MurphyA/hacker-news huggingface dataset:
by giancarlostoro | 2026-01-21 07:23:29+00:00
I wouldn't say open source code solely trained the models, surely there are CS courses and textbooks, official documentation as well as transcripts of talks and courses all factor in as well.

On another note, regarding AI replacing most open source code. I forget what tool it was, but I had a need for a very niche way of accessing an old Android device it was rooted, but if I used something like Disk Drill it would eventually crap out empty files. So I found a GUI someone made, and started asking Claude to add things I needed for it to a) let me preview directories it was seeing and b) let me sudo up, and let me download with a reasonable delay (1s I think) which basically worked, I never had issues again, it was a little slow to recover old photos, but oh well.

I debated pushing the code changes back into github, it works as expected, but it drifted from the maintainers own goals I'm sure.
by nospice | 2026-01-21 07:23:32+00:00
> An entry fee that is reimbursed if the bug turns out to matter would stop this, real quick.

The problem is that bug bounty slop works. A lot of companies with second-tier bug bounties outsource triage to contractors (there's an entire industry built around that). If a report looks plausible, the contractor files a bug. The engineers who receive the report are often not qualified to debate exploitability, so they just make the suggested fix and move on. The reporter gets credit or a token payout. Everyone is happy.

Unless you have a top-notch security team with a lot of time on their hands, pushing back is not in your interest. If you keep getting into fights with reporters, you'll eventually get it wrong and you're gonna get derided on HN and get headlines about how you don't take security seriously.

In this model, it doesn't matter if you require a deposit, because on average, bogus reports still pay off. You also create an interesting problem that a sketchy vendor can hold the reporter's money hostage if the reporter doesn't agree to unreasonable terms.
by mvanzoest | 2026-01-21 07:23:40+00:00
I've found it useful for getting features started and fixing bugs, but it depends on the feature. I use Claude Sonnet 4.5 and it usually does a pretty good job on well-known problems like setting up web sockets and drag and drop UIs which would take me much longer to do by hand. It also seems to follow examples well of existing patterns in my codebase like router/service/repository implementations. I've struggled to get it to work well for messy complicated problems like parsing text into structured objects that have thousands of edge cases and in which the complexity gets out of hand very quickly if not careful. In these cases I write almost all the code by hand. I also use it for writing ad-hoc scripts I need to run once and are not safety critical, in which case I use it's code as-is after a cursory review that it is correct. Sometimes I build features I would otherwise be too intimidated to try if doing by hand. I also use it to write tests, but I usually don't like it's style and tend to simplify them a lot. I'm sure my usage will change over time as I refine what works and what doesn't for me.
by iso1631 | 2026-01-21 07:24:08+00:00
Defence in depth is a valid security approach, and NAT provides another defence in depth

If you have a vulnerable ipv4 machine on 192.168.0.24 port 2345 which is hidden behind a public IP of 1.2.3.4, and you set your firewall rule to allow any inbound traffic, with no nat rules then it will be exceedingly difficult for a remote attacker to reach that vulnerable port (they have to trick your router's connection table into routing it)

If the same machine is on 2100:1234:5678:a::24 then that port is exposed.

Now sure your firewall could block the traffic, and that's great. But having multiple layers of active configuration to allow the traffic through is more secure than having a single layer as it means you need to screw up twice.

Worse than that with dual stack you may think you have set your firewall to block non-established connections at the ipv4 stage, but your device is sat there on an open ipv6 address you didn't even consider. Dual stack is certainly less secure than single stack as there are two opportunities to screw up.
Show HN: CLI tool to clean up dependency directories across all your projects
by kuneosu | 2026-01-21 07:24:12+00:00
If you work on multiple projects, you've probably noticed directories like node_modules, venv, target, and __pycache__ silently eating up tens of GBs of disk space.
dep-clean scans for all dependency/cache directories under a given path and lets you selectively delete them through an interactive checkbox UI.

# Features

- Multi-language support: Auto-detects cache directories for Node.js, Python, Rust, Go, Java, .NET, iOS, and more
- Interactive selection: Pick which directories to delete instead of nuking everything
- Size display: Shows how much space each directory is using
- Safe preview: `--dry-run` option to see what would be deleted

# Usage
## Install
`npm install -g @kuneosu/dep-clean`

## Scan current directory and select what to delete
`dep-clean`

## Scan specific path
`dep-clean ~/projects`

## Only clean node_modules
`dep-clean --only node_modules`
Show HN: Replacing ComfyUI node graphs with YAML-defined DAGs
by jaskirat05 | 2026-01-21 07:24:14+00:00
I have been using ComfyUI for a while at work and kept running into friction with large node graphs- hard to diff, hard to version, and you never if you will OOM until you start running the graph. I build a backend that let's you define ComfyUI workflows as YAML-defined DAGs instead of UI node spghetti. You can also plugin multiple comfyui backend instances and the code takes care of moving artifacts
by jeroenhd | 2026-01-21 07:24:15+00:00
If you have a shitty ISP that rotates prefixes like it's 2005, hosting anything public is a massive pain already. DDNS works just as well on IPv6, though.

Internally, a ULA will keep things reachable even if you move ISPs. You could even set up a NAT66 setup to translate your changing prefix to your stable ULA so you don't need to update any firewall rules, but that's a pretty terrible workaround for a problem that shouldn't be on you to fix in the first place.
by cocoto | 2026-01-21 07:24:36+00:00
From the very beginning everyone tells us “you are using the wrong model”. Fast forward a year, the free models become as good as last year premium models and the result is still bad but you still hear the same message “you are not using the last model”… I just stopped caring to try the new shiny model each month and simply reevaluate the state of the art once a year for my sanity. Or maybe my expectation is clearly too high for these tools.
by f311a | 2026-01-21 07:24:43+00:00
How would it work if LLMs provide incorrect reports in the first place? Have a look at the actual HackerOne reports and their comments.

The problem is the complete stupidity of people. They use LLMs to convince the author of the curl that he is not correct about saying that the report is hallucinated. Instead of generating ten LLM comments and doubling down on their incorrect report, they could use a bit of brain power to actually validate the report. It does not even require a lot of skills, you have to manually tests it.
by vee-kay | 2026-01-21 07:24:45+00:00
Isn't this the same state where the rich people water their plush lawns even in the peak of summer during drought?

And where 90% of the water for its huge capital city-district (Los Angeles) is not even sourced locally (say, by desalination of seawater, as it is a coastal city), but it's instead piped from hundreds of miles away, while banning the villages at the source locations from using the local rivers/lakes as all that precious water gets piped away to feed the thirsty city-district (Los Angeles)?
by machomaster | 2026-01-21 07:25:37+00:00
> I think there is a way to resolve these issues, but I think first Canada has to at least acknowledge they exist.

One can't and shouldn't acknowledge the things that don't exist.

Like:

- Venezuela's drugs being a big problem in the USA

- Russia/China trying to take Greenland

- Norwegian government responsible for giving Peace Nobels

- Canada's efforts to poison USA with fentanyl

They are all fake news and anyone spewing that should ridiculed, not engaged and reasoned with to find the compromise. (Example: since we are talking here and I share my eternal wisdom with you, it is only fair that you should give me all of your weath. Oh, you don't think it is reasonable and don't want to give a random guy anything? Fine, it is a fair compromise then in which you give me half of everything. The Greatest Deal!)
by joecool1029 | 2026-01-21 07:25:43+00:00
> Pixel devices hand it off to the Qualcomm modem.

Older ones maybe, newer ones use Samsung Shannon modems.

> iirc Samsung devices do it differently and they implement it in userspace using StrongSwan?

Just to be cursed the entire IMS stack for Samsung on both qcom and exynos is custom. It’s why no custom roms have support for voLTE on their devices. They also had their own RCS that they sunset in favor of Google Messages.

Apple’s implementation is cursed too and not only did they use an older specification but they didn’t fully implement required responses to registration issues, I wrote about it here: https://wt.gd/working-rcs-messaging
by EagnaIonat | 2026-01-21 07:26:00+00:00
This is anecdotal and maybe reflects what other people are seeing.

If you know the field you want it to work in, then it can augment what you do very well.

Without that they all tend to create hot garbage that looks cool to a layperson.

I would also avoid getting it to write the whole thing up front. Creating a project plan and requirements can help ground them somewhat.
by catlifeonmars | 2026-01-21 07:26:03+00:00
> I would put that under the umbrella of algo/math, i.e. the structure of the LLM is part of the algo, which is itself governed by math

Yes you’re right. I misspoke.

I’m curious if there are ways to get around the monolithic nature of today’s models. There have to be architectures where a generalized model can coordinate specialized models which are cheaper to train, for example. E.g calling into a tool which is actually another model. Pre-LLM this was called boosting or “ensemble of experts” (I’m sure I’m butchering some nuance there).
by yesnomaybe | 2026-01-21 07:26:20+00:00
+1 for fedora. I use it for work. I use an exotic browser (LibreWolf) running teams. Slack desktop from https://packagecloud.io/slacktechnologies/slack it does everything well (screensharing, audio, video) all on Gnome Wayland.

the beauty is you can use native packages not flatpaks, so better chance everything works because it's been tested by the maintainer against the fedora release. at least that my theory.
by tpm | 2026-01-21 07:27:35+00:00
One good thing about the collapse of Soviet Union was that Gorbachev refused to start senseless wars. There were hundreds of thousands of Soviet soldiers stationed in various countries of Eastern Europe, but he explicitly said he will not use force to hold the countries in the Soviet fold. After that the communist regimes there promptly fell. Putin apparently thinks this was a mistake he decided to correct. So I don't know, maybe Gorbachev was telling us the (hubris, stupidity) is not inevitable, and Putin is telling it is inevitable, after all? Time will tell I guess.
by deknos | 2026-01-21 07:28:01+00:00
Of course it's not insecure because of NAT.

NAT (in all its forms) is just a very convenient technology for many people and niche situations.

And adoption of IPv6 will be hindered as long as NAT is not a first class citizen.

And of course, mostly NAT should not be used as "firewall replacement". But what many firewall proponents forget here:

NON-IT People at home cannot run and manage a firewall (and proxies). For them, NAT is a convenient and mostly okayish replacements.

Another niche would be IP Packet Handling of VMs.
by tombert | 2026-01-21 07:28:35+00:00
I've been watching those Kaze Emanuar videos on his N64 development, and it's always so weird to me when "doing the expensive computation again" is cheaper than "using the precomputed value". I'm not disputing it, he seems to have done a lot of research and testing confirming the results and I have no reason to think he's lying, but it's so utterly counter-intuitive to me.
by branko_d | 2026-01-21 07:28:45+00:00
For inserts, you cannot escape writing into the base table and all indexes. However, my understanding is that for updates PostgreSQL has a write amplification problem due to the fact that each time a row is updated this creates a new row (to implement MVCC), and a new physical location in the heap, so all indexes need to be updated to point to the new location, even those not containing the updated columns.

OTOH, with a heap-less (aka. clustered, aka. index organized) table, you would only have to update the indexes containing the columns that are actually being updated. You don't need to touch any other index. Furthermore, only if you are updating a key column would you physically "move" the entry into a different part of the B-tree. If you update an included column (PK columns are automatically "included" in all secondary indexes, even if not explicitly mentioned in the index definition), you can do that in-place, without moving the entry.

Here is how this works in SQL Server - consider the following example:

CREATE TABLE T (

ID int,
NAME nvarchar(255) NOT NULL,
AMOUNT int NOT NULL,

CONSTRAINT T_PK PRIMARY KEY (ID)

);

GO

CREATE INDEX T_I1 ON T (NAME);

GO

CREATE INDEX T_I2 ON T (AMOUNT);

Now, doing this...

UPDATE T SET AMOUNT = 42 WHERE ID = 100;

...will only write to T_PK and T_I2, but not T_I1. Furthermore T_PK's entry will not need to be moved to a different place in the B-tree. SQL Server uses row versioning similar to PostgreSQL, so it's conceivable that PostgreSQL could behave similarly to SQL Server if it supported clustered (index-organized) tables.
by bigstrat2003 | 2026-01-21 07:29:59+00:00
Unlike the other poster, I'm not going to blame you for getting things wrong. It happens, we all were learning at one point. But I do think it's incredibly unreasonable to use a mistake you made as an argument against IPv6. This would be like if I rm -rf'ed my Linux box into oblivion when I was first learning and then avoided Linux after that because I had bad vibes about it. Sometimes you need to accept the L and not blame the tools.
by sshine | 2026-01-21 07:31:05+00:00
> Some software, such as Visual Studio Code and derivatives, has very lax policies on extensions. Even if you install it from a trusted source, but then install an untrusted extension, the extension will run with full access to your files!

Installing VSCodium on NixOS, you need to specify the extensions as part of your system configuration. This means extensions get pinned. But beyond that, they still have full user access.
by dyauspitr | 2026-01-21 07:31:48+00:00
Those crop harvesting robots can’t do anything else though. They’re also not very good at weeding, or picking berries or tea. Things that require finesse. Also imagine not having to use the god awful amounts of pesticides we currently use. You’ve got to think of these humanoids as universal. You should be able to tell the robot picking weeds to stop and go do the grocery shopping ideally.
by Dylan16807 | 2026-01-21 07:32:15+00:00
That came up earlier and I know it's a gray area but I agree with the idea that a line tossed into the marketing and not backed up by the manual weakens the importance. The firewall in the PIX is the security workhorse.

Also that sentence implies you can get a connection to a device, you just know less about which one it is. Is that really a meaningful security feature? To the extent that connections are actually blocked, it's not because of the NAT scrambling they quoted in the first half of that sentence. That sentence is somewhere between unhelpful and flat-out wrong.
by phire | 2026-01-21 07:32:21+00:00
The firewall on your typical IPv4 router does basically nothing. It just drops all packets that aren’t a response to an active NAT session.

If the firewall somehow didn’t exist (not really possible, because NAT and the firewall are implemented by the same code) incoming packets wouldn’t be dropped, but they wouldn’t make it through to any of the NATed machines. From the prospective any machine behind the router, nothing changes, they get the same level of protection they always got.

So for those machines, the NAT is inherently acting as a firewall.

The only difference is the incoming packets would reach the router itself (which really shouldn’t have any ports open on the external IP) reach a closed port, and the kernel responds with a NAK. Sure, dropping is slightly more secure, but bouncing off a closed port really isn’t that problematic.
by psychoslave | 2026-01-21 07:32:23+00:00
>Futhark supports a fairly conventional Python-like notation for array slices, namely a[i:j]. This does not have such a simple correspondence with function application syntax.

I don't get it. How is that not trivial with something like

array·slice(from: initial, to: juncture)

Which is not much different from a·/(i,j) when one want to play the monograph game instead. It can be further reduced to a/(i,j) taking from granted that "/" is given special treatment so it can be employed as part of identifiers.
by machomaster | 2026-01-21 07:33:17+00:00
They still did that. Even though being a pawn in another player's game (USA trying to kill its technological competitor) and paying for it in many different ways was definitely not in the Canada's interests.

You seem to have this strange position that "what's good for the US is also automatically good for Canada, or at least it doesn't matter what Canada things and what it's national interests might be; just shut up and do what we say (even if it's a command to jump from the building)".
by iso1631 | 2026-01-21 07:33:21+00:00
If you don't have RPF enabled on your router in theory your upstream peer can send traffic to 192.168.80.26 and it would pass through. Reply traffic may or may not be natted depending on how it's entered in the connection tracking table.

There may be situations where your router can be tricked too, I can't think of one off the top of my head which wouldn't also apply to a stateful firewall sitting on a routed network segment with no nat, and it would typically be a vulnerability to patch

But your principal is right -- it's far harder to exploit than just connecting to an ip of say 2001:172:56:107:111::192.168.80.25 on port 80
by Terr_ | 2026-01-21 07:33:44+00:00
That reminds me of this [0] observation:

> "Suits make a corporate comeback," says the New York Times. Why does this sound familiar? Maybe because the suit was also back in February, September 2004, June 2004, March 2004, September 2003, November 2002, April 2002, and February 2002. Why do the media keep running stories saying suits are back? Because PR firms tell them to.

That was 20 years ago... but it seems the pattern continues. It only took a few searches to construct this list of Bloomberg telling you about suits:

* 2017: "The Double-Breasted Suit Is Back" [1]

* 2020: "The Suit, Proclaimed Dead, Is Alive and Well" [2]

* 2021: [Global pandemic goes here, so expect a lull]

* 2024: "The Suit Makes Office Comeback" [3]

* 2025: "Double-breasted Suits Are Back" [4]

* 2026: "Want to Keep Your Job? Buy Yourself a Blazer" [TFA]

Yes, there are a couple "suits are now out" results, but which seems more likely: That people's ideas of workplace fashion are naturally yo-yo-ing every alternate year, or that the same companies are out there still whispering in reporters' ears?

_______________

[0] http://www.paulgraham.com/submarine.html

[1] https://www.bloomberg.com/news/features/2017-08-24/the-doubl...

[2] https://www.bloomberg.com/news/articles/2020-08-26/the-suit-...

[3] https://www.bloomberg.com/news/articles/2024-10-09/new-busin...

[4] https://www.bloomberg.com/news/articles/2025-09-17/double-br...
by kstrauser | 2026-01-21 07:33:57+00:00
The invoice on my order history says Dell was the seller, and I specifically remember that the label on the unopened box showed that it was shipped directly from Dell’s warehouse.

I went through this like 100 ways when it happened. I bought the monitor from Dell. They shipped it from their hands straight to mine. And when it broke, they refused to make good on it.
by cy20251210 | 2026-01-21 07:34:16+00:00
GLM-Image is a multimodal image model designed for text-to-image generation and visual understanding.

It supports prompt-based image generation, image editing, and multimodal reasoning, aiming to provide a unified image AI foundation for developers and creators.

This site showcases model capabilities, example outputs, and technical background. It’s especially useful for people exploring AI image generation models or building AI-powered creative products.

Happy to get feedback on the model’s capabilities, real-world use cases, or comparisons with other image models.
by esperent | 2026-01-21 07:34:46+00:00
> power-user stack

Try installing the Claude Superpowers skills - you can install them one by one from here, but it's easier to install the superpowers plugin. Try using it for a couple of sessions and see how it works for you.

For a full test, try starting with the brainstorming one which then guides you from brainstorming though planning, development etc.

I've been using it for a few days and I would say it's enhanced my workflows at least.
by Athas | 2026-01-21 07:34:59+00:00
The post explains that 'a[i]' can easily enough be written as 'a i'. Your suggestions do not resemble the current function application syntax in the language discussed in the post. The question is not whether a terse slice syntax can exist (clearly it can), but whether a syntactic similarity between indexing and application can also be extended to a syntactic similarity between slicing and application.
by n4r9 | 2026-01-21 07:35:16+00:00
> Working with young children is another good way to observe that not every emotional reaction is acceptable.

I have a two year old son and disagree with this. I wonder if you're using the phrase "overreaction" to mean both the emotion and the associated behaviour? I make sure to demonstrate that my son's emotions - sadness, anger, happiness - are always "acceptable" in the sense that it's okay for him to have those feelings. I never want him to feel like his feelings are not accepted, because that can easily leadsl to him hiding and suppressing feelings rather than acknowledging and learning how to process and regulate them. This is what basically all modern parenting books say and has accorded with my experience so far. But his behaviour can be unacceptable. It's okay for him to feel angry, but it is not ok for him to respond to that by hitting, biting, snatching etc. He needs me to help label and contextualise his feelings, and to show him how to divert those feelings into a healthier physical response.