MurphyA/hacker-news huggingface dataset:
Tell HN: Internet Bug Bounty (IBB) on HackerOne Appears Dead, CVEs Unpaid
by irke882 | 2026-01-06 15:01:15+00:00
I figured out this might be a good place to ask/raise this.

This is about the IBB program:

https://hackerone.com/ibb

A few months back, I reported two vulnerabilities that should get a $8000 payout or so. They got CVE numbers and got fixed months back.

It seems like the program is dead. Last report has been resolved 8 months ago. I have tried repeatedly to contact HackerOne through different channels, but got no response. This includes e-mailing the official IBB e-mail, e-mailing HackerOne people directly, reaching out through their forms and using mediation. There's total silence.

I searched social media for any mentions of this, but didn't see any communications.

It looks like the program is dead. The bounties are still being promised, but the reports are ignored - even for published CVE's that clearly do qualify for payouts according to the rules.

Does anyone know more about the situation? What shall be done here? Is the program dead?
by soseng | 2026-01-06 15:01:23+00:00
It's so easy to bait me with this nostalgia. There is something mysterious and enjoyable about dialing-in or connecting to a server in the unknown. During those days, many things were not easily discoverable which added to the fun.

For a brief time, this extended to the early internet with IRC servers. I spent most of my early teenage years downloading warez, .wav music files, and trying not to be a n00b on #c while asking n00b questions

Now that I am an old man, I wonder what today's youth do that is equivalent to this fun nerdy culture? Maybe I can partake, LOL.
by rk3d | 2026-01-06 15:01:54+00:00
Blogs used to be a pretty big deal for developers back in the day, or at least they were for me. It was our place to showcase the projects we'd completed, provide commentary on new technology, stay in touch with friends, share photos, and maybe share a tweet or two in the sidebar.

One of my favorite blog engines was Typo, one of the very first open-source Ruby on Rails projects. I found Typo cool because it was associated with the new web framework RoR and provided a quick way to get started blogging. The themes were unique and so simple. I was 15 when this came out, and I spent an entire summer trying to make it work. I had been building websites for a couple of years at this point, but mostly with a WYSIWYG editor (NetObject Fusion 7, anyone?) and PHP.

The thing with Ruby on Rails back then was that you couldn't just pay for hosting like you could for HTML and PHP, where servers were already configured for you. No, you had to learn how to host the application yourself inside of Apache with a plugin like Passenger to serve content over port 80 (instead of 3000). It was a challenge I didn't overcome until much later, after I had a better understanding of RoR, but the impression of Typo stuck with me.

Fast forward almost 20 years :O to today, well, last week, really. When I googled Typo to see what had happened to that project. I learned that the project was renamed to Publify (which is still maintained) at some point, and the typo website was a memorial to the original software at TypoSphere.org with a "Proudly Powered by WordPress" banner at the footer (oof!). So I did some digging and found a couple of GitHub repos that had the Typo core before it was moved to the new Publify name. These repos had not been touched in at least a decade. So, I found a new challenge.

What would it take to fork the repo and upgrade all dependencies so it works with Rails 8 and Ruby 3 (it was built for Rails 3.0.10 and Ruby 1.9.3)?
by virgil_disgr4ce | 2026-01-06 15:02:00+00:00
Thinking is not besides the point, it is the entire point.

You seem to be defining "thinking" as an interchangeable black box, and as long as something fits that slot and "gets results", it's fine.

But it's the code-writing that's the interchangeable black box, not the thinking. The actual work of software development is not writing code, it's solving problems.

With a problem-space-navigation model, I'd agree that there are different strategies that can find a path from A to B, and what we call cognition is one way (more like a collection of techniques) to find a path. I mean, you can in principle brute-force this until you get the desired result.

But that's not the only thing that thinking does. Thinking responds to changing constraints, unexpected effects, new information, and shifting requirements. Thinking observes its own outputs and its own actions. Thinking uses underlying models to reason from first principles. These strategies are domain-independent, too.

And that's not even addressing all the other work involved in reality: deciding what the product should do when the design is underspecified. Asking the client/manager/etc what they want it to do in cases X, Y and Z. Offering suggestions and proposals and explaining tradeoffs.

Now I imagine there could be some other processes we haven't conceived of that can do these things but do them differently than human brains do. But if there were we'd probably just still call it 'thinking.'
by PaulHoule | 2026-01-06 15:02:08+00:00
Negative posts that I post tend to do better than neutral or positive ones. I have a classifier that judges titles on "most likely to get upvoted" for which "Richard Stallman is Dead" is the optimal title, and another that judges on "likely to have a comments/vote ratio > 0.5" [1]. The first one is a crummy model in terms of ROC, the second is pretty good and favors things that are clickbaity, about the battle of the sexes, and oddly, about cars.

But that 35 as an average score is hard for me to believe at first, I mean, the median HN post gets no votes, last time I looked the mean was around 8 or so. What is he sampling from?

[1] comments/votes = 0.5 is close to the mean
by runjake | 2026-01-06 15:02:44+00:00
This was always my secret to getting a job I’m not qualified for on paper.

At one point early in my career the old engineer left. I quickly stepped in “just until they hired somebody qualified”. Back then, a 4 year CS degree was required to get the job.

For reasons I can’t recall, we couldn’t hire someone for 6 months. My boss and I had a meeting with HR where he pleaded my case to get me hired. The HR director was actually yelling that I wasn’t qualified.

My boss calmly replied “He’s been doing it for the past 6 months. He’s actually been making improvements. Remember that process of yours that suddenly got a lot better? He did that.” I ended up getting hired right there. There was further drama about me being at my pay scale without a degree but my boss shielded me from much of it.

For that 6 months and for another 12 months after, I probably spent 18 hours a day working or learning to get up to speed. I was single and motivated so it worked out. Loved that boss.

That was many decades ago so I keep an eye out for that spark among my colleagues. I occasionally see it but for the most part, they are much more ambitious than I was and that warms my heart. (Two of them started companies you’ve heard of and cashed out)
by ryandv | 2026-01-06 15:03:28+00:00
Yes... I've asked for the same - show us the goods with a Destroy All Software style screencast; otherwise the default position is that this entire HN post is just more AI generated hallucination.

Nobody's taken me up on this offer yet. [0]

[0] https://news.ycombinator.com/item?id=46325469
by FireBeyond | 2026-01-06 15:03:28+00:00
Hah. In my Safeway, the ice cream and half the frozen aisles have a lock on every door. I can’t imagine how much inconvenience that causes everybody. The employees openly say it’s ridiculous and you regularly find a queue in each aisle waiting to be individually served by an employee with a key unlocking and re locking each door they want something from.
by philistine | 2026-01-06 15:04:59+00:00
You assume there's only one type of player. Some players fall into a category I lovingly call Madden Guy. These people will play some other games, but they will play one game *a lot*. Call of Duty, Arc Raiders, Destiny, Battlefield, Fortnite, these are the type of games who attract these kind of players. If a game has 600 purchasable items, a seasonal battlepass-type thing, multiple female rappers skins, and a publisher-financed pro scene, it's probably one of those games.

Those games 100% already have game modes you pay by the hour. They will have special modes you access with currency and you need to keep paying to keep playing. Those modes are usually special, with increased and unique drops.
by c-linkage | 2026-01-06 15:05:00+00:00
OT: Is Cloudflare breaking the internet again?

This is the third link off the HN Front Page that yields the following error in Firefox:

Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for philippdubach.com. The certificate is only valid for the following names: cloudflare-ech.com, *.cloudflare-ech.com

Error code: SSL_ERROR_BAD_CERT_DOMAIN
by 9rx | 2026-01-06 15:05:03+00:00
> neither did communism (I know since I grew up in it

Impossible. Communism is a work of science fiction, much like Star Trek which is a more modern adaptation of the same idea. Like Star Trek, the concept is dependent on post-scarcity, which we've never seen, and isn't likely to ever happen. Perhaps you mean you grew up under rule of the Communist Party?

> it had to be bought for non-trivial money with good old mortgages, and only regime-aligned people could

The defining features of communism are no class, no state, and no money. It imagines these will no longer be relevant in a post-scarcity world.
by scblock | 2026-01-06 15:05:08+00:00
If this odd apology for Microsoft's own messaging from The Verge wanted to make sense it would need to explain why office.com says "Microsoft 365 Copilot" in the title field and on the header of the page, and "Welcome to Microsoft 365 Copilot" front and center on the page, including "The Microsoft 365 Copilot app (formerly Office)", and do a better job than "Microsoft is referring to a mobile app they renamed."

At that point it doesn't matter what someone says pedantically. MS is abusing the office.com domain, which should send me to MS Office information.

Also, at the very end, the Office name is still ruined, given that they want to sell you "Microsoft 365" rather than "Office 365".

This is easily as bad as me having to launch the "Windows App" on my iPad when I need a quick remote desktop session. Just call it remote desktop because that is what it is.
by hubraumhugo | 2026-01-06 15:05:13+00:00
dang's explanation sums it up nicely:

> It's human nature: https://en.wikipedia.org/wiki/Negativity_bias. Everyone does it, but we perceive other people as doing it more than we do, which is itself a variation of the bias.
You can even see it in the title of the OP, in the word "overwhelmingly". That's excessive: the negative bias is noticeable, but if you look closely, it's not overwhelming. (To make up some numbers, it's more like 60-40, not 90-10.)

However, it often feels as if it is overwhelming; in fact, one or two datapoints, plus negativity bias, are enough to create just such a feeling. The feeling gets expressed in ways that trigger similar feelings in other people, so we end up with a positive* feedback loop.

The interesting question is, what factors mitigate this? how do we dampen negativity bias? or, how do we get negative feedback into our positive feedback loop of negative affect? That must also be happening all the time, or we'd be in a "war of all against all", which isn't the case, though (again) it may feel like it.

* ['positive' in the sense of increasing; a positive loop of negative affect!]

https://news.ycombinator.com/item?id=40430263
by phtrivier | 2026-01-06 15:05:19+00:00
As other pointed out, you may very well have a more productive setup this way, but providing numbers is rage-bait because we don't know where your baseline come from.

Do you ship 20x more PRs ? Did you solve 20x more bugs ? Did you add 20x more features ? Did you provide 20x more ARR, more values, etc...
by EGreg | 2026-01-06 15:05:52+00:00
It's not clear that the EU can force Apple to write code that opens up the iOS platform for alternative app stores and payment methods, but there is one thing that the EU can absolutely do with 100% reliability, any time they want: the EU can decide not to let Apple use Europe's courts to shut down European companies that defend European merchants, performers, makers, news outlets, game devs and creative workers, from Apple's ripoff, by jailbreaking phones.

This is my approach to far-reaching private property in general, not just IP: just have courts decline to enforce it. That is less violence and more libertarian than anarcho-capitalists.

Imagine having the courts vigorously defend your personal property rights and your first 3 homes, but gradually less guarantees for your 10th and 100th house. It would be hard for, say, Blackrock to buy up all those houses or Bill Gates to buy up all that farmland.

This is philosophically in step with the Lockian proviso, and just closer to natural law in general. A lion, no matter how strong or clever, can’t defend and enforce his rules on a swath of land past a certain point. Humans just came up with these systems due to abstract concepts like property ownership, corporations, countries etc. having no limits.

PS: This guy is onto something. Repealing or relaxing laws benefiting others is exactly the way you get back at them. Tariffs are not.
by nostrademons | 2026-01-06 15:06:16+00:00
Yes and no.

I think what'll happen here is that these computing price increases will be what finally makes certain ML startups un-economical. That's what will precipitate the AI bubble burst. The whole thing runs on investor capital, so it keeps going until some investors lose their capital. Once the bubble bursts, you're going to get some really cheap GPUs, RAM, and hard drives (as well as cloud computing prices), as many of the more marginal data centers go out of business and liquidate their hardware.

It's going to be a rough couple years for hobbyist computer aficionados though. In the near future I'd try to wait this one out and get a job at an AI startup instead.
by EGG_CREAM | 2026-01-06 15:06:17+00:00
That’s because our mass protests are focused on the overseas concentration camps, illegal detainment and arrests, and the other authoritarian moves our president has made. It’s true that Americans in general care little about foreign policy. It’s not an anti-Europe thing, it’s just that people care about stuff that more immediately affects them. European countries are smaller and more integrated, so foreign policy has a more immediate affect on them. Foreign policy has a dramatic affect on Americans lives, but it’s usually indirect and therefore not top of mind for the average citizen. That doesn’t mean we like our government’s foreign policy. And all that’s without mentioning that many believe the Greenland talk is not serious, and simply a distraction, and therefore mass protests would actually be playing into the admins hands.
by enraged_camel | 2026-01-06 15:07:15+00:00
There's three types of work in software:

- Commodity work, such as CRUD, integrations, infra plumbing, standard patterns.

- Local novelty, i.e. a new feature for your product (but not new to the world).

- Frontier novelty, as in, genuinely new algorithms/research-like work.

The overwhelming majority of software development is in the first two categories. Even people who think they are doing new and groundbreaking stuff are almost certainly doing variations of things that have been done in other contexts.
by moralestapia | 2026-01-06 15:07:54+00:00
Hi philipp (in case you're reading this),

Could you clarify what do you mean by "points" ("score" in your pre-print)?

Also, what's your data source?

"This study uses publicly available data from Hacker News." is not really a data source.

Also also, you missed the largest, most important effect that skews the votes on this site. But you can definitely find it on the dataset you got, that'd be a very interesting disclosure!

Hint: Immediately after posting this comment, it went to the bottom and "downvotes" magically started to come in ;).
by alexmchale | 2026-01-06 15:08:10+00:00
GreenArrow Email | Remote | Full-Time
https://www.greenarrowemail.com/careers/developer

I'm Alex McHale, Lead Developer at GreenArrow Email. We're looking to add an additional developer to our team. The right candidate will have solid Go skills and can "hit the ground running" (so sorry for the cliché). Bonus if you're a polyglot who might have skills in Ruby on Rails and JavaScript.

We've put a lot of thought into our job post. Please give it a read. If you think you're a fit, there's a link at the bottom of the post with a form to fill out.
by joshstrange | 2026-01-06 15:09:08+00:00
I've seen the same with comments (both negative sentiment and shorter length). Short, snarky, negative comments [0] normally get a much better response than well-reasoned, longer-form comments.

Not that karam matters on HN but I have been disappointed to see longer comments that I put a lot of effort into get ignored while short, pithy comments get way more upvotes/replies. I've spent literally over an hour on some detailed comments that didn't even get a reply from the original person asking a question and likewise had comments I fired off with near-0 thought that "blow up". It's frustrating that better content is not always rewarded.

[0] Something I'm guilty of
by mau | 2026-01-06 15:09:21+00:00
German-style strings is a way to store array of strings for columnar dbs. The idea is to have an array of metadata. Metadata has a fixed size (16 bytes) The metadata includes the string length and either a pair of pointer + string prefix or the full string for short strings. For some operations the string prefix is enough in many cases avoiding the indirection.

This is different from Pascal strings.
by rocmcd | 2026-01-06 15:09:34+00:00
This has been my biggest question through this whole AI craze. If AI is making everyone X% more productive, where is the proof? Shouldn't we expect to see new startups now able to compete with large enterprises? Shouldn't we be seeing new amazing apps? New features being added? Shouldn't bugs be a thing of the past? Shouldn't uptime be a solved problem by now?

I look around and everything seems to be... the same? Apart from the availability of these AI tools, what has meaningfully changed since 2020?
by justtraderit | 2026-01-06 15:09:38+00:00
Thanks for pointing this out.

Buy Me a Coffee doesn’t seem to make the page publicly accessible from my location.
For now, crypto is the most reliable option for me.

USDT (TRC20):

TT1md66ugKJwsYiuGXt1Tz93d3HF8mrCga

I appreciate you letting me know.
by reedlaw | 2026-01-06 15:09:49+00:00
Gergely Orosz (The Pragmatic Engineer) interviewed Yegge [1] and Kent Beck [2], both experienced engineers before vibe coding, and they express similar sentiments about how LLMs reinvigorated their enjoyment of programming. This introduction to Gas Town is very clear on its intended audience with plenty of warnings against overly eager adoption. I agree that using tools like this haphazardly could lead to disaster, but I would not dismiss the possibility that they could be used productively.

1. https://www.youtube.com/watch?v=TZE33qMYwsc

2. https://www.youtube.com/watch?v=aSXaxOdVtAQ
by theultdev | 2026-01-06 15:09:52+00:00
Used to work in this realm. It doesn't matter.

Easylist will contact you, strongarm you into disabling your countermeasures and threaten to block all JS on your page if you don't comply.

So no ad servers can load, no prebid, nothing will function/load if the user has an adblocker that uses easylist (all of them) installed.
by eth0up | 2026-01-06 15:10:01+00:00
In my experience as a consumer, for study and amateur production, the preservation and fortification of critical-thinking is inevitable and prerequisite. Without such, it would be a dark age, with incoherent whispers from the future.

With coding, results are often proportionate to the quality, thoroughness and structure of my prompts. And much debugging.

With intellectual pursuits, any output of interest or previously unknown nature must be verified. I find the farther I push past the safety rails (always ethically, but often harsh) the greater the inclination to hallucinate, appease/placate or evade through reframing, detours and actually quite a number of clever but counterproductive maneuvers.

But I'd say, have no worries. Critical Thinking to the LLM is copper to the cable. It simply doesn't work without it. And because of this, an unintended benefit comes from exercising one's attentiveness and scrutiny. Just keep in mind that a Pandora's Box exists behind scrutiny. Depending on one's level of patience and persistence, this alone is a deep and fascinating pursuit in itself.

The only way AI will kill a skill is the same as anything else would. It's the underlayment, ie indolence, naivety, etc. For the generally aware, it's a force multiplier and for me, new form of existential mirror.
Show HN: Simboba – Evals in under 5 mins
by ntkris | 2026-01-06 15:10:21+00:00
Hi HN,

I built Simboba because we needed something for our own product, and I wanted to explore how dev tools change with AI coding assistants.

The hardest part of evals is creating good annotated test cases. So I focused on getting users there with the power of AI coding assistants.

How it works:

- AI drafts datasets from your codebase
- Web UI to review and refine cases
- Everything tracked in git
- Multi-turn conversation support
- LLM-as-judge + deterministic checks (e.g. was tool xyz called)
- Evals run as simple Python scripts

The AI coding assistant angle: I wanted users running customised evals in 5 minutes, not just a generic example. Started with a CLI command that generates a prompt for Claude Code / Cursor. That felt like too much friction. Then tried a separate markdown file with instructions, but AI tools didn't find this easily.

What worked: clear instructions in the README plus structured schemas (Pydantic). The AI reads the README, understands your codebase, the structure required for the package and drafts a real dataset for your product. Then writes the eval script.

I'd love to know what you think, and happy to answer questions!
by petercooper | 2026-01-06 15:10:29+00:00
You wouldn't own the land. It's quite common with small business web design for the developer to also control the hosting. The actual point in the web site case is that you are revoking the copyright license to the content until you receive payment, a well tested and accepted concept in UK law.

That said, there have certainly been situations where builders have gone back to properties and taken back their property (like tiles from walls, joinery, etc.) but I have no idea how that pans out legally as it's outside my wheelhouse.
by yomismoaqui | 2026-01-06 15:10:31+00:00
Haven't you really tried an agentic code like Claude Code, Codex, AMP...? For "really try" I mean investing some time with it like 10-20 hours min to see the things they are good with and how to use them well. They are tools and have the corresponding learning curve.

I have passed through a phase of copy/pasting from the ChatGPT web to autocomplete tools, but the real feeling of "shit, this is going to really change how I code" came with Claude Code.
Show HN: Capture website screenshots from your terminal. No browser needed
by erikpau | 2026-01-06 15:10:35+00:00
I built a CLI tool for capturing website screenshots directly from your terminal. It displays images inline using Sixel, iTerm2, or Kitty protocols, so you can preview sites without leaving your workflow.

Built in Rust, it's open source, you can find the code here: https://github.com/allscreenshots/allscreenshots-cli