MurphyA/hacker-news huggingface dataset:
by ahmetomer | 2026-01-09 09:38:02+00:00
I'm using Apple's Password Manager (native app on iOS & macOS), but didn't install its browser extension that can do autofill because for me it wasn't as convenient (it has a bad UX, unreliable autofill, etc.)

So, when I'm prompted to log in somewhere, I open the password manager and repeat the steps you just mentioned. It does add extra steps to the process, but I don't think it makes it less safe than having an autofill extension, which requires a ton of permissions and is more prone to compromises. And yes, my manual method also means I have to rely on me being aware of the URLs I'm on, but I usually bookmark my main services, so it's working fine for me this way. I also treat all emails as spam and/or an attack unless I verify them by the domain, and whether I had just recently requested to log in or requested a password change, etc.

At the end of the day, it boils down to us paying attention to every action we take, regardless of the measures we take, as new and different methods are being deployed to own us every day.
by anonymous908213 | 2026-01-09 09:38:06+00:00
For a cautionary tale, I'm not seeing a mention of how you were actually compromised? You mentioned losing multiple accounts, but presumably didn't decide to sign up for their 'game' website while entering your gmail address and password plus Discord password. KeePass should rule out having used the same password for all three accounts. KeePass should also, in theory, not immediately give up all of your credentials to a random .exe running on your computer. If it did, it would be useful for people to know to avoid it.
by Ianjit | 2026-01-09 09:38:34+00:00
A few studies over different time frames:

[1] https://www.youtube.com/watch?v=1OzxYK2-qsI
[2] https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-gen...
[3] https://www.youtube.com/watch?v=JvosMkuNxF8
[4] https://www.faros.ai/blog/ai-software-engineering

"The technology has improved so rapidly that this study is now close-to-meaningless."

You could have said that anytime in the last 3 years, but the data has never shown it to be true. Is there data to show that the current gen models are so much better than the last gen models that the existing productivity data should be ignored? I don't think the coding benchmarks show a step change in capabilities, its generally dev vibes rather than a large change to measurements.
by bmez | 2026-01-09 09:38:42+00:00
Given unlimited time, read all of them, learn all the languages. It will all help make you a better programmer in your preferred language. With limited time (as a normal being), start with the top 100 books. Any of them. The next will be simpler than the first...

I have an M.Sc. in Comp.Sci. Flicking through books like these, all the chapter titles resonate with courses, exams, and problems we solved. It also makes me realise I have probably forgotten more than I like to think.

On the other hand, bashing my head against graph theory and logic, has made me a much better programmer. Similarly, the hours spent in Van Roy and Haridi's fairly abstract and technically language-agnostic "Concepts, Techniques and Models of Computer Programming" made me primed to learn a lot of languages fast - because I had the primitives mastered.
by fh973 | 2026-01-09 09:39:22+00:00
Europe does not need more open source, it needs its own healthy and competitive software industry.

It doesn't matter if the email platform a government uses is open source, but it should be able to pick a local alternative. It does not matter if the e-ID or payments app is running on an open source mobile OS, but it should be possible to run it on a non-US one.

Policy may help the European software industry, at least governments should actively work on getting away from their Microsoft addiction. Open source may be one of the options, but it is not the right model for all types of software.

Blindly preferring open source may kill otherwise viable local software businesses.
by dfabulich | 2026-01-09 09:39:57+00:00
Not really. At a buffet restaurant, if you could take the food out with you, you'd takeaway more food than you can eat at one sitting. OpenCode users and Claud Code™ CLI users use tokens at approximately the same rate.

This is more like an all-you-can-eat restaurant requiring you to eat with their flimsy plastic forks, forbidding you to bring your own utensils.
by u8080 | 2026-01-09 09:40:05+00:00
> lengthy errata doesn't mean anything

In STM32G0 for example, there is "SPIv1" peripheral which has very critical implementation bugs which can get SPI to completely stuck until reset by RCC.

There is very brief mention in STM errata about this, I had to dig up forums and dance up with SWD around this.
by leoedin | 2026-01-09 09:40:08+00:00
Using a Raspberry Pi (or anything running Linux) is a completely different experience from bare metal. I wouldn't recommend it for learning fundamentals.

If you want to understand how interacting with peripherals and hardware works, an RP2040 is a good option - it has great documentation and sensible peripherals. Or STM32s have huge numbers of examples in the wild.

Ultimately the biggest difference - the thing you need to learn the most - is peripheral setup. Things like setting up the clock, setting up an I2C or SPI bus, reading and writing bytes from a UART etc. This stuff happens on every computer all the way up to a Raspberry Pi, but the bigger and more powerful the MCU the more it tends to be abstracted away by libraries and middleware.

If you want to truly learn this stuff you have to get low down, strip away all the abstractions and get very familiar with the 1000+ page user manual. Doing that on the simplest microcontroller possible is a benefit, because you're not overwhelmed by complex peripherals and too-many-settings.

I'd also recommend starting with C, rather than trying to mess around with Rust. Rust (and embassy) are great for building apps with very few runtime bugs, but debugging stuff in the Rust async world is a headache, and you've got an abstraction layer sitting between you and the chip.

It's actually really powerful to realise that a peripheral is just 10 memory addresses, and to make it work you just need to define a C struct and point it to the start address. Suddenly you're talking to the peripheral and can configure it. None of that is obvious with layers of middleware and abstractions.
by cumo | 2026-01-09 09:41:02+00:00
No, I’m not paying for his course, I just appreciate someone actually putting "fresh" (reworked) ideas into the world. And sure, everyone has a life; that’s not exactly a philosophical revelation. If “Hegelian enlightenment” is your punchline, you might want to remember that Hegel, like Heraclitus, Plotinus, Spinoza, and Kant, built entire systems by reworking older metaphysics. That’s how philosophy grows.

Dismissing someone else’s work as “illegitimate” when you haven’t reworked a single idea yourself isn’t critique: it’s just opting out of the conversation while pretending you’re above it.P.S.: for you; the brain’s prefrontal cortex literally relies on pattern‑integration, not invention from scratch.
by aebtebeten | 2026-01-09 09:41:06+00:00
¡gracias, paisano!

vibing heavily on por defender los trabajadores neoyorkinos rubios y fornido I am reminded of "i sing of Olaf glad and big":

https://en.wikipedia.org/wiki/I_sing_of_Olaf

(I have this poem from, of all things, a code sample in APL documentation. I wonder if there might have been a strong reason IP Sharp was founded north of the border?)
by gpderetta | 2026-01-09 09:42:26+00:00
> define "store ordering". Does it affect loads in any way? Or simply just stores

It affects the visible ordering of remote stores to normal memory, so load are necessarily affected (it wouldn't make sense to guarantee a store order if unobservable).

Really, TSO is defined independently of x86 and in fact it took a while to actually prove that x86 was TSO. Concretely, how do architectures that claim (optional) TSO differ from each other at least for access to normal memory?
by refurb | 2026-01-09 09:43:41+00:00
Intuition?

Let me put it this way - if you wanted to know a subject well, as in truly understand it, for example the current protests in Iran.

Do you think you’d walk away with a good understanding from what the mainstream media says? From social media?

I think it clear to most people the media does a horrible job.

Now consider if they do such a horrible job on those topics, do you think they suddenly do a good job on US politics?
by usrnm | 2026-01-09 09:44:13+00:00
I understand that it's a very controversial take, but I don't really understand what's so terrible about computer-generated images depicting something like this. I mean, it's clearly wrong when it concerns actual children, but this is just pixels on the screen and bytes on disks. No living creature was actually hurt when producing these images and cannot be hurt by them. We as a society are totally ok with images depicting various horrible and outrageous stuff, why is this example suddenly such a big issue?

Edit: I'm not talking about deepfakes of real people
by Zababa | 2026-01-09 09:44:21+00:00
>Is this a workaround to let us see “what it would look like”, or are there optical reasons why this produces an image that is inherently artificial, and could never really be perceived that way?

Both in a way. When you look at a landscape, your eyes and brain are constantly adjusting everything so what you look at "directly" is sharp, and you don't really realize most of what is in your field of view is low resolution, maybe a bit blurry. Same when looking at something really close.

When you look at a picture, if some parts of it are blurry, your eyes/brain can't adjust so that it becomes sharp, because it was captured blurry. Even if you had a camera that exactly reproduces your eye, the pictures would look nothing like what your eyes see, because your eyes and brain are a very different system from a camera.

In photo there is something called "depth of field", which is "the distance between the nearest and the farthest objects that are in acceptably sharp focus in an image captured with a camera" [1]. You can see on the wikipedia page that there's an equation for approximating depth of field, that has in it 2u², where u is the distance to the subject. That means the closer the subject, the smaller the size of depth of field. You can test this with your eye. Take an object 30cm away, put your finger between your eye and the object, and you can change the focus of your eye between your finger and the object. When you focus on your finger the object is a bit blurry, when you focus on the object your finger is a bit blurry [2]. Now take two object that are 15cm away from each other, but 2m or more away from you. Changing the focus from one object to the other won't make the first object as blurry as when you did that close. This is because your depth of field is larger, as the distance increases.

Finally macro. In macro photography, you're often extremely close, so depth of field is extremely thin. When I say extremely thin, I mean "it can take 10 or more pictures to cover a whole fly". A solution in that case, to get all your subject in focus (sharp), is to take lots of different pictures, focusing a tiny bit closer/farther away each time, and then taking all the sharp parts of each picture. That's the technique used here, often called "focus stacking".

[1]: https://en.wikipedia.org/wiki/Depth_of_field

[2]: This might be harder if you're older, as we age we slowly lose the ability to adjust focus, hence the need for reading glasses (cameras can also use "reading glasses" when they can't focus close enough, they're called "close-up filters" and work the same).
by stkdump | 2026-01-09 09:45:11+00:00
I never thought that it would be a promising approach to build entire web apps using wasm. You don't just have to make it possible to interact with the DOM. You also have to have the right high level language to do this kind of DOM interaction and application logic. JS isn't bad for that purpose and it would probably take a lot to find something that is much better (which compiles to WASM instead of js, like ts and svelte do).

The only real avenue for js-free web applications would be to completely abandon the browser rendering path and have everything render into a canvas. There are experiments to use UI toolkits designed for the desktop. But even that I see more of a niche solution and unlikely to become very widely used. HTML/css/js have become the lingua franca of UI development and they are taking over desktop applications as well. Why should that trend reverse?
by n2h4 | 2026-01-09 09:45:38+00:00
what i noticed from you and a couple other similar stories in this thread is that a same email is used at multiple places. Have you looked into email aliases like simplelogin, anonaddy, or anything of that sort?

or at the very least, the basic username+alias@domain.tld? this let's you know at least which thing was compromised.

of course, I don't recommend doing the same for important services like you banking accounts, but for the vast majority, having an alias would be enough.

and compartmentalisation always helps (different emails/accounts for personal, govt, and work domains).
by forgotpwd16 | 2026-01-09 09:45:52+00:00
Content: https://news.ycombinator.com/item?id=46540446

You didn't address any of my comments regarding the statements you made. (Didn't even linked Witten-Helffer-Sjöstrand (1982) you referred to. I guess it was an hallucination afterall.) You simply replicated the same statements. Won't be answering further because obviously there's no point. Believe what you want to believe. Or become acceptable to criticism, that maybe your grand AI generated science doesn't hold without becoming obsessive that you're correct, which is how real science moves forward.

P.S. Requires multiple people to flag a thread to become dead. Personally won't be flagging/downvoting (edit: cannot downvote anyway replies to own post) this one although should for being very out of context.
by BoxOfRain | 2026-01-09 09:45:56+00:00
That's not what I mean, I don't like corpo-speak either. I mean just treating people like they're human beings, neither with affected shortness nor affected warmth. I really don't like the common notion that you have to be cold and short with people to be a good engineer, it makes the culture considerably less pleasant and more abrasive than it needs to be in my view.

I could just as well turn that around and say why should we all adopt your diktat of unpleasantly curt communication? To me when people talk in this way it signals a lack of social skills, or at least a disrespect for the time of people you're writing for the benefit of.
by Folcon | 2026-01-09 09:46:07+00:00
You've reminded me of the forest fire simulator[0], there's a potential second dynamic how reducing the occurrence of negative events might also increase their impact when they do eventually occur

Reduce lightning strikes and increase rate of tree growth, no idea if it applies here as much?

Black swan[1] talks about this and the housing crisis was a significant event, but you can make an argument against this position as well

-[0]: https://www.veritasium.com/simulation5

-[1]: https://en.wikipedia.org/wiki/The_Black_Swan:_The_Impact_of_...
by lxgr | 2026-01-09 09:46:42+00:00
It's usually more than 3 cents out of your left pocket and 1.5-2 into your right one, even if you do everything right and never incur interest charges or fees.

> It's a great trick though, people really buy into the whole points/cashback thing and don't realise they're being paid with their own money

Even better, they become poorly-paid lobbyists for the entire scheme, since it successfully makes them feel like they're getting "luxury" items/services for free by "gaming the banks", when they're really just participating in a loyalty scheme exactly as designed.

Sure, it's possible to eke out a net cash profit here and there, but all in all, it's just a great counterexample to homo economicus.
by gbil | 2026-01-09 09:46:51+00:00
Is this some kind of a joke? People, children, are getting bullied every day by fake nude images of them ending even in suicide and you are asking what is "so terrible" ???

EDIT: op seems to have clarified in another reply that they are talking about fully generated computer images but this is out of context, the outcry here is that Grok generated fake images of actual people to start with!
by dottjt | 2026-01-09 09:47:24+00:00
I could be misunderstanding this, but you know that you can buy ETFs that are currency hedged?

Taking Vanguard for example, VGS is global equities, but VGAD is global equities that are AUD-hedged (my home country).

The only downside is that you pay more in fees (and they're less tax efficient). People generally don't bother with it though, because on a long enough time-line currencies usually revert to their long-term average, so if you're holding for retirement there's generally little point.
by embedding-shape | 2026-01-09 09:48:03+00:00
Even if autofill breaks, the moment it does, if you're security aware, is to actually read the URL you're at, not start copy-pasting like it's the wild west.

> autofilling passwords can also make people _more_ susceptible to phishing

No, it doesn't. What it does, is generally make people _less_ susceptible to phishing, but the moment you stop paying attention when autofill breaks, is the moment you can STILL get phished. But in 90% of the cases, the autofill will HELP you avoid getting phished.

What an absolutely bananas thing to say, that autofilling passwords make people more susceptible to phishing, completely wrong and borderline harmful to spread things like this.
by greatgib | 2026-01-09 09:48:55+00:00
Don't know if they will get valuable feedbacks but yes, what is needed as always is money. Ever by financing projects or buying solutions that would develop them.

As said by someone else, not do the usual wasteful:

- Create a big global project with a tender directed at bullshit consulting companies and big groups.
- Giving millions/billions to recreate a crappy version of something instead of pushing existing solutions.

Also, I have the feeling that an important point is that "open source" software is Open Source, and the proper solution is to fund good OSS software or stacks wherever they come from and not be short sighted of taking to much care of the dev or project location. Even if obviously it would be better that money goes to European devs)
by lxgr | 2026-01-09 09:49:07+00:00
> It’s not being paid with my own money. If I can get 2% cash back, then the situation is I either pay 98% of $x, or $x.

The counterfactual isn't getting or not getting 2% cash back, it's the merchant paying or not paying ~3% in fees, a part of which you get back from your issuing bank as a kickback to keep participating in and advocating for this scheme.

Of course this would require regulatory action. Absent that, the status quo represents the stable equilibrium.
by mentalgear | 2026-01-09 09:50:26+00:00
I think this was disused a few days ago in a similar HN comment thread. Turns out, the US has way more data-tapping anti-privacy laws than the EU - only that the US more or less secretly adopted them and forbids any company from telling their end-users.

Whereas you hear more about "data regulation-attempts" in the EU because it actually still has very strong privacy-rules and when trying to alter them there is a real public debate and not a hush-hush secret commission that gives security agencies access to all user data without public notification.
by cogman10 | 2026-01-09 09:50:33+00:00
I worked at HP as an intern during the saga. I even got to attend a training by the Palm team... Which wasn't great.

My impression just from that training is that WebOs was extremely mismanaged. The training was billed as a "how to write apps for WebOs" and it instead was an hour long meander by the Palm employee about how different the company culture is and how hard it became to do anything.

I had the distinct impression they didn't even know that the training was supposed to be before being assigned to do it.

I think that's indicative of everything. HP had this product that they were trying to shoehorn into the most bizarre places. At it's core it was a mobile Linux os which used html/css/JavaScript as the main user experience engine. And HP was trying to put that on printers and rack mount displays. The one place they didn't seem to care putting it was the mobile devices it was designed to target. They simply half assed the launch of a product.
by dns_snek | 2026-01-09 09:50:46+00:00
I don't think your other comment supports your assertion. I've experienced Bitwarden failing to auto-fill due to quirks on websites, but I've never seen it fail to identify the domain correctly.

You link to Bitwarden's issues mentioning autofill and while it's true that autofill might break, if you click on the extension icon it's going to present you with a list of credentials for the current domain and give you options to quickly copy the username and password to your clipboard.

If that list is empty then I'm immediately put on high alert for phishing, but so far it's always been due to the website changing its URL/domain. I retrace my steps, make sure I'm on the right domain, then I have to explicitly search for the old entry and update it with the new URL.
by benrutter | 2026-01-09 09:50:49+00:00
Hello back!

The JVM is a great parallel example. Anyone listening to the hype in the early days based around what the JVM could be would surely be disappointed now. It isn't faster than C, it doesn't see use everywhere due to practical constraints, etc.

But you'd be hard pushed to say the JVM is a total failure. It's used by lots all round the world, and solves real problems, just not the ones we were hoping it would solve. I suspect the future of WASM looks something like that.
by fingerlocks | 2026-01-09 09:50:52+00:00
No, sorry. That's not what I'm saying.

If you compile hello-world.c into a binary then it will have a placeholder (ad-hoc) signature that was signed by an "empty" key that can never expire.
The Go compiler isn't doing anything special. By default all binaries are signed this way unless they were compiled with the explicit intention of App Store distribution.

And the above does not apply to .app bundles.
by xipix | 2026-01-09 09:51:00+00:00
The article seems to evaluate Wasm as it were a framework upon which apps are built. It's not that, it's an orthogonal technology allowing CPU optimisations and reuse of native code in the browser. Against that expectation, it has been a huge success despite not yet reaching bare-metal levels of performance and energy efficiency.

https://bungee.parabolaresearch.com/change-audio-speed-pitch

One such example: audio time stretch in the browser based upon a C++ library. There is no way that if this were implemented in JS that it could deliver (a) similar performance or (b) source code portability to native apps.
by embedding-shape | 2026-01-09 09:51:40+00:00
> extensions like 1Password are _too_ URL-aware, until recently it tried to use heuristics and ignore subdomains for matching credentials

I've used 1Password for years (Linux+Firefox though, FWIW), and this never happened to me or our family. I did discover though that the autofill basically went by hierarchy in the URI to figure out what to show, so if you specify "example.com" and you're on "login.example.com", you'll see everything matching "*example.com" which actually is to be expected. If you only want to see it on one subdomain, you need to specify it in the record/item.

That it ignored the subdomains fully sounds like it was a bug on your particular platform, because 1Password never did that for me, but I remember being slightly confused by the behavior initially, until I fixed my items.