skysight-inc/HackerNews huggingface dataset:
Yes it was the mandate that the GOP lost their minds on. The “don’t tread on me” crowd. The problem is that an insurance like program can’t work if the only people paying are sick people.
American society was only "refined" if you were part of the accepted classes. The US has whitewashed our history with rose tinted glasses. It's always been pretty bad, just the winners get to tell the story.
Hm. I realise this is an advertisement but that just makes its deficient treatment of failure all the more worrying.

I have yet to write the article on systems-theoretic accident analysis that is long overdue, but I don't subscribe to the idea that there is "a" root cause, much less "the" root cause. What people call a root cause is almost always just an arbitrary stopping point for analysis. This stopping point is selected either based on convenience or for political reasons.

Any real-world accident comes after running the system in a hazardous state, often for quite some time. The decision to do this is rarely explicit or the result of one thing, but a multitude of interacting factors and competing interests. A safe system needs feedback loops and control actions to keep it out of hazardous states. For any accident, we will usually find many missing or deficient control systems and feedback paths.

This is usually easier to phrase in reverse: we would never ask someone to identify the root cause of success -- and it's just as silly to do it in the case of failure.
> Most great musicians, bartenders, software engineers, etc. do the same. Without entry level/apprentice jobs the only other model is patronage from the rich

Or, you know, school? Hobby work? Activities people would engage in of they weren't under threat of poverty or death should they fail to enter the workforce as soon as possible.
I couldn’t be more pro-Luigi comrade. But doctors != (the AMA | insurance companies).
Show HN: Perforator – cluster-wide profiling tool for large data centers
Hey HN! We are happy to share Perforator – our internal cluster-wide profiler with great support for native languages and a built-in AutoFDO pipeline to simplify sPGO builds. Perforator allows you to profile most binaries without having to recompile or adjust the build process. We use it at Yandex to profile each pod inside a large cluster at modest speed (99Hz), collecting petabytes of profiles every day.

There's a blog post about it at https://medium.com/yandex/yandexs-high-performance-profiler-....

Inspired by Google-Wide Profiling, we started continuous profiling years ago with simple tools like poormansprofiler.org. With the rise of eBPF, we came up with a simple and elegant solution providing detailed profiles without noticeable overhead. Pretty wild when you can see the guts of your production binaries in a flamegraph without them even noticing.

Some technical details:

- Our main contribution is infrastructure for continuous PGO using AutoFDO. Google and Meta have done tremendous work on building PGO infrastructure, and we made the last missing piece of the puzzle to make this work well and scalable.

- Native binaries are profiled through eh_frame analysis, interpreted/JIT-compiled languages are profiled through perf-pid.map or hardcoded structure offsets.

- We render profiles in multiple ways, the most common one is a fast implementation of FlameGraphs, rendering 1M frames in 100ms.

- We provide Helm charts to easily deploy Perforator on your k8s cluster.

- You can use Perforator in standalone mode as a replacement for perf record.

I'd love to answer your questions about the tool!
I use both nvim and vim on macOS using the same plugins config (vimscript) No luascript.

No idea what are the disadvantages of this approach, but then again my usecases are pretty standard, e.g syntax highlighter, linter, auto-completion.
(These are older comments that we merged from https://news.ycombinator.com/item?id=42888185, in case anyone was confused by the timestamps)
I prefer sites follow my OS, and if I want to manually change light/dark mode, I do it at the OS level.
I moved the comments to https://news.ycombinator.com/item?id=42896716 since that's a Show HN by the project author.

(I hope that's ok simonpure and thanks for submitting so many good things!)
>Square roots are implemented in hardware

But how does that hardware implementation work internally?

The point I'm trying to make is that it is probably an (in-hardware) loop that uses Newton's Method.

ETA: The point being that, although in the source code it looks like all looks have been eliminated, they really haven't been if you dig deeper.
> Activities people would engage in of they weren't under threat of poverty or death should they fail to enter the workforce as soon as possible.

And this is going to change, because as jobs are lost business leaders will graciously volunteer to redistribute their wealth
Dutch is also not censored, so I guess that many other languages aren’t censored too
neovim does not support running external programs that have an UI with `!`

So, no.
My point wasn't about giving up, but merely an assessment of the current power dynamics, and it's uncontrovertibly.

Americans have been told what makes the country strong is that there are balances of power and we're watching it unfold in real time. I dearly hope to be proven wrong in my worry.
"Which foreign government did Epstein work for and What evidence is there to corroborate it?"

(Hint : There is a large swathe of connections and evidence that is easily available if it wants to tell the truth)
Note that in most scenarios compiler do not "recognize UB" and then don't tell you about it. Instead, they do not know whether there will be UB or not at run-time and simply assume that you know what you are doing.

I also like to point out that not all modern compilers behave the same way. GCC will (in the case it is clear there will be a null pointer dereference) compile it into a trap, while clang will cause chaos: https://godbolt.org/z/M158Gvnc4

Both have sanitizers to detect this scenario.
How long before o3 is available in GitHub copilot?
Félix Is like MacOS, it's good until it's not and then you can't extend it.
You have the ability to unflag stories. This is critically important. Please do the right thing here.
I agree. Helix has been the first TUI editor that I have been able to be productive on. With Emacs, vim and neovim, there was so much fiddling just to get started. And the more functionality I added, the slower and bigger the editors became, so I kept going back to the JetBrains suite and vscode.

With Helix, it was love at first sight. I like how discoverable its UI is. I prefer the modal approach of Helix where movement goes first, so that I can see over what what and where my action will take place. I like not having to fiddle with plugins. I like the defaults, meaning my config file fits on my screen and there's still vertical space to spare.
How is #metoo equivalent having a series of private citizens sideline officials in every government department, including the Treasury, to get access to federal administrative and financial databases to unilaterally conduct mass layoffs [0] and give the president ammunition for whatever funding fight he's going to have with states next?

And promise to suspend normal conflict-of-interest rules in a completely unfunded deferred resignment offer?

And forcing senior civil servants to resign throughout all departments and agencies, including firing checks-and-balances mechanisms like Inspectors General while they're at it?

[0] It looks like OPM is targeting at least a 30% reduction in workforce this year.
Both Java and JS adhere to IEEE 754, what’s your point?

Sure it doesn’t have BigDecimal, but you’re not going to write HFT in JS either.
> OpenAI has no moat

... is definitely something I've said before, and recently, but:

> That moat is trivially circumvented by lighting a larger pile of money

If that was true, someone would have done it.
And the consequence is that people get banged on the head if they either use sth existing (cause they will be using it wrong) or they build sth on their own (because that's obviously bad) or they get fed up and don't use anything.

The issue with security researchers, as much as I admire them, is that their main focus is on breaking things and then berating people for having done it wrong. Great, but what should they have done instead? Decided which of the 10 existing solutions is the correct one, with 9 being obvious crap if you ask any security researcher? How should the user know? And typically none of the existing solutions matched the use case exactly. Now what?

It's so easy to criticize people left and right. Often justifiably so. But people need to get their shit done and then move on. Isn't that understandable as well?
The real dichotomy will be labor vs. capital as factors of production. AI competes with labor. Capital owns AI. Capital stands to benefit immensely -- that includes corporations. Labor stands to lose -- that includes not only gig economy workers but all people who sell their skills for money.
Or just make sure the source is available.
The guy who is good at it and can make a $100 job for $5 will not keep charging $5 for too long
> you dont need unit test if you table design is clean, because SQL operators are deterministic and are tested by the RDBMS vendor

Imagine well structured tables in 3rd normal form.

And then a view which joins 20 tables and creates a report with myriad of case/then expressions.

Many things can go wrong. (Wrong join conditions, duplicate rows, omitted rows, wrong formulas)

You might say that there should be no such logic in database and I understand the sentiment, but circumstances (e.g. performance) might say it’s needed.
No because at longest a tsc compile job on an extremely large application of hundreds of files might take at most 13 seconds. Then on top of that I typically just execute type checking in my editor and SWC in my build. The only time I run a static tsc job is just prior to code commit.
I get that. But then, keeping that legacy stuff running is just as problematic as rolling your own crypto. We can leave OpenSSL as it is but it shouldn't be the popular recommendation for developers.

They should have another library which, like I said, actively deprecates obsolete and insecure practices but in a way that makes the update process digestible for people depending on it.
I'd be really surprised if there's much difference at all in speed/responsiveness if you run them without plugins.
The checklist is really simple: did you use a verified product or did you try to roll your own and fail?
We need age limits up and down the offices. Neither Biden nor Trump should have been allowed to run this time and probably not last time either.
Anybody can build a Diffie-Hellman protocol. You can practically do with a calculator; in fact, we did that as an exercise at a talk, with a big audience, using frisbees to "exchange" the keys. But: the talk was about how, as a pentester, to trivially break these systems, because making a system that uses a DH key exchange safely, as opposed to one that simply appears correct in unit tests, is treacherously hard.

I'm still curious about what you could have possibly meant by learning about "weaknesses" like "known-plaintext attacks". Can you say more?
Show HN: A CLI tool to extract and replace Tailwind colors
Hi there!

Although I love Tailwind I have always found it frustrating when I get a starter kit or a template and tailwind colors (indigo-800, gray-200) are hard-coded.
It makes it very hard to change the whole theme at once.

I created this small CLI tool to list all default tailwind colors présent in the project and rename them to a custom colour.
Here's an article (German, sorry) about Stihl (chainsaws) threatening to leave Germany

https://www.spiegel.de/wirtschaft/unternehmen/stihl-saegenhe...

For me what he says doesn't make a lot of sense. For instance he threatens to go to the Swiss who, he even concedes, has higher wages. Also he complains about too much regulation while he concedes that it is a EU thing. Then he says construction costs in Germany are so high. I have a hard time imagining that construction costs in the Swiss are lower than in Germany.
https://archive.is/YL4Kd
Currently on the internet people skip the article and go straight to the comments. Soon people will skip the comments and go striaght to an AI summary reading neither the original article nor the comments.
Yes, I have some numbers. Wholesale electricity costs since 2020 have repeatedly exceeded 700 - SEVEN HUNDRED - Euros per MWh (1). Because it was dark and still, a condition every single European in the last ten thousand years has known to exist. That's your number.

I won't ask you what impact you think that has on, say, steelmaking, because I've lived it. I've picked the tenders and the Euro steel was not competitive with Chinese steel if it was free, due to uncertainty in delivery date.

China spent approx 2x Hinkley Point on nuclear. It has 30 GW of capacity in return. That works in winter. I would do nasty things to get that for my country.

(1) Naturally, French nuclear is literally not allowed to access this price, and must sell at 45. Because FREE MARKET.
This is better than lobotomizing a transformer
There are other methods used in hardware, eg (for example)

https://en.wikipedia.org/wiki/Methods_of_computing_square_ro...

Something like Heron's method is a special case of Newton's method.
Ranking Paradoxes, from Least to Most Paradoxical [video]
The statistical review of World Energy that they source the data from does do the substitution method.

And it knows that plant efficiency is increasing over time so it updates the compensation factor it uses. That means that over time a nuclear plant producing the exact same amount of electricity every year will look like a declining primary energy usage.

The effect is slightly muted by their use of a global average efficiency conversion factor. An actual country deploying globe leading efficiency fossil fuel plants would see a greater effect in the direct, un-substituted numbers as less fossil fuels will be needed to generate the same amount of electricity.
I mean to start with if you are literally using "salted hashes" you are boned. There's a whole literature of "password hashes" ("password KDFs"), and that literature exists for a reason; the papers are a record of the weaknesses found in "salted hashes", a construction dating back to the late 1970s.

But once you adopt something like BCrypt or scrypt or PBKDF2 or Argon2 (literally throw a dart at a dartboard), you're into the space of things where you should, as a competent engineer, be expected to figure out a sound system on your own. The only domain-specific knowledge you really need given to you by a cryptographer is "don't just use salted hashes".
I feel like a lot of devs and artists are dreading the idea of their entire job becoming nothing more than "debug/fix the mess an AI made". Going from designer/architect to QA/editor would kill a lot of the fun and satisfaction people get from their work.
Yeah excellent point. When presenting numbers for reading/interpretation then talking in terms of cubes with a certain side length has to be the easiest to interpret. Its important to be specific about the units and not say "5 metres cubed" because that will just lead to confusion with m^3 (already confusing to be fair!).

An alternative is using "known" points of reference like Olympic swimming pools, the Sistine Chapel etc (similar to "an area the size of Belgium"). But that risks getting absurd.
You mean, like how Windows already does?
> I wish something was there that is more "batteries included" than them.

There are e.g. Spacemacs and Doom emacs that don't only include batteries, but supercritical nuclear reactors about to explode at any moment. :)
You'll want to look at your hashing algorithm and number of iterations to make sure they are up to snuff and you'll want to make sure that your salts are unique and properly random. (I recently learned that the PS3 private keys were reversible because Sony's random number function returned a fixed result.)

Proper password hashing is protecting against a different threat than blocking brute force login attempts (which isn't really an encryption issue.) Password hashing is more about protecting your user's passwords if your database is breached so that you limit the attackers ability to re-user those credentials to access other services the user may have re-used them with.
There are only three things I would consider for tech at a start up.

1. What I already know if I am the one building the prototype.

2. Cost of training new employees.

3. Execution speed.

Everything else can be ignored.
No it doesn't and it isn't.

If you're working for a grid operator tell me how many TWh you need to sustain a 1-in-20 - A 1-in-goddamn-20 - dunkelflaute in a single large European nation, multiplied by cost of storage. Not the "decline", the absolute cost, and what percentage of GDP it would be. Compare and contrast to military expenditure at a time of near-war.

I also know these numbers.
I'm in that boat. I'm watching all of Christoph Paar's cryptography lecture series on YouTube -- it was recorded in 2010, so I do wonder if it's missing any new state of the art / best practises.

I'm like 18 lectures in, two out of three semesters. And I still feel like I have only the vaguest ideas what the primitives are, how they work, what they're for, and their weaknesses. I'm having to follow all the mathematics as someone not mathematically inclined (Prof Paar did do a good job of making the mathematics fairly accessible though).

All of this so I can have a bit more confidence in proposing E2E for a project at some point in future (before somebody asks us to, too late).

And my use-case makes it difficult to follow the most trodden paths so I can't just plug in a handshake protocol and MACs and elliptic curves or "just use PGP" or whatever.

As a software dev, I have all these boxes I could use, that come with so many caveats "if you do this, but don't do this, no do that, don't do that"... It's very tricky trying to work out how to glue the pieces together without already being in the field of crypto. Feels like I'll always be missing some crucial piece of information I'd get if I pored over hundreds of textbooks and papers but I don't have the resources to do so!

I'd love if someone did like, a plain English recipe book for cryptography! Give the mathematical proof of stuff, but also explain the strengths/weaknesses/possible attacks to laypeople without the prerequisite that you need to understand ring modulus or Galois fields or whatever first. Or, like, flowcharts to follow!
What makes you dislike them so much?
so far I've only seen it in the midwest - WI and IL
We don’t use SMF for the same reasons we didn’t have ZFS on linux for so long, worries about the CDDL license and how it integrates.

I’m also not saying we should have ported SMF, one complaint I have about it is that it was a product of its time and used XML (much like launchd on macos, which is actually another supervising init btw ;D).

However taking inspiration would have been good, instead of creating software that appears like it belongs on a Windows/DOS based operating system rather than a unix-like.
Would it sell more than the additional sales that were obtained by the work done during the time saved through generating it with AI instead of finding an artist?
Let's be fair though: Auth0 does a little more than just password authentication

Registration, 2FA, reset, email verification, federation, password rules, brute force protection, RBAC/ABAC etc

(I'm no fan of Auth0 fwiw)
Yes: there are reasonable, reputable cryptographers who advocate against hybrid cryptosystems.
So this seems to be the current strategy, as soon as someone opposes the actions of the Trump (and by extension the Republican party which has by now almost completely purged of dissent) everyone argues they are partisan (the whole if you are not supporting us you must be against us). This by the way is a very common strategy of authoritarian regimes.

Regarding spending cuts being antithetical to authoritarian regimes, note that the cuts don't affect the military or law enforcement (except for people who were involved in prosecuting Trump) that's very much in line with many authoritarian regimes.
What an astonishingly dumb comment.

I hope you’re not actually responsible for anything.
Maybe there weren't any principle (for these people at least) in the first place...
The article centers around vim being easy to configure relative to neovim.

A daggy but effective trick I started using is using cursor (i.e. a context-aware LLM) to help modify my dotfiles, including neovim configs.

If it messes up, simply git checkout . to go back to what you had before.

But usually an LLM is much faster and more accurate than I am (I'm obviously no pro when it comes to neovim configs). I'm careful to work incrementally - i.e. small changes at a time, and read them carefully to ensure you understand what they're doing - but using an LLM to help modify dotfiles has honestly helped a tonne.
I've been enjoying my time with Helix, although I've had to undo some muscle memory associated with vim, and add back commands I missed too much (never letting you go, 'dd').

My major complaint with Helix, and one that will stop me from using it long term, is the (IMO) insane undo behaviour. It always undoes too much and then I get myself into a mess. There's something about undo checkpoints and being able to manually create one, but I don't feel managing that should be my problem.
> The issue with security researchers, as much as I admire them, is that their main focus is on breaking things and then berating people for having done it wrong.

This is plain incorrect in my experience.

Recommended reading (addresses the motivations and ethics of security research): https://soatok.blog/2025/01/21/too-many-people-dont-value-th...

> Great, but what should they have done instead? Decided which of the 10 existing solutions is the correct one, with 9 being obvious crap if you ask any security researcher?

There's 10 existing solutions? What is your exact problem space, then?

I've literally blogged about tool recommendations before: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

I'm also working in all of my spare time on designing a solution to one of the hard problems with cryptographic tooling, as I alluded to in the blog post.

https://soatok.blog/2024/06/06/towards-federated-key-transpa...

Is this not enough of an answer for you?

> How should the user know? And typically none of the existing solutions matched the use case exactly. Now what?

First, describe your use case in as much detail as possible. The closer you can get to the platonic ideal of a system architecture doc with a formal threat model, the better, but even a list of user stories helps.

Then, talk to a cryptography expert.

We don't keep the list of experts close to our chest: Any IACR-affiliated conference hosts several of them. We talk to each other! If we're not familiar with your specific technology, there's bound to be someone who is.

This isn't presently a problem you can just ask a search engine or generative AI model and get the correct and secure answer for your exact use case 100% of the time with no human involvement.

Finding a trusted expert in this field is pretty easy, and most cryptography experts are humble enough to admit when something is out of their depth.

And if you're out of better options, this sort of high-level guidance is something I do offer in a timeboxed setting (up to one hour) for a flat rate: https://soatok.com/critiques