MurphyA/hacker-news huggingface dataset:
by 1718627440 | 2026-02-21 09:30:50+00:00
I think you misunderstood me, the software is part of the device I paid for and own.

If I tell someone to install a light switch in my living room and then it occasionally switches states when someone presses another switch at my outside wall and occasionally refuses working, I don't feel like they fulfilled their contractual obligation. Same with smartphones and software.

I would agree with you if I would want additional features, like if I want a filesystem, but there is no filesystem manager yet, or if I want to install a package, but there is no package manager, or the package manager uses another format. But here there is a package manager and the package has the right format, so I tell the device to install it and it just doesn't solely because I am called John Brown and not Alphabet Inc. . That is not right.
by jjav | 2026-02-21 09:30:52+00:00
> My wife was complaining about far right knuckle draggers turning up in her feed.

This is what is so difficult in facebook vs. HN. Here if people post angry insulting rants, it gets collectively downvoted to oblivion. That is effective.

On facebook there is no equivalent. All I can do is block an individual, but I personally have to do it for every offensive person, which is for practical purposes impossible. Facebooks needs a downvote button and an option to hide any comments which have N downvotes.
by safety1st | 2026-02-21 09:31:13+00:00
This is the first time I've ever heard somebody claim that section 230 exists to deter child predators.

That argument is of course nonsense. If the platform is aware of apparent violations including enticement, grooming etc. they are obligated to report this under federal statute, specifically 18 USC 2258A. Now if you think that statute doesn't go far enough then the right thing to do is amend it, or more broadly, establish stronger obligations on platforms to report evidence of criminal behavior to the authorities. Either way Section 230 is not needed for this purpose and deterring crime is not a justification for how it currently exists.

The final proof of how nonsensical this argument is, is that even if the intent you claim was true, it failed. Facebook and Instagram are the largest platforms for groomers online. Nazi and white supremacy content are everywhere on these websites as well. So clearly Section 230 didn't work for this purpose. Zuck was happy to open the Nazi floodgates on his platforms the moment a conservative President got elected. That was all it took.

The actual problem is that Meta is a lawless criminal entity. The mergers which created the modern Meta should have been blocked in the first place. When they weren't, Zuck figured he could go ahead and open the floodgates and become the largest enabler of CSAM, smut and fraud on earth. He was right. The United States government has become weak. It doesn't protect its people. It allows criminal perverts like the board of Meta and the rest of the Epstein class to prey on its people.
by globalnode | 2026-02-21 09:32:14+00:00
What a sad story. I feel sorry for this person. But it was very naive to put that data up in the first place. I recently tried to open a FB acct so I could connect with local community but within 2 days I was accused of being a bot and asked to start a video interview with a verification bot. That didn't happen, local community can do without me ;)
by zeeed | 2026-02-21 09:32:39+00:00
If you’re on Gmail, there’s “plus addressing” - this allows you to append any term after your email - and then sort accordingly.

So if your Gmail is foo.bar@gmail.com you can use foo.bar+servicename@gmail.com and the mail will still end up in your mailbox. Then you can create a rule that sorts incoming mails accordingly.
by FrojoS | 2026-02-21 09:32:50+00:00
Reminds me of this scene from Andor:

-----

Luthen: Turning back will be impossible. You knew where this was going. You've always knew. Has anyone ever made a weapon that wasn't used? The network has been built. It's up. It grows or it dies. We've waited long enough.

Mon: Do you realise what you've set in motion?

Luthen: It was time for that as well.

Mon: Palpatine won't hestiate now.

Luthen: Exactly. We need it. We need the fear. We need them to over-react.

Mon: You can't be serious!

Luthen: The empire has been choking us so slowly we're starting not to notice. The time has come to force their hand.

Mon: People will suffer!

Luthen: That's the plan. You're not angry with me. I'm just saying out loud what you already know. There will be no rules going forward. If you're not willing to risk your conscious then surrender and be done with.

---

https://www.youtube.com/watch?v=ao9ARb6dEfc

edited: formatting
by Kwpolska | 2026-02-21 09:33:21+00:00
Solving the problem of having a personal and a work GitHub account is really trivial without any extra tools. All you need is a dedicated SSH key for that GitHub account. (And why would you have a password for a ssh key on your personal machine?)

~/.ssh/config

Host github.com-work
HostName github.com
User git
IdentityFile ~/.ssh/work_id_rsa
IdentitiesOnly yes

~/.git/config

[user]
email = work@example.com

[remote "origin"]
url = github.com-work:Work/Widget.git
by bonesss | 2026-02-21 09:33:33+00:00
For the utility present in LLMs I see these legal rabbit holes of copyright, harm recommendations, illegal image generation, and destructive failure modes and feel like the LLM cart is uncomfortably ahead of the horse.

Imagining the discussions at Google to stay away from productization of the technology, I think I also would have been on the conservative side. Non-deterministic execution, harmonic frequencies with mental illness, catastrophic destructive failure loops and “interesting” IP challenges don’t seem great for business in the long run.

I have no special insights, but someone is gonna address the blatant copyright laundering, and the misuses of image generation, ugly-style in court and as we are already seeing visible MS and AWS failures from LLM use, some business is gonna experience direct harm from these systems and respond through lawyers who can address the inadequacy of “tool can make mistakes” stickers.

Parties without rules are super fun, but with certain kinds of fun the cops are gonna show up at some point. I’d feel better working at a law firm using LLMs to go after “AI” companies than I would working at an “AI” shop outside the top dogs right now.
by fuzzfactor | 2026-02-21 09:34:37+00:00
I've got an adapter that only goes up to 40GB because it's 20 yrs old.

ATA (aka IDE or EIDE) was all they had before SATA so these adapters were all over the place.

WTF is a Pi for?

There's small little chips that do exactly this interface, still probably plenty available surplus for cheap since ATA is not popular any more.

Any ATA HDD that works on a mainstream USB adapter will handle CHS for DOS usage just fine, or LBA. Pretty much automatically. This was already smoothed out before about 1994 or so.

DOS of the '90's could handle LBA anyway, I like the MS-DOS from Win98SE which was not available separately by then but after W98 is installed to a FAT32 partition, the key DOS OS files in W98 will be available to copy to a fresh fat32 volume. You pretty much copy the same (newer) DOS files from W98 to your DOS root that it would have after installing DOS 6.22

Here's a USB adapter now:

https://www.amazon.com/SATA-Adapter-Converter-Cable-Drive/dp...

Not only that but Windows 10 will still install and run on drives with these old connectors just fine in BIOS mode as expected but also partitioned & formatted with the latest GPT HDD layout, GPT would boot with UEFI rather than BIOS for most mainstream configurations.

But also if you do it right, GPT will boot a plain MBR HDD if the UEFI can find a suitable FAT32 BOOT folder.

UEFI + GPT alone is just too lame to run DOS on bare metal any more. Not without BIOS mode or CSM enabled. GPT is still a show-stopper though, DOS needs MBR drive layout :(

OTOH MS-DOS will still install & run on any PC or drive, even NVMe, as long as there is a CSM or legacy BIOS mode and you are not stuck with a crippled mother board having only UEFI. GPT-only means no DOS for you. Not without some kludge like a virtual machine.

The purpose of UEFI + GPT was to make it so you couldn't run DOS, Win3.x, W9x, Wxp, Vista, W7, and Linux ever again on bare metal.

Not without CSM. The key UEFI module.
by jeroenhd | 2026-02-21 09:34:56+00:00
I'm not a lawyer, but I believe the EU's Cyber Resilience Act combined with the NIS2 Directive do task governments with setting up bodies to collaborate with security researchers and help deal with reports.

The law seems written to target vendors and products rather than services though, reading through this: https://www.acigjournal.com/Vulnerability-Coordination-under...
by zmgsabst | 2026-02-21 09:35:01+00:00
The real value is in mixed mode:

- Lean supports calling out as a tactic, allowing you to call LLMs or other AI as judges (ie, they return a judgment about a claim)

- Lean can combine these judgments from external systems according to formal theories (ie, normal proof mechanics)

- an LLM engaged in higher order reasoning can decompose its thinking into such logical steps of fuzzy blocks

- this can be done recursively, eg, having a step that replaces LLM judgments with further logical formulations of fuzzy judgments from the LLM

Something, something, sheaves.
by unforbiddenYet | 2026-02-21 09:35:10+00:00
> engineers who've worked with them (or reviewed their OSS contributions) could validate or challenge that [skill]

I like your idea of verifiable skills but I don’t think the proposal is solid. We need a trusted third-party as a validator so everyone is happy. Otherwise, we bring bias and corruption into this.

The problem is currently solved by professional certification — yes it could be gamed but it provides an official confirmation from a reputable source rather than someone’s word that you’re good.

Please keep iterating! We need better tools!
by dxdm | 2026-02-21 09:35:32+00:00
I think it's still worth-while to do reviews. A second pair of eyes does wonders, and it spreads knowledge of what things exist and how they work. If changes are small, reviews can be quick. It's possible to keep building on top of code being reviewed, and even easy when using modern VCS tooling like jujutsu.

Once the code is merged, chances are it will not get changed
Those follow-up tasks will be displaced by more pressing work that will keep piling onto a slightly unstable foundation, increasing the tilt over time.

There is an excluded middle between "no reviews" and "infinite review cycles": proper, timely and efficient reviews. They are worth investing the time to get right. They will start paying dividends months down the line, and boy will they keep paying.

This is not about trying to get things perfect from the get go, but to get them done right while you're there. "We'll fix it later" is not gonna happen, and is much more expensive than it initially seems.
by hathawsh | 2026-02-21 09:36:46+00:00
Good to know. Now I think I know why micropayments for news media never took off: because people who want to read news media probably don't want to waste mental cycles on keeping track of a micropayments account. They want a set-and-forget solution with a predictable cost. If micropayments can't fit those expectations, then the market probably wants something other than the thing we're calling micropayments.
by roggenilsson | 2026-02-21 09:37:54+00:00
In my previous job we worked like this. We had one dev branch that everyone pushed directly to and the dev branch was eventually branched to an RC branch which in turn was merged to master once the release was complete.

The team was small, around 6 people, and the codebase was maybe medium sized (~500k LOC). There was no formal review process, instead it was up to each team member to ensure the quality of their own and others code. In practice I would read through all commits that came in the previous day while having my morning coffee. If there was some egregious I would talk to whoever made to commit to make discuss if something should change, but this was fairly rare.

Formal PR reviews were only ever really used for new members or for bigger/sketchy changes where someone wanted more eyes on it.

Because I ended up reading most commits, I ended up knowing how pretty much the entire codebase worked. It takes a while for this to develop, but the more you do it the better you get at it, especially in the context of a single codebase.
by skrebbel | 2026-02-21 09:38:12+00:00
It's standard practice and it freaks managers the fuck out, esp if they're not familiar with hacker culture. Maybe the standard practice needs some work? I'm not sure, I understand the perspective of security researchers who want to force action on a fix. But I also completely understand how a deadline is perceived as a threat.

Don't forget that there's lots of gray hat / black hat hackers out there as well, who will begin with an email similar to this, add a bitcoin address for the "bug bounty" in the next, and will end with escalating the price of the "bounty" for the "service" of deleting the data they harvested. It's hard even for tech-savvy managers to figure out which of these you're dealing with. Now put yourself into the shoes of the average insurance company middle manager.

For completeness, I don't think this company's behavior is excusable. I'm just saying that maybe also the security community should iterate a bit more on the nuances of the "standard practice" vulnerability reporting process, with the explicit goal of not freaking people out so bad.
by mentalgear | 2026-02-21 09:38:18+00:00
The EU is displaying exactly the kind of political leadership we need in this topic: pro-consumer, pro-environment, and firmly against planned obsolescence. Removable batteries were the industry standard in the early days of mobile phones, and it worked perfectly. We only lost that standard when Apple’s 'walled garden' mindset infected the rest of the industry.

The amount of avoidable e-waste generated since then is unfathomable: We are talking about mountain-sized piles of discarded electronics, much of it exported to Africa and Asia. There, people (often children) burn those pieces to extract the remaining rare earths, inhaling toxic fumes in the process, while the remaining hazardous garbage is buried and left to poison the groundwater. It is an absolute moral failure that our society, and politicians beholden to Big Tech lobbyists, let this go on for so long in the name of pure profit for a few big companies at the expense of everything else.
by casey2 | 2026-02-21 09:38:37+00:00
It's just another in a long list of intentionally broad laws designed to make everything illegal. They shot themselves in the foot though. Since

(6) "DEVELOPER" MEANS A PERSON THAT WRITES, CREATES, MAINTAINS, OR CONTROLS AN APPLICATION

The user is a "developer" so they can just send themselves an implicit age signal without modifying any software.
by mschuster91 | 2026-02-21 09:39:34+00:00
Adding a tiny strip of glue to the battery so it doesn't slosh around in the case is not a problem.

The problem is that you need heat to open up the device itself (all that is between the battery and the hot air gun is about 1mm of glass), followed by a bath in isopropanol and lots and lots of twaddling around with tweezers and spatulas to get the old glue residue removed from both the display and the case (risking damaging either in the process), followed by really annoying meticulous work to place a new glue sheet exactly onto the case (or display) to make sure it fits again. Oh and you always risk cracking the display while removing it.
by astrobe_ | 2026-02-21 09:41:49+00:00
> Object-oriented Forth? Far out.

The cost is stupidly high, though. Look at the source code of [1].

The only good page to take from OOP book is the automatic and implicit pseudo-variable "self" or "this", that can reduce stack juggling significantly. I've implemented that in my (yet to be published) dialect and it works like a charm. In my experience, you can have that for cheap and anything more is not worth it from the point of view of a byte-counting Forth programmer.

[1] https://vfxforth.com/flag/swoop/index.html
by nudpiedo | 2026-02-21 09:41:56+00:00
Literally the first line of the link:

“The current interface was designed for internal use in Lean and should be considered unstable. It will be refined and extended in the future.“

My point is that in order to use these problem provers you really gotta be sure you need them, otherwise interaction with an external ecosystem might be a dep/compilation nightmare or bridge over tcp just to use libraries.
by BrandoElFollito | 2026-02-21 09:42:28+00:00
You typically disclose the vulnerability for one of these reasons: you want money, you want fame, you want to make a better world. There are others such as blackmail but let's settle for the typical ones.

If you do it for money or fame, you step cautiously not to annoy the company. You ask, you beg, etc. Not something to be proud of but this is life.

If you do this to make the world a better place, you get annoying. You explain the risks, possibly how to fix it and then send a few reminders with the threat of making it public. Depending on where you are this may be a danger for you or not (though you would usually go anonymous in that case).

OP did the right thing. Without setting deadlines, a company will ignore it. Or not - but in that case they will not be offended by the deadline and would discuss with the reporter (by agreeing on mitigation if a complete fix cannot be done easily).

There used to be a time when companies cared because it was an uncommon event. Today you get 3 "We are so sorry" emails a week, so one more or one less make it less stressful to have public disclosures or data leaks. There is simply no accountability.
by vb7132 | 2026-02-21 09:43:22+00:00
This seems like a common problem. I am experimenting with how to consume less news (but still not miss the important bits). Built an agent that sends me daily summaries. And that's how I found this post!

I am maintaining the list of what I am reading: https://www.bvaibhav.info/knos-digest

Plan to extend this beyond HN.
by jrflowers | 2026-02-21 09:43:38+00:00
> it’s about enabling private pervert detectives.

Yeah I know, you wrote that reading about trafficking children is a hundred times worse than trafficking children, that is why I pointed out what you wrote

How is anything you mentioned in this response worse than trafficking children? Like I would imagine that trafficking children would be the worst possible thing, can you explain how it is not actually that bad? Like if you could start a sentence with: “This instance of child sex trafficking is not nearly as bad as somebody reading about it online and posting because: “
by vbsd | 2026-02-21 09:43:56+00:00
Even if we accept this metaphor of English as a programming language, it’s used in a highly unusual way.

With regular programming, you have a full specification of the program (the code) and it gets turned into an executable. When you want to change some behavior, you change the code parts that relate to the behavior and the whole thing is compiled again.

With agentic programming, there’s no full spec, no “codebase in English”. You write instructions but they are discarded as soon as you close your session, and what’s left is this lower level thing (the code written in a traditional programming language).

It’s almost like a difference between declarative and imperative paradigm for the process of creating software.
by matltc | 2026-02-21 09:44:16+00:00
I disclosed a vulnerability much like this one. .gov website. Incrementing IDs. No password to crack, just a url parameter with a Boolean value. Pretty much

example.com/clients/fullz?id=123&butDoIReallyHaveToAuth=false

Changed param key but yeah. Just that. You did need to have an authenticated session, but any valid session token would do.

They hit me with same kind of response. I got a lawyer. Worked out in the end, but I was out three hundred bucks for the consultation

That was the last vulnerability I will ever disclose
by fuzzy2 | 2026-02-21 09:45:08+00:00
That would be illegal. I doubt Shopify are to blame here, it's more likely one of the gazillion plugins that every shop uses was the vector. Either way, it's highly likely the shop owner is the data controller, from a legal perspective.

(Scenario: E-Mail address A with shop A, address B with shop B, then received a newsletter I did not subscribe to [already illegal] from shop B to address A. Only common data point: PayPal account.)
by jeroenhd | 2026-02-21 09:45:13+00:00
It could be a donated account. I've noticed archive.whatever also bypasses some paywalls by using legitimate account logins but I doubt there's one person going around subscribing to every news outlet that gets any coverage.

If archive.whatever wasn't so useful to the general public, it'd be hard to distinguish from a criminal operation given the way it operates, unlike say the Internet Archive who goes through all of the proper legal paperwork to be a real nonprofit.
by xvilka | 2026-02-21 09:45:25+00:00
Lean is a great idea, especially the 4th version, a huge level up from the 3rd one, but its core still deficient[1] in some particular scenarious (see an interesting discussion[2] in the Rock (formerly Coq) issue tracker). Not sure if it might hinder the automation with the AI.

[1] https://artagnon.com/logic/leancoq

[2] https://github.com/rocq-prover/rocq/issues/10871
by locknitpicker | 2026-02-21 09:45:28+00:00
> Working without branches, except for releases, is the most effective way of working, using rebase instead of merge to get a single line of commits.

I think you're confusing workflows with commit history.

You can work with feature branches all you want, rebase them as you feel like it, and then do squash merges to main.

The likes of GitHub even have a button for this.
by 5o1ecist | 2026-02-21 09:47:01+00:00
There's no need for you to worry about it, MY FELLOW HUMAN [1], because you will never know.

[1] https://old.reddit.com/r/totallynotrobots

PS: Of course that's not true. An ID system for humans will inevitably become mandatory and, naturally, politicians will soon enough create a reason to use it for enforcing a planet wide totalitarian government watched over by Big Brother.

Conspiracy-theory-nonsense? Maybe! I'll invite some billionaires to pizza and ask them what they think.
by athrowaway3z | 2026-02-21 09:47:13+00:00
I have no clue what you're trying to say.

The whole point is that people don't throw away their original device.

Yours situation seems rather niche, and it sounds like you might be going out of 'business' while at the same time allowing 1000x times the number of people to want to do dummy-self-repairs (i.e. replace their batteries) even if it's with a bit more theater about who is licensed.

The total number of people means much more demand - even for what you cook-up manually as not-a-business.
by SanjayMehta | 2026-02-21 09:47:26+00:00
LinkedIn locked me out of my account, and wants me to verify via this same Persona company. I didn't read the terms but there's no way I'm giving Microsoft or its minions my govt id.

What this user missed is the affidavit option: you can get a piece of paper attested by a local authority and upload that instead, if you really really need a LinkedIn verified account.

Microsoft can go jump.
by lloeki | 2026-02-21 09:49:00+00:00
> I like not conflating those two things

Fair enough!

It simply occurred to me that if your `user.defaultBranch` is set to e.g `trunk` then presumably when you `git init` you also want it to create a `trunk` branch, ergo `init.defaultBranch` would be set to the same value, ergo... irrespective of naming, could they actually be the same thing?