MurphyA/hacker-news huggingface dataset:
by danudey | 2026-03-05 21:22:05+00:00
If you're interested in implementing this directly into your dockerfiles with some minimal changes, Docker already supports this to a degree:

https://docs.docker.com/reference/dockerfile/#copy---link

The TL;DR:

If you change your dockerfile to use `COPY --link <foo> <bar>`, then docker will create a layer containing only the files that would be copied, and that layer is treated as independent of layers coming before it. The only caveat is that you need to have a build cache with previous builds and use --cache-from to specify it, which means saving build state.

That said, there are a lot of benefits you can get very quickly if you can implement it. For example, if you have a dockerfile which creates a container, builds your golang application in it, and then copies the result into a fresh alpine:3.23.3 image, and you use a local cache for that build, then when you update to alpine 3.23.4 it will see that the build layers have not changed, therefore the `COPY --link` layer has not changed. Thus, it can just directly apply that on top of the new alpine image without doing any extra work.

Apparently it can even be smart enough to realize that it doesn't need to pull down the new alpine:3.23.4 image; it can just create a manifest that references its layers and upload the manifest; the new alpine image layers are there, the original 'my application' layers are already there, so it just creates a new manifest and publishes it. No bandwidth used at all!

> How many copies of `python3.10` do I have floating around `/var/lib/docker`.

Well, if you use 'FROM python:3.10' for your images then only one.

If you're careful, you can sort of pull together contents of multiple images by using `COPY --link`, and then even if you have 10 layers then changing from python:3.10 to python:3.14 only changes one of them.

Again, this does require that you maintain a cache, but that cache can live in a lot of places that doesn't have to be the local filesystem: https://docs.docker.com/reference/cli/docker/buildx/build/#c...
by larodi | 2026-03-05 21:23:06+00:00
yes, they will hit the TV or through the remote, or bang the mouse, or the box. I mean - if you tell me this is 'care', no... this is outrage, and it would probably not even be focused to one particular component.

and for what is worth - the reason of failure may not be because of particular nut, but the combination of them all.

the whole idea that most software is done in good faith is just plainly wrong, and most of the software we rely on a daily basis - all the enterprise bullshit - is very very very often not done in good faith, but rather just made, seamed, helped into some weird equilibrium of temporary performance.

perhaps hardware is done right more than software ever is.
by kelnos | 2026-03-05 21:23:10+00:00
> How did people manage this prior to 2007?

Paper maps. Or even (in the earlier 00s) looking up directions on MapQuest or whatever, and then printing those directions out. I don't want to keep printing out directions; what a huge waste of paper that would be. Paper maps are doable, but awkward to use, and can easily become out of date. You need to have addresses (or at least nearby landmarks or cross-streets) for everywhere you want to go, because paper maps have a very limited set of points-of-interest on them.

> Those restaurants are worthless

That's just, like, your opinion, man. Your criticisms seem to mostly amount to "people should just abandon the various conveniences and niceties that smartphones provide, because there are alternatives, even in cases where those alternatives are incredibly inconvenient".

Yes, it's idiotic that we're subjected to so much tracking when we carry our phones around. But the response shouldn't be "let's just become a luddite and not take advantage of modern technology". It should be "wow, this makes me fucking angry; we need to fix our laws so this sort of thing doesn't happen".
by D-Machine | 2026-03-05 21:23:31+00:00
Correct. My TL:DR summary would be:

- when quantifying for gum and patches, it is really hard to conclude that these pure forms of nicotine are any different from caffeine in harms / addictiveness

- cigarettes, or even pure tobacco smoked is definitely addictive and bad due to other compounds in play

- chewing tobacco products are likely a lot less worse than smoking, but still probably worse than pure nicotine gum or patches

- data is very unclear on vaping

IMO experience suggests vaping can clearly be highly addictive (see: young adults and teens), and I know personally there is even some minimal research on vaping e.g. THC that shows that vaping might be worse than just smoking cannabis, so vaping definitely warrants caution in general [though vaping THC requires much higher temps and different solvents, and involves different terpenes and other compounds].
by nostrademons | 2026-03-05 21:23:39+00:00
I kinda wonder if this is how we got DeepSeek. It was developed by a Chinese hedge fund. Entirely possible their business model was to take out large leveraged puts against the major U.S. AI vendors; shit on their business models with an entirely open-source model; and profit. The stock market certainly dropped in a massive way when DeepSeek was released, so if they traded against NVDA/GOOG/META et al, they profited in a big way.
by erelong | 2026-03-05 21:24:01+00:00
hopefully this continues to show how awkward the idea of "intellectual property" (IP) is until people abandon it

IP sounds good in theory but enables things like "patent trolling" by large corps and creating all kinds of goofy barriers and arbitrary questions like we're asking about if re-implementations of ideas are "really ours"

(maybe they were never anyone's in the first place, outside of legally created mentalities)

ideas seem to fundamentally not operate like physical things so asserting they can be considered "property" opens the door for all kinds of absurdities like as pondered in the OP
by ezst | 2026-03-05 21:24:55+00:00
Or not. I've been using Linux since 2006, initially for fun and giggles, and then by choice, and nowadays it's without a doubt the superior alternative. My successive employers forcing me through Windows gave me the "privilege" of daily-driving Windows at work and seeing up-close everything that Microsoft has produced since XP. That show-stopping 15min drivers installation because you plugged-in some headset or mouse? That's Windows-only. That screen positioning that can't be remembered consistently between work and office? Ditto. That nefarious hours-long unskippable OS-upgrade? Same. That feeling of losing your mind because you configured something in a specific way and now it's gone? Oh yeah, that's Windows overriding your user-preferences behind your back, just because. Your playlist blasting in the open space? Apparently that's a Windows feature of your bluetooth headphones switching off (even when they were not playing because your playlist was paused). That wifi that you have to re-enter the credentials once a month or so? Yeah, Windows suspend/resume once again crapped and that somehow caused network amnesia. And that's just the hardware-ish stuff. The permanent nagging, upselling, silly distractions, adverts and overall lack of polish and stability is nothing new in software-land.

I cannot remember when I last had a network, bluetooth, audio or driver issue with Linux on my ThinkPad. I legitimately cannot. But I can assure you I that had 3 of those in the last couple weeks alone on my work's HP elitebook with W11 24H2.
by zarzavat | 2026-03-05 21:25:37+00:00
What are we supposed to talk about in this thread exactly? The developers of this model are evil. Are we supposed to just write dry comments about benchmarks while OpenAI condones their models being deployed for autonomously killing people?

Yes I'm sure it makes a very nice bicycle SVG. I will be sure to ask the OpenAI killbots for a copy when they arrive at my house.
by xpe | 2026-03-05 21:25:55+00:00
> There are game theoretic reasons why a military should never accept any external restrictions on an asset.

1. Last week I made a case for why DoD, if rational, would accept limited use under a consequentialist decision theory frame:
https://news.ycombinator.com/item?id=47190039

2. One what basis is it rational to give the current administration (the leadership) the benefit of the doubt w.r.t. having a sincere drive towards advancing the national security of the United States? The evidence highly points in the other direction: towards corruption, political ends, and narcissistic whims.
by krasikra | 2026-03-05 21:26:01+00:00
This is a great reminder that AI-assisted development tools need sandboxing at minimum. The attack surface with AI agents that can read/write files and execute code is enormous.

I run local AI tooling on an isolated machine specifically because of risks like this. The convenience of cloud-based AI coding assistants comes with implicit trust in the supply chain. Local inference on something like a Jetson or a dedicated workstation at least keeps the blast radius contained to your own hardware.

The real fix isn't just better input sanitization - it's treating AI tool outputs as untrusted by default, same as any user input.
by krasikra | 2026-03-05 21:26:09+00:00
The hardest engineering skill I've developed is knowing when to stop optimizing. There's always another microsecond to shave, another edge case to handle, another abstraction to introduce.

The best codebases I've worked with share a common trait: they have clear boundaries about what they don't do. The worst ones try to be everything and end up being nothing well.

This applies doubly to developer tools. The ones that survive decades (Make, grep, curl) do one thing and compose well. The ones that try to be platforms tend to collapse under their own weight.
by krasikra | 2026-03-05 21:26:16+00:00
Excellent deep dive. The uevent/netlink path is one of those things every Linux developer should understand but few actually trace through.

One thing worth adding: on embedded systems (ARM SBCs, Jetson boards), hotplug behavior can be surprisingly different from x86. Some device tree overlays don't fire proper uevents, and you end up polling sysfs as a fallback. The kernel's device model assumes a level of firmware cooperation that embedded vendors don't always provide.

The kobject lifecycle diagram alone makes this worth bookmarking.
by mitthrowaway2 | 2026-03-05 21:26:17+00:00
Because last time I checked, private companies that voluntarily offer a service to the government on contract terms are free to put whatever restrictions they want into their contract, and the government is free to not sign it if they don't like it?

Or is, say, FedEx now a supply chain risk too, if they happened to offer parcel delivery services for the DoD and put in a clause excluding delivery to active war zones?
by shimman | 2026-03-05 21:26:59+00:00
Of course we can, these are all non physical properties of the universe. We can design things to not enable tracking or advertising, we just don't because the public isn't allowed to provide public solutions so we're forced to use malware by corporations that profit off of the malware.

Do people seriously forget that humans design with an explicit purpose? That purpose can change you know...

edit: needs to be stated that the last data privacy law the US passed was regarding video rentals in the 80s.
by tetris11 | 2026-03-05 21:27:01+00:00
At the starting of the week
At summit talks you'll hear
them speak
It's only Monday

You could be sitting,
taking lunch
The news will hit you like
a punch
It's only Tuesday

We'll all go running
underground
And we'll be listening for
the sound
It's only Wednesday

You'll hear a whistling
overhead
Are you alive or are you
dead?
It's only Thursday

Though that shelter is your
home
The living space, you have
outgrown
It's only Friday

Tomorrow never comes until
it's too late

Six Day War (Colonel Bagshot)
by t-writescode | 2026-03-05 21:27:20+00:00
I know there’s a series of unfortunate events that can lead to this information accidentally getting logged into a log file; but the comedy of errors necessary to get there almost leads itself to malice rather than accident.

Have we as developers gotten so lazy with our permissions requesting that we think it’s okay to ask for all message access? If not, why ask for it? Why *log* every message, afterward? What pull request approved that? What PR was approved that logged the auth token?

Even more to the messages, if they’re logging them, they can see them. If they can see them, how do we know if they are or aren’t sending them to their servers?

Ugh.
by kelnos | 2026-03-05 21:28:01+00:00
> The decision will be predicated on whether I can do everything in person.

I don't want to do everything in person. It's frankly amazing that I can deposit a check on my phone, from my home, and don't have to go to a bank branch to deposit it anymore. For close to 20 years now, my primary banking has been through banks that don't have a physical presence at all, let alone in my city. And I don't mind it that way at all; in fact I like it, because these banks focus harder on making things more convenient for me.

Your attitude here seems to be that if other people's preferred method for doing something doesn't conform to your preferred method, then the other people must be wrong somehow. That's not a reasonable way to be looking at this.
by Animats | 2026-03-05 21:29:01+00:00
Only the military, and some banks, really take physical security seriously.

Someone tried to crash through the main gate at the Camp Pendleton Marine Corps Base two years ago. It did not end well for them.[1]

Attempt to crash the gate at CIA HQ last year. Drunk driver shot.[2]

Attempt to crash the gate at NSA HQ a few years ago. Two drugged-out "men dressed in women's clothing". Hit barrier, tried to turn around and escape, blocked by guard vehicle. One killed, one injured, one guard injured.[3]

[1] https://www.youtube.com/watch?v=RPQPKnNj8wM

[2] https://www.nytimes.com/2025/05/22/us/shooting-cia-headquart...

[3] https://www.youtube.com/watch?v=K49x05eOowo
by Aurornis | 2026-03-05 21:29:12+00:00
> What a model mess!
OpenAI now has three price points: GPT 5.1, GPT 5.2 and now GPT 5.4.

I don't know, this feels unnecessarily nitpicky to me

It isn't hard to understand that 5.4 > 5.2 > 5.1. It's not hard to understand that the dash-variants have unique properties that you want to look up before selecting.

Especially for a target audience of software engineers skipping a version number is a common occurrence and never questioned.
by monster_truck | 2026-03-05 21:29:15+00:00
Wild timing on this. Been seeing a huge uptick in people "trying to learn opsec" as they fumble around for ways to make money with openclaw and land on "selling fake bags/shoes/watches", seemingly emboldened by those who value these brands trying to use openclaw to secure mispriced items or snipe auctions.

Funny thing is, I'm not sure anyone is actually doing either thing successfully. Every time I've looked into an openclaw success story it's ended up being complete fiction.
Ask HN: How to get resume noticed and a callback?
by wpoint | 2026-03-05 21:30:00+00:00
I am finding it hard to get my resume noticed. I have 15 years of experience with progressive growth from Software Engineer to Sr. Manager. I recently tried a startup that did not work out. We had a moderate revenue but unfortunately I had to shut it down because math did not work out. We also failed to raise next round after seed.

I was hands-on manager until half decade ago but as team size increased I did not find time to code. Now, it's incredibly hard to pick up and do Leetcode with kids at home.

I am not trying to complain or get sympathy from strangers. Thankfully I had a some reserve from which we kept spending but I have to get a job soon.

I have applied to a few positions in last two weeks but I got nothing. I got four to five auto rejections which appears mostly triggered by ATS.

With thousands of layoffs market is brutal and probably hundreds of laid-off managers are searching.

The new advice I am hearing is to ping HM on LinkedIn or ask recruiters about it. I am not sure if this will be a good strategy to get a position for EM roles. Unfortunately, many people from my network have got laid off and referrals are running dry.

What's the best way to get noticed and get a callback from recruiter or HM?

If you have any good examples of EM resumes that worked recently with AI everywhere I will appreciate that.
by Traster | 2026-03-05 21:31:07+00:00
Well firstly, they don't charge $200 for them because they can't produce them for $200. But the point I'm making is he seems to be trying to say they aren't beautiful. He says he's describing this "dark" world or "strange" watches. I do actually think he probably thinks the watches look strange. I don't think he thinks they're beautiful, maybe he'll find a brand to fall in love with one day. I doubt it because he seems to have too much of himself invested in this. But the people buying them don't think they're strange, they think they're beautiful. I don't go out telling everyone that they shouldn't buy a Ferrari because my Honda Civic can do the same job.
by jvanderbot | 2026-03-05 21:31:21+00:00
I'm not arguing with you - you have a valid point.

But I don't view hobbies as that separate from status signals within the hobbying group. Oh you play games? What games? Did you beat it? etc etc.

Esoteric knowledge/practices here are status signls (Oh you reached shattered planet without xyz??).

That starts to sound a lot like "Oh you aquired a lambo XYZ without usual steps abc" and that's a really fun convo in the in-group, and a total miss with the out-group.
by sebastiennight | 2026-03-05 21:31:27+00:00
> I'm not saying no one should write marketing copy, if that's your thing, go for it. Take your time, wordsmith. But for others they don't enjoy it or are not particularly good at it

The problem is that the generated "marketing copy" ends up being bland and ineffective (nobody "buys", so the copy fails at its single job) when using generalist LLM tools like eg. ChatGPT.

So in the end, you don't achieve the goal of "getting better copy" from it because neither version (neither the copy you'd have done naïvely without knowing anything about marketing, nor the LLM copy) converts anyone.
by BoiledCabbage | 2026-03-05 21:31:29+00:00
> Depending on their agreements, you could argue it's a rented asset. Doesn't change any calculus.

I think your mistakenly thinking of it as an asset. It's not as asset like a house, it's a service. They have a service contract. They have uptime and SLA commitments. That contract has parameters, and changing those parameters means a new contract.

A similar service would be signing up a private company to do intelligence gathering and analysis for the DoD in Asia. They find a company that specializes in Asia and sign a contract. They give them work and the contractors fulfill it. Coming back and saying "we want you now to give us analysis for important decisions in South America." The company would reasonably reply "we don't have the skills to do that in South America. Our team knows nothing about South Am, we're no better than someone off the street at that. There is no credibility behind anything we'd say about South America. And on top our contract was foe Asia". If we want to discuss a plan for hiring people for South Am let's discuss it, but that's a new contract." And then the DoD saying they're a supply chain risk makes no sense.

Or if you want an even more and hyperbolic example they cant take those data analysis to and say we're sending them ti the front lines of Iran. The company say no, and the DoD replying "you're a supply chain risk". They are not renting people, they are signing for a service of data analysis. Similarly they are not renting hardware they are signing for an LLM/intelligence service.
by ValentineC | 2026-03-05 21:31:41+00:00
It's also in the linked article:

> GPT‑5.4 in Codex includes experimental support for the 1M context window. Developers can try this by configuring model_context_window and model_auto_compact_token_limit. Requests that exceed the standard 272K context window count against usage limits at 2x the normal rate.
by motoxpro | 2026-03-05 21:32:10+00:00
This is what clouds like AWS, Azure, and GCP solve (vertex AI, etc). They are already an abstraction on top of the model makers with distribution built in.

I also don't believe there is any value in trying to aggregate consumers or businesses just to clean up model makers names/release schedule. Consumers just use the default, and businesses need clarity on the underlying change (e.g. why is it acting different? Oh google released 3.6)
by cheesecompiler | 2026-03-05 21:32:11+00:00
> I personally think all of this is exciting. I’m a strong supporter of putting things in the open with as little license enforcement as possible. I think society is better off when we share, and I consider the GPL to run against that spirit by restricting what can be done with it.

I like sharing too but could permissive only licenses not backfire? GPL emerged in an era where proprietary software ruled and companies weren't incentivized to open source. GPL helped ensure software stayed open which helped it become competitive against the monopoly proprietary giants resting on their laurels. The restriction helped innovation, not the supposedly free market.
by zkmon | 2026-03-05 21:32:29+00:00
This seems assumes coding as the usecase. A lot of business activity expects software outputs be precise, reproducible and can be held liable for accuracy. Imagine excel spreadsheet showing approximate numbers as formula outputs. "Caution: AI might make mistakes" is basically saying that I'm not responsible for correctness of my outputs. Does speed compensate for accuracy loss? Maybe, in some cases. But a lot of AI stories pretend that it is acceptable in all cases.
by idorosen | 2026-03-05 21:32:44+00:00
There is an old but still reasonable solution with mkinitcpio hooks encrypt/sd-encrypt + ssh, which is very easy to set up with EFI or grub2 onward. Tailscale is probably overkill for this use case, given that you're already exposing pre-/early- boot to the network by setting up interfaces that early. This became much more hermetic with secureboot and TPMs, too.
by D-Machine | 2026-03-05 21:32:48+00:00
> Both of these links go to self-reported data about how addicted people feel themselves to be

This is an incredible and outright lie.

Actually try reading the page I linked, there are plenty of links to scientific studies, scientific reviews, and high-quality resources, as well as lots of careful notes about serious confounds in the usual studies. This includes in exactly the sections I linked.

By all means still be cautious and not careless about using the stuff, that is a perfectly sane position. But I think it is very clear that e.g. patches and gum are highly unlikely to have anything even approaching the risk profile of classic tobacco products.
by nine_k | 2026-03-05 21:32:50+00:00
If we apply risk/reward analysis, how probable is such a chain of exploits? If you already got local root, you might as well do a little bit more than a simple DoS.

Depending on how much performance would be gained by using io_uring in a particular case, and how many layers of protection exist around your server, it might be a risk worth taking.