MurphyA/hacker-news huggingface dataset:
by perching_aix | 2026-01-28 07:47:19+00:00
I don't get why + addresses always come up in this. They're machine-undoable by design.

Using randomized relay addresses instead gives you an immensely higher confidence that when a given contact address starts getting spam, it is misuse stemming from a specific entity. Especially if you rotate it at a fixed time interval, cause then you can even establish a starting timeframe.

Still not perfect but it can never really be, and not even out of email's fault. As long as DNS and IP addressing rule the world, there's only so much one can do. It's a secret handling problem at its core.
by EdiX | 2026-01-28 07:48:16+00:00
Nothing has been "proven". The original story was The Information (paywalled article) reshared by Business Insider [1] and claimed that 70% of the transactions were reviewed by an indian. The source was an anonymous source.

Business Insider also reached out to Amazon at the time and a spokesperson denied that actually reviewed any transactions.

This "proven false" thing is just another anonymous source claiming that actually it was only 20%.

So you actually have no proof of anything, you just have three persons claiming three different things (0%, 20% and 70%).

[1] https://www.businessinsider.com/amazons-just-walk-out-actual...
by anon291 | 2026-01-28 07:48:51+00:00
I'm about as into formal methods as you can get, with a deep background in Haskell and such. Rust is wonderful and all that, but sometimes I think the optimism is misplaced and doesn't come from a place of full knowledge. Statements like this make me scared:

> The geometry engine is manifold, which guarantees watertight meshes from boolean operations. The Rust bindings give us zero-cost abstractions over the C++ core — the operator overloads compile down to direct manifold calls. No garbage collection pauses. No floating point surprises from a scripting layer.

Floating point is incredibly surprising. People seem to believe that a typed programming language eliminates floating point error. Scripting and interpretability has nothing to do with why floating point is hard. Floating point arithmetic is as deterministic in Python as C++ or Rust. The issue is whether people understand the rules. The type system has nothing to do with this, as floating point errors are almost always value errors, not type errors. The only way to avoid floating point errors using formal methods is an actual theorem prover. Rust is nowhere close to being a theorem prover.
by nextaccountic | 2026-01-28 07:49:09+00:00
Do you mean HACL* / ValeCrypt / EverCrypt?

A number of projects like Firefox and the Linux kernel uses them. It's boring at that point. The generated code is C and assembly can be used like any library, but it has been formally verified.

But, there is ring and rustls too. A number of projects are shifting to it
by cmkr | 2026-01-28 07:49:40+00:00
EDIT (after 150+ comments of roasting):

First: You are legends. Thanks for the massive roasting. Had a Haupt-Mieterversammlung directly after clicking "Submit" and was too tired (and scared) to directly address the issues afterwards. Reading your comments really delivers some intense cringe-moments over here seeing my bugs exposed. I try to frame it as some of the best feedback from some of the best engineers in the world. This helps (it does).

The core stuff: I chose to implement ASN-list lookups instead of a GeoIP service (to have less deps). Worked for my european test cases. Clearly not battle-tested enough for the wild.

What I'm hearing:
- Hosting detection has false positives (detecting links as hosting) and false negatives (US-hosted sites scoring 100%)
- Social media LINKS shouldn't count same as EMBEDS (fair point)
- Missing: registrar, TLD jurisdiction, DNS location
- AWS/Cloudflare detection is spotty
- Migration cost estimates are too high for small sites
- Some UI bugs on Firefox

What we shipped overnight (yes, while this was trending):
- "Hotfix" for our scanning friends over nsa.gov
What we ship from now on:
- Fix the real bugs

v0.2 roadmap based on your feedback:

1. Hybrid GeoIP + ASN detection
2. Differentiate links vs embeds
3. Add registrar/TLD/DNS checks
4. Fix AWS/CloudFront/Cloudflare detection
5. Smarter migration cost estimates
6. UI fixes

Building in public. This is day 1.

To everyone who tested edge cases: you part of this tool soon :)
To whover tested nsa.gov at 2am CET: I noticed.

I am not sure how much i will get done by today – maybe i will need to touch grass later a bit (or feeding the cows as we do it over here in austria)
by ifwinterco | 2026-01-28 07:49:52+00:00
I question the wisdom of that path though. Like yes the government can probably read a lot of your stuff easily, and all of it if they really want to. But why does that mean you have to live like a medieval hermit in a hut in the mountains?

I have opinions but at the end of the day I'd rather live within the system with everything it has to offer me, even knowing how fake a lot of it is. Living in remote huts is just not that interesting
by bandrami | 2026-01-28 07:50:11+00:00
Previous tools have been deterministic and understandable. I write code with emacs and can at any point look at the source and tell you why it did what it did. But I could produce the same program with vi or vscode or whatever, at the cost of some frustration. But they all ultimately transform keystrokes to a text file in largely the same way, and the compiler I'm targeting changes that to asm and thence to binary in a predictable and visible way.

An LLM is always going to be a black box that is neither predictable nor visible (the unpredictability is necessary for how the tool functions; the invisibility is not but seems too late to fix now). So teams start cargo culting ways to deal with specific LLMs' idiosyncrasies and your domain knowledge becomes about a specific product that someone else has control over. It's like learning a specific office suite or whatever.
by anon291 | 2026-01-28 07:50:20+00:00
> borders are secure now, nobody gets to leave

This is honestly insane.

> On the military angle, I'd much rather live in a country without nukes.

That's because the majority of the typical American with these views is extremely privileged and has never actually had to live in a country without nukes. Ukraine is the future of countries without nukes -- forced to choose between great powers or made into buffer zones without any prospects. It's all so tiresome really.
Show HN: GrindMal – A dev "arena" (Alpha Invite)
by tomari99 | 2026-01-28 07:50:44+00:00
We're building GrindMal, a dev ecosystem based on one rule: Artifacts > Opinions.

This is NOT for beginners. It's for developers who learn by grinding on broken, real projects. No tutorials. No hand-holding. PRs are the only help.

The Vision: To become the definitive "arena" where the most resilient developers prove their skills through silent collaboration and shipped code. Imagine a future "Hall of Grind" and autonomous challenge engines. (Link to your vision doc or a brief README section.)

We are Alpha-Ready and Need:

Go-builders to help with the core platform (Next.js/TypeScript, GitHub API integration).

Design thinkers who understand that in this system, UX is a set of constraints that prevent comfort.

Open-source veterans who want to help design the "broken projects" and review protocols.

If you're interested:

Read the Core Philosophy to see if it resonates.

Your first task is not to message me. It's to submit a PR to our onboarding repo fixing a deliberately broken markdown file or a simple bug in our alpha site code. This is the only way in.

Repo: https://github.com/Grind-Mal (Make sure the onboarding repo has a clear "first-alpha-contributor" issue!)

This is a filter. The grind starts now.
by ozy | 2026-01-28 07:50:50+00:00
I really like the idea of openscad, or this, or the many alternatives. But when I say a shape with these and these dimensions, the next shape should attach to it somewhere. And then I want to say: chamfer all outside edges. But in all these programs, it's me redoing the math in my code, computing where the shape goes. As for chamfers, I just give up ...
by delaminator | 2026-01-28 07:51:03+00:00
Yeah, it’s a bit weird seeing it talk to itself like that.

It should help you use more discipline in your DevOps.

“Never Do anything you can’t Undo”

My Claude has sudo and root on the database.

Of course the real disaster would be stuff you don’t notice like shoving test data into the prod DB while you weren’t looking.
by Ronsenshi | 2026-01-28 07:51:38+00:00
Six months is definitely not long enough of a break for skills to degrade. But it's not just skills, as I wrote in another comment, the biggest thing is knowledge of new tools, new versions of language and its features.

I'd say there's at most around 2 years of knowledge runtime (maybe with all this AI stuff this is even shorter). After that period if you don't keep your knowledge up to date it fairly quickly becomes obsolete.
by soulofmischief | 2026-01-28 07:51:59+00:00
Interesting, thanks for sharing!

As for the web stuff, these tools are great in the hands of thoughtful, attentive, experienced engineers who have developed the muscles for knowing how to slap these models into shape. For anyone else, I agree right now that they can be more headache than they are worth.

I get a lot of velocity out of Opus 4.5 and spend 8-20 hours a day coding with it nearly every day, but I am constantly, multiple times an hour, screaming and yelling at these things, getting frustrated and bewildered by their output, etc. It is absolutely a tradeoff, but thankfully the tradeoff for me is frustration and mental energy, instead of correctness or performance. But left alone, these models drive in circles and tear everything up along the way.

I totally believe you about these models having difficulty with realtime programming. It's a more niche field with less example training material. Out or pure curiosity I do wish I was able to see exactly where the failure modes arise. I wonder how things will be at the end of 2026, because 2025 was a game changer for many domains.
by gorgoiler | 2026-01-28 07:52:15+00:00
I’d much rather have tamper detection. Encryption is great should the device is stolen but it feels like the wrong tool for defending against evil maids. All I’d want is that any time you open the case or touch the cold external ports (ie unbolted) you have to re-authenticate with a master password. I’m happy to use cabled peripherals to achieve this.

Chaining trust from POST to login feels like trying to make a theoretically perfect diamond and titanium bicycle that never wears down or falls apart when all I need is an automated system to tell me when to replace a part that’s about to fail.
by jillesvangurp | 2026-01-28 07:52:39+00:00
Analysis paralysis is a thing. And as the article makes very clear, there are a lot of ways to get stuck doing anything else then the one thing you are supposed to be doing.

The way to break through that is indeed to start doing. Forget about the edge cases. Handle the happy path first. Build something that does enough to deliver most of the value. Then refine it; or rebuild it.

Seriously. The cost of prototyping is very low these days. So try stuff out and learn something. Don't be afraid to fail.

One reason LLMs are so shockingly effective for this is that they don't do analysis paralysis; they start doing right away. The end results aren't always optimal or even good but often still good enough. You can optimize and refine later. If that is actually needed. Worst case you'll fail to get a useful thing but you'll have a lot better understanding of the requirements for the next attempt. With AI the sunk cost is measured in tokens. It's not free. But also not very expensive. You can afford to burn some tokens to learn something.

A good rule is to not build a framework or platform for anything until you've built at least three versions of the type of thing that you would use it for. Anything you build before that is likely to be under and overengineered in exactly the wrong places. These places make themselves clear when you build a real system.
by AnthonyMouse | 2026-01-28 07:53:53+00:00
> Is armed with knives enough?

It depends on the numbers. Do they have 100,000 guys with guns but you have a hundred million with knives? Then you have a chance. But your chances improve a lot if your side is starting off with something more effective than that.

> Presumably it isn't, and you'd need a certain minimum level of technological parity with your tyrants.

You don't need parity, you need a foothold to leverage into more.

> So where's the industrial base which makes the weapons? Or the money to buy the weapons?

In a civil war, you take the domestic facilities and equipment by force and then use them. But first you need the capacity to do that. Can 10,000 guys with knives take a military base guarded by a thousand guys with guns? Probably not. Can they if they all have guns? Yeah, probably.

Then the government has to decide if they're going to vaporize the facility when you do that. If they don't, you get nukes. If they do, now you have a mechanism to make them blow up their own infrastructure by feigning attacks. And so on.
by EdiX | 2026-01-28 07:54:06+00:00
If they didn't say it they heavily implied it to the point that journalists were fooled. For example you can read about it in this very quaint 2018 article that went with a woke "it's your fault I'm disfunctionally paranoid" angle: https://www.cnet.com/culture/amazon-go-avoid-discrimination-....

No one cared what I was doing. Is this what it feels like to shop when you're not black?

Turns out people did care what she was doing.
by ewidar | 2026-01-28 07:54:12+00:00
I guess it depends what appeal to you.

As an example finding myself in a similar 80% situation, over the last few months I built

- a personal website with my projects and poems

- an app to rework recipes in a format I like from any source (text, video,...)

- a 3d visual version of a project my nephew did for work

- a gym class finder in my area with filters the websites don't provide

- a football data game

- working on a saas for work so typical saas stuff

I was never that productive on personal projects, so this is great for me.

Also the coding part of these projects was not very appealing to me, only the output, so it fits well with AI using.

In the meanwhile I did Advent of Code as usual for the fun of code. Different objectives.
by codedokode | 2026-01-28 07:54:19+00:00
I think it is possible to run CPU code on GPU (including the whole OS), because GPU has registers, memory, arithmetic and branch instructions, and that should be enough. However, it will be able to use only several cores from many thousands because GPU cores are effectively wide SIMD cores, grouped into the clusters, and CPU-style code would use only single SIMD lane. Am I wrong?
by sunaookami | 2026-01-28 07:55:01+00:00
>Has the technical and scientific community in the US already forgotten this huge breach of trust?

Have you ever seen the comment section of a Snowden thread here? A lot of users here call for Snowden to be jailed, call him a russian asset, play down the reports etc. These are either NSA sock puppet accounts or they won't bite the hand that feeds them (employees of companies willing to breach their users trust).

Edit: see my comment here in a snowden thread: https://news.ycombinator.com/item?id=46237098
by SpicyLemonZest | 2026-01-28 07:55:09+00:00
Historically I would have agreed with you. But since the rise of LLM-assisted coding, I've encountered an increasing number of things I'd call clear "ghost bugs" in single threaded code. I found a fun one today where invoking a process four times with a very specific access pattern would cause a key result of the second invocation to be overwritten. (It is not a coincidence, I don't think, that these are exactly the kind of bugs a genAI-as-a-service provider might never notice in production.)
by Sesse__ | 2026-01-28 07:55:32+00:00
The oldest rules on FIDE's pages are the ones for “before 2014”. They state:

The game is drawn when a position has arisen in which neither player can checkmate the opponent’s king with any series of legal moves. The game is said to end in a ‘dead position’. This immediately ends the game, provided that the move producing the position was legal. (See Article 9.6)

And 9.6 just states:

The game is drawn when a position is reached from which a checkmate cannot occur by any possible series of legal moves. This immediately ends the game, provided that the move producing this position was legal.

And similarly 6.9, which governs loss on time:

Except where one of the Articles: 5.1.a, 5.1.b, 5.2.a, 5.2.b, 5.2.c applies, if a player does not complete the prescribed number of moves in the allotted time, the game is lost by the player. However, the game is drawn, if the position is such that the opponent cannot checkmate the player’s king by any possible series of legal moves.

So it's at least ten years old, but possibly quite more. I know I have a copy of the 1984 rules (or possibly even older) somewhere on paper, but then I'd have to go into the attic :-)
Show HN: Modelfy – Turn a single image into a 3D model (GLB/OBJ)
by binskyell2615 | 2026-01-28 07:55:50+00:00
Hi HN — I built Modelfy, a web tool that generates a 3D mesh + textures from a single image, then lets you download the result (e.g., GLB/OBJ).
It’s aimed at quickly prototyping assets for 3D, games, and product mockups. It works best on a single object with a clean background; complex scenes can produce messy geometry.
I’d love feedback on output quality, workflows you’d expect (retopo, PBR maps, scale/origin), and what would make this useful in a real pipeline.
by Ronsenshi | 2026-01-28 07:55:57+00:00
The only issue is that as an engineering manager you reasonably expect that the team learns new things, improve their skills, in general grow as engineers. With AI and its context handling you're working with a team where each member has severe brain damage that affects their ability to form long term memories.
You can rewire their brain to a degree teaching them new "skills" or giving them new tools, but they still don't actually learn from their mistakes or their experiences.
by kakacik | 2026-01-28 07:56:44+00:00
Vendor/ecosystem lockin, all on purpose, to give as much friction and annoyment as possible without flatly refusing the service which is generally bad for PR and apple does care about keeping their image up. This is their typical behavior for a long time, their primary mission is to force you into their ecosystem, not selling specific hardware (with 30% margin but still at the end they don't care about that).

Try running airpods pro against any android phone. Severely degraded experience on purpose to the point of rendering them worse than chinese 10$ aliexpress buds and practically useless. Wife had them, worked fine with iphone mini 13 but she hated iOS with passion so eventually reverted back to samsungs. She had to give airpods pro to her sister who still has apple phone and bought some cheapish buds for 50 bucks which work flawlessly and she is happy again.

Maybe engineers at apple are consistently incompetent to implement basic bluetooth unlike any chinese sweatshop, but somehow I refuse to believe so.
by PunchyHamster | 2026-01-28 07:57:21+00:00
that on itself is not a problem. The problem is that those work worse.

For example, the part of systemd that fills DNS will put them in random order (like actual random, not "code happened to dump it in map order)

The previous, while very much NOT perfect, system, put the DNSes in order of one in latest interface, which had useful side-feature that if your VPN had different set of DNSes, it got added in front

The systemd one just randomizes it ( https://github.com/systemd/systemd/issues/27543 ) which means that using standard openvpn wrapper script for it will need to be reran sometimes few times to "roll" the right address, I pretty much have to run

systemctl restart systemd-resolved ; sleep 1 ; cat /etc/resolv.conf

half of the time I connect to company's VPN

The OTHER problem is pervasive NIH in codebase.

Like, they decided to use binary log format. Okay, I can see advantages, it can be indexed or sharded for faster access to app's files...

oh wait it isn't, if you want to get last few lines of a service the worst case is "mmap every single journal file for hundreds of MBs of reads"

It can be optimized so some long but constant fields like bootid are not repeated...

oh wait it doesn't do that either, is massively verbose. I guess I can understand it, at least that would make it less crash-proof...

oh wait no, after crash it just spams logs that previous log file is corrupted and it won't be used.

So we have a log format that only systemd tools can read, takes few times as much space per line as text or even JSON version would, and it still craps out on unclean shutdown

They could've just integrated SQLite. Hell I literally made a lil prototype that took journalctl logs and wrote it to indexed SQLite file and it was not only faster but smaller (as there is no need to write bootid with each line, and log lines can be sharded or indexed so lookup is faster). But nah, Mr. Poettering always wanted to make a binary log format so he did.
by 0xDEAFBEAD | 2026-01-28 07:57:41+00:00
Knives are basically obsolete technology in military terms. Firearms are not obsolete; that's why almost every soldier (or "paramilitary") carries one. Your technological parity point is technically correct, but it doesn't really apply here.

There are more privately owned guns than people in the US. We are already profusely armed.
by Chryzano | 2026-01-28 07:57:59+00:00
The altcoin market cap is still holding onto the macro uptrend despite all the surrounding geopolitical tension. Although the analyst predicts the altcoin season will recover and be 'biblical,' the liquidity is draining.

The market conditions are very volatile as the U.S. threatens to hit the NATO countries with tariffs. Meanwhile, the European nations are brandishing their power by threatening to cut off access to US markets through the so-called “trade bazooka. Cutting out US companies' function in the EU market could cost billions of dollars.

NATO’s retaliation plan

Another potential course of action involves NATO countries selling off their U.S. dollar-denominated bonds on the open market. Such a move could depress the dollar, raise borrowing costs, and fuel inflationary pressure in the U.S. economy.

Despite two of the biggest economies plotting against each other and the geopolitical tension rising, the altcoin market cap still managed to trade inside the ascending triangle. The ascending triangle is a bullish pattern, and holding this shape shows that the altcoin season is just delayed and not cancelled.

According to analyst and entrepreneur Mark, the altcoin season this year is going to be ‘biblical.’ Speaking to a prominent crypto media outlet, Fundstrat managing partner Tom Lee also projected that once gold and silver take a break from their rallies, the crypto market will come back to life.

https://twitter.com/santimentfeed/status/2015845556103381416

However, the liquidity in the crypto has dried up. According to Santiment, an analytical platform, the combined market cap of the top 12 stablecoins in crypto has declined by $2.24B in the past 10 days.

The dwindling supply of stablecoin could mean several things. As the market conditions are volatile, investors are risk-averse and moving out of crypto in search of safe havens. If at all investors were buying and selling, the money would remain in the crypto market in the form of stablecoins.

But, this behavior shows investors cashing out and a stablecoin crunch evolving. As such, before the altcoin season kicks off, there will be a recovery in stablecoins.