MurphyA/hacker-news huggingface dataset:
by opoka | 2026-01-28 23:45:50+00:00
Hi HN. We analyzed 1,374 CVEs across MySQL, PostgreSQL, MariaDB, MongoDB, and SQLite.

Key findings:

- Interface Hazards (design-transferred risks) outnumber Implementation Defects 3:1
- 79% of SQL injection occurs downstream of the database engine
- ORMs—built specifically to fix this—still fail at 88%

The formal proof (Section 1.1) shows string concatenation is non-composable with parsing. Injection isn't a bug to patch; it's a mathematical property of the interface.

Section 1.2 makes the comparison to W^X: operating systems enforce code/data separation at the hardware level. Databases violate it at the application level. We regressed.

Full methodology is auditable via API. Data and code in the repo.

Happy to answer questions.
by gerdesj | 2026-01-28 23:45:55+00:00
"I have a Windows 11 workstation ... There's no lag with context menus or browsing directories with a lot of files."

You have the same Windows updates as everyone else and it will be painful. Also you should be keeping those CAD and games up to date and that will be very painful. Updates often happen at unfortunate times.

The Win 11 start menu has managed to be worse than the Win 10 effort and jumped to the middle of the task bar because ... reasons. Search on it is ever so slow. For some reason Win server 2025 has decided that I want to use a welsh keyboard (I'm english and tend to en_GB) when I RDP to one. Cymraeg (soz if I got "welsh" wrong) is alphabetically first in the en_GB list of keyboard mappings and I didn't even know there is a welsh keyboard! I suppose they must have some accents and diacritics not found in english. Its all just a bit weird that a bug like that surfaces after well over two decades of me using RDP from a Linux box to a Windows server.

You wag your finger at endpoint management in the same way that most software vendors used to do at AV back in the 90s and 00s (and 10s and 20s!) Its nothing new and basically bollocks! Modern AV is very good at being mostly asynchronous these days and besides, we have unimaginably faster machines these days and very fast CPU, gobs of RAM and SSDs. Copy a multi GB file and yes AV will take a while but at least you might be saved from nasties.

There is a good reason that corp devices have to run things like inventory agents, log shippers and the rest too - its about security. You doing your own IT security is fine and I'm sure you'll be fine.

You can get Win 11 to work on an old machine for now but as you say, you have to circumvent things. When you do that, I think you are storing up issues for later. Perhaps you will be lucky but perhaps not. My dad will soon be rocking Linux instead of blowing a grand+ on a new PC. He will get a secure booting Ubuntu based effort that looks quite similar to Win 11 that is fully supported by the vendor ... and me. I managed to "port" my wife some years ago and she is a much tougher proposition than my dad!
by observationist | 2026-01-28 23:45:59+00:00
```During development of the RSDB, we noted significant enough performance gains from it that we decided to integrate it during phase 3 of the Trinity Large training run instead of waiting for a later training run. While the
data distributions between phase 2 and phase 3 make direct comparison difficult, the overall effect was notable: BatchHet reduced by a factor of 4.23x, and step-to-step variance reduced by a factor of 2.4x (see Figure 1), a significant improvement when compared to the default packing strategy. We note that training runs without the RSDB exhibit much higher values in the higher-order moments of the running loss distribution, which we believe to correlate with network instability during training.
```

Page 9 of the technical report has more details, but it looks like they found some data prep methods as well as some other optimizations that overall worked out really well. I don't think it was any one particular thing.

As far as Llama 4 goes, it was only referenced as a similarly sized model, they called it one of their model "peers"; I don't think they intended any sort of quality comparison. Llama 4 was notable for sparsity, despite its poor performance and reception, some of the things they achieved technically were solid, useful research.
by jib6671 | 2026-01-28 23:46:01+00:00
From haladir.com, we do legacy mainframe modernization using formal methods, property-based testing, and other stuff. We open-sourced MOBOL, a Python SDK for automating interaction with mainframe environments running on UniKix COBOL systems. It enables programmatic testing and automation of CICS transactions on AWS EC2-hosted instances. Running COBOL is extremely difficult, so we made this to make it a bit easier. If anyone works in COBOL, or legacy systems, reach out, we'd love to talk.
by picklepixel | 2026-01-28 23:46:06+00:00
I pay for Netflix Premium but was stuck at 1080p. Turns out Netflix layers multiple capability checks before serving 4K: user agent, screen resolution, Media Capabilities API, codec support, DRM robustness negotiation, and their Cadmium player's internal bitrate caps.

Built an extension that spoofs all of these. The interesting discovery: you have to intercept every layer. Miss one and you're back to 1080p.

Here's the catch though. Even with all the JavaScript spoofs working, Chrome still won't get 4K. Netflix requires Widevine L1 (hardware DRM), and Chrome only has L3 (software). The browser literally can't negotiate the security level Netflix wants. Edge on Windows has L1, so the extension actually delivers 4K there.

So what's the point on Chrome? Honestly, not much for 4K specifically. But the reverse-engineering was the interesting part. Understanding how Netflix fingerprints devices and decides what quality to serve. The codebase documents all the APIs they check.

On Edge: works reliably, getting 3840x2160 at 15000+ kbps.
On Chrome: spoofs work, DRM negotiation fails, stuck at 1080p.

The repo has detailed documentation on what each spoof does and why. Happy to discuss the technical approach or answer questions.
by dukeyukey | 2026-01-28 23:46:12+00:00
> But it isn't true. For the rest of the world SV is still the place to go to, one way or another.

We are using different meanings for the same phrase. SV is the best place to raise, IF YOU CAN AND ARE WILLING TO RAISE THERE. But not everyone can, nor does everyone want to. And of the locations that are not in the US, London dominates.

And hell, Americans raise in Boston, Seattle, NYC, and so on. Not even all Americans move to SV, let alone people who may not even get a visa to enter the US.
by Terr_ | 2026-01-28 23:46:14+00:00
In terms of things I'd say to encourage someone to play without spoilers, I think I'd focus on mechanics, like:

1. The game has depth to its locations that shows up on repeated visits. Expect to return with better tools/information to see new things. Shortcuts will reveal themselves over time.

2. There is an in-game tool that takes notes for you, hints at undiscovered content, and can provide on-screen waypoints to help you navigate.

3. Don't be too worried about your (avatar's) personal safety, or about rushing. Later there may be times where both might matter for your goals, but the game is designed to support trial-and-error.
by aprilthird2021 | 2026-01-28 23:46:20+00:00
Several of the links of yours are about PERM applications, not H1B.

I agree abusers (employers) should be put on he H1B visa blacklist which already exists.

H1B already mandates that employees be paid within the wage window of their peers. And anecdotally I know several who make more than their citizen peers in the same company same level
by watwut | 2026-01-28 23:46:27+00:00
The meaning of "concentration camp" did not changed. European historians and writers use them exactly like I did. So does wikipedia. In particular, European historians writing about WWII can not possibly limit the meaning of that word to extermination camp only, because concentration camps as such played pretty important role the whole time. https://en.wikipedia.org/wiki/Nazi_concentration_camps

Immigrants including Somali are blamed for economic situation, lack of housing, meat price. And just like Jews back then, they are accused of being the source of criminality, rape, child abuse. And as before, by actually criminal government (Literally Trump accused people attacked by ICE of that raping kids. Go figure.) I genuinely believe it is OK to not closely follow what Trump, Vance and Miller write and say. But, if you don't, maybe you should not make confident assumptions about their rhetoric.

> ruin caused by France and others

Common here. You are switching one scapegoat for another.

> This is why I wrote a religion, not religion. They were helped by the rules of Judaism that makes the religion and race the same set of people.

The racial component of nazi ideology came from Germans themselves, they perceived it as science. They thought they are being scientific men. In fact, quite a few atheistic Jews were shocked to find they are the hated Jews themselves. German jews were frequently atheistic, integrated, married Germans a lot and considered themselves Germans. Race theory was not inspired by Judaism and was not helped by Judaism. You are kind of blaming the victim here.

> At any rate, I do have a better picture now of what is happening and what is colloquially called "concentration camps" by Americans in this context, thanks!

European historians, writers, politicians, journalists use concentration camp like I did. YOU did confused it with extermination camp. It was you who simply did not knew the term is not limited to the single digit number of nazi extermination camp, that nazi had many more concentration camps and that the term was routinely used for non german concentration camps too.
by Miraste | 2026-01-28 23:47:10+00:00
I get the feeling you had a specific use case that didn't work well with Apple GPUs? I'd be curious what it was. The architecture does have some unusual limitations.

By software problem, though, I meant referencing OpenCL benchmarks. No one in 2026 should be using OpenCL on macOS at all, and the benchmarks aren’t representative of the hardware.
by cedws | 2026-01-28 23:47:20+00:00
I've been trying to get token usage down by instructing Claude to stop being so verbose (saying what it's going to do beforehand, saying what it just did, spitting out pointless file trees) but it ignores my instructions. It could be that the model is just hard to steer away from doing that... or Anthropic want it to waste tokens so you burn through your usage quickly.
by thewebguyd | 2026-01-28 23:47:54+00:00
> feeling that we really can’t do much.

That's why people don't dig into the deep complex issues. Because it's uncomfortable, and forces one to confront the potential reality that their worldview, and everything they've known about how our society works is wrong, broken, and collapsing in front of them.

It can be a very distressing and depressing state of mind. There's a reason "ignorance is bliss" is a common trope, because there's some real truth to it. For some, it's better for emotional and mental wellbeing to ignore the problems of reality and remain ignorant.
by analog31 | 2026-01-28 23:48:05+00:00
>>> Windows 11's file browser lags when opening directories with more than 100-ish files. Windows 11's file browser takes a few seconds to open at all.

>>> Context menus take a noticeable amount of time to appear.

> I can almost guarantee this is from some endpoint management software your company installed.

This can also be due to OneDrive / Sharepoint / Teams etc. Which I suspect supports your point.

A hard lesson I learned was that cloning a git repository into a directory managed by OneDrive is a recipe for interesting behavior.
by abustamam | 2026-01-28 23:48:22+00:00
I feel your pain, as someone in their mid-30s, and also a new dad. It's trite to say that it's hard to make friends in your 30s but it really is true. Between career, family, and just day-to-day life, it's really hard to form connections that are any more than just superficial.

What works for me is finding communities. I participate in Toastmasters, which meets every week (one meets twice a month), and it's a good way to make connections with people and get to know them better. It's also fun because there's people of many walks of life. Retirees, college students, business owners, executives, everyone in between. It's a great way to meet people I probably wouldn't have otherwise met in tech circles.
by aprilthird2021 | 2026-01-28 23:48:24+00:00
> If you really think that companies are moving out of country because "there's not enough talent", despite having some of the more relaxed tax codes and most talented universities here

The US has a huge delta between its great universities and its mediocre ones. There are some smart and sharp kids everywhere in even the lowest ranked schools. But altogether the amount of people who can pass a code screen in the US is pretty low. If you ever interviewed people for a software position in a big tech firm, you'd realize this.
by rekabis | 2026-01-28 23:48:31+00:00
> I gave up with Windows 10 because you needed Windows Pro in order to make an "offline" account

You quit without even trying.

Windows 10 and 11 can have all local accounts by using RUFUS to create the install media. And if your PC comes with Windows already installed, there are still commands - even with 25H2 - that allow you to bypass the Microsoft Account requirement during setup and configure a local account.

And this is with both Home and Pro.
by pixl97 | 2026-01-28 23:48:42+00:00
It is not completely wrong. It's situational. The attention span of the general public is short, exceptionally short when it's about something that doesn't directly affect the general public too.

General public: "OMG, I should boycott Apple because they are making some other businesses life hard, why?"

It's a very hard sale because all the general public sees is Apple phones are easy to use and friendly. Attempting to explain the complexities that occur in the background gives Apple power in the narrative that they are doing everything to keep you "safe".
by coredog64 | 2026-01-28 23:49:38+00:00
> If you don't bring more fungible labor into the US, the jobs will be offshored.

Offshoring is not always a substitute for an employee chained to the job by a visa. I'm sure you can get a million and one anecdotes here on HN about the perils of working across timezones, cultures, and legal systems.
by orwin | 2026-01-28 23:49:51+00:00
> And if you want to read for information, you’re almost certainly going to get better information by reading a modern history of Rome than by reading Polybius.

It's not 'almost certainly'. Modern history books written by academics contain an historiography, references to archeological researchs, reference to archives when some exist (remarquably, while the French revolutionary council archived their discussions and those were kept since 1792, no historian reference them before 1998, and since then, every academic book do :/), linguistic research, economics (local economy: what was produced, what was imported) and probably other fields I never recognised/took interest in.
by egorfine | 2026-01-28 23:50:19+00:00
> we will never enforce using any of these features in systemd itself. It will always be up to the distro

So, plausible deniability. It's not the systemd project, it's the distro.

> I certainly don't think distributions like Fedora or Debian will ever go in that direction.

In the past they made decisions that we can call unexpected. I believe that in the short term future they won't but in say ten years? I'm not sure. The technology (created by Amutable?) will be mature by that time and ready to close Linux down.
by m132 | 2026-01-28 23:50:34+00:00
It gets real depressing when you compare the recent case of Google to what was done to AT&T in the 80s.

I'd love to be proven wrong, but it feels like over the past couple of decades we've gone from clever guys coming together with an idea and starting companies like Microsoft, Google, and Apple, to celebrating buyouts of startups by large behemoths—that's how low the definition of success has dropped. Is competition law even a thing anymore?
by aprilthird2021 | 2026-01-28 23:50:36+00:00
Outsourcing happens when the economy forces companies to cut costs. When innovations return substantial growth, most companies don't think much about the costs. We have a rough economy, bad tariff policy, a weakening dollar, and immigration policy that's reducing the overall US population (and with it, spend in the economy). All those factors push companies to need to cut costs
by jjwiseman | 2026-01-28 23:50:49+00:00
As other commenters noted, this is almost certainly not RF spoofing, just sending bad data to an aggregator (ADS-B Exchange) over the internet.

This instance of spoofing is notable for being the first that I know of that wasn't primitive vector art or text, but a raster image!

In that area of Florida multiple receivers would have picked up actual ADS-B broadcasts. ADS-B aggregators do have various anti-spoofing measures, but they're not impossible to circumvent.

The only case of actual RF spoofing of aircraft transponder signals that I know of was actually done by the U.S. Secret Service, which interfered with passenger jet collision alert systems (TCAS) by apparently broadcasting bogus signals near Ronald Reagan National Airport (KDCA): https://nymag.com/intelligencer/article/aviation-flights-whi...
by zamadatix | 2026-01-28 23:50:53+00:00
It's hard to square their complaints about Microsoft's delivering AI crap when the top work project reference they have is:

> DesignVerse

> AI website builder startup.

> - Tech Stack: Next.js, Vercel AI SDK, Mastra AI Framework

> - Role: Full Stack Developer

> - Built core features (full stack) and helped implement the AI-powered editing system.
by mhitza | 2026-01-28 23:50:56+00:00
Happy to see a "plain language summary" section, from which I've copied.

> We gave pregnant rats drinking water with BPA levels similar to those considered safe for humans in 2015. We observed lasting effects in their offspring exposed to low-dose BPA. BPA caused notable female masculinization and male feminization. These sex-specific effects resembled those seen in people with metabolic syndrome, a set of health problems that raise the risk of diabetes and heart disease. Our results imply that reducing BPA use in food and beverage containers could help prevent these outcomes.
by maxglute | 2026-01-28 23:51:55+00:00
PRC built ~550 GW of solar last year, ~300GW domestic, ~250GW export. About 4 million barrels of oil equivalent per day in terms of oil displacement / energy flow (substitution method). In terms of stock, assume 30 year panel lifespan (30yr*4mbd) lifetime generation of single day of PRC solar production effectively minting 120 mbd, or about global daily oil extraction @120mbd. Assuming 17% capacity factor = 820Twh/yr using primary energy / equivalent / substitution method of 1 unit of solar = 3 unit of oil @35% work efficiency. Another way to look at it, PRC's 2025 solar production will displace about 45 million barrels of oil over it's lifetime.

Another point to consider is manufacturing all these panels, which are functionally net carbon sinks, count towards PRC emissions vs extracting oil/lng where exporters who gets to shift emission accounting onto importers/consumers under current territorial emission accounting. IF PRC got credited for ~110 mb/d of fossil displaced via solar (round down for conservative carbon payback), PRC emissions would be completely negated, i.e. PRC annual solar production would avoid ~30Gt of emissions over lifetime vs PRC total emissions of ~15Gt.

Lastly, thought experiment: PRC solar manufacturing at like 50% utilization, they're scaled for ~1100GW, if world can absorb PRC solar, PRC can mint enough panels in 12 years to replace oil. Hypothetically, if PRC maintained peak 400GW of solar expansion per year (~3mbd), i.e.2025 1100GW, 2026 = 1500GW, 2027 = 1900GW... by 2036 = 5500GW about ~40mbd of annual displacement, and cumulative ~300mbd displacement (flow not stock), aka current total global fossil consumption replacement.

Obviously, this is functionally magical thinking, PRC going through solar involution = they're not going to 5x their solar production... but theoretically this scenario not impossible. PRC can scale to 5500GW for the paltry sum of lol $50B per year. Probably need another 200B in battery storage to match. About 2.5T in ~10 years, really a pittance if it can be absorbed/integrated. Of course will run into material/battery crunch (i.e. eliminate silver / increase copper mining), but on paper that is something that can happen, certainly by 2050/60 on lax timelines. Alternative aggressively hopium framing, but 8billion people chip in $25 per year directed at solar + batteries and we can replace fossil in 10-15 years. We already spend more than this on fossil. we're It doesn't have to be PRC alone, but if they wanted to, they can carry it.
by hparadiz | 2026-01-28 23:52:21+00:00
The problem is as soon as you run something new and it doesn't scale properly in X11 you're gonna be making a bug report instead of using what everyone else is using. Currently just with the screen sharing thing it's not even just graphical. There's also updates for Pipewire so you can select the audio output you wish to stream with your video feed. That dialog simply doesn't exist at all in X11. You probably don't even know it exists. It's been feature complete now for YEARS. There's a reason that Valve is using Wayland on SteamOS. It's cause it's feature complete now and they are working on stuff like HDR which won't work at all on X11. I'm guessing that X11 support will start to be dropped in the next few years by major code bases. It's hard for me to even explain some of the bugs I saw with X that disappeared overnight when I switched to Wayland. You talk about OpenGL and Vulkan support but hilariously that's what I'm trying to explain to you has *better* performance now than even Windows.

Just basic stuff wayland has that X11 will never have:

- No screen tearing by default
- Proper vsync
- Lower latency for input → display
- Per-monitor refresh rates (144Hz + 60Hz works correctly)
- Fractional scaling is actually correct (no blurry hacks)

Seriously, move on.
by Nextgrid | 2026-01-28 23:52:30+00:00
Patreon is a very niche app in the grand scheme of things. There's the saying that only 1% of web visitors ever stop by and actually contribute, and I'd expect that number to drop to 0.001% when it comes to contributing monetarily through a tool like Patreon. This is an absolutely tiny minority.

Hell I'd argue more people are upset about the lack of an OnlyFans app than Patreon. OF has way more brand-recognition (outside of tech) than Patreon.
by johnnyanmac | 2026-01-28 23:53:08+00:00
So

- the devs all need to get licesnses and specific hardware to develop for IOS

- They spin up their own servers to manage all the finances coming in

- They work on their payment processing solution separate from Apple. And Patreon still pays some fee to apple over the app.

- the model of Patreon only takes 5% off of creators, so that's not enough for Apple. It also wants a cut at the customers of the website who provide services. Customers not beholden to any one platform.\

- And to force them to do that, they are kicking the other processing plan off as an option, leaving only them to work with.

And it's somehow not evil? If I let a friend sleepover at my apartment, is the landlord in the right to demand a day of rent from them too?