MurphyA/hacker-news huggingface dataset:
by fake-name | 2026-01-23 04:26:31+00:00
If you read the article, the OP points out that static analysis for this platform is not supported in Ghidra.

Also, reading between the lines, I think it's safe to assume the author did dump the flash.

> Using the strings command on the firmware dump reveals a lot of interesting details about the webserver itself, but nothing obvious hints us to the password.
by _heimdall | 2026-01-23 04:27:19+00:00
This is a debate I've had many times. XML, and REST, are extremely useful for certain types of use cases that you quite often run into online.

The industry abandoned both in favor of JSON and RPC for speed and perceived DX improvements, and because for a period of time everyone was in fact building only against their own servers.

There are plenty of examples over the last two decades of us having to reinvent solutions to the same problems that REST solved way back then though. MCP is the latest iteration of trying to shoehorn schemas and self-documenting APIs into a sea of JSON RPC.
by cthalupa | 2026-01-23 04:28:18+00:00
The fact that there is absurd AI hype right now doesn't mean that we should let equally absurd bullshit pass on the other side of the spectrum. Having a reasonable and accurate discussion about the benefits, drawbacks, side effects, etc. is WAY more important right now than being flagrantly incorrect in either direction.

Meanwhile this entire comment thread is about what appears to be, as fumi2026 points out in their comment, a predatory marketing play by a startup hoping to capitalize on the exact sort of anti AI sentiment that you seem to think is important... just because there is pro AI sentiment?

Naming and shaming everyday researchers based on the idea that they have let hallucinations slip into their paper all because your own AI model has decided thatit was AI so you can signal boost your product seems pretty shitty and exploitative to me, and is only viable as a product and marketing strategy because of the visceral anti AI sentiment in some places.
by MrJohz | 2026-01-23 04:29:04+00:00
I had a similar issue trying to create an Apple TV account. I already had an Apple account that I was using on my work laptop (first mistake - I should have created a work account there instead), and for 2FA, I needed to wait for a code to pop up on that laptop. It never came. There was an email alternative, but that also didn't work properly (maybe only on certain devices, IIRC?). Apparently in the settings you can request a 2FA code, though, so I did that... but that only had five digits, whereas I needed to give six for the code to work. Eventually I figured out that Apple had just forgotten to zero-pad the 2FA code out to six digits, so I needed to add a leading zero to make things work.

The worst part of this is that now my Apple TV account is linked to a laptop that I don't always have on me. And even if I did have it on me, I don't want to get a laptop out and turn it on just to do 2FA. I already have a TOTP app on my phone, just let me put everything in there and leave me be.

My experience with MacOS is generally that it's about as buggy as my home Linux setup. That's partly a testament to how solid Linux can be these days, but at the same time, it feels pretty damning considering only one of these operating systems is free (in any sense of the word). And that's not including stuff like the configurability of the whole thing.
Show HN: C/C++ Cheatsheet – a modern, practical reference for C and C++
by crazyguitar | 2026-01-23 04:29:41+00:00
Hi HN,

I’m the creator of C/C++ Cheatsheet — a modern, practical reference for both C and C++ developers. It includes concise snippet-style explanations of core language features, advanced topics like coroutines and constexpr, system programming sections, debugging tools, and useful project setups. You can explore it online at https://cppcheatsheet.com/.

I built this to help both beginners and experienced engineers quickly find clear examples and explanations without digging through fragmented blogs or outdated docs. It’s open source, regularly maintained, and contributions are welcome on GitHub.

If you’ve ever wanted a lightweight, example-focused guide to:
- Modern C++ (templates, lambdas, concepts)
- C fundamentals and memory handling
- System programming
- Debugging & profiling
…this site aims to be that resource.

Any feedback is welcome. Thank you.
by protocolture | 2026-01-23 04:29:49+00:00
some of the Rainbow 6 games, and Arma, tend to enforce carry limits much more harshly. OG Operation Flashpoint I remember being unable to stand from prone if my leg was shot. Which made it fun if I had just succeeded at something and needed to complete a mission otherwise having to replay it 100 times to get that far without the leg injury, so I would just slowly crawl 3 kilometers in the dark.
by x-complexity | 2026-01-23 04:30:31+00:00
> The CCP aspires to climb the value chain up to where the US is, which means shifting away from manufacturing to the high profit margin tech, biotech, and other science related industries.

None of that requires a strong currency, only a strong industry.

That's what the CCP has done with their own currency, by deliberately weakening it & funneling the strength into drowning the global market with their industry's products. A strong currency runs counter to that by making their products more expensive as a result.

Had the RMB continued its original trajectory (2003-2015), it would've wound up at approximately 1EUR ~= 5RMB. Instead, the CCP made the decision to weaken the RMB to maintain industrial capability, and further expand into technological ventures without abandoning the other industries they've captured before.

> That some in the US want to go down the value chain and take China's manufacturing spot just as China zooms ahead of the US, is, well... It would be comical if it weren't so sad.

1) China is able to "zoom ahead" because they have a strong industry within their own borders, buffered from the political decisions of other countries.

2) The value of the lower parts of the chain is not obligated to be lower than the upper parts of the chain.

https://www.kenan-flagler.unc.edu/news/its-okay-to-move-down...
by striking | 2026-01-23 04:31:04+00:00
I tried using XML on a lark the other day and realized that XSDs are actually somewhat load bearing. It's difficult to map data in XML to objects in your favorite programming language without the schema being known beforehand as lists of a single element are hard to distinguish from just a property of the overall object.

Maybe this is okay if you know your schema beforehand and are willing to write an XSD. My usecase relied on not knowing the schema. Despite my excitement to use a SAX-style parser, I tucked my tail between my legs and switched back to JSONL. Was I missing something?
by oxfeed65261 | 2026-01-23 04:31:04+00:00
Bret Devereaux, an historian blogger, has a long, detailed look at the economics of premodern peasant farmers and their households, called Life, Work, Death and the Peasant, starting at https://acoup.blog/2025/07/11/collections-life-work-death-an...

It begins:

“This is the first post in a series (I, II, IIIa, IIIb, IVa, IVb, IVc, IVd,IVe, V) discussing the basic contours of life – birth, marriage, labor, subsistence, death – of pre-modern peasants and their families. Prior to the industrial revolution, peasant farmers of varying types made up the overwhelming majority of people in settled societies (the sort with cities and writing). And when I say overwhelming, I mean overwhelming: we generally estimate these societies to have consisted of upwards of 80% peasant farmers, often as high as 90 or even 95%. Yet when we talk about these periods, we are often focused on aristocrats, priests, knights, warriors, kings and literate bureaucrats, the sort of folks who write to us or on smiths, masons and artists, the sort of folk whose work sometimes survives for us to see. But this series is going to be about what life was like for the great majority of people who lived in small farming households.”
by Braxton1980 | 2026-01-23 04:31:34+00:00
1. Trump has constantly stated how he believes the US has spent money and lives doing things for the rest of the world. He just did it with Canada this week saying "Canada exists because of the US'.

2. The majority of his followers have some level of cult like adoration for him and therefore he isn't worried about losing support for radical actions.

3. Republican voters have been told to not trust the experts, news, or the opposing political party which eliminates all outside sources of information. This allows them to make claims about our debt or why we shouldn't pay it and many of these voters won't get opposing views.

4. Trump wants a massive increase in spending for the military and has cut taxes. While at the same time Republicans ran on the high debt. Not paying it by claiming it's invalid solves that.
by throwup238 | 2026-01-23 04:31:43+00:00
You’re absolutely right! If Fastmail or 1password charged more for their services, the bar for what I consider good value would be different. Those two services are _absolutely_ worth more to me than they currently charge and I’d be happy to pay.

But they don’t, which is why I use them as my baseline. If my email provider and password manager - two services with damn near infinite vendor lockin - can do it, no one has any excuse.
by dfajgljsldkjag | 2026-01-23 04:32:47+00:00
Yeah, I'd imagine you could point claude code at the github and it'll do just as good or better, for a much cheaper price.

> A simple delay could cost $1.00 or $2.00, whereas a complex granular looper might cost up to $5.00.

These prices don't seem reasonable unless there's some really special sauce in their ai.
by memothon | 2026-01-23 04:33:36+00:00
Turso offers a cloud-hosted sqlite product. The idea is you can easily spin up per-tenant databases and have a "serverless" sqlite interface.

It feels like it has a lot of the same downsides of hosted databases so I'm not sure what the specific value is.

From their site they really emphasize local first syncing (so mobile apps and electron/tauri apps) and multi tenancy (hard database boundaries)
by protocolture | 2026-01-23 04:33:39+00:00
The article had some ideas on how to improve games without detracting from them?

Like using a free form road builder like modern city building games use is neither unfeasible or unfun?

Preplanning a settlement is also something that is done in modern city builders, zoning areas for different use?

Taxes dont seem to be difficult to implement either.

Article seems more reasonable than the reaction. And its probably not going to go unnoticed by people playing in the genre.
by nwatson | 2026-01-23 04:33:40+00:00
Self-hosted might be the way to go soon. I'm getting 2x Olares One boxes, each with an RTX 5090 GPU (NVIDIA 24GB VRAM), and a built-in ecosystem of AI apps, many of which should be useful, and Kubernetes + Docker will let me deploy whatever else I want. Presumably I will manage to host a good coding model and use Claude Code as the framework (or some other). There will be many good options out there soon.
by ivoryweb | 2026-01-23 04:35:01+00:00
This framing resonates more than most SOC 2 discussions I’ve seen. The confusion isn’t really about controls — it’s about not knowing what order things are supposed to exist in.
What you said about everything feeling reactive once tools and auditors enter the picture really hits. It feels like people are forced to “pick a lane” before they even understand what the lanes are, so every decision compounds uncertainty instead of reducing it.
I’ve noticed that most early teams don’t lack effort or intent — they lack a clear mental model for readiness. Without that, it’s impossible to tell whether you’re preparing, over-preparing, or just creating artifacts that won’t survive contact with an audit anyway.
The hardest part seems to be that none of this is obvious upfront. You only realize what you should’ve done earlier after you’ve already paid for tools, consultants, or rewrites. By then, everything feels heavier and more expensive than it needed to be.
Genuinely curious — before SOC 2 became a deadline, what signals would have helped you realize you weren’t “ready” yet, instead of just “behind
by binarysolo | 2026-01-23 04:35:14+00:00
For my product niche, Amazon has (many) more buyers at my pricepoint and value prop (moderately well-designed kitchen gadgets at a price point between your run-on-the-mill gadget and OXO).

Maybe I also know how to SEO better on Amazon vs Walmart, but not sure! ¯\(°_o)/¯
by 0xbadcafebee | 2026-01-23 04:35:19+00:00
There's no way to know in advance if some leaked cleartext will provide enough information to an attacker to be useful. Attackers profit from making creative use of information they didn't have before.

That said, plenty of people disable the most useful security features of SSH, like verifying host key signatures, with no ill-effects (as far as they know). For the majority of users, using Telnet and unencrypted HTTP would make no difference, as nobody's trying to hack them, and who really cares about privacy anyway?

Did you know SSH has long-standing performance limitations due to its design that need patches to eliminate? It was never intended to be a high-performance tool. If you want really high performance, use Telnet. If you want real security, use SSH with all strong security options enabled plus a server using ContainerSSH with the OAuth2 plugin (SSH's keys are static, which can be captured and reused, which is bad). If you don't care either way, use SSH with the defaults.
by SkyPuncher | 2026-01-23 04:35:35+00:00
> The credit card icon doesn't change the credit card

Ha. I thought I was the only one who's cursed this every single time I need to change payment (which is often)

> You just wanted to move the cursor. Now everything is selected.

Holding the space bar is your friend on this one. I recently learned, holding two fingers will move with selecting.
by themafia | 2026-01-23 04:37:12+00:00
If you can process drugs and get high in prison then you're not actually in any form of custody. You're just left to your own devices in an unsupervised locked box. It's not hard to figure out why our recidivism rate is so embarrassing.

Anyways, I'm sure this will /completely/ prevent drugs from getting in, so I guess that justifies the destruction of prisoner rights?
by appplication | 2026-01-23 04:37:14+00:00
This is missing the most annoying one for me: when I type a search term into safari and it randomly interprets it as an address that it can’t resolve. E.g. “how to bake cookies” gets resolved to how%20to%20bake%20cookies (which safari tries to resolve via DNS or whatever instead of piping it to the search provider). Even better, it’s entirely nondeterministic, though it does seem to be due to some race condition with whatever determines whether it’s a search or a url, and is more likely to happen when typing quickly.

I’d say it happens about 10% of the time I type anything in the search bar. It’s incredibly annoying. Without getting into too much detail, but I confirmed they’re tracking it internally too for close to a decade and are intentionally choosing not to prioritize.
by nonethewiser | 2026-01-23 04:37:38+00:00
I think its great.

They explicitly distinguish between a "flawed citation" (missing author, typo in title) and a hallucination (completely fabricated journal, fake DOI, nonexistent authors). You can literally click through and verify each one yourself. If you think they're wrong about a specific example, point it out. It doesn't matter if these are honest mistakes or not - they should be highlighted and you should be happy to have a tool that can find them before you publish.

It's ridiculous to call it doxxing. The papers are already published at NeurIPS with author names attached. GPTZero isn't revealing anything that wasn't already public. They are pointing out what they think are hallucinations which everyone can judge for themselves.

It might even be terrible at detecting things. Which actually, I do not think is the case after reading the article. But even so, if they are, I think the problem takes care of itself.
by thayne | 2026-01-23 04:38:38+00:00
> I doubt it is something that the founding fathers of Free Software/Open Source had in mind.

From the beginning, GNU projects welcomed contributions, and discussions of bugs and features were in the public. Sure it was on mailing lists, not on Github, but it was more than just shipping sources with the binaries.

That isn't to say you have to accept third party pull requests and have an open bug tracker to be free software/open source. Sqlite is a famous example that doesn't follow that model.
by MrJohz | 2026-01-23 04:38:44+00:00
If we're doing "features": password fields with no option to view the plaintext value? I use long passwords, and if I'm in a safe place, I would much rather see what I'm typing and correct any typos I make along the way than have to retype the same password multiple times with long delays between each attempt.

Also, once a day my Touch ID stops working and I need to log in with my password again. That's fine, the passwordless access expires after 24 hours or so, fair enough. But I turn my laptop on fresh every morning and have to also put my password in then. If I do that, I at least expect to be and to use my fingerprint until the end of the day.
by oenton | 2026-01-23 04:39:23+00:00
For what it's worth, I absolutely agree with the comments saying the warning doesn't clearly communicate the risks. I too had no idea opening a directory in VS Code (that contains a tasks.json file) could cause some code to execute. I understood the risk of extensions but I think that's different, right? i.e. opening a trusted project doesn't automatically install extensions when there's an extensions.json (don't quote me on that, unless that's correct)

To give some perspective: VS Code isn't my primary IDE, it's more like my browsing IDE. I use it to skim a repo or make minor edits, without waiting for IntelliJ to index the world and initialize an obscene number of plugins I apparently have installed by default. Think—fixing a broken build. If I'm only tweaking or reinstalling dependencies because the package-lock file got corrupted and that's totally not something that happened this week, I don't need all the bells and whistles. Actually I want less because restarting the TypeScript service multiple times is painful, even on a high end Mac.

Anyway enough about IntelliJ. This post has some good discussions and I sincerely hope that you (well, and Microsoft) take this feedback seriously and do something about it. I imagine that's hard, as opposed to say <improving some metric collected by telemetry and fed into a dashboard somewhere>, but this is what matters. Remember what Steve Ballmer said about UAC? I don't know if he said anything, but if it didn't work then it's not going to work now.
by mkozlows | 2026-01-23 04:39:43+00:00
This is performance art, right? The very first bullet point it starts with is extolling the merits of XSD. Even back in the day when XML was huge, XSD was widely recognized as a monstrosity and a boondoggle -- the real XMLheads were trying to make RELAX NG happen, but XSD got jammed through because it was needed for all those monstrous WS-* specs.

XML did some good things for its day, but no, we abandoned it for very good reasons.
by throwup238 | 2026-01-23 04:40:03+00:00
> What you've discovered is that prices are all made up. If we think about how to price a product, say a chair, from first principles, you'd take the cost of the raw materials, the time it takes you to turn those raw materials into the finished product, add a %age profit on top, and call it a day. In the real world though, that's not how pricing things works. You have a product, which costs $X in raw materials, and then you just... make up a number, $Y. Hopefully, $Y is much greater than $X, and you're able to make a great living off selling your chairs. Maybe you're called Eames and people will pay you $5,500 for your chair/lounger, maybe you're Office Depot and sell them for $129. Maybe you're not very good at chairs, so they're not level and then you can't give them away, not even to your friends.

That's not at all how I think products are priced. That sound's like something you'd tell a kindergartner to shut them up.

> You can optimize for value, but then you'll find yourself in Walmart at 1am realizing that the 3-pack is cheaper per-roll than the 30-pack that night for some reason, and getting angry over that.

I have never found myself in a Walmart at 1am nor have I ever gotten angry at toilet paper (I get the Charmin ultra from Costco like a normal person). You need to re-calibrate because you sound like an Inland Empire methhead. Pro tip: you want to shoplift the detergent. That tends to trade better with the other methheads.
by dfxm12 | 2026-01-23 04:41:10+00:00
Yeah, I think when making a game, in general, fun is the first thing to consider. All these games are lumped into the article as "city builders", but Age of Empires and Sim City are completely different genres, just as one example.

I expect an RTS game like Age of Empires to be balanced for competitiveness rather than realism.

Sim City 2000 at least markets itself as a simulation game, which I'd expect to be more realistic in terms of city building. For better or worse, though, the simulation seems rather simplistic, which could lead to unrealistic city designs or confusion around why the Sims don't want to drive over the fancy highway bridge I just spent $5000 on...
by jandrewrogers | 2026-01-23 04:41:20+00:00
There is an entire area of math about the uncertainty of decision correctness in incomplete information scenarios. One of the neat aspects of it is that all computable optimal decision makers are mechanically exploitable if you have a reasonably accurate model of their finiteness. In the case of human minds, that just means they are a lot like you. The exploits require iterated games and are cognitively difficult (you have to track a lot of state).

Anecdotally, in my poker playing days I had a lot of success by attacking quasi-optimal play this way. Optimality is contextual. You can engineer a context that motivates suboptimal decisions in fact, though it isn’t easy.

However, at the limit, this is really just attacking the cognitive facilities of your opponents rather than the math of the game. Someone that with a similar ability to manipulate large amounts of state mentally could nullify the advantage. It is meta-games all the way down.
by cthalupa | 2026-01-23 04:42:43+00:00
Artists were saying this even before streaming, though, much less AI.

I listen pretty exclusively to metal, and a huge chunk of that is bands that are very small. I go to shows where they headliners stick around at the bar and chat with people. Not saying this to be a hipster - I listen to plenty of "mainstream" stuff too - but to show that it's hard to get smaller than this when it comes to people wanting to make a living making music.

None of them made any money off of Spotify or whatever before AI. They probably don't notice a difference, because they never paid attention to the "revenue" there either.

But they do pay attention to Bandcamp. Because Bandcamp has given them more ability to make money off the actual sale of music than they've had in their history - they don't need to rely on a record deal with a big label. They don't need to hope that the small label can somehow get their name out there.

For some genres, some bands, it's more viable than ever before to make a living. For others, yeah, it's getting harder and harder.
by doanbactam | 2026-01-23 04:43:16+00:00
We switched our main API from Postgres to Turso last month and haven't looked back. The automatic schema migrations are a nice touch, but I wish the documentation on vector embeddings was a bit more robust. It's wild how much of the modern web is moving back to file-based databases. We switched our main API from Postgres to Turso last month and the cold start times are basically zero now. Are there any plans to support vector columns soon, or is that strictly off-roadmap for now?