skysight-inc/HackerNews huggingface dataset:
Coding will become AI dominated at many levels. A lot of people on here don't want to hear that because they have an ego about their exclusive coding skills. Your compensation will decrease. You may be fired. The coding ability of the average 'senior' developer is not impressive, and the title will not protect you.
I predict that there will be a Security Engineer specialty in finding LLM written or influenced vulnerabilities.
"VPN" services do in fact use VPN, they're not HTTP based. It is technically appropriate to call them as such, as awkward as it is.
this link is totally throttled as of now cool! ive never seen github do that
Show HN: Signal.fyi – Are You Managing the Hidden Costs of Public Docker Images?
Hey HN,
I built signal.fyi to address a problem I’ve seen firsthand: managing public Docker images isn’t as “free” as it seems. From tracking vulnerabilities to ensuring compliance, the hidden costs add up—especially for small teams without the resources of larger organizations.

What signal.fyi Does:
- Daily Scans: Automatically checks your public Docker images for vulnerabilities and parent image updates.
- Enriched Pull Requests: Summarizes vulnerabilities and parent image changes right in your PRs, helping teams isolate risks and streamline reviews.
- Public Dashboards & Reports: Provides no-login-required, shareable compliance reports for stakeholders and audits.

Why It Matters:
Managing public Docker images manually is time-intensive. Based on research (inspired by Chainguard’s Report: https://get.chainguard.dev/true-cost-of-vulnerability-manage...), teams can spend thousands of hours annually on CVE management and compliance prep. Signal.fyi automates these processes to:
- Improve visibility into security risks.
- Track changes to your parent Docker image—a critical yet often overlooked metric.
- Create an audit trail to align with frameworks like NIST’s Secure Software Development Framework (SSDF).

Who It’s For:
Teams that manage source code via github and rely on public Docker images and want to reduce security risks.
Organizations looking to simplify compliance while improving transparency.

Why Now:
We’ve written about the hidden costs of managing public Docker images—are you prepared to address them? You can read more here:
https://www.lftsolutions.com/are-you-managing-the-hidden-cos...

Try signal.fyi:
Setup takes under 5 minutes, and you’ll get actionable insights within 24 hours: https://github.com/marketplace/www-signal-fyi

I’d love your feedback—what resonates with you, and how can signal.fyi solve your challenges better?

This is an improvement over the two below previous posts:
https://news.ycombinator.com/item?id=42122864
https://news.ycombinator.com/item?id=40989006
To be needlessly pedantic, reinventing wheels never gets you better wheels. The entire point of the idiom is that the wheel is already a perfect machine and any effort made trying to improve upon it is wasted. At best, you just expend time and effort to get the wheel again.

Which is why it doesn't belong in software - there is no software version of the wheel.
I had six TCL Roku TVs before we downsized. I plugged an AppleTV 4th Gen into the two I used the most often and set them automatically switch to the port the AppleTV was connected to.

The Apple Remote could control the volume and turn the TV on and off.

WiFi was disabled on the two that were attached to AppleTVs.
I haven't written any C++ in ages so I used a local Ollama3.2 to do a simple class and struct. The AI wanted me to use the `friend` keyword on class functions that weren't being accessed from anywhere else... I did correct itself after I asked but it took some intuition and googling to get there.
Sometimes removing the old way is the improvement though. E.g. adding an alternative to symlinks doesn't help if symlinks are still allowed.
I saw someone recently explaining it this way: we now have tools to inflate keywords and prompts into fancy side-long text, which we then feed to tools which will shrink those text into short summaries.

So I guess office jobs are now grinding machines, where one side has keywords, the other side extracts keywords, and in the middle there is an enormous waste of resources to fit some manager's metrics.
A notable example of a large-scale app built with a very similar architecture is ATproto/Bluesky[1].

"ATProto for Distributed Systems Engineers" describes how updates from the users end up in their own small databases (called PDS) and then a replicated log. What we traditionally think of as an API server (called a view server in ATProto) is simply one among the many materializations of this log.

I personally find this model of thinking about dataflow in large-scale apps pretty neat and easy to understand. The parallels are unsurprising since both the Restate blog and ATProto docs link to the same blog post by Martin Kleppmann.

This arch seems to be working really well for Bluesky, as they clearly aced through multiple 10x events very recently.

[1]: https://atproto.com/articles/atproto-for-distsys-engineers
Thank you @EGreg for sharing this.
ultimately the goal is that we can replace Susan in purchasing with a $500/month AI-powered SAAS that locates suppliers based on your predefined needs and handles communications with them

it's a tragedy that with all the ways that humanity could be improved -- and there's a very wide range to choose from -- this is what we choose to spend half a trillion on
This is why things like https://blessed.rs exist. Although since they're unofficial, their discoverability is also likely a problem.
Move on? Usually no answer means no interest, or at least not enough to allocate the effort.
AI devs are the new drag and droppers.

I remember all those devs who could only do tutorials using visual tools like VB6 and ASP forms.

Once the requirements went beyond the basics the project always got handed off to a real dev.
> Not trying to be perverse - but why does sha1-smol need any dependencies, let alone 40?

It has zero dependencies, but only 40 crates on the eco system depend on it. Compared to sha1 which has 10 dependencies, but > 660 crates depend on it.
Actually I don't believe that's the case. The getenv function as described by ISO C cannot be safely used in a program that only uses getenv, if that program uses ISO C threads, and more than one threat calls getenv without synchronizing with the others.

I don't think POSIX fixes this: it doesn't specify that the environ array is protected against concurrent access.

If two threads call getenv right around the same time, one of them could invalidate the environ array just as the other one has started to traverse it.

If you want to be safe, copy the environment to a different data structure on program startup. Then have all your threads refer to that data structure.
Actually, no.

I feel inspired and excited about life and what experiments this money can help me do (which otherwise wouldn't get funded).
Worth noting there are still elvis and the one true vi available, in case vim gets foobar'd, though I haven't checked their respective states now and last used either over ten years ago. Like with shells, I've always wondered why people are so quick to jump onto particular implementations when the value is in the wide availability of editors implementing vi key bindings, and the comfort of building up muscle memory this brings. Obviously, I couldn't care less about "plugins".
Even my TCL TVs with Roku were better than TVs with Android built in.
In case I was unclear it has 0 dependencies, but 40 crates in the ecosystem depend on it.
This is in line with the ideal scenario of Twitter remaining online as a quarantine for spam and culture war stuff, but real traffic migrating slowly elsewhere, hopefully without any single "winner" ever becoming big enough to attract what was left behind.
I've ended up only using inline generative AI completions to do programming when I'm either on a strict deadline or making a demo for a conference/meetup talk. Otherwise I limit myself to pasting in/out of a chat window. This helps balance things out so that I can meet deadlines when I need to, both otherwise retain my programming/SRE skill.

That being said, one of my top google searches are things like "kubernetes mount configmap as files" because I don't quite do them often enough to have them totally internalized yet.
IMHO the article is not mainly about the implementation of the Log, but rather leveraging on the idea of the log to build reliable and fault tolerant applications. The implementation of the log itself can be either centralised or decentralised.
They would need principles first. You can't even trust the left to be leftist in this country.
But does it? If the software is a spell checker for a language I don't know I will have no idea if it is any good.
> The backend code for LLVM is awful, and tablegen only partially addresses the problem. Most LLVM code for defining instruction opcodes amounts to multiple huge switch statements that stuff every opcode into them, its disgusting. This code is begging for a more elegant solution, I think a functional approach would solve a lot of the problems.

So one of the main problems you run into is that your elegant solution only works about 60-80% of the time. The rest of the time, you end up falling back onto near-unmaintainable, horribly inelegant kludges that end up having to exist because gee, real architectures are full of inelegant kludges in the first place.

Recently, I've been working on a decompiler, and I started out with going for a nice, elegant solution that tries as hard as possible to avoid the nasty pile of switch statements. And this is easy mode--I'm not supporting any ugly ISA extensions, I'm only targeting ancient, simple hardware! And still I ran into the limitations of the elegant solution, and had to introduce ugly kludges to make it work.

The saving grace is that I plan to rip out all of this manual work with a fully automatically-generated solution. Except that's only feasible in a decompiler, since the design of that solution starts by completely ignoring compatibility with assembly (ISAs turn out to be simpler if you think of them as "what do these bytes do" rather than "what does this instruction do")... and I'm worried that it's going to end up with inelegant kludges because the problem space more or less mandates it.

> You could try and solve the problem by using a superoprimisation approach from the beginning. Look into the Souper paper which automatically generates peepholes for LLVM:

One of the problems that Souper ran into is that LLVM IR is too abstract for superoptimization to be viable. Rather than the promise of an automatic peephole optimizer, it's instead morphed more into "here's some suggestions for possible peepholes". You need a really accurate cost model for superoptimization to work well, and since LLVM IR gets shoved through instruction selection and instruction scheduling, the link between LLVM instructions and actual instructions is just too tenuous to build the kind of cost model a superoptimizer needs (even if LLVM does have a very good cost model for the actual machine instructions!).
My point is that one cannot make blanket statements about "low performers performing better under supervision". I say this as someone who prefers to work from an office at least 4 days a week.

You're right, each of us have differing motivations. That doesn't give anyone license to promote their own point of view and tar everyone else with the same brush.
https://archive.is/OpGbB
> they failed miserably at finding bounding boxes, usually just making up random coordinates.

This makes sense to me. These LLMs likely have no statistics about the spatial relationships of tokens in a 2D raster space.
I would fall into this camp. I don't understand everything I am doing, but I have learned a lot through trial and error. I have an IT background in infrastructure and dabbled in automation, but never enough to be good. AI has allowed me to create things from my ideas that interest me. Is it good, no. Do I sell it though, no. I create things for myself. I wouldn't be able to do these things without it though because I didnt have the time and the teaching I had tried didnt interest me.
Tangent: I remember hearing of a sci-fi story where a city has been automated for generations and stuff is starting to fall apart while nobody knows how to fix it. Does anyone know what the name is? I have been unable to find it for a while.
That's incredible. Why? And why a clone? ???
Roku never suffered from that.
I plan to start an AI lab from India. I sense an opportunity - India's way behind China and US.
Being restricted from doing crimes by a vendor of commercial software isn’t a cyberpunk dystopia. Buy or download something else.

It’s a typical restriction of software terms of service to prohibit use outside of applicable laws and regulations.
Yeah the typical issue of "they could go bad" is always present.

Really that's internet services history in a nutshell. You use the thing, you move when you feel motivated.
I can understand not wanting to add SMTP or CGI to the stdlib. But a lot of common POSIX functionality (which is sometimes a single syscall away) is missing too.
I don't care that much about the name. It was already clear that even ignoring the name, that the rust-crypto ecosystem became the mainstream choice.
I havent seen any data that shows the people who RTO and "stay" are bad at their job. I think low preformers are going to get RIFed either way if they RTO or not. Those who RTO easily will generally be the employees who are already geographically close to the office, satisfied with their job, and see future career opportunities.

The good ones already have had the opportunity to leave all along, and if they are good enough, they may be able to set up a home based position. Maybe government roles do not need high performers at scale like the private sector does.
Yes, sir I do remember :)

Why not keep going? Well, everything comes to an end eventually. Projects are kind of like that - they start and they end.
X to doubt. So far at least, to do anything nontrivial you still have to understand code. Sure it will raise the bar for what someone without such understanding can make, but a lot of that can already be done with code-free tools.

What most people who would call themselves programmers are working on is far beyond what AI can do today, or probably in the foreseeable future.
Eventually won't AI be trained on a massive corpus of source code and be tuned to actually program something as good as a lot of the existing bloatware out there that businesses pay out the nose for?
Yes. People don't like being confronted with their shortcomings. Cultivate humility - you'll learn more.
> thrift/grpc is a godsend for internal service routing

Compared to what? What else did you try?
Maybe try this: https://blueskydirectory.com/starter-packs
I think you misread what I wrote. Edited my comment to add the word “only” to clarify.
I'll sound like a grumpy old man, but: that's one of the big advantages of using Java. The ecosystem is _super stable_ if you go with the usual stack (Spring Boot, etc.), you generally get support for all the modern cloud stuff, and it breaks very rarely.
Possessing a persecution complex and actually experiencing persecuion are separate things.

https://en.wikipedia.org/wiki/Persecutory_delusion
Science is not a political bias.
There are a lot of questions here that also apply to teaching CS. Do we want our graduates to still know the old way? Perhaps for job interviews and days when GPT is down and for problems it can't solve yet.

The "no AI without understanding the solution" rule is a start here.
This happens to me and I just move to another AI program if i have 0 idea, but I have been getting better at figuring things out too.
I didn’t say burden and choices, I said blame and responsibility.
I have a “summarise” log entry: the current log’s contents that will be relevant to the future are summarised. For example, if it’s FY2023’s financial transactions, we compute the final balances at the end of the year. We then close the log, and write an entry to it of “no more log entries after this are valid”.

We then copy the summary transactions to a new log, and compress and archive the old log.

You can identify high throughput and low throughput types of log entries and segregate them into different log streams. For example, the “new customer/change customer info” stream probably gets way less traffic than the “customer has logged in” stream. The former is also harder to summarise. Put the hard to summarise but low volume stuff in its own log.
Extreme content aside (well sometimes included):

Personally I found the "job" of managing who you follow / feed and pruning on twitter tiresome and at times impossible.

Bluesky has been better, maybe only due to fewer people, but if so then so be it.
what does "off exchange" mean exactly? buyers and sellers directly transacting with each other through what medium?
GPT-4o gets 45% on new history benchmark
https://github.com/RealNeGate/Cuik/blob/5c6f6ef9bfa983eb358a...
> Yeah the typical issue of "they could go bad" is always present.

It's at least refreshing to see Bluesky PBC try to prevent it by setting up guardrails themselves, like allowing people to host their data somewhere else, which seems to work today already.

Here's to hoping the federation stuff shapes up nicely too.
I second the parent comment. It describes me almost perfectly.
Except that it is exactly the same, as Twitter will use those signals to derank globally the users whose posts are blocked too often.

Meanwhile, Musk himself is banning people for thinking what he decides is wrong.
The worst i heard this week was "we don't know what this code does"
I'm pretty sure they were hired as developers.
google trends can disambiguate the context

https://trends.google.com/trends/explore?date=all&q=%2Fm%2F0...

both decline, but emacs is steeper
Show HN: I built a way to 50-100x engagement on X
It rewards community members for engaging with your X's posts. Gives them coins which they can use to redeem stuff in the store (eg. free subscriptions, discounts, merch, etc).

Did it for youtube, LinkedIn, FB and IG too.
Surprisingly, youtube API is the most restrictive to work with.
X is the easiest - you just need to pay them (no surprises).

Added a penalty system that deducts a multiplier of the coins awarded if someone tries to game the system (eg. remove a like).

Might be interesting to see how people use this to actually use their community to grow their socials. Sometimes i look at discord communities (esp web 3) and feel that they feel kinda wall-ed up within discord - like you can't use it much to power much of your businesses. Heck you don't even know who signed up beyond their username.

Oh and yeah this is actually built on a community building platform that is like discord + slack, but with a focus on businesses use cases (eg. white-labelling, APIs, LLMs, etc).
That gist is correct - I would add that the log needs a few specific properties and conceptually be the shared log for state, communication, execution scheduling.

The next step is the, how do you make this usable in practice...
https://prosopo.io/
One particularly frustrating category of errors is mistaking the content of my message/reminder/calendar appt as the actual requested action.

"Siri in two hours remind me to: [do X]" I'm sorry I can't do X

"Siri send message to wife: [message]" I'm sorry I can't do [message]

This error type seemed to increase with the advent of Apple Intelligence
Tailwind doesn't generate any JS at all. The final build is 100% CSS.
I am deeply suspicious of anyone who doesn't bother or who is unable to explain this churn. For the right kind of people, this is an excellent opportunity to reflect: why is there churn? Why did the dust not settle down? Why was the initial approach wrong and reworked into a new approach?

I can understand this if you are coding for a corporate. But if it's your own project, you should care about it enough to write good commit messages.
The three main reasons I see being given are:

- backward compatbility: a big std lib increases the risk of incompatible changes and the cost of long term support

- pushing developers to be mindful of minimal systems: a sort of unrelated example is how a lot of node library use the 'fs' module just because it is there creating a huge pain point for browser bundling. If the stdlib did not have a fs module this would happen a lot less

- a desire to let the community work it out and decide the best API/implementations before blessing a specific library as Standard.

In my opinion a dynamic set of curated library with significantly shorted backward compatibility guarantees is the best of both worlds.
It’s the same reason LLMs don’t perform well on tabular data. (They can do fine but usually not was well as other models)

Performing feature engineering with LLMs and then storing the embeddings in a vector database also allows you to reuse the embeddings for multiple tasks (eg clustering, nearest neighbor).

Generally no one uses plain decision trees since random forest or gradient boosted trees perform better and are more robust.
amazing :D
A bit off topic, but does anyone know why there's only one Bluesky relay, or can direct me to an article? Even if the hardware requirements are high, I'd think someone would've made a second relay by now.
A new operation: Workflow Update
`llmhelp` bash function to assist on infra work
How it works
1. Takes the last command from your bash history
2. Reruns it to capture the output
3. Gives this info to `llm cmd` to get a suggestion
4. Show the suggestion to the user!

Basically a quicker feedback loop instead of looking up params & typos on google.
Previous summer I've toyed with trying to write an "async prompt" a-la Erlang's shell with output scrolling and line-editing (see e.g. [0] for example of what I am talking about), but it is so bloody difficult to do correctly, especially when the input spans several lines and there are some full-width characters on the screen, that I've abandoned it.

[0] https://asciinema.org/a/s2vmkOfj6XtJkQDzeM6g2RbPZ
When it used to have Wolfram|Alpha integration, that part was sorta good? Not sure why they dropped it so quickly.
perhaps "Delete pages/general-information-and-resources/psychological-safety.md" will inspire a less ambiguous response
>Unless you never let your child near any slightly older child with a phone, you as a parent cannot individually control this.

...are you implying kids are having group jerkoff / porn sessions? Seems like a pretty absurd claim.

Also, on your second point, you seem to be almost strawmanning -- I see no claim from the person you're replying to that they think kids need more protection.

They're stating that parents are actively giving their kids devices, and have a lot of tools to restrict usage of those devices. Whether they literally limit physical access, oversee use, or install filtering software, there's a lot that can be done to restrict access in an authoritarian manner to those kids, and exclusively within the household without having to affect and restrict the overwhelming majority of society: grown adults.

(I also personally believe education is more important than any sort of restriction, and am always against censorship or surveillance policies in general. I definitely agree with them on but I'm trying to mostly restrict my post to what that person almost definitely had in mind, rather than soapboxing my own views).
Good observation. If ordered data is only present in silos, maybe we should work towards the “narrow waste” for such data, to make it less siloed. :)

Surely we can discuss (computer programs can interoperate on) something ordered other than raw bytes (ie the contents of a file).

xattrs I suppose would be the best way to do something backward compatible yet descriptive enough to be useful? I agree it’s a steep hill to climb.
As far as I know, none of the data center builders have had major problems with states or the federal government.
Russia suffering 'environmental catastrophe' after oil spill in Kerch Strait