MurphyA/hacker-news huggingface dataset:
by andrelaszlo | 2026-02-21 00:22:32+00:00
Last year I found a vulnerability in a large annual event's ticket system, allowing me to download tickets from other users.

I had bought a ticket, which arrived as a link by email. The URL was something like example.com/tickets/[string]

The string was just the order number in base 64. The order number was, of course, sequential.

I emailed the organizer and the company that built the order system. They immediately fixed it... Just kidding. It's still wide open and I didn't hear anything from them.

I'm waiting for this year's edition. Maybe they'll have fixed it.
by rgblambda | 2026-02-21 00:22:57+00:00
>If there is a direct call to action then they should be held responsible

>They directed people to kill and as such they were guilty.

I'm glad we finally reached an agreement that people can and should be held criminally responsible for their words.

>They cannot use the excuse they were following orders.

Good, though that's not what was being argued. I think you knew that though.
by jpmitchell | 2026-02-21 00:23:07+00:00
For me at least, the advent of coding AI has just forced me to finally accept a truth that I probably always knew: that I'm an average (at best) software developer, and that I don't have anything truly unique or impressive to contribute to the field. My side projects were always just for myself.

I love computing, and programming. If anything I'm better able to appreciate that now that I no longer care if my work has any impact.
by ouhamouch | 2026-02-21 00:23:34+00:00
Yes.

Archive.org snapshots may load javascript from external sites, where the original page had loaded them. That script can change anything on the page. Most often, the domain is expired and hijacked by a parking company, so it just replaces the whole page with ads.

Example: https://web.archive.org/web/20140701040026/http://echo.msk.r...

----

And another example: https://web.archive.org/web/20260219005158/https://time.is/

The page "got changed" every second. It is easy to make an archived page which would show different content depending on current time or whether you have Mac or Windows, or your locale, or browser fingerpring, or ...
by lapcat | 2026-02-21 00:23:49+00:00
> That's the same argument people made about Twitter. "If it goes bad, we'll just leave." We know how that played out.

I did just leave Twitter. For me, it played out fine.

> Bluesky is built on ATProto, an open protocol. The pitch is simple: your data is yours, your identity is yours, and if you don't like what Bluesky is doing, you can take everything and leave.

Is that actually the pitch? I thought the pitch was that Bluesky is not Twitter.

I find it strange to think of my social media posts as "my data". I intentionally posted on someone else's website. The posts are part of a public conversation and in large part make sense only in context.

In my opinion, the most crucial part of social media posts are the links, the URLs. On any social media site, you might be able to export your data, but that's kind of pointless, because your "data" lives at a certain URL, and it won't help to have an export if the links are broken.

There's actually a fate worse than acquisition: closure. This happened to the social network app.net, for example, which I was on years ago. All of my posts are gone, the site offline. At least my old Twitter URLs still work (they redirect to x.com). In any case, you know there's only one way to guarantee that the things you post online stay online: self-hosting. Maintain your own website. No social network can solve that problem for you.

> In practice, running your own mail server is painful and everyone just uses Gmail.

This is not even remotely true.

It is true that a lot of people use Gmail, but there are plenty of other email services. I personally have accounts with several different providers. My main one is my web host.

> And then there's the money. You don't raise $120M at a $700M valuation to run a public utility. Those investors need a return.

I think this is the most important point in the article, but not because of the protocol or decentralization. The question is, when and how will Bluesky be enshittified?
by browningstreet | 2026-02-21 00:23:56+00:00
Bluesky isn't my bank records, isn't my photo archive, isn't my github, isn't my Documents folder.

I don't care if Bluesky goes away, gets bought, whatever.

Social media is disposable like a retail outlet. I'm sad if the coffee shop around the corner goes out of business, but there are 99K coffee shops in the US. I can go to another one.

As it is, I don't use Meta or X.. because they're led by despicable beings. Bluesky gets a pass for now, and has enough interesting people that I show up and have a chat. Like a coffee shop or a bar.
by KevinMS | 2026-02-21 00:24:08+00:00
So you see general entertainment TV shows as the same as literally conservative radio? If a conservative radio show gave equal time to Jasmine Crockett who would even listen? If Hannity gave equal time to Joe Biden, probably hours of equal time, who would even want that? Or take it seriously? That's like a Mosque giving equal time to a Rabbi. That's not the spirit of the rule. Late night entertainment shows were getting around the rule by claiming they were news shows that are exempt.
by staticassertion | 2026-02-21 00:25:05+00:00
I don't really agree. Maybe I do, but I probably have mixed feelings about that at least.

DoS is distinct because it's only considered a "security" issue due to arbitrary conversations that happened decades ago. There's simply not a good justification today for it. If you care about DoS, you care about almost every bug, and this is something for your team to consider for availability.

That is distinct from, say, remote code execution, which not only encompasses DoS but is radically more powerful. I think it's entirely reasonable to say "RCE is wroth calling out as a particularly powerful capability".

I suppose I would put it this way. An API has various guarantees. Some of those guarantees are on "won't crash", or "terminates eventually", but that's actually insanely uncommon and not standard, therefor DoS is sort of pointless. Some of those guarantees are "won't let unauthorized users log in" or "won't give arbitrary code execution", which are guarantees we kind of just want to take for granted because they're so insanely important to the vast majority of users.

I kinda reject the framing that it's impossible to categorize security vulnerabilities broadly without extremely specific threat models, I just think that that's the case for DoS.

There are other issues like "is it real" ie: "is this even exploitable?" and there's perhaps some nuance, and there's issues like "this isn't reachable from my code", etc. But I do think DoS doesn't fall into the nuanced position, it's just flatly an outdated concept.
by aswihart | 2026-02-21 00:26:52+00:00
> Dependencies should be updated according to your development cycle, not the cycle of each of your dependencies. For example you might want to update dependencies all at once when you begin a release development cycle, as opposed to when each dependency completes theirs.

We're in this space and our approach was to supplement Dependabot rather than replace it. Our app (https://www.infield.ai) focuses more on the project management and team coordination aspect of dependency management. We break upgrade work down into three swim lanes: a) individual upgrades that are required in order to address a known security vulnerability (reactive, most addressed by Dependabot) b) medium-priority upgrades due to staleness or abandonedness, and c) framework upgrades that may take several months to complete, like upgrading Rails or Django. Our software helps you prioritize the work in each of these buckets, record what work has been done, and track your libyear over time so you can manage your maintenance rotation.
by subscribed | 2026-02-21 00:27:14+00:00
Let me list several of the more impactful.

- dedicated, certified security coprocessor (Titan M2) - on pixel it's fused with verified boot, offers key storage, firmware isolation and anti rollback.

- verified boot: mandatory and backed by Titan, immutable boot from. Almost all laptops lack as much as anti rollback.

- strong hardware-backed key protection and actually isolated TEE. Yes, I know about Intel (SGX/TDX) and AMD (SEV/SME). Broken into many times over. How many commodity hardware devices offer comprehensive protections like Titan-backed TEE?

- secure hardware-backed disk encryption key derivation (with throttling of course)

- on-device attestation: complete verification of the entire chain. Dreaded Play Integrity or open AOSP / GrapheneOS hardware attestation. Which PC vendors can offer that? Perhaps Apple but that's not a pc and you won't run qubes on that?

- physical anti-tamper: which laptops wipe encryption keys stored in the secure hardware when you're trying to unlock the bootloader?

- physical memory tagging (see ARM MTE). Apple offers some but again, that's not for qubes. Intel promises MKTME in the future.

- does your laptop disable all the unconnected ports whilst the laptop is broken? Does your pin/password verification happen inside TEE/TPM, not in the OS?

- modes similar to PXN/SMEP, SMAP/PAN (to stop these pesky wifi/gpu firmware from reading userpace memory). There's some support for SMEP and SMAP on intel/amd

- microcode and firmware upgrades velocity

There are reasons GOS doesn't support any hardware other than pixels. Regrettably and thankfully that is about to change soon <3

Don't read me wrong, qubes is brilliant and on SOME hardware (business grade laptops with TPM 2.0, verified firmware upgrade process with some protections and proved track progress with rapid hardware drivers and firmware upgrades -- sure, brilliant choice. For pcs.

But is not even remotely close security-wise..

Best available would be probably Purism Libre (lacking TPM if I read it correctly, weak hardware but, oh well, pixel is not super fast either lol), or something with coreboot perhaps?

Whats the safest and still useful laptop hardware you cna think of?
Let's compare with with pixel.
by operator-name | 2026-02-21 00:28:12+00:00
The custom Github Actions approach is very customisable and flexible. In theory you could make and even auto approve bumps.

If you want something more structured, I’ve been playing with and can recommend Renovate (no affiliation). Renovate supports far more ecosystems, has a better community and customisation.

Having tried it I can’t believe how relatively poor Dependabot, the default tool is something we put up with by default. Take something simple like multi layer dockerfiles. This has been a docker features for a while now, yet it’s still silently unsupported by dependabot!
by lumirth | 2026-02-21 00:28:13+00:00
The thing that strikes me is that AI CEOs themselves make the claim that "AI will replace workers." Which seems a little nonsensical. Why would you say something like that, won't everyone hate you? After seeing some polls of the broader public's outlook on AI (can't remember where), it seem people do hate the C-suite for saying things like this. It's terrible marketing.

Here's the trick: it's not the public they're marketing to. It's other CEOs. As is often the case, consumers are either the product, or, best case, bystanders, and worst case, victims, of the machinations of the corporate world. May both sides of all of their pillows be warm. May their beds be filled with crumbs.
by fsloth | 2026-02-21 00:28:22+00:00
Fun fact: Erwise[0] was the first _graphical_ browser developed by a group of students in Helsinki University of Technology with Sir Berners Lee. Sadly there was no funding in Finland available at the time and they had to abandon the project and most of the group ended up working at Tekla, contributing to a bunch of cool AEC CAD technology (Tekla is now a Trimble subsidiary).

[0]https://en.wikipedia.org/wiki/Erwise
by breve | 2026-02-21 00:28:45+00:00
Dude. That's not evidence, that's advertising. You're taking at face value a claim made by a company that has lied continuously for over a decade about the self-driving capabilities of their cars:

https://motherfrunker.ca/fsd/

https://en.wikipedia.org/wiki/List_of_predictions_for_autono...

Remember how there were supposed to be 1 million robotaxis on the road by 2020:

https://www.thedrive.com/news/38129/elon-musk-promised-1-mil...

Lying is part of the company culture at Tesla. They even lie about dumb things there's simply no need to lie about, but they go ahead and lie anyway:

https://www.motortrend.com/reviews/tesla-cybertruck-beast-vs...

https://www.youtube.com/watch?v=K0AJmLvKjxw

https://www.youtube.com/watch?v=5J3H8--CQRE

It's not rational to swallow Tesla's lies hook, line, and sinker. If you can't produce independent verification of Tesla's claims then there's nothing to talk about.
by dinkelberg | 2026-02-21 00:29:22+00:00
One more relevant study, but on the health effects of long term melatonin use:

https://newsroom.heart.org/news/long-term-use-of-melatonin-s...

"The main analysis found:

* Among adults with insomnia, those whose electronic health records indicated long-term melatonin use (12 months or more) had about a 90% higher chance of incident heart failure over 5 years compared with matched non-users (4.6% vs. 2.7%, respectively).
* There was a similar result (82% higher) when researchers analyzed people who had at least 2 melatonin prescriptions filled at least 90 days apart. (Melatonin is only available by prescription in the United Kingdom.)

A secondary analysis found:

* Participants taking melatonin were nearly 3.5 times as likely to be hospitalized for heart failure when compared to those not taking melatonin (19.0% vs. 6.6%, respectively).
* Participants in the melatonin group were nearly twice as likely to die from any cause than those in the non-melatonin group (7.8% vs. 4.3%, respectively) over the 5-year period."

However they were not able to control for severity of the insomnia and used dosage, because that data weren't in the dataset.
Show HN: Routype – typed REST client in ~200 lines, no codegen
by jbingen | 2026-02-21 00:29:41+00:00
I wanted a typed client for existing REST endpoints without adopting tRPC's architecture or maintaining OpenAPI schemas. Most solutions either replace your routing layer or add a build step. This just wires TypeScript types to your existing routes.

You describe your routes once with a lightweight helper, then get a fully typed fetch wrapper. Params, query, body, and output are all inferred. Wrong shapes are compile errors. Zero dependencies, zero runtime magic.

```
// before
const user = await fetch(`/users/${id}`).then(r => r.json()) // any

// after
const user = await api.getUser({ params: { id } }) // User
```

Works with any framework (Express, Hono, Next.js, etc). Optional Zod integration if you want runtime validation from the same source of truth.
by raw_anon_1111 | 2026-02-21 00:30:28+00:00
You actually check your email regularly? How much effort does it really take to transfer a balance on a phone?

For Bank Of America it’s:

1. Click on “pay & transfer”

2. Click on “transfer”

3. Click on “From” and choose account

4. click on “to” and choose account

Then type in the amount and and click on the date?

Is it really that much easier on a computer?
by tl2do | 2026-02-21 00:30:51+00:00
I have similar and deep privacy concerns. But I also know that cameras have helped find criminals and assist crime victims. I don't want to let fugitives go without punishment. In fact, I must admit that cameras are a realistic choice given the current technology.

Flock Safety must be under public evaluation. Tech companies tend to hide technical specs, calling them trade secrets. But most internet security standards are public. What should be private is the encryption key. The measure to protect development effort is patents, which are public in the registry.
by denuoweb | 2026-02-21 00:31:02+00:00
You are not a registered nonprofit. Look yourselves up, you cannot, because you are not listed: https://apps.irs.gov/

Your donations page lists a Pakistani bank, and you do not provide an American EIN, yet you claim to be based in New Mexico. Who is your registered agent? Calling yourselves a nonprofit when you are not actually a nonprofit is not a good start.

This appears to be a legitimacy issue, not a Stripe software issue.
by sushshs | 2026-02-21 00:31:23+00:00
I used to think stuff like this was immoral and cringe. As I’ve aged, it’s become more and more obvious you need a tribe or you’ll lose to somebody that does. I’m not personally Christian, but I grew up and generally like white Christian societies compared to the alternative. And my morals are basically inline with the religion - how could they not be? The west was a Christian project until very recently. It’d be like a fish asking “what’s water?”. So ubiquitous you don’t even realize it until it’s gone.

That being said, Trump is awful and his admin is not gonna do anything but gaslight his supporters, so while im ok with this in principle, I’m aware in reality it’ll be used for net negative things (akin to his cruel fumbling of deportations).
by janice1999 | 2026-02-21 00:32:01+00:00
> ...exploitative practices of the silicon valley elite have gone mainstream and will hopefully course correct the industry in time.

I have little hope that is true. Don't expect privacy laws and boycott campaigns. That very same elite control the law via bribes to US politicians (and indirectly the laws of other counties via those politicians threats, see the ongoing watering down of EU laws). They also directly control public discourse via ownership of the media and mainstream communication platforms. What backlash can they really suffer?
by zug_zug | 2026-02-21 00:32:09+00:00
As a neutral 3rd-party who wants to help you speed-run your self-growth (because I like your energy):

- Yeah you come across as aggro. That's okay, sounds like you went through some stuff.

- Sounds like you've identified you grew up in a weird situation. That sounds bad, sucks you had to go through that.

- But it also sounds like there's a piece of you that's trying to overcorrect. I understand, it's common among us nerds -- you grow up in a situation where you aren't as appreciated as you should be and you try to turn off that feeling entirely somehow. Unfortunately these types of attempts to hack our own feelings are usually worse than the problems in the first place. Usually the best course is to slowly try to remind yourself (over years) "That was a bad situation, it was bad luck, it meant nothing, and it's not the norm. I don't need to fundamentally change to not have that happen again."
by yongjik | 2026-02-21 00:32:14+00:00
> those protestors also broke into an military armory, armed themselves to the teeth, and an armed conflict broke out

Oh you are one of those people.

So when you said you were "surprised by the lack of depth of assessing Korea's history of prosecuting its presidents" you were complaining that people didn't follow your far-right revisionist history of Korea?

Talking with the likes of you is waste of my time, but just to clear the matter for others interested:

On May 18th, 1980, paratroopers were beating and arresting residents of Gwangju, not just protestors but random civilians, going into people's homes to beat up everyone and arrest anyone they didn't like. By 20th, multiple people were beaten to death, and as people got angry protests became larger and larger.

On 21st, the street of Geumnam-ro was packed with tens of thousands of protestors. On 1 pm, soldiers opened fire on protestors, with more than 50 dying. That afternoon, people started organizing armed militia.

These are all very well known and publicly available information, a google search away for anyone who can read Korean.

English summary is also available at: https://en.wikipedia.org/wiki/Gwangju_Uprising
by alephnerd | 2026-02-21 00:32:58+00:00
> Probably the best thing that could happen for their security would be an above ground nuclear weapons test to get everyone off their back.

Then KSA makes a nuke. Then Turkiye. Then the UAE. Then Egypt...

> It's not like surrending their program is going to save them, just ask Gadaffi about how it worked out for him. Oh wait

Yep.

But it will reduce the risk of us using scorched earth tactics to deindustrialize and collapse Iran as a warning to other countries.

A managed transition to amenable leadership (clerical or secular) and complete US or EU control of Iran's nuclear program would be good enough for us.

> it's not like they're the ones starting the nuclear race in the region: that one's on Israel

Take up Israel's nuclear program with the French, not us Americans - it was De Gaulle who sent his nuclear engineers to build Israel's nuclear program in the 1950s-60s [0].

We could not denuclearize Israel on time in the 1970s, just like we can't denuclearize China, India, Pakistan, or North Korea.

This is also why Israel was treated as a pariah state by the US from the 1970s-90s [1][2][3]. The US-Israel relationship only took off in the 2000s under Clinton 2 and Bush.

[0] - https://www.cia.gov/readingroom/docs/DOC_0000271219.pdf

[1] - https://www.cia.gov/readingroom/docs/CIA-RDP86T01017R0001007...

[2] - https://www.cia.gov/readingroom/docs/CIA-RDP91-00561R0001000...

[3] - https://www.cia.gov/readingroom/docs/CIA-RDP90-00965R0008072...
by selridge | 2026-02-21 00:33:26+00:00
Yeah, that’s the concern.

We are in the middle of an earthquake. The 90s was like this, but it’s bigger. Radical changes in what it means to build software are happening right now. That will without a hair of a doubt result in equally radical changes in what constitutes good and bad work.

Maybe, just maybe, the thing that seems really durable (taste) is already getting put into a blender that’s still running.
by scythe | 2026-02-21 00:34:10+00:00
The argument about luminance ranges is wrong. I measure the brightness of monitors regularly as part of my job, and typical maximum luminance values are in the range of 100-500 lux. That puts you right in the steep range of the visual response (especially if you are turning it down and near a max of 100), which is natural — maximizing the slope of the neuronal response to light means that more information will be available to the brain. In fact a good monitor will be tuned according to the just-noticeable difference which aims precisely to maximize the information available according to this characteristic curve. See e.g. the DICOM standard:

https://dicom.nema.org/medical/dicom/current/output/chtml/pa...

The author's basic problem is that he knows too much about the brain and not enough about monitors.

The author goes on to argue that you should be turning your brightness down, but most people already are turning their brightness down; the blue light filter is more comfortable. He does make a reasonable case that you should be reducing green light similarly, but people prefer the incandescent effect of the flux filter to a straightforward color filter — indeed a primary design goal of these filters has been to be pleasant to look at which is why people use them.
by dunham | 2026-02-21 00:34:41+00:00
It's been a very long time, but my recollection was the Mosaic did images first, and it was non-standard. (The beginning of the end.) I might be thinking of some other feature though.

I was also disappointed that the editing went away after the first browser. (There was "Amaya" which had editing, but it was a research thing and not a commonly used browser.)
by rconti | 2026-02-21 00:34:50+00:00
I always really enjoyed Facebook -- much more so than any other social media network. It was all friends, friends' content, and groups I was interested in and cared about. Sure it had ads, and a bit of suggested stuff, but mostly it was interesting content, no ragebait, no politics.

But as those friends use it less and less, I use it less and less. And the less I use it, the more "suggested" crap I get. If I don't use it for a week, the site is absolute garbage.