MurphyA/hacker-news huggingface dataset:
by mrandish | 2026-01-28 03:48:49+00:00
Related but tangential to the article's thesis, I just want to add a technical perspective about NFL football broadcasts from someone with a background in professional live broadcast television production. Due to the massive popularity of televised NFL football (they're >95 of the top 100 most watched programs on television every year), the production budgets for broadcasting games are equally massive.

The result is that NFL game broadcasts are generally the most technically sophisticated live, multi-camera broadcasts in existence. What they manage to do in real-time in front of a live global audience is remarkable, requiring orchestrating a complex ballet of split-second hand-offs between over a hundred production professionals each coordinating their contribution to the broadcast in perfect sync.

From a pure IT perspective, a Super Bowl broadcast relies on a terabit scale, high-reliability IP and power distribution infrastructure that would impress even the most jaded big data center architect - and it's all installed, tested and working on-site in about a week - including fail-over backup generators and multiple data feeds to off-site backup production locations. In the past two years they've even reached the level of switching the entire broadcast from an off-site backup location in the event of a catastrophic failure of the main production truck. That means every raw HD camera feed from wireless sideline handhelds, to pylon cams to multiple Skycams all arriving in sync at 60 fps hundreds of miles away (last year game used >160 on-site cameras),

Even if you think of the Super Bowl as just some kind of weird 'sport ball thing', it can be interesting to meta-watch how the production is being composed. Every year the Super Bowl is where the best new innovations in live broadcast technology show up first. Every vendor is vying to have their latest toys strutting their new visual magic on the planet's biggest live stage. Last year an obvious standout was 3 new $150,000 Canon 122X zoom lenses (that's insane zoom) with a special new optical block allowing instant switching between normal zoom and film-like shallow depth-of-field.

Those 3 units were the only samples then in existence, hand carried by their engineers from Japan just for the Super Bowl. And I knew immediately when one of them popped on the screen because it created a super telephoto zoom showing a quarterback's forehead-to-chin face so close you could see every crease and bead of sweat - from ~100 yds away(!) - all with the beautiful shallow depth of field that is, in any other live broadcast zoom lens, simply impossible. You either get the insane zoom or you get the depth-of-field but not both at once, at the same f-stop. Magic indeed. I have no idea what new, never-seen-before tricks await us in ~10 days, maybe some new Skycam motion control wizardry, or an impossibly small wireless camera giving us a new viewpoint or some new GPU-rendered, real-time CGI perfectly integrated into the live environment - but I'm excited to find out!
by scorpioxy | 2026-01-28 03:49:08+00:00
From what I am seeing, no one is feeling coy simply because of the cost savings that management is able to show the higher-ups and shareholders. At that level, there's very little understanding of anything technical and outages or bugs will simply get a "we've asked our technical resources to work on it". But every one understands that spending $50 when you were spending $100 is a great achievement. That's if you stop and not think about any downsides. Said management will then take the bonuses and disappear before the explosions start with their resume glowing about all the cost savings and team leadership achievements. I've experienced this first hand very recently.
by rakel_rakel | 2026-01-28 03:50:09+00:00
Another great example from tedunangst's excellent presentation "LibreSSL more than 30 days later".

https://youtu.be/WFMYeMNCcSY&t=1024

Teaser: "It's like throw a rock, you're gonna hit something... I pointed people in the wrong direction, and they still found a bug".
by Swizec | 2026-01-28 03:50:37+00:00
> If someone meant to engineer a codebase to hide subtle bugs which might be remotely exploitable, leak state, behave unexpectedly at runtime, or all of the above, the code would look like this.

I wonder who could possibly be incentivized to make the cryptography package used by most of the worlds computers and communications networks full of subtly exploitable hard to find bugs. Surely everyone would want such a key piece of technology to be air tight and easy to debug

But also: surely a technology developed in a highly adversarial environment would be easy to maintain and keep understandable. You definitely would have no reason to play whackamole with random stuff as it arises
by ndriscoll | 2026-01-28 03:50:56+00:00
It's based on recognizable elements because it's clearly parodying them; they are not copying the brand. They are not relying on people thinking there's an endorsement or association with Kellogg. This stuff is all obvious to anyone with enough reasoning ability to pass the LSAT (or anyone who can pass middle school), so obviously any lawyer who claims otherwise is a disingenuous liar.

I only mentioned the E because you did, and it's the most obvious element to display that in fact the font is completely different; the only similarity is "vaguely cursive". It's that sort of "clearly referencing X but obviously 'off'" look that parodies shoot for.
by iqp | 2026-01-28 03:51:12+00:00
Ask 10 people & you'll get 10 different answers :D. Here's mine: I don't think software development jobs are going to disappear, even though the amount of hand-written code will in all likelihood decline. Those employing s/w devs are just going to expect more output. Until recently most smaller teams wouldn't even attempt more ambitious projects due to worry they'd blow it (yes, the uncomfortable reality is that most s/w projects fail). Now, they're getting braver since LLMs are essentially a RAD tool, and I'd argue that's a good thing.

I've been a professional dev for 20 years, and done plenty of solo projects, but also worked on teams at small & large firms. Even when we were able to build good products, the amount of man-hours sunk into those products often meant they weren't profitable. One of my former bosses made the whole s/w dev dept. gather int the cafeteria one day & ranted at us that he's spent 6 million Euros paying software developers but our products aren't selling, and he doesn't understand why we take so long to build basic products. That boss left shortly thereafter & the company was restructured, but in a way, he wasn't wrong. I can imagine that had we had LLMs things might've turned out differently, but who knows.
by ggm | 2026-01-28 03:51:33+00:00
OpenSSL is a very odd codebase, it's grown by accretion, under many stewards, with several flavours of coding belief, over time from SSLEAY which Eric Young coded over 2 decades ago. It had chip-specific speedups from the days of the Intel 486.

I was part of a body which funded work to include some stuff in the code, and the way you take something like X509 and incorperate a new ASN.1 structure inside the code, to be validated against conformance requirements (so not just signing blindly over the bitstream, but understanding the ASN.1 and validating it has certain properties about what it says, like not overlapping assertions of numeric ranges encoded in it) is to invoke callouts from deep down, to perform tasks and then return state. You basically seem to have to do about a 5 layer deep callout and return. It's a massive wedding cake of dependency on itself, it personifies the xkcd diagram of "...depends on <small thing>" risks.

I'm not surprised people continue to find flaws. I would like to understand if this approach also found flaws in e.g. libsodium or other more modern crytography, or in the OpenBSD maintained libreSSL code (or whatever it is) or Peter Gutmann's code.

OpenSSL is a large target.
by avcloudy | 2026-01-28 03:52:17+00:00
> Congress has been in a state of relative gridlock for many years, across multiple administrations whether republican or democrat.

Let me stop you right there. It's not a both sides issue, is it? It's one side forcing gridlock? A party of obstruction, even.

> People thinking that Trump is a king or dictator are delusional, because the US doesn't work that way. If Trump rounded up thousands of US citizens and simply burned them alive, he would be arrested by the military and impeached by congress, because there are red lines that basically everyone agrees on.

No, and it's very important to you that you think that's true, because then people who disagree aren't just wrong, they're mentally ill. The only Trump Derangement Syndrome is the people thinking he's fit to be in any kind of leadership position.

The problem is that we're seeing people treat Trump like a king to a worrying degree, and he has gotten several of the traditional rights of kings that made people depose kings, like immunity to prosecution. And we're seeing things that were formerly thought to be absolute red lines like rounding up citizens and deporting them to Venezuelan prisons will absolutely be tolerated by his base. People like you constantly assure us that there are red lines he won't be allowed to cross, and then defend him when he does cross them and deny ever saying that thing would be wrong.
by 1vuio0pswjnm7 | 2026-01-28 03:53:09+00:00
If the Signal Messaging LLC is compromised, then "updates", e.g., spyware, can be remotely installed on every Signal user's computer, assuming every Signal user allows "automatic updates". I don't think Signal has a setting to turn off updates

Not only does one have to worry about other Signal users being compromised, one also has to worry about a third party being compromised: the Signal Messaaging LLC
Show HN: Minima LMS – Bitmap view tracking, caption search, reusable content
by pigon1002 | 2026-01-28 03:53:26+00:00
I built Minima LMS after working with several LMS platforms and wanting to implement some design ideas differently.

Key decisions I made:

- Bitmap-based view tracking - tracks actual viewing/skipping patterns, not just "completed/incomplete"

- Reusable date-based content - courses with specific dates can be duplicated without manually updating every date reference

- Granular nested permissions - fine-grained access control that works naturally with hierarchical content structure

- Caption-powered search - search video transcripts and jump directly to the timestamp

- Live session attendance that handles all edge cases (entry/exit/re-entry) without needing server-side exception handling

These choices solved real pain points I experienced. For example, most LMS platforms either over-track (too much DB overhead) or under-track (just yes/no completion). The bitmap approach gives detailed analytics efficiently.

Built with Django, SolidJS, PostgreSQL, OpenSearch. MIT licensed.
Quick start: sh dev.sh up

Would love feedback from the community!
Show HN: Nyxi – Execution-time governance for irreversible
by Shaehenderson | 2026-01-28 03:53:48+00:00
With AI agents getting more autonomous, controlling irreversible actions (sending money, emails, deploying code) is becoming critical.

Nyxi introduces execution-time governance: a clean veto/allow boundary that works regardless of whether proposals come from humans or models.

Public docs and demos here (proprietary, no source): https://github.com/indyh91/Nyxi-Showcase

Main overview: https://github.com/indyh91/Nyxi-Showcase/blob/main/docs/PROD...

Would love feedback on the concept!
by varenc | 2026-01-28 03:54:13+00:00
Increasing the friction and difficulty to stalk someone definitely results in less actual stalking. I'm sure some would-be stalker can figure out AirTags but can't figure out or afford the alternatives.

Also, wouldn't
this argument apply to the use of AirTags as anti-theft devices? Since AirTag alternatives exist, just use the alternatives devices for anti-theft that also work for stalking. But some people don't do this and just want to use AirTags for anti-theft purposes. Which sort of illustrates my point. Fewer people do a thing when it's harder. No would care that AirTags aren't good for anti-theft if there were alternatives equally as good.
by jibal | 2026-01-28 03:54:32+00:00
The title change from "AISLE" to "AI" is misleading. As the article states,

> This doesn't mean that AI can replace human expertise. The OpenSSL maintainers' deep knowledge of the codebase was essential for validating findings and developing robust fixes. But it does change the SLA of security. When autonomous discovery is paired with responsible disclosure, it collapses the time-to-remediation for the entire ecosystem.
by vee-kay | 2026-01-28 03:54:42+00:00
Article title is click bait.

Hominin tools that are millions of years old have already been found by archeologists.

e.g., recent news:
Scientists uncover 3-million-year-old tools but they weren’t made by our ancestors:
https://www.futura-sciences.com/en/scientists-uncover-3-mill...

A list of findings of earliest known hominin tools:
https://en.wikipedia.org/wiki/List_of_earliest_tools
by safety1st | 2026-01-28 03:54:50+00:00
Yeah, this kind of gets to my main point. A prohibition against slavery very clearly protects the weak. The authorities don't get enslaved, the weak do. Who does a prohibition against "cyberweapons" protect? Well nobody really wants cyberweapons to proliferate, true, but the main type of actor with this concern is a state. This "constitution" is written from the perspective of protecting states, not people, and whether intentional or not, I think it'll turn out to be a tool for injustice because of that.

I was really disappointed with the rebuttals to what I wrote as well - like "the UNDHR is invalid because it's too politicized," or "your desire to protect human rights like freedom of expression, private property rights, or not being enslaved isn't as universal as you think." Wow, whoever these guys are who think this have fallen a long way down the nihilist rabbit hole, and should not be allowed anywhere near AI governance.
by jumploops | 2026-01-28 03:54:54+00:00
Yeah to be clear it will have the same issues as a flyby contributor if prompted to.

Meaning if you ask it “handle this new condition” it will happily throw in a hacky conditional and get the job done.

I’ve found the most success in having it reason about the current architecture (explicitly), and then to propose a set of changes to accomplish the task (2-5 ways), review, and then implement the changes that best suit the scope of the larger system.
by somenameforme | 2026-01-28 03:54:57+00:00
What was rolled back? There was no major change in action whatsoever, only rhetoric, which is meaningless. As for funding, Trump raised substantially less in 2024 than 2020 while Harris raised more money than any campaign ever has, by a wide margin. [1] Dark money also overwhelmingly flowed to the DNC. [2] And a large chunk of all of Trump's funding came after the previous administration tried to imprison him, which rather freaked people out - even those not particularly fond of him. That also likely played a significant role in the more DGAF presidency we're seeing today relative to 2016.

[1] - https://ballotpedia.org/Presidential_election_campaign_finan...

[2] - https://www.brennancenter.org/our-work/research-reports/dark...
by bandrami | 2026-01-28 03:55:55+00:00
I am, though it always takes me longer than just writing it myself because I have to fix so much (which may be a function of the kind of software I write). But more importantly the development team I support as an admin absolutely loves their agents or whatever they're being called this week and yet isn't giving me stuff that I can move into operations any faster than they were a year ago.
by dlcarrier | 2026-01-28 03:56:22+00:00
I went to one once, and it still worked like a regular grocery store, too. The only reason I never went back was because they were expensive and in an awkward location. There were some items only discounted to Prime members, but for everything else, you could forgo the technology and Amazon integration and pay with cash or a card. It's not like the Amazon Go stores where you have to use their system.
by epistasis | 2026-01-28 03:56:58+00:00
They were prevented from following just policy, and were being forced to perform actions that go against professional ethics, politically driven prosecutions unconnected from fact or law.

People resigned to send the message to the public: the integrity of the office had been compromised, and the lawyers (lawyers!!) couldn't stay due to their ethics. This is a difficult thing to understand for people that lack ethics.
Show HN: Xray – A minimal screenshot tool for developers (Rust/Tauri)
by wlswo | 2026-01-28 03:57:49+00:00
I built Xray because I was frustrated with existing screenshot tools that were either too bloated, required accounts, or didn't play well with multiple monitors and high-DPI scaling.

Xray is a lightweight, open-source screenshot utility built with Rust and Tauri. The goal was to create a tool that stays out of the way but provides precise control when needed.

Key Technical Specs:
Core: Built with Rust to ensure memory safety and low overhead.

Frontend: Minimalist UI using Tauri (React/TS), keeping the binary size significantly smaller than Electron-based alternatives.

Performance: Optimized for quick startup and low latency during capture.

Why I built it:
Most tools focus on social sharing or cloud storage. I wanted something that focused on the local workflow: capture, annotate (arrows, text, blur), and copy-to-clipboard or save. I also wanted to ensure it handles complex display setups without the common "offset" bugs found in many cross-platform screenshot libraries.

What’s different:
Native Feel: It uses system-native APIs via Tauri’s backend.

Privacy: No telemetry, no cloud sync, no accounts. Everything stays on your machine.

Clean Codebase: The project is structured to be easily extendable for those who want to add custom post-processing scripts.

The project is still in its early stages. I'm looking for feedback on:

Performance on various Linux window managers (Wayland vs X11).

UX/UI improvements for the annotation toolset.

Any features that are missing for a developer-centric workflow.

Github: https://github.com/wlswo/xray

I'll be around to answer any questions about the implementation or the tech stack.
by codyb | 2026-01-28 03:58:39+00:00
"ongress has been in a state of relative gridlock for many years, across multiple administrations whether republican or democrat. As a result, presidents have increasingly been leading by executive order rather than legislation. That is not Trump's fault, that is just the state of the country."

"eople thinking that Trump is a king or dictator are delusional, because the US doesn't work that way. If Trump rounded up thousands of US citizens and simply burned them alive, he would be arrested by the military and impeached by congress, because there are red lines that basically everyone agrees on."

So presidents are acting more like kings, but Trump... isn't?

Does pardoning people who commit acts of violence in your name not sound like a king?

Or what about pardoning people who donate do your campaigns?

"Talk about taking over Canada or Greenland is just rhetoric to get better deals and improve ally strength, because this is what Donald Trump has been doing since the 1980s. Doing something with Venezuela is part of basic US national strategy, not simply a spontaneous whim of Donald Trump."

You think Donald Trump has been _strengthening_ our relationships with allies? In what manner has he done that in your mind? Is it the tariffs, the denigration, or the threats that are helping? And how does Canada talking about moving away from the US at Davos, then confirming it again later play into that? Is our allies cutting off signal intelligence actually a sign that our bonds with them is getting stronger?

Just trying to understand.

"Doing something with Venezuela is part of basic US national strategy, not simply a spontaneous whim of Donald Trump."

Which part of US national strategy is that exactly? Sure Maduro is pretty universally condemned by anyone paying attention, but so are plenty of other authoritarian regimes? Is part of the national strategy leaving the ruling class exactly the same as the one the apparently corrupt dictator we deposed had and then extorting it for millions of barrels of oil? Does the richest country in the world, which also is the largest oil producer and has plenty of access to a very stable world oil market need to resort to extorting barrels of oil from foreign dictators as part of national strategy?

If it's just part of our national strategy, why'd the rational change so frequently and why does no one seem to have heard that before Trump decided to start focusing on it and amassing weapons off their coast?

"This doesn't mean you have to like a current president personally or morally, or even agree with everything they are doing, but at least you can gain more perspective around what is real and what is not."

Primo ending though.
by oefrha | 2026-01-28 03:59:02+00:00
See also The State of OpenSSL for pyca/cryptography

https://cryptography.io/en/latest/statements/state-of-openss...

Recently discussed: https://news.ycombinator.com/item?id=46624352

> Finally, taking an OpenSSL public API and attempting to trace the implementation to see how it is implemented has become an exercise in self-flagellation. Being able to read the source to understand how something works is important both as part of self-improvement in software engineering, but also because as sophisticated consumers there are inevitably things about how an implementation works that aren’t documented, and reading the source gives you ground truth. The number of indirect calls, optional paths, #ifdef, and other obstacles to comprehension is astounding. We cannot overstate the extent to which just reading the OpenSSL source code has become miserable — in a way that both wasn’t true previously, and isn’t true in LibreSSL, BoringSSL, or AWS-LC.

Also,

> OpenSSL’s CI is exceptionally flaky, and the OpenSSL project has grown to tolerate this flakiness, which masks serious bugs. OpenSSL 3.0.4 contained a critical buffer overflow in the RSA implementation on AVX-512-capable CPUs. This bug was actually caught by CI — but because the crash only occurred when the CI runner happened to have an AVX-512 CPU (not all did), the failures were apparently dismissed as flakiness. Three years later, the project still merges code with failing tests: the day we prepared our conference slides, five of ten recent commits had failing CI checks, and the day before we delivered the talk, every single commit had failing cross-compilation builds.

Even bugs caught by CI get ignored.
by dwattttt | 2026-01-28 04:00:15+00:00
Referencing the classic https://xkcd.com/2030

"I don't quite know how to put this, but our entire field is bad at what we do, and if you rely on us everyone will die"

"They say they've fixed it with something called <del>blockchain</del> AI"

"Bury it in the desert. Wear gloves"
by Perceval | 2026-01-28 04:01:08+00:00
Protesting is absolutely something you can and should be able to do casually and without having to protect your face/identity. It was enshrined in the First Amendment as a fundamental check on the federal government in order to recognize the natural right of a self-governing people to peaceably assemble and petition the government for a redress of grievances.

What is not something that should be gone casually – or really at all – is an attempt to engage in insurrection with black bloc or globalized intifada insurgency tactics to prevent the enforcement of law.
by laborcontract | 2026-01-28 04:01:28+00:00
counterpoint:

- The readme is two lines and has six words, one of which is a typo.

- Claude would never commit a node_modules folder unless coerced.

It’s disrespectful to casually call things AI-generated. I wish people would do it less unless they have 1) proof and 2) a meaningful reason for it.