MurphyA/hacker-news huggingface dataset:
by reincarnate0x14 | 2026-01-14 16:24:57+00:00
Even slightly higher barriers greatly reduces attempts, and the developers have much more practice at it. Rootkits and such for unix/linux have been around forever, but with VMs and containers getting recycled and such and long term expectations around impermanence and thus programmatically recreated and verifiable configurations, it's a lot harder to get something to stick without being found.

On top of that is the user interactivity model and software distribution model. For most non-admins the various protection schemes on Windows are a choice between "use my computer" and "don't use my computer" and thus basically meaningless. Plus there are fewer centrally managed repos because so much Windows software is hostile to being managed that way and large companies all have to build their own, and small organizations generally give up trying. Quick, hands-off integrity checks on linux can happen in the background and generally won't explode things.

Logging is a factor too. Windows logging tends to be "nothing" or "tsunami" with not a lot in between, and when log monitoring solutions charge by volume and analysts have to comb through oceans of noise to identify potentially dangerous activity, the end result is much less effective watchdogs. I've seen a lot of "Windows -> low cost log monitor doing filtering -> high cost log monitor that people actually look at" due to this, which is obviously harder to manage and less effective.

Most of this can be made the case for Windows, of course, but often isn't because getting Windows into a desired state is such a pain in the ass that it trains people into the "don't touch it, it's working!" mindset. Microsoft was making real strides towards this 20 years ago but their current product management has been security counterproductive IMHO. Doing things in the OS that look a lot like malware turns out to not be a good idea.

When we were developing attacks for unix environments it was often easier to go after the application deployment or CI chains than try to root the box unless there was a juicy SSHD or bash or whatever bug, which have been highly publicized are usually rapidly fixed without needing major effort from endpoint managers.
by TheusHen | 2026-01-14 16:25:05+00:00
Absolutely agreed — and this is an important distinction.

IPv6 gives you global addressability, not guaranteed reachability. Stateful firewalls still exist and inbound-by-default is still rare on consumer networks.

The I6P design explicitly assumes that reality. The motivation for being IPv6-first is not “firewalls disappear”, but that the problem space collapses from many forms of NAT and address/port translation down to mostly predictable stateful filtering.

That’s also why the transport is QUIC/UDP: firewall behavior is far more consistent, hole punching is simpler, and path changes are survivable.

So IPv6 isn’t treated as magic — it’s treated as a cleaner substrate with fewer pathological cases than IPv4 NAT.
by tracker1 | 2026-01-14 16:25:27+00:00
I tend to have most of my workflows setup as scripts that can run locally in a _scripts diorectory, I've also started to lean on Deno if I need anything more complex than I'm comfortable with in bash (even bash in windows) or powershell, since it executes .ts directly and can refer directly to modules/repos without a separate install step.

This may also leverage docker (compose) to build/run different services depending on the stage of action. Sometimes also creating "builder" containers that will have a mount point for src and output to build and output the project in different OSes, etc. Docker + QEMU allows for some nice cross-compile options.

The less I rely on Github Actions environment the happier I am... the main points of use are checkout, deno runtime, release please and uploading assets in a release.

It sucks that the process is less connected and slow, but ensuring as much as reasonable can run locally goes a very long way.
by fzeroracer | 2026-01-14 16:25:47+00:00
I live in Seattle and I've seen multiple large protests around the ICE murder of Renee Good. Part of the problem is that the US is too large as the people responsible for the jackbooted thugs kicking in doors and killing citizens are on the other side of the country. Business in Minneapolis is practically grinding to a halt as stores and businesses close their door out of fear.

I think we're one or two bad incidents away from wide-scale rioting.
by qcnguy | 2026-01-14 16:25:51+00:00
The BLM movement hasn't suffered any hardships. They were the opposite of cancelled: BLM were donated over $90M.

(they embezzled large parts of it. one of them just got charged with wire fraud and money laundering https://www.justice.gov/usao-wdok/pr/executive-director-blac...)
by mbreese | 2026-01-14 16:25:53+00:00
I would rather they published nothing. There is no need to make any of this public. Just stop selling Adafruit products and stop selling to Adafruit. If anyone asks, then you can say "we don't do business with them any longer". The public doesn't need the rationale.

That's it. Everything else is dragging the community/customers into a fight that they didn't ask for.
by gopkarthik | 2026-01-14 16:26:11+00:00
Alphabet Inc.’s Google said its Gemini artificial intelligence assistant can now proactively tap into users’ data across Gmail, Search, Photos and YouTube, an attempt to make its consumer-facing AI product more personalized.

Google has made Personal Intelligence an opt-in experience, meaning users must choose to turn it on — and they can choose which apps are connected to Gemini. For example, you could set it up to ignore your search history but factor in your email, photo library and YouTube viewing history.
by naravara | 2026-01-14 16:26:13+00:00
> Unless this was in the early 2010s the email provider was probably using TLS

It was the mid 2010s yes.

And they’re not going to abduct and torture and American citizen out of the blue. The more “intensive” methods are higher cost, the intention is just to increase the friction involved with engaging in the routine and scalable, ordinary forms of snooping.
by ynac | 2026-01-14 16:26:27+00:00
I'm down to just a few sweat shirts and over shirts from the 80s, but they are hanging in there. Both the colors and the fabric. When the subject comes up with friends who ask about a particular shirt I joke, "The cotton was tougher back then". Recently, I've had jeans, shirts, and even socks that didn't make it through a single summer.

Is anyone else freaked out about cleaning their dryer's lint filter given all the new fabric materials? I'm putting together a dryer-vac system to keep it from billowing into the air of our small laundry room.
by gregors | 2026-01-14 16:26:34+00:00
I suspect you've also had zero reason to use the vast majority of programming languages at work in any meaningful capacity outside of the normal top ones. That's normally how tech decisions work. That certainly doesn't negate the possible benefits of other languages.

Others use Erlang and Elixir quite effectively and successfully in several billion dollar businesses apart from nerd aspects. It will be interesting to me personally if Gleam also has its day in the sun.
by BryantD | 2026-01-14 16:26:41+00:00
Sorry to be a pedant, but not exactly. They raided James O'Keefe's house to seize his cell phones as part of an investigation into potential conspiracy to traffic stolen goods (the diary) across state lines. Journalists (which is a very broad term, and in this context I think O'Keefe qualifies) are certainly allowed to receive stolen or classified material, which also applies to the raid on the WaPo reporter. They are not allowed to induce others to break the law on their behalf, and that's what was at question in the Biden diary case.

I don't think the O'Keefe raid was justified and it's certainly the first step on a slippery slope. I also think the current situation is a worse violation of norms.
by moduspol | 2026-01-14 16:26:52+00:00
Once you get beyond shell, make, docker (and similar), dependencies become relevant. At my current employer, we're mostly in TypeScript, which means you've got NPM dependencies, the NodeJS version, and operating system differences that you're fighting with. Now anyone running your build and tests (including your CI environment) needs to be able to set all those things up and keep them in working shape. For us, that includes different projects requiring different NodeJS versions.

Meanwhile, if you can stick to the very basics, you can do anything more involved inside a container, where you can be confident that you, your CI environment, and even your less tech-savvy coworkers can all be using the exact same dependencies and execution environment. It eliminates entire classes of build and testing errors.
by jovial_cavalier | 2026-01-14 16:26:53+00:00
1) They did not hit stable. GKH is referring, in this email, to a legitimate attempt to contribute from a student at UMN. Whether or not this student was part of the hypocrite commits study, I don't know. But it's not a hypocrite commit, just a normal buggy commit. You can tell, because it's from a umn.edu email address, which they did not use for hypocrite commits.

2) I don't actually care about the internal policies of UMN's IRB. Whether or not the study's approval was proper and whether they would get into trouble with their boss is not my problem. The point is that what they did is obviously not immoral or unethical.
by user070223 | 2026-01-14 16:27:20+00:00
Her logic seems reasonable but stating that the fibers "return to their original crinkled state" is missing the fact that the fiber go through the process of spinning to improve tensile strength (as well as the options of making an infinite yarn from finite fibers by twisting them together). regardless to return to original "crinckled state" they need to overcome those forces as well as the forces of the geometry of the knit(on a different scale).

BTW Rayon is also made from cellulose, cellulose II. While Cellulose I(natural) is metastable it can be converted by disolving in lye to a stable form (beta-gllocouse molecolue chain goes from being parallel to being anti parllel which increases the # of hydrogen bonds as well as helping create a more stable 3d structure) which again improve tensile strength and resist wrinkles on a different scale.
by alimbada | 2026-01-14 16:27:29+00:00
So I cleared out one of my SSDs and installed Fedora yesterday.

I still had the issue of no gamepad detection. I had to install xone which took some trial and error. Firstly, I didn't have dkms installed and secondly, soon after installing Fedora the kernel was updated in the background and on reboot my display resolution was fixed to 1024x768 or something for some reason (that's gonna be another issue I'll have to look into). I rebooted and went back to the previous version and then dkms complained the kernel-headers were missing. However, the kernel-headers were installed for the latest kernel but not the older version I had rebooted to. I'm not used to Fedora or dnf (I run Proxmox+Debian in my homelab) so after a quick search to figure out how to install a specific version of a package (it's not as simple as <package>@<version> but rather <package>-<version>.fc$FEDORA_VERSION.$ARCHITECTURE) I got kernel-devel installed and was able to finally run the xone install script successfully and have my gamepad detected.

The most frustrating thing is that the xone install script doesn't fail despite errors from dkms so after the first install (where I almost gave up because I thought something was wrong with my setup) I had to run the uninstall script each time there was a problem and then run it again. The xone docs also mention running a secondary script which doesn't actually exist until the first script runs successfully so that added a lot of confusion.
by Incipient | 2026-01-14 16:27:36+00:00
I absolutely think AI will be/has been comoditised. The real value is in integrations and being able to draw in the right context, cleanly, to get the right outputs.

This is something where Google, Microsoft, and Apple, will really be able to dominate. Lots of businesses I've seen have already been using copilot for asking questions about their entire sharepoint library. The underlying model I expect could quite easily be gpt5, Claude, or even DS R1 without anyone really caring or noticing.
by bagacrap | 2026-01-14 16:27:43+00:00
See for some, "over time" means "the next guy's problem". That is true before LLMs of course. And that's even the prevailing school of thought in most organizations. And to some extent it is correct to accept some tech debt because otherwise you'll never get anything done.

For those who have been around a while, dealing with the "over time" of yesteryear is a daily occurrence. So naturally they are more averse to it. And LLMs seem to dramatically shorten the duration of "over time".
by az09mugen | 2026-01-14 16:28:02+00:00
That's a nice thing, but I have a few remarks/questions.

"the International Astronomical Union adopted a broad framework calling for the moon to have its own time reference."

I wonder how the "01/01/1970 00:00:00"-for-the-moon will be decided. I hope also there won't be

Also, and even if apparently the moon won't be considered as a supplementary set of timezones (thank god no [0]), there will have to be a kind of correspondence with the earth GMT/UTC. And will there have to be a lunar calendar ? There are not so many days in a terrestrial year than on the moon IIRC.I don't quite get the whole picture, but it's interesting.

0. https://www.youtube.com/watch?v=-5wpm-gesOY
by hamburglar | 2026-01-14 16:28:05+00:00
As an uninformed observer, here is a possible sequence of events that sounds somewhat plausible based on what we know so far:

* sparkfun employee engages in some shitty behavior (maybe harassment, maybe photoshops) toward adafruit CEO
* adafruit engages sparkfun to ask them to put a stop to it
* employee leaves sparkfun
* employee continues shitty behavior
* adafruit continues to bug sparkfun about behavior
* sparkfun now has no control over employee, wants to wash their hands of it
* adafruit isn’t happy with this resolution, continues to push it, interprets inaction as tacit approval
* sparkfun cites CoC about private matters, inappropriate messages
* HN speculates :)
by mothballed | 2026-01-14 16:28:54+00:00
Well of course, Greenland is a massive welfare drain, trying to forcibly take it when you already get to use it for defense is would be like marrying the $20 hooker for the 'free' services. You wouldn't buy the cow when you already get the milk cheaper than the farmer.

The reason Trump wants Denmark is for vanity purposes.

If Denmark actually can shitcan the place while making it look like a victory they would definitely do it. Although the only way I think they can pull that off is by convincing Greenland to become independent and then the US swooping in when Greenland realizes their free money hydrant has turned off and they need a new sugar daddy because all those minerals they're sitting on aren't actually worth a dime unless someone is dumb enough to try and use them in one of the most hostile inhabited environments on earth to mine them.
by troupo | 2026-01-14 16:28:58+00:00
> if you insist I'll refrain from speculating why you're so obsessed with defending a megacorporation and insisting they deserve the benefit of doubt

I'm pointing out unsubstantiated claims, often to people who don't know jack shit about music industry (e.g. that's why almost every comment in this thread has a variation of "Spotify doesn't pay artists, Spotify pays rights holders")

Note how you still haven't said anything of substance except emotions and ad hominems. But sure, your position is correct and valid, and not mine.
by efields | 2026-01-14 16:29:24+00:00
Wow: the Sinclair ZX81 launched in the UK in 1981 for around £49.95 as a kit (£50) and £69.95 assembled, making it incredibly cheap, and later in the US as the Timex Sinclair 1000 for $99.95 (kit) or $149.95 (assembled)

Cheap for a 1980s computer, now pennies. Wild.
by vablings | 2026-01-14 16:29:31+00:00
40 RA, my mum used to drive a Vauxhall Carlton

> Additionally Britain generally has a problem with politicians believing that the only solution to a problem is banning/regulating things, regardless what the root cause might be. Banning/regulating something requires new legal powers. So more laws.

I mean it's true and it does work for the most part. The bans on knives, drain cleaner etc have reduced the number of these kinds of crimes especially in London. It's hard to argue against something when a lot of this kind of policymaking is effective
by bloppe | 2026-01-14 16:29:38+00:00
I don't think LLMs are an abject failure, but I find it equally odd that so many people think that transformer-based LLMs can be incrementally improved to perfection. It seems pretty obvious to me now that we're not gonna RLHF our way out of hallucinations. We'll probably need a few more fundamental architecture breakthroughs to do that.
Show HN: Interactive Timeline of US Legislation (1975–Present)
by itta_e_ta | 2026-01-14 16:30:00+00:00
Hey all,

This is a project I’ve been working on over the last year.

In addition to combining data from multiple federal sources into a single UI, I built a 2,500+ rule regex-based parser / pseudo state machine that classifies every legislative action into discrete states and stages. This makes it possible to generate a day-by-day timeline of what happened to every bill over the last 50 years, and a graph showing how many (and which) bills occupy each major legislative state at any point in time. In total, 1,555,069 actions are parsed into 1,157 unique enums across 41 stages.

I also fully re-parsed the official bill text XML into a modern format and recreated the large bill-text XLS styling system in CSS, which dramatically improves load times and (to my knowledge) is the first near-complete recreation of that XLS styling in CSS.

Hope you find it interesting :)
Show HN: An async bulkhead for Java with explicit overload semantics
by janbalangue | 2026-01-14 16:30:09+00:00
I’ve been working on a small, design-first async bulkhead for Java.

It focuses strictly on admission control:
– bounds in-flight async operations
– fails fast under saturation
– never queues or waits
– defines permit lifetime explicitly (admitted → terminal)

v0.3.1 is a small patch release that fixes cancellation classification in observability (wrapped CancellationException is now reported as CANCELLED), without changing runtime behavior.

I’m interested in feedback from people who’ve dealt with overload, fan-out amplification, or unclear async semantics in Java systems.
by rayiner | 2026-01-14 16:30:16+00:00
She likes babies. I've raised my kids around WASP liberals because I want to socialize my kids to be orderly, but there's a definite baby shortage in that circle. Also, a lot more guilt and less people having fun than at a southern state school football game. It’s a lot closer to a big Indian wedding (which she also likes for some reason) than anything you find among the Annapolis yacht club circle.

I don’t have a view on where she goes to college—we just had a good season and I wanted to take her to a game. If I had a choice, maybe I’d want her to go to Oxford or Cambridge.
by irishcoffee | 2026-01-14 16:30:37+00:00
> It’s frequently not illegal to talk to a reporter. Let’s not kid ourselves, this isn’t about classified material it’s about loyalty, so watch what happens to sources that didn’t do anything illegal.

It is not illegal to talk to a reporter, it is illegal to share classified intel with someone who doesn't have a clearance and a need-to-know.

Do I think they should have raided this persons house? Absolutely not. Is it illegal to share classified information, absolutely.

"For my friends everything, for everyone else, the law" or whatever the saying is, applies here. In this case, the reporter did nothing wrong, but the raid on the home of the reporter can be justified according to the law, so it isn't illegal. Should it be? Probably.

Legislation is good, rules are good, the classified rules seems to make sense if you subscribe to Hanlons Razor at the least. Sometimes though, laws just don't make sense and shouldn't be codified.

For example:

MCL 750.335 - "Any man or woman, not being married to each other, who lewdly and lasciviously associates and cohabits together, and any man or woman, married or unmarried, who is guilty of open and gross lewdness and lascivious behavior, is guilty of a misdemeanor punishable by imprisonment for not more than 1 year, or a fine of not more than $1,000.00."

This shouldn't be a law.
by Stefan-H | 2026-01-14 16:30:41+00:00
The point of measured environments like the TEE is that you are able to make guarantees about all the software that is running in the environment (verified with the attestation). "If the software can modify data legitimately, it can be tampered with." - the software that makes up the SBOM for these environments do not expose administrator functions to access the decrypted data.
by grhmc | 2026-01-14 16:31:00+00:00
Hey y'all, I'm Graham the CEO of DetSys. Determinate Secure Packages has been a huge effort we've made to help customers in the national security, medical, aerospace, etc. industries more comfortable using Nix in their workflows.

In pretty much every Nix consulting gig I’ve ever had, I’ve been asked something like "well, what about security patching?" This has been a high priority goal since I started Determinate Systems. We just had to build a lot of infrastructure and maturity as a company to make it feasible :).

Anyway, if you have any questions I'd be glad to answer. Thanks!
by jovial_cavalier | 2026-01-14 16:31:02+00:00
See another comment I made in this thread about GKH's response - the UMN group submitted a handful of small patches as part of this study, and "wasted" probably a handful of man hours or at worst a few man days of maintainer time. I don't really consider it a waste because evidence that critical open source infrastructure doesn't bother to run static analysis before merging code from randos is actually useful information that the public deserves to have.

GKH's response was to waste man weeks or man months of maintainer time persecuting every last commit that happened to come from umn.edu, despite having zero reason to believe these commits were more suspect than any other institution's commits.
by kristintynski | 2026-01-14 16:31:14+00:00
Most systems that try to reference themselves across time, scale, destroy themselves.

The failure modes are boringly consistent:

runaway growth

collapse

phase drift / incoherence

What’s unusual is not that systems fail.
It’s that any survive at all.

The document is an attempt to characterize the survivors.

When you formalize “recursive self-reference without accumulating error,” you get a hard constraint on scale ratios. In the simplest nontrivial case:

λ² = λ + 1

with φ as the only positive fixed point.

I’m not claiming this is a new law, and I’m not appealing to aesthetics, biology, or teleology. This is a structural claim:

recursive systems are extremely fragile, and only a narrow class avoids blowing up, collapsing, or decohering.

The note shows the same constraint and the same failure modes appearing in places that normally don’t talk to each other: fixed points, fluid modes, learning systems, biological loops, and self-models.

If this is wrong, it should be easy to falsify.

A single counterexample — a recursively self-referential system that’s provably stable outside this constraint — would break the entire framing.

I haven’t found one yet.
by fuzzfactor | 2026-01-14 16:31:39+00:00
I say it's the dryer too, more than the washer for a lot of fabrics.

You just have to figure with all that dryer lint after every single load that your items certainly aren't getting any bigger after giving off all those grams of fiber.

You can only imagine whether or not more or less fiber than that is being lost down the drain with your wash water each time.