skysight-inc/HackerNews huggingface dataset:
Not trying to be perverse - but why does sha1-smol need any dependencies, let alone 40? Isn’t it a single public pure function from a slice of bytes to a u128? (Implemented with some temporary state and a handful of private functions.)

(I am likely being completely naive, but I am well satisfied by Julia’s stdlib function for this, so wondering what makes Rust different since I’ve been doing more and more rust lately and am trying to understand what the difference might be).
Never encountered it before, but it looks cool.

I think they are trying to solve a related problem. "We can consolidate the work by making a generic log that has networking and syncing built-in. This can be used by developers to make automatically-decentralized apps without writing a single line of networking code."

At a first glance, I would say that Gossiplog is a bit more low level, targeting developers of databases and queues, to save them from re-building a log every time. But then there are elements of sharing the log between components. Worth a deeper look, but seems a bit lower level abstraction.
Remember leftpad! :)

"Every dependency is an asset. Every dependency is a liability."

It's a balance.
Bluesky also doesn't show me videos of people dying every 10 minutes.
Thanks for marketing push for bluesky via nature!
yes a large component of it is about developers. if developers were perfect beings, we wouldn't need rust in the first place.
Do you have any advices for someone about to learn marketing as dev same as your younger self?
No, I don't feel like substantiating my claims to someone who assumes a default hostile response to me and makes nonsensical readings of what I say.

For instance, when I compare Lua to vim9 script and say the former is general purpose, I am obviously in the context of comparing the one scripting language to the latter. And you know that. And yet, even though you understand the context perfectly, you still choose to write "Lua is very much not a general-purpose Language..." and proceed to patronize me on semantics.

So, will I be able to substantiate? Yes. Will I bother to do so to you? No.
Do you still stand by your decision to give over the `sha1` name?
Compared to ... cmake? vckpg? conan?

I have never had a good experience with those. However, using

mydep.path = <path>

in cargo has never been an issue.

And I hate to say it, path-based deps are much easier in C++ / C than other "make the build system do a coherent checkout" options like those mentioned above. So we're at worst parity for this use case, IMHO and subject to my own subjectivity, of course
You can use cryptography to perform parts of verification. Specifically, you can use anonymous credentials to prove to a specific website that you have a credential. But that credential must then be issued by some authority that actually examines your physical "proof of age" (driver's license etc.) and issues it to your device.

The problem is that, at least at the moment, simply obtaining a credential like this has a huge chilling effect. You need to mail stuff into some crummy company chosen by the government, which then processes it and takes time. That company might be breached, which identifies you as "a person who is specifically interested in accessing adult content." Many of these problems can theoretically be fixed, but fixing them would have to be the goal of the authorities -- and I suspect it is not.
I upgraded all of my breakers to AFCI+GFCI. Worked flawlessly so far (about 6 months in).

The only two times where my AFCI tripped were 1) my blow-dryer shorted out due to a worn out cable (WAI) and 2) the PSU on my PC started tripping the AFCI (sent back to the manufacturer and got a replacement). So in both cases, at least for me, the AFCIs caught real problems.

Not a single trip of the GFCI function so far including vacuum, fride, and various power tools (and it's great peace of mind to have this with kids in the house).
Security jobbies using AI to find holes created by developers using AI. Too funny.
Leetcode has created a generation of illiterate programmers.
I recently revived a web app I wrote in 2006, my first startup. It was a social media site focused on media sharing. A pretty simple LAMP stack for the time. PHP 5, MySQL 3.2, but it has all of your typical (for the time) social media features. I revived this app because I wanted some hands-on time with new CI/CD tech that I don't get to use at my day job, so I'm working to extremely over-engineer the app's deployment process as a learning project. I could have used Wordpress or some other Hello World app, but this is a lot more fun.

I had written nearly all of the PHP from scratch. I wrote libraries for authentication/authorization, templating, form processing etc. I used one PEAR library for sending email. The frontend was vanilla HTML and there was barely any JavaScript to speak of. We used Flash for media playback. In other words, myself and my small team built nearly all of it ourselves. This was just how you did most things in 2006.

It only took me about an hour to get the 19-year old app up and running. I had to update the old PHP mysql drivers to mysqli, and update the database schema and some queries to work in MySQL 8 (mostly wrapping now-reserved words with backticks and adjusting column defaults which are now more strict). The only thing that didn't work was the Flash.

An hour to revive an app from 2006. Contrast this with my day job, wherein we run scores of Spring Boot apps written in Java 8 that have pages of vulnerabilities from tens of dozens of dependencies, which are not easy to update because updating one library necessitates updating many other libraries, and oh my goodness, the transitive dependencies. It's a nightmare, and because of this we only do the bare minimum of work to update the most critical vulnerabilities. There's no real plan to update everything because it's just too tall of an order.

And the funny thing is, if you compare what this PHP app from 2006 did, which had truly, barely any dependencies, to what these Spring Boot apps do, there is not a lot of difference. At the end of the day, it's all CRUD, with a lot more enterprise dressing and tooling around it.
> It’s the same as in C, Rust, or any other programming language I’ve ever used. If you don’t use a library, it doesn’t end up linked in your executable.

I don't think that's true. If the standard library is pre-compiled, and it doesn't use `-ffunction-sections` etc. then I'm pretty sure you'll just get the whole thing.

There is experimental support for building Rust's standard library from source, but by default it is pre-compiled.
that or sunshine on planets
I think asking them to fact check search results is probably unreasonable. Depends how far they are expected to go.
Yes but we already have illiterate programmers and there are companies who hire them, and the majority that recognises what they are and don’t. I’m talking about the code copy-pasters who cannot really reason about the problems they’re given nor understand how the code they pasted works. My point is that this is not a new phenomenon and I don’t think it will fool those that weren’t fooled by it before.
This is true for any type of assistance. We have had the same arguments about calculators a long time ago.
You’re right it was terrible for a while. I’m glad they fixed it.
You want to replace the shit smarts in a TV with a slow underpowered Firestick?
What I don't understand is how you don't end up with a totally impractical number of vectors if you have one per token? Surely nobody is storing that many in any real system?
"who can generate write-only text with a prompt" but won't understand why it is wrong.
It is quite clear by the result that you've spent all of your time/effort building some front end to genAI vs making a video editor. As of now, I see very little that looks like a video editor. There is no basic transport controls, there's no obvious way of trimming clips, there's nothing that says "you can edit videos" in this.

This is a very premature demo that does more harm than good in promoting your product. If you said we built a tool that makes it easy to generate content, then you'd have a much more interesting product. Tacking on claims of this being a video editor is extremely disappointing, as the most basic of abilities of a video editor are missing. This is what brings on the criticism of being a rushed product launch just for the PR postings.
I agree 100% .

Even though NodeJS is largely responsible for my career, NPM has given me more trauma than my messed up childhood.

Imagine you're a new programmer, you're working on a brand new app to show to all your friends. But you want to add a new dependency, it doesn't like all the other dependencies, cool you say I'll just update them. Next thing you know absolutely nothing works, Babel is screaming at you.

No worries, you'll figure something out. Next thing you know you're staring at open git issues where basic things literally don't work. Expo for example has an open issue where a default new react native project just won't build for Android .

It's like no one cares half the time, and in that case the solution isn't even in the node ecosystem, it's somewhere in the Android ecosystem. It's duct tape all the way down. But this can also inspire confidence if a billion dollar project can ship non-functional templates, then why do I have imposter syndrome when my side projects don't work half the time!
> You don't need a dozen regex libraries, you just need one that's stable, widely used and likely to remain so.

That is the case today. Virtually everyone uses `regex`.

There are others, like `fancy-regex`. But those would still exist even if `regex` was in std. But then actually it would suck, because then `fancy-regex` can't share dependencies with `regex`, which it does today. And because of that, you get a much smoother migration experience where you know that if your regexes are valid with `regex`, they'll work the same way in `fancy-regex`.

A better example might be datetime handling, of which there are now 3 general purpose libraries one can reasonably choose. But it would have been an unmitigated disaster if we (I am on libs-api) had just added the first datetime library to std that arose in the ecosystem.
Haha, no, but maybe all the AI-generated contents out there is starting to train me to write in a similar style...
I live in volcanic country so with the lidar data I can find things like old spatter cones hidden in the forest and sometimes lava tube entrances.

But it's also been logging country, historically, and the lidar data shows me old roads and old rail beds that used to wind through the area. Also Old logging camps and towns to become apparent.
This is a good representation of my experience as well.

At the end of the day, this is because it isn't "writing code" in the sense that you or I do. It is a fancy regurgitation engine, that will output bits of stuff it's seen before that seem related to your question. LLMs are incredibly good at this, but that it also why you can never trust their output.
huh what ? this is a whole new level of flat earther thinking. you actually believe that apex predators are not the most intelligent? Like humans became the apex because of something else than intelligence? AI and covid showed humanity what levels of wacky stuff people believe. I am not trying to convince you, thank you for showing me this perspective :)
I have in the past, but most people don't.

E.g. for esp32 see https://docs.esp-rs.org/book/overview/using-the-standard-lib...
imo we are seeing two types of programming viewports emerge.

i mean maybe it's just me but i quite like this new normal where i'm an "intermediary". i review every line that comes out and research things if they don't make sense or i'm confused. and a lot of times it helps me figure out how to approach a problem or refine an existing one. i'm still architecting everything and diving in.

i guess if you liken progamming to like i dunno, chopping your own tree down, turning it into 2x4s to build a house then yeah, it seems like your skills are atrophying.

i do not miss the "joy" of writing random boilerplate 100s of times or variations of the same function. i do however fear for the the new generation who maybe didn't cut their teeth on having minimal guidance. i can totally see people just coasting and blindly pasting things, but that's always sort of existed on stack exchange, etc.
And if it comes back..... throw it harder.
X doesn't do that for me either... If you see posts you don't like, block/hide them. X learns.

That's the cost of a free platform though. Rather have that than being banned for thinking wrong.
I feel this happening to me too... depressing
>What would be your one piece of advice for someone looking to bootstrap a company?

Hire only when your revenue exceeds costs. Might be hard but this instills the discipline of always operating at a profit.

>How can one identify B2B problems worth solving? And how do you go about acquiring and selling to those customers?

Look for inefficiencies in workflows. If you save companies time or effort in a big way, they will pay up. To acquire customers, you need to super-precise emails (I never did outbound but I'm unsure my style of content marketing will fly today)

>If you were starting today, which domain would you choose?
The one you feel most passionate about. But remain open to significant pivots. First idea never works, but it is essential to choose something you can really get into.
I used to be like you. This is why you may want to try Cursor paired with Claude for this.

Set Cursor in "agent" mode (with Claude as a model).

Ask what you need.

It will automatically test your Docker deployment and configuration.

Then you become like me, a monkey clicking "Accept".

But a happy monkey.
Oh please. Trump gets to put forth these outrageous proposals because (almost) nobody believes he will follow through with them. But the House? Bad idea.
Is that actually happening? I use o1 a lot for brainstorming etc, but I don't think I could build a program of any significant size without understanding how to program myself so to guide o1 and stitch it's outputs together. It's also not at all uncommon for me to have to do stuff completely myself, it doesn't have great insights into deep problems for instance.
calculators dont spit out nonsense learners will not catch
LLMs are inherently bad at this due to tokenization, scaling, and lack of training on the task. Anthropic’s computer use feature has a specialized model for pixel-counting:
> Training Claude to count pixels accurately was critical. Without this skill, the model finds it difficult to give mouse commands. [1]
For a VLM trained on identifying bounding boxes, check out PaliGemma [2]

You may also be able to get the computer use API to draw bounding boxes if the costs make sense.

That said, I think the correct solution is likely to use a non-VLM to draw bounding boxes. Depends on the dataset and problem.

1. https://www.anthropic.com/news/developing-computer-use
2. https://huggingface.co/blog/paligemma
Maybe, but it's hard to be a vim user without being somewhat of a vim nerd. At least you have to understand a new concept of interface, several modes, and lots of keyboard shortcuts - that would make you a nerd in any other application.
There's a corollary here to "build it yourself", which is "vet it yourself". Cargo, npm, and pip all default to a central registry which you're encouraged to trust implicitly, but we've seen time and time again that central registries do not adequately protect against broken or malicious code that causes major security flaws downstream. Each of these ecosystems trains its developers to use hundreds of dependencies—far more than they can personally vet—with the understanding that someone else must surely have done so, even though we've seen over and over again that the staff of these registries can't actually keep up and that even long-running and popular projects can suddenly become insecure.

I'd like to see an ecosystem develop that provides a small amount of convenience on top of plain old vendoring. No central repository to create a false sense of security. No overly clever version resolution scheme to hide the consequences of libraries depending on dozens of transitive dependencies. Just a minimal version resolution algorithm and a decentralized registry system—give each developer an index of their own libraries which they maintain and make downstream developers pick and choose which developers they actually trust.

Maybe a bit like Maven if Maven Central didn't exist?
My rule with LLMs is to use them only after reading documentation. It's easy to ask them for some boilerplate for something you haven't done in a long time, however, I think its better to just take five minutes to go read whatever spec/documentation is out there and then ask the LLM to write whatever code if you want.
In theory yes.

Although a ten year old dependency is written in Python, it's likely not going to work any more due to changes in the build system, stdlib, etc.
> In C++, I control my dependencies. In Rust I get above 100 so quickly I just

Just don't add dependencies, it's that simple. If you have enough time to control C++ dependencies, you can control them in Rust as well.
We hit the opposite issue with our samsung washing machine (we plan to never buy another samsung product because of multiple issues with this thing and their support).

It has 5 different “modular” control boards, and when one fails, it tells you which one. That seems great until you realize the boards are > $300, and the error codes point you to the wrong boards (edit: and they don’t accept returns of spare parts)

This created 100’s of pounds of ewaste. The washing machine is 4 years old.

There is something to be said for miniaturization and consolidation of components. If the damn thing had one board that cost $400, then we would have to throw out the whole machine. It’d also have simpler wiring harnesses, etc.
Can anyone recommend good science or ml people to follow on bluesky? I've moved from twitter, but haven't quite found as interesting content yet, especially with ML - seems like they are still posting on twitter
> As soon as you have a requirement that is not the 90% of cases you can quickly end up in a dead end

You framed that as a criticism of ChatGPT, I think that is indeed the point the OP is making. IMO if this is something you used to do you could get a nice starting point with a single prompt and then go from there, then that would take 3 times less compared to reading the documentation from get-go.
I'm not familiar with a lot of the acronyms and catch-phrases already in the first part of the article... let me try to make a bit of sense of this:

IR = Intermediate Representation
SSA = Single Static Assignment
CFG = Control-Flow Graph (not Context-Free Grammar)

And "sea of nodes" is this: https://en.wikipedia.org/wiki/Sea_of_nodes ... IIANM, that means that instead of assuming a global sequence of all program (SSA) instructions, which respects the dependecies - you only have a graph with the partial order defined by the dependencies, i.e. individual instructions are nodes that "float" in the sea.
It’s also creating a generation on management, clients and non-technical people who send me outputs from Claude and suggest I implement what it said. Needless to say, this makes my life harder.
The point was not about competency. I think typical distribution packagers are very competent.

"They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. We would all do well to remember that the xz backdoor was not caught by distribution code review: it was caught due to a performance side effect that the next adversary will be more careful to avoid.

Software stacks are getting bigger, largely due to engineering pressures that are outside of the control of distributions. It's a basic fact that that means work for the same (or fewer) people, which in turn means less time spent on more complicated packages. Under those conditions, competency is not the deciding factor.

This is, separately, why having lots of little packages can be (but isn't necessarily) a good thing: small packages that decompose into well-understood units of work can be reviewed more quickly and comprehensively, and can be assigned capabilities that can be tracked and audited with static analysis. You can't do that as easily (or at all) when every package decides to hand-roll its own subcomponents.
Cool! Thanks for the history :) I genuinely never liked the name. Fang is much better.
I’ve been doing a similar thing, although I called it “append only transaction ledgers”. Same idea as a log. A few principles:

- The order of log entries does not matter.

- Users of the log are peers. No client / server distinction.

- When appending a log entry, you can send a copy of the append to all your peers.

- You can ask your peers to refresh the latest log entries.

- When creating a new entry, it is a very good idea to have a nonce field. (I use nano IDs for this purpose along with a timestamp, which is probabilistically unique.)

- If you want to do database style queries of the data, load all the log entries into an in memory database and query away.

- You can append a log entry containing a summary of all log entries you have so far. For example: you’ve been given 10 new customer entries. You can create a log entry of “We have 10 customers as of this date.”

- When creating new entries, prepare the entry or list of entries in memory, allow the user to edit/revise them as a draft, then when they click “Save”, they are in the permanent record.

- To fix a mistake in an entry, create a new entry that “negates” that entry.

A lot of parallelism / concurrency problems just go away with this design.
I would say "expands the class of simple applications one can build without expertise" in the same way spreadsheet software enabled simple financial programs, website builders meant you didn't need to do HTML/JS nitty-gritty, etc. OTOH these technologies also enable financial blunders (I am personally responsible for at least one really nasty Excel bug), horrible website design, etc etc.

Edit: Arvind Naranyan of AI Snake Oil uses LLMs to create "one-time-use" apps, mostly little games or educational things for his kids. As an AI skeptic I think this is cool and should be celebrated. But there is a serious downside when using it blindly for real work.

I have never liked the term "can program" anyway, programming is the easy part....
I along with my wife have been running Escape Velocity grants where we give no-conditions grant to young people under 25 who show promise.

https://invertedpassion.com/escape-velocity-grant/

Plan to accelerate it.
yeah, I’ve had many moments in my AI-driven development cycles looping with the LLM in a dead end, eventually giving up and falling back to regular old programming.

I think LLMs are great for reducing the friction with just starting a task, but they end up being more of a nuisance when you need to dig into more nuanced problems.
Tech Things: Inference Time Compute, Deepseek R1, and the Arrival of the Chinese
I was using Metrowerks C++ compiler suite to develop code for Dragonball (68000) embedded system 22 years ago!
I wonder how much of this is just the move away from shared libraries.

In the .NET space nuget certainly makes it easy to add dependencies, but dependencies do seem to be overall fewer and the primary interesting difference I'd note is that a dependency is in fact it's own DLL file - to the extent that it's a feature that you can upgrade and replace them by dropping in a new file or changing configuration.

It strikes me that we'd perhaps see far less churn like this if more languages were back to having shared libraries and ABI compatibility as a first class priority. Because then the value of stable ABIs and more limited selections of upgrades would be much higher.