MurphyA/hacker-news huggingface dataset:
by charcircuit | 2026-01-02 04:39:25+00:00
>Being able to snapshot and restore memory is a pretty common feature across all decent hypervisors

A hypervisor that protects against this already exists for Linux with Android's pKVM. Android properly enforces isolation between all guests.

Desktop Linux distros are way behind in terms of security compared to Android. If desktop Linux users ever want L1 DRM to work to get access to high resolution movies and such they are going to need such a hypervisor. This is not a niche use case.
Show HN: Gojju, a Fun Programming Language
by init0 | 2026-01-02 04:39:46+00:00
Hey HN! I built Gojju, a programming language that cherry-picks my favorite features from 5 languages:

- Python: List comprehensions, slicing

- Ruby: #{interpolation}, postfix if, blocks

- Haskell: |> pipe operator, lambdas \x -> x+1, Maybe/Either

- Perl: unless/until, regex literals

- JavaScript: Arrow functions =>, spread ...

Example:

[1, 2, 3, 4, 5]
|> filter(\x -> x % 2 == 0)
|> map(\x -> x * 2)
|> sum

Install: `pip install gojju`

The name "Gojju" (ಗೊಜ್ಜು) means "essence" or "secret ingredient" in Kannada.

Would love feedback on the syntax choices!
by _mig5 | 2026-01-02 04:41:46+00:00
Hi westurner!

> Could it also detect changed package files; if there are per-package-file checksums like with debsums and `rpm -V`?

Yes, that's exactly what it does. See https://git.mig5.net/mig5/enroll/src/branch/main/enroll/plat... and https://git.mig5.net/mig5/enroll/src/branch/main/enroll/rpm....

It also tries to ignore packages that came with the distro automatically, e.g focusing on stuff that was explicitly installed (based on 'apt-mark showmanual' for Debian, and 'dnf -q repoquery --userinstalled' (and related commands, like dnf -q history userinstalled) for RH-like)

> Does it check extended filesystem labels with e.g. getfacl for SELinux support?

Not yet, but that's interesting, I'll look into it.

> At least once I've scripted better then regex to convert a configuration file to a Jinja2 templated configuration file (from the current package's default commented config file with the latest options).

Yep, that was the inspiration for my companion tool https://git.mig5.net/mig5/jinjaturtle (which enroll will automatically try and use if it finds it on the $PATH - if it can't find it, it will just use 'copy' mode for Ansible tasks, and the original files).

Note that running the `enroll manifest` command against multiple separate 'harvests' (e.g harvested from separate machines) but storing it in the same common manifest location, will 'merge' the Ansible manifests. Thereby 'growing' the Ansible manifest as needed. But each host 'feature flips' on/off which files/templates should be deployed on it, based on what was 'harvested' from that host.

> Does it log a list of running processes and their contexts; with `ps -Z`?

It doesn't use ps, but it examines systemctl to get a list of running services and also timers. Have a look at https://git.mig5.net/mig5/enroll/src/branch/main/enroll/syst...

Thanks for the other ideas! I'll look into them.
by gizmo686 | 2026-01-02 04:43:39+00:00
This depends on industry. Around here, working locally on laptop is a luxury, and most devs are required to treat their laptop like a thin client.

Of course, being developer laptops, they all come with 16 gigs of RAM. In contrast, the remote VMs where we do all of the actual work are limited to 4GiB unless we get manager and IT approval for more.
by somenameforme | 2026-01-02 04:43:56+00:00
Russia did inquire about joining NATO multiple times, as far back as the 50s as the USSR, in the 90s after USSR collapsed, and then again by Putin in the 2000s. It was rebuffed each time.

Joining the EU would be somewhat nonsensical as they would gain very little from it and cede substantial sovereignty in exchange. It's the same reason places like Norway have no interest in joining the EU.
by panick21_ | 2026-01-02 04:44:04+00:00
> I wonder who pays for the real cost of the ticket

Everybody already has local regional tickets anyway. And most people can't be in more then one place at the time anyway. And most people stay in the same region most of the time anyway.

So really you are not losing much compared to having separate local region tickets in a system where the long distance trains are separated.

> who cleans and repairs the trains

The already existing organizations that have run the trains for a long time.

> who invests in infrastructure and all that

The government ...

> I always wonder how the germans can pull this off for 50 Euro. Magic.

Its not magic its just a transportation policy and taxes.
by hyghjiyhu | 2026-01-02 04:45:38+00:00
Imo if you run into the halting problem it's because you are trying to do too much. In particular I think what you actually want is to check soundness based on the "shape" of the code rather than the reason about which variables can have which values and what that means for soundness.

flag=false;
if flag {
use_after_free();
}

can be rejected with a clear conscience.
by kirykl | 2026-01-02 04:47:04+00:00
I tried to buy a vacuum from a Sears store once. The cashier couldn't price match against Sears' own website, which had a lower price. So while inside the store, I purchased the vacuum on my phone, and selected in store pickup, and showed it to the cashier. But they had a separate building for in store pickup I had to drive around to.
by BobbyTables2 | 2026-01-02 04:47:20+00:00
Yeah but those standard libraries are still inadequate 30 years later.

Imagine a hypothetical Python scenario where every application and library had their own list implementations with differently named methods and behavior.

Yet C is exactly that. Is it not common place to log messages to a file? How many applications and code bases DO NOT use syslog(). And if one wants to use syslog, then assert failures won’t get logged there…

Sure, with a custom assertion and logging framework one can get reasonable behavior. But it’s not automatic. Hence, a Tower of Babel …
by latch | 2026-01-02 04:47:40+00:00
I now live in SEA and travel a bit, and the showroom have been popping up everywhere. You see more and more on the streets. Better prices and aggressive partnerships.

My home country has a 100% tariff on EV Chinese-made electric vehicles. But if you're a country that doesn't have an domestic industry to protect, or don't mind unfair trading practices (or whatever mix of reasons countries are giving for essentially blocking BYD), then why wouldn't you welcome them? I don't see this ending well for traditional auto makers.
by digiown | 2026-01-02 04:47:42+00:00
It "protects" against this given the user already does not control the hypervisor, at which point all bets are off with regard to your rights anyway. It's actually worse than Windows in this regard.

I would never use a computer I don't have full control over as my main desktop, especially not to satisfy an external party's desire for control. It seems a lot more convenient to just use a separate machine.

Even mainstream consumers are getting tired of DRM crap ruining their games and movies. I doubt there is a significant Linux users would actually want to compromise their ownership of the computer just to watch movies or play games.

I do agree that Linux userland security is lackluster though. Flatpak seems to be a neat advancement, at least in regard to stopping things from basically uploading your filesystems. There is already a lot of kernel interfaces that can do this like user namespaces. I wish someone would come up with something like QubesOS, but making use of containers instead of VMs and Wayland proxies for better performance.
by afiori | 2026-01-02 04:47:43+00:00
An advantage of WASI is that it mostly works on non-WASI runtimes too, as it can be compiled to one or more normal modules (with the multi memory feature).

So a possible reason is that maybe they are not interested in offering general interfaces but just a single python specific one.

In this case they could have likely used wasi for that too but I can see how it could have been seen as an overhead
Show HN: Runtime Kubernetes Compliance Engine (Policy as Data, No SCAP XML)
by scanset | 2026-01-02 04:48:15+00:00
I’m sharing an open-source Kubernetes runtime compliance reference implementation built on Endpoint State Policy (ESP).

It treats compliance as policy as data: you declare what you want to check and what compliant state looks like, and the system continuously evaluates live cluster state instead of running point-in-time scans.

Key ideas:
• Agent-based runtime state collection in Kubernetes
• Deterministic policy evaluation (no SCAP XML)
• Results emitted as time-bound attestations, not snapshots
• Framework-agnostic (STIG, NIST, SSDF, etc.)

The repo is ready to build and test:
• Dockerfiles and Helm charts included
• Starter policy library with basic coverage
• End-to-end reference architecture (agent → evaluator → result sink)

This is aimed at people doing platform security, DevSecOps, or compliance in regulated environments where snapshot evidence doesn’t hold up.
by jdross | 2026-01-02 04:50:18+00:00
You can’t afford to buy a home because the current owners vote to restrict new housing through zoning and expensive regulation on construction permitting, so supply is limited in the places you’re trying to live (a higher income region?).

The government also subsidized mortgages for the prior generation to increase asset values and now that time is up. Subsidized demand = inflation

Finally, you likely want a bigger house than your parents had. And most people want it to be in the cooler area, not somewhere in Iowa where schools are great but restaurants and non-remote jobs are lacking
by donkyrf | 2026-01-02 04:50:56+00:00
So according to you, a company that has about 25% of the global smartphone market, should be _legally forbidden_ from creating a tightly integrated software/hardware bundle.

Whereas, a company that has 70% of the global browser market somehow would have no way to take advantage if they had an even larger share.

I wonder how our species would survive without the unique market analysis from one-of-a-kind minds like yours.
by lostlogin | 2026-01-02 04:51:02+00:00
> Its military would just need to enforce the threat that you get bombed if you fuck with America.

Panting a Russian flag on the side of a crappy tanker is enough to get the US to back off.

Russia can do what it likes with current US leadership.

https://www.nytimes.com/2025/12/31/us/politics/russia-oil-ta...
by shomp | 2026-01-02 04:52:56+00:00
I think you meant compared to a reference observer? Events are not really independent of observers. Consider the case in baseball where a runner and the baseman tag the base at the "same" time from opposite sides of the base. Assume they move at equal speeds. If the umpire is closer to the baseman then the baseman has tagged it first, if he is closer to the runner, then the runner has tagged it first. The "event" of "touching the base" has two possible outcomes depending on where the observer stands, and there is no "view from nowhere" or observer-free view that we can reference.
by charcircuit | 2026-01-02 04:53:22+00:00
You already don't control the firmware on the CPU. Would you be okay with this if the hypervisor was moved into the firmware of the CPU and other components instead?

I honestly think you would be content as long as the computer offered the ability to host an arbitrary operating system just like has always been possible. Just because there may be an optional guest running that you can't fully control that doesn't take away from the ability to have an arbitrary guest you can fully customize.

>to satisfy an external party's desire for control.

The external party is reflecting the average consumer's demand for there not being cheaters in the game they are playing.

>It seems a lot more convenient to just use a separate machine.

It really isn't. It's much more convenient to launch a game on the computer you are already using than going to a separate one.
by ngruhn | 2026-01-02 04:53:41+00:00
> In typecript’s not so strict type system, you can cast anything to the `any` type. And from the `any` type, you can cast it to whichever type you wish

Minor correction: this is really more an issue with the `as` operator. For example these also work:

user as unknown as NotUser
user as never as NotUser

`as` let's you cast to arbitrary super- and sub-types. It prevents you from casting to unrelated types directly (here `NotUser`), but you can always use the trick above:
Either cast to the top-type (unknown/any) or bottom-type (never) first, then you have something that's a super-type (sub-type) of everything so you are free to cast back down (up) to an arbitrary type.

The potentially unsafe step is the down cast. Up casts should always be safe.
by vpShane | 2026-01-02 04:54:55+00:00
I just got a laptop for Christmas (first thing I've bought for myself in a good while) with 64GB of DDR5 RAM, a video card inside of it, AMD Ryzen 7 CPU, AMD Radeon 6550M. 144hz screen.

Not the best, but works for me.

I put CachyOS on it, using Steam just run the game's installer adding it as a game to your library -- you just select which proton you want (cachyos-proton) as a dropdown in the Properties in the Steam library. that's it.

it's lightweight, arch (I ditched manjaro), runs KDE and games perfectly, cursor IDE runs great, VMS run great.

first thing I did when I got it from fedex was remove Windows and put Linux on it. I thought 'maybe I'll just bite the bullet and sign up a Microsoft cloud account to be able to access ..my desktop' and 1/4 through its install I held the power button and popped a flash drive in. just say no to windows and you'll all be happy, trust me.

the only effort it required was for me to say f this on using Lutris and just use Steam as the wrapper.

2026 is definitely the year for linux. every year is. valve heavily invested in Arch, proton, and is using Linux on their devices and honestly: Windows is spyware, and after their vibe coded jank 25H2 update that broke a ton of things and Windows 10 being EOL, I hope more people get to enjoy throwing Ventoy on a USB stick with a bunch of linux isos copied over to it and boot and play with what they love.

so I disagree, 2026 is the year for Linux, and Linux is love.
by noduerme | 2026-01-02 04:55:11+00:00
I understand that, but that's not really my point. Yes, they have an isolationist and xenophobic bent. But while it's understandable that having a social media presence full of sketchy / terrorist / trafficking / whatever might now be a reason for a country to deny a visa, it creates the question of what they do with innocent people who simply refuse to participate. My question is what happens if you don't have any social media or smartphone at all? Will we be completely excluded from being allowed to travel freely unless we post our thoughts on a daily basis?
by iainctduncan | 2026-01-02 04:55:48+00:00
Another aspect of this is that a band or label really need to hit a minimum sales quota to justify pressing albums, so people buying vinyl are actually helping them more than they would be by simply donating the profit of a vinyl purchase (which is of course not the retail price of vinyl). Bands want to release, and this helps them do it.

Preordering product – whether books, vinyl, or digital – really, really helps self-funded artists and indy arts business.

Keep it up, kids! :-)
by lostlogin | 2026-01-02 04:56:06+00:00
> And how sure are you that they can reliably discriminate between Russian vessels versus others that look and sound identical?

Based on recent events, even people struggle to tell what is Russian and what isn’t.

These smart mines might solve that?

https://www.nytimes.com/2025/12/31/us/politics/russia-oil-ta...
by arcfour | 2026-01-02 04:56:49+00:00
> And of course, as always, those for which it works will tell you you're doing-it-wrong™ .

This sounds like you are rejecting help because you have made up your mind in frustration already.

Because you are doing it wrong. If you want an OS that just works, you should use Ubuntu or Fedora. Why is SteamOS based on Arch then? Because Valve wants to tweak things in it and tinker with it themselves to get it how they like.

You don't.

So use an OS that requires less from you and that tries to just work out of the box, not one that is notorious for being something you break and tinker with constantly (Arch).
by refulgentis | 2026-01-02 04:57:33+00:00
Worst of both worlds? In theory this is accurate, in practice, it isn’t. The crux of why people are fine with it as far as I can identify is “but these games still have cheaters” - people aren’t looking for 0 cheaters so much as < X% are cheaters, keeping the odds low than any given match they are in has a cheater.
Show HN: Aurora-OS.js – a tiny OS-like desktop in JavaScript (try demo)
by mentalos | 2026-01-02 04:57:39+00:00
Hi HN — I built Aurora-OS.js, a lightweight, embeddable OS-style desktop UI written in plain JavaScript. It’s intended for demos, in-browser desktop experiences, and learning OS/desktop concepts without a heavy framework.
The future of this project is a fully playable hacking simulator to be released on Steam and other marketplaces.

Contributors & testers wanted!
by digiown | 2026-01-02 04:57:44+00:00
Ah, I see, you're talking about Intel ME/AMD PSP? That's unfortunate and I'm obviously not happy with it, but so far there seems to be no evidence of it being abused against normal users.

It's a little funny that the two interests of adtech are colliding a bit here: They want maximum control and data collection, but implementing control in a palatable way (like you describe) would limit their data collection abilities.

My answer to your question: No, I don't like it at all, even if I fully trust the hypervisor. It will reduce the barrier for implementing all kinds of anti-user technologies. If that were possible, it will quickly be required to interact with everything, and your arbitrary guest will soon be pretty useless, just like the "integrity" bullshit on Android. Yeah you can boot your rooted AOSP, but good luck interacting with banks, government services (often required by law!!), etc. That's still a net minus.
by HDThoreaun | 2026-01-02 04:59:42+00:00
EVs are a superior car if you have a private garage and rarely take long trips or have multiple cars so you don’t need the EV for trips. Great for suburban living, which is where most Americans live. Never having to go to the gas station is legitimately a game changer and it’s worth swapping to EVs for that alone given you check the 2 boxes. Then you consider the better torque and easier maintenance and it’s a no brainer.

Boulder is not a great EV town because everyone road trips all the time. 70% of Americans live east of the Mississippi where road trips are less common.
by wwes369 | 2026-01-02 05:00:27+00:00
From reversing the brachistochrone for maximum lasting, not fastest descent.

One minimal rule set. Multiple emergent realities:

Dark energy as irreversible geometric loss (geometrically derived ~68.9%)
Dark matter as compact converted data
Cosmic web resonance (observer-independent)
Neural persistence (gamma bloom)
AI efficiency (ratio-based pruning & revival, with emergent intelligence via tuned static noise)
Not a theory of everything.
A ruler for what persists long enough to matter.
by drekk | 2026-01-02 05:00:37+00:00
Location: MA, USA

Remote: Yes

Willing to relocate: Yes

Technologies: Go, Python, TypeScript, PHP, Linux, SQL, Odoo (ERP), React, Matlab

Résumé/CV: https://drive.google.com/file/d/1CAQRCiM5aJ9lJlbwd3FnZ0U7UIB...

Email: sebastian@lloret.io

Summary: I'm a full-stack engineer looking for meaningful work. I'm most motivated when my code helps people directly. In my last role, I worked on systems that helped millions access financial tools, and it was incredibly rewarding. I want to find that sense of purpose again. I enjoy solving concrete problems with Go, Python, and modern web stacks, often around data or system reliability. If your company is building something that improves lives, I'd love to help.
by tooltalk | 2026-01-02 05:02:39+00:00
>> Shouldn't we be writing thank-you notes to the Chinese tax payers who so graciously subsidies cheap cars for us?

I'd write a BIG thank you note to the Chinese taxpayers if they could send a direct cash payment instead, so I can use it towards my next EV purchase (of my own choosing).

Otherwise, I prefer not to participate in China's predatory pricing tactic enabled by illegal export subsidies to undermine foreign competitors and distort global market.
by narrator | 2026-01-02 05:03:37+00:00
Non-performing loans of state-owned entities get bought by asset management companies (AMCs) with AMC liabilities. People's Bank of China liquifies AMC Liabilities so the banks keep lending.[1] AMCs often then can't pay because the state-owned entity isn't able to pay on the loan it bought. They then get bailed out by the Ministry of Finance, but the actual source of funds inside the government is difficult to discern [2].

[1] https://www.rba.gov.au/publications/bulletin/2024/apr/chinas...
[2] https://newbagehot.yale.edu/docs/china-1999-asset-management...
by tapoxi | 2026-01-02 05:04:21+00:00
Once it's out you could but EKs are unique and tied to hardware. Using an EK to sign a boot state on hardware that doesn't match is a flag to an anti-cheat tool, and would only ever work for one person.

It also means that if you do get banned for any reason (obvious cheating) they then ban the EK and you need to go source more hardware.

It's not perfect but it raises the bar significantly for cheaters to the point that they don't bother.
by ksec | 2026-01-02 05:05:11+00:00
>we see it is 5.5T for Western world vs 4.6T for China (according to my brief google searching).

I would bet the unit volume of manufacturing with those 4.6T is more than double that of 5.5T. And those 5.5T likely have some very high value, high margin leading edge equipment.

Not only is China catching up to those sectors, they are continuing their momentum to accelerate and expand in other low value market. They key here isn't to maximise profits, it is to maximise control.

If Trade is war, which is the fundamental of principle of what "Art of War" is about, then I dont see how the west could win this war without some very drastic changes.
by eisjxh | 2026-01-02 05:05:55+00:00
The Korean Ministry of Science and ICT released this promotional video for their national AI strategy. It includes:
- A scene where a man puts on foundation (makeup) and a woman being impressed by the "AI Foundation"
- A pun where AX (AI Transformation) gets confused with an axe, complete with a mountain god cameo
- "Handsome highways" wordplay (잘생겼다 means both "handsome" and "well-built")
- Unironic references to "AI sovereignty" and becoming a "Top 3 Global AI Power"

South Korea announces "AI Foundation Models," "AI Highways," and "AI Sovereignty" via a video that assumes the public needs a golden axe folklore bit to stay engaged—or can only associate the word "foundation" with a makeup product.

Hard to tell if this reflects their estimation of public intelligence or their own grasp of the subject. The confidence is inversely proportional to the substance.
by kmeisthax | 2026-01-02 05:06:33+00:00
That may have been possible and even easy on older hardware but modern Apple hardware makes this way more of a pain in the ass. They have a whole separate hypervisor (SPTM), kernel, and userland running in a higher set of guarded privilege levels from the standard ARM exception levels.

Compromising the camera dot on modern iOS requires compromising SPTM, which is equivalent to a full jailbreak. Most modern iOS spyware doesn't actually go as far as that, it just does enough exploitation to get the data they want.

None of this applies to macOS, which doesn't use SPTM, because the whole point of SPTM is to enforce iOS code signing and lockdown rules.
by yndoendo | 2026-01-02 05:06:37+00:00
My Framework 13 with a 2880x1920 screen running Gnome 49 on Arch allows for selecting 125, 133, 150, 166, 200, 250, 266, 300, 333, and 375.

org/gnome/mutter/experimental-features; scale-monitor-framebuffer, xwayland-native-scaling