number generation in embedded devices is the primary cause of these failures, and we discuss mitigation strategies including proper entropy collection and prime validation checks."
by bob778 | 2025-12-30 22:25:38+00:00
Beyond the other comments denouncing it as AI slop, it’s fundamentally wrong. GMV aka marketplace thru-revenue is strictly defined by accounting standards and most tax offices (including the IRS and ATO). It’s not something you just decide to have. One of the core principles of it is that the consumer is aware that the revenue will flow through (eg, if buying something on Etsy/Amazon, that is obvious while others like Uber are more contentious). Using a different model provider is unlikely to pass the test.

This would’ve been a fascinating article if written by an accounting expert but is unfortunately just slop.
by kube-system | 2025-12-30 22:25:45+00:00
Yikes. They don't need a "special arrangement" for those requirements. This is the bare minimum at many professionally run colocation data centers. There is not a security requirement that can't be met by a data center -- being secure to customer requirements is a critical part of their business.

Maybe the person who wrote that is only familiar with web hosting services or colo-by-the-rack-unit type services where remote-hands services are more commonly relied on. But they don't need to use these services. They can easily get a locked cabinet (or even just a 1/4 cabinet) only they could access.
by josephg | 2025-12-30 22:25:48+00:00
That’s possible, but the hardware (a rodecaster pro 2 connected over usb) works just fine in other Linux apps. I can record audio in audacity. And I can play back audio in resolve. I just can’t record audio in resolve.

I think it’s a software issue in how resolve uses the Linux audio stack. But I have no idea how to get started debugging it. I’ve never had any problems with the same hardware in windows, or the same software (resolve) on macOS.
by _heimdall | 2025-12-30 22:25:59+00:00
For the silent down votes, I'd be curious how you can hold claims Elon made regarding what DOGE would get done against him.

I don't agree with how they went about trying to cut government spending, but that's beside the point. When he wasn't in control and ultimately got stonewalled and removed as soon as he ran through the initial hype of the project, how is it his fault the claims failed? Do you disagree that the government has a similar amount of waste and spending that could be cut?
by FiloSottile | 2025-12-30 22:26:46+00:00
Frank does great work that is critical to many businesses, and should get funded to do it professionally.

However, donating money to an open collective is prohibitively hard for most big companies. Maybe the world should be different (or maybe not, since it would be easy for employees to embezzle money if they could direct donations easily), but that's how it works currently.

AFAICT, there is also no fiscal sponsor, so the donation matching suggested in a sister comment won't apply.

This is why Geomys (https://geomys.org) works the way it does, and why it has revenue (ignoring the FIPS and tlog sides of the business) which is 30-50x of some GitHub Sponsors "success stories": we bill in a way that's compatible with how companies do business, even if effectively we provide a similar service (which is 95% focused on upstream maintenance, not customer support).

I am not saying it's for everyone, or that Frank should necessarily adopt this model, or that it's the only way (e.g. the Zig foundation raises real amounts of money, too), but I find it frustrating to see over and over again the same conversation:

- "Alice does important maintenance work, she should get professionally funded for it!"

- "How does Alice accept/request funding?"

- "Monthly credit card transactions anchored at $100/mo that are labeled donations"

- no business can move professional amounts of money that way

- "Businesses are so short-sighted, it's a tragedy of the commons!"
by teekert | 2025-12-30 22:26:58+00:00
Pff the mental list of what I can’t use when I write is getting pretty big. Em dashes are done for, as are deep dives, delving, anything too enthusiastic, and Oxford commas…

A text either has value to you or it doesn’t. I don’t really understand what the level of AI involvement has to do with it. A human can produce slop, an AI can produce an insightful piece. I rely mostly on HN to tell them apart value-wise.
by leptons | 2025-12-30 22:27:02+00:00
>Should you also have to prove you are not a bot sponsored by short-sellers?

On a 35 day-old account, yes. Anything "post-AI" is suspect now.

The rest of your comment reads like manufactured AI slop, replying to things I never even wrote in my one sentence comment. And no surprise coming from an account created 1 day ago.
by MirrorEthic | 2025-12-30 22:27:22+00:00
I built Claude Cognitive because Claude Code kept forgetting my codebase between sessions.

The problem: Claude Code is stateless. Every new instance rediscovers your architecture from scratch, hallucinates integrations that don't exist, repeats debugging you already tried, and burns tokens re-reading unchanged files.

At 1M+ lines of Python (3,400 modules across a distributed system), this was killing my productivity.

The solution is two systems:

1. Context Router – Attention-based file injection. Files get HOT/WARM/COLD scores based on recency and keyword activation. HOT files inject fully, WARM files inject headers only, COLD files evict. Files decay over turns, co-activate with related files. Result: 64-95% token reduction.

2. Pool Coordinator – Multi-instance state sharing. Running 8 concurrent Claude Code instances, they now share completions and blockers. No duplicate debugging, no stepping on each other.

Results after months of daily use:
- New instances productive on first message
- Zero hallucinated imports
- Token usage down 70-80% average
- Works across multi-day sessions

Open source (MIT). Works with Claude Code today via hooks.

GitHub: https://github.com/GMaN1911/claude-cognitive

Happy to answer questions about the architecture or implementation details.
by talos | 2025-12-30 22:27:24+00:00
Yeah, it's got a real issue with false positives. And I've tried a bunch of other tools (Sapling, ZeroGPT, a few others) and actually GPTZero was the best of the bunch. The others would miss obviously AI generated content that I'd just generated to test them.

I've had a blog post kicking around about this for a while, it's CRAZY how much more expensive AI detection is than AI generation.

In my mind content generated today with AI "tells" like the above and a general zero-calorie-feel that also trip an AI detector are very likely AI generated.
by mjr00 | 2025-12-30 22:27:30+00:00
Monorepo vs multiple repos isn't really relevant here, though. It's all about how many independently deployed artifacts you have. e.g. a very simple modern SaaS app has a database, backend servers and some kind of frontend that calls the backend servers via API. These three things are all deployed independently in different physical places, which means when you deploy version N, there will be some amount of time they are interacting with version N-1 of the other components. So you either have to have a way of managing compatibility, or you accept potential downtime. It's just a physical reality of distributed systems.

> We may just not be at scale—thank God. We a small team.

It's perfectly acceptable for newer companies and small teams to not solve these problems. If you don't have customers who care that your website might go down for a few minutes during a deploy, take advantage of that while you can. I'm not saying that out of arrogance or belittlement or anything; zero-downtime deployments and maintaining backwards compatibility have an engineering cost, and if you don't have to pay that cost, then don't! But you should at least be cognizant that it's an engineering decision you're explicitly making.
by saghm | 2025-12-30 22:27:33+00:00
Libraries, yes. Tooling around packages/building/managing runtimes? I'm not convinced. Perl has been using CPAN like two decades now, and I wouldn't consider that ecosystem to exactly be an example of "there's only one way to do it". I feel like you're extrapolating in the wrong direction; older languages are less likely to have first party tooling for this, so they're more likely to have multiple ways of doing it, but I don't think there's much evidence that a language that started out with first party tooling will always follow that same trend. I don't think the issue with Python is it's age as much as the tooling it has was just really not good for a long time. People will probably want to replace subpar tooling regardless of the official status if there's a better alternative, but I'd expect that I'm the presence of good enough first-party tooling, people will eventually stop bothering.

I do actually think Go is a bit of an illustrative example here because it started out with just `go get` and liberal use of vendoring, then accumulated a variety of attempted replacements (e.g. godep and dep, which confusingly were not the same thing), but eventually the first party tooling around modules became a thing and after some time it seems like pretty much everyone dropped those interim tools and standardized on the official tooling. I feel like this actually shows that the proliferation of tooling can actually be stopped even if it didn't exist early on, provided that there's a process for making it official.
by netsharc | 2025-12-30 22:27:52+00:00
If the social media moguls could've remained non-cunty and not polluted their products with their toxicity, they could've had a tool that could see the state of the world in almost real-time. That would've been a very powerful tool.

I suppose these sorts of conversations happen over chats now, which are E2EE (famous last words..).

Interestingly I guess China is able to observe the state of the Chinese community, via WeChat. Geez, even monetary transactions are tracked. Maybe the Chinese Clippy could ask "Hey Li, you're spending less on bubble tea, how are you feeling?".
by j1elo | 2025-12-30 22:27:56+00:00
I wonder if anyone knows about Droid-ify. Whether it it a safe option, or better to stay away of it?

It showed up one day while I searched about why F-Droid was always so extremely slow to update and download... then trying Droid-ify, that was never a problem any more, it clearly had much better connectivity (or simply less users?)
by DiogenesKynikos | 2025-12-30 22:28:16+00:00
The US was barely treading water militarily, at enormous cost in both lives and cash. It was not progressing towards its military and political goals. That's why the US public pulled the plug.

The US could have continued to tread water for another 5 years, or another 10 years, or another 15 years, and would have lost even more men and spent even more money, and it would still have faced the same problem: there was no way to win the war. Every day that the war continued just meant more deaths and more money wasted.
by stackghost | 2025-12-30 22:28:33+00:00
Just like my previous comments, much depends on the specifics.

My wife's sister and her husband run a small retail shop in $large_city. My sister-in-law taught herself how to set up and modify a website with a shopify storefront largely with LLM help. Now they take online orders. I've looked at the code she wrote and it's not pretty but it generally works. There will probably never be a "help me fix this unmaintainable mess and I will pay you" moment in the life of that business.

The crux of my point is this: In 2015 she would have had to hire somebody to do that work.

This segment of the software industry is where the "LLMs will take our jerbs" argument is coming from.

The people who say "AI is junk and it can't do anything right" are simply operating in a different part of the industry.
by nlh | 2025-12-30 22:28:34+00:00
It's weird it looks like only a small % of comments on here have caught on to the obvious LLM-ness of it all (I missed it the first go-around but on second read, you're is absolutely correct).

I'm wondering once the exceedingly obvious LLM style creeps more and more into the public mind if we're going to look back at these blog posts and just cringe at how blatant they were in retrospect. The models are going to improve (and people will catch on that you can't just use vanilla output from the models as blog posts without some actual editing) and these posts will just stand out like some very sore thumbs.

(ps all of the above 100% human written ;)
by ipdashc | 2025-12-30 22:28:42+00:00
> ex big tech

I mean, this seems like a pretty big thing to leave out, no? That's where all the crazy high salaries were!

Also, there are still legacy places that more or less build software like it's 1999. I get the impression that embedded, automotive, and such still rely a lot on proprietary tools, finicky manual processes, low level languages (obviously), etc. But those are notorious for being annoying and not very well paid.
by b40d-48b2-979e | 2025-12-30 22:28:57+00:00
maybe they could be encrypted, and you could say "well its everything but the
encryption key, which is owned in physical form by the CEO."

I don't see how this is any different from most projects where keys and the like are kept in some form of secrets manager (AWS services, GHA Secrets, Hashi Vault, etc.).
by nen-nomad | 2025-12-30 22:29:03+00:00
Claude Code with Opus models has definitely reduced our TTM. It took us some time to build processes around it. It freed our resources to focus on tasks such as crafting better user journeys and marketing plans.

One thing I am not sure about is the debt we are accumulating by allowing AI agents to write and maintain the code. In the short term, it is boosting our speed, but in the long run, we may suffer.

But the product works well, and our users are happy with the experience.

I have been a programmer for three long decades, so I have mixed feelings about this. But some days I see the writing on the wall.
Show HN: A dynamic key-value IP allowlist for Nginx
by dayt0n | 2025-12-30 22:29:13+00:00
I am currently working on a larger project that needs a short-lived HTTP "auth" based on a separate, out-of-band authentication process. Since every allowed IP only needs to be allowed for a few minutes at a time on specific server names, I created this project to solve that. It should work with any Redis-compatible database. For the docker-compose example, I used valkey.

This is mostly useful if you have multiple domains that you want to control access to. If you want to allow 1.1.1.1 to mywebsite.com and securesite.com, and 2.2.2.2 to securesite.com and anothersite.org for certain TTLs, you just need to set hash keys in your Redis-compatible database of choice like:

1.1.1.1:

- mywebsite.com: 1 (30 sec TTL)

- securesite.com: 1 (15 sec TTL)

2.2.2.2:

- securesite.com: 1 (3600 sec TTL)

- anothersite.org: 1 (never expires)

Since you can use any Redis-compatible database as the backend, per-entry TTLs are encouraged.

An in-process cache can also be used, but is not enabled unless you pass --enable-l1-cache to kvauth. That makes successful auth_requests a lot faster since the program is not reaching out to the key/value database on every request.

I didn't do any hardcore profiling on this but did enable the chi logger middleware to see how long requests generally took:

kvauth-1 | 2025/12/30 21:32:28 "GET http://127.0.0.1:8888/kvauth HTTP/1.0" from 127.0.0.1:42038 - 401 0B in 300.462µs # disallowed request

nginx-1 | 192.168.65.1 - - [30/Dec/2025:21:32:28 +0000] "GET / HTTP/1.1" 401 179 "-" "curl/8.7.1"

kvauth-1 | 2025/12/30 21:32:37 "GET http://127.0.0.1:8888/kvauth HTTP/1.0" from 127.0.0.1:40160 - 401 0B in 226.189µs # disallowed request

nginx-1 | 192.168.65.1 - - [30/Dec/2025:21:32:37 +0000] "GET / HTTP/1.1" 401 179 "-" "curl/8.7.1"

# IP added to redis allowlist

kvauth-1 | 2025/12/30 21:34:02 "GET http://127.0.0.1:8888/kvauth HTTP/1.0" from 127.0.0.1:54032 - 200 0B in 290.648µs # allowed, but had to reach out to valkey

kvauth-1 | 2025/12/30 21:34:02 "GET http://127.0.0.1:8888/kvauth HTTP/1.0" from 127.0.0.1:54044 - 200 0B in 4.041µs

nginx-1 | 192.168.65.1 - - [30/Dec/2025:21:34:02 +0000] "GET / HTTP/1.1" 200 111 "-" "curl/8.7.1"

kvauth-1 | 2025/12/30 21:34:06 "GET http://127.0.0.1:8888/kvauth HTTP/1.0" from 127.0.0.1:51494 - 200 0B in 6.617µs # allowed, used cache

kvauth-1 | 2025/12/30 21:34:06 "GET http://127.0.0.1:8888/kvauth HTTP/1.0" from 127.0.0.1:51496 - 200 0B in 3.313µs

nginx-1 | 192.168.65.1 - - [30/Dec/2025:21:34:06 +0000] "GET / HTTP/1.1" 200 111 "-" "curl/8.7.1

IP allowlisting isn't true authentication, and any production implementation of this project should use it as just a piece of the auth flow. This was made to solve the very specific problem of a dynamic IP allow list for NGINX.
by Joel_LeBlanc | 2025-12-30 22:29:25+00:00
It's great to see discussions around the intricacies of digital assets, especially when it comes to security like the CVE vulnerabilities in the Linux kernel. I've been in the digital asset space for a while, and I always emphasize the importance of thorough due diligence—it's a bit of a balancing act knowing that bugs can arise. For evaluating apps specifically, I’ve found the DREA (Digital Real Estate Analyzer) tool really helpful for assessing potential risks and opportunities. It’s all about being prepared while recognizing that the digital landscape can be unpredictable.
by Joel_LeBlanc | 2025-12-30 22:30:15+00:00
It's fascinating to see how AI is reshaping the landscape for digital assets—buying websites or e-commerce stores has become more accessible than ever. When evaluating potential investments, I always stress the importance of thorough due diligence; I've found that using tools like DREA (Digital Real Estate Analyzer) can really streamline the process and provide valuable insights. It's all about understanding the numbers and the potential for growth, especially in such a dynamic environment. What specific metrics are you focusing on?
by lucideer | 2025-12-30 22:30:43+00:00
> How does uv solve the “write once, run anywhere” problem like go?

Here's an examply Python script from the uv website[0]:

#!/usr/bin/env -S uv run --script
#
# /// script
# requires-python = ">=3.12"
# dependencies = ["httpx"]
# ///

import httpx

print(httpx.get("https://example.com"))

This will auto-install Python 3.12 (or greater) in a per-script virtual environment, along with the httpx package from pypi & immediately execute the script, on any system that has uv.

[0] https://docs.astral.sh/uv/guides/scripts/#using-a-shebang-to...
by simonw | 2025-12-30 22:30:47+00:00
I recovered it from https://archive.softwareheritage.org/browse/origin/directory... and pushed a fresh copy to GitHub here:

https://github.com/simonw/sqlite-s3vfs

This comment was helpful in figuring out how to get a full Git clone out of the heritage archive: https://news.ycombinator.com/item?id=37516523#37517378
by Joel_LeBlanc | 2025-12-30 22:30:53+00:00
It's definitely crucial to evaluate digital assets thoroughly before making any investment. I've found that doing your due diligence can reveal hidden opportunities or risks. Personally, I've been using a free tool called DREA (Digital Real Estate Analyzer) to help streamline my evaluation process. It’s been a game changer for digging into the metrics that matter. What specific aspects are you focusing on in your evaluation?
by mikkupikku | 2025-12-30 22:31:00+00:00
I think even calling it a "design" is dubious. It's an attribute of these systems that arose out of the circumstance, nobody ever sat down and said it should be this way. Even Torvalds complaining about it doesn't mean it gets fixed, it's not analogous to Steve Jobs complaining about a thing because Torvalds is only in charge of one piece of the puzzle, and the whole image that emerges from all these different groups only loosely collaborating with each other isn't going to be anybody's ideal.

In other words, the Linux desktop as a whole is a Bazaar, not Cathedral.
by Arbortheus | 2025-12-30 22:32:05+00:00
It would be nice. Our security team started complaining that we serve a 301 redirect on port 80 for our website (just like 99.9% of websites do... sigh) and wanted port 80 shut down.

To appease them, I switched the redirect off in dev/staging, and soon enough even devs are having trouble accessing the site because they type 'website.com' and that can't resolve, only 'https://website.com' can.

(And before you say it, yes we use HSTS, but I presume there were some scenarios where that wasn't already cached/hit).
by dspillett | 2025-12-30 22:32:52+00:00
For new sites that is definitely practical. Modern versions of Chrom{e|ium} & Firefox (and other browsers based on them) have defaulted to HTTPS when the protocol is not specified. The only potential issue is if users do specify the protocol and leave the S out, it would be good for browsers to try HTTPS when HTTP fails (though only if it completely fails to connect).
by Veserv | 2025-12-30 22:33:05+00:00
That is a artifact of implementation. Monolithic operating systems with tons of shared services expose lots to their tenants. Austere hypervisors, the ones with small API surface areas, basically implement a microkernel interface yet both expose significantly more surface area and offer a significantly worse guest experience than microkernels. That is why high security systems designed for multi-level security for shared tenants that need to protect against state actors use microkernels instead of hypervisors.
by ahepp | 2025-12-30 22:33:36+00:00
> other architectural concepts such as the complete lack of an interactive userland is far more beneficial when you consider what an attacker actually wants to do after landing on your box

What does that have to do with unikernel vs more traditional VMs? You can build a rootfs that doesn't have any interactive userland. Lots of container images do that already.

I am not a security researcher, but I wouldn't think it would be too hard to load your own shell into memory once you get access to it. At least, compared to pulling off an exploit in the first place.

I would think that merging kernel and user address spaces in a unikernel would, if anything, make it more vulnerable than a design using similar kernel options that did not attempt to merge everything into the kernel. Since now every application exploit is a kernel exploit.