skysight-inc/HackerNews huggingface dataset:
Love this.

What are computers for?

Local first could be the file format that allows us to use devices without cloud services. Back to file first, vendors of software apps, pay for software once (or one year of updates or whatever).

It's s new horizon.
Bounties make sense for open source projects where the main reward is to contribute to the community.

For private corporations/closed code, it is a way to get a thousand engineers looking at their code and APIs and only pay a small amount to however is the first one to find something. Everybody else gets nothing even if they put a lot of time and effort.

Underpaid is an understatement.
I use an extension for the former and the latter has never been a problem for me using ports > 8000.

+1 for having your own local 'tab home page'!
Show HN: I built an AI Coloring Page generator
I built Colori.io, a text-to-image AI that generates black-and-white coloring pages from any prompt. Turn words into art, ready to color!
Sure.

I think what comes up most often for me is when I want to fix something on a different branch than the one I'm at now, or when I want to fix something that feels like it should be separate commit.

In git you can `git stash`, commit the unrelated change and then run `git stash pop` to get your in-progress changes back.

In jj your work is already added to the current commit whenever you run a jj command, so you can simply switch to the other branch and do the work, and when you switch back your work is as you left it. It saves you the `git stash` commands. I also like that anonymous branches are completely normal in jj, so I don't need to create branches just to find my way back to a change.

Similarly, jj removes most usages of `git rebase --interactive` by allowing you to checkout a previous commit, and as you're making changes to it all descendant commits are being rebased automatically. This makes it easy to insert changes between two commits, simply create a new commit where you'd like it to go and then descendant commits will automatically be rebased on this new commit as you make changes.

To me this is more intuitive, and it removes `stash` and `rebase --interactive` as concepts.
Hi, thanks for sharing your ideas. Any ideas are welcome!
Thank you for sharing. What a terrifying experience. I hope you get some help to deal with the trauma.
I guess the main disadvantage is you can't reliably link to anything. Maybe not a problem if you only ever need one local server.
That was a sarcastic comment. I think the sarcasm was not clear enough. Sorry about that.
The discussion thus far has been about the incentivized manipulation of the data points as they come in. Aggerating those into statistics will produce misleading and incorrect results. Its not that an an individual data point can be different than the average, its that the flow of individual data points into the average is being 'managed' as people try to 'improve' these KPIs.
Why do you focus on number of jobs vs poor economic outcomes current state across the economy for your median worker? Why do we care if immigration creates jobs from consumption if the jobs created (from said immigration) are going to be low quality, economically unfavorable (to the worker) jobs?

“Think of the jobs!” arguments in this thread are optimizing for economic activity. I am arguing for workers to have better lives through better jobs, not more jobs. To understand this is to also better understand the shift to far right populism in the developed world as it relates to economic insecurity.
Thank you for the feedback!

1) 100% agreed. I would never release a tool like this that just used an LLM. But this tool uses Grounding with Google Search. So in this case Gemini uses Google Search as a tool to try to verify whether the statement is true or not. If it cannot ground its response, it returns a message saying that it can't fact check the statement - it will never return an LLM's "opinion". If it can ground it, it returns an answer with citations and links to Google searches.

2) That may be true. But even I have found it useful as I'm reading comments on YouTube posts and in Facebook groups to verify whether what people are saying is true or not. Even people I agree with spread (intentionally or not) mis- and disinformation since it's so easy to do.

3) Per the first point, since it's grounded in Google Search it is giving very real-time responses. Try it with the headlines on any news site.
While I understand this sentiment, we do need to balance the short term and the long term. And in the long term, economic growth is compound growth.

Consider an example.
Country 1 grows at 2.5% (like the US)
Country 2 grows at 1.5% (like the EU)

What is the difference after 100 years?

The first country will have grown by 1200%.
The second country by 440%.

The faster growing country is now almost 3x richer than the second country.

This is comparable to the difference between Romania and Austria currently.

As these growth effects compound, I believe that it will become hard to compete on quality of life long term.
Portugal and Spain seem to have a iberic mechanism that honestly i don't know in detail, which prevented a sharp increase (at least as significant as european counterparts) after Ukraine war.

My guess is that renewable adoption is necessary to decrease energy prices, but is not enough, so good policy enters the chat.
I'm not so sure, I think a junior dev on my team might be being held back by AI, he's good at using it. However he was really struggling to do something very basic. In my view he just needs to learn that syntax and play around with it in a throw away console app. But I think AI is crutch that may distract from doing that. Then again it is utterly fantastic at explaining small bits of code so it could be an excellent teacher too.
> the downside is that it means you have to re-invent the world to work with this flavor of runtime.

This is at least one of the reasons we've been building thin kernel interfaces for Wasm. We've built two now, one for the Linux syscall interface (https://github.com/arjunr2/WALI) and one for Zephyr. A preliminary paper we wrote a year or so back is here (https://arxiv.org/abs/2312.03858), and we have a new one coming up in Eurosys 25.

One of the advantages of a thin kernel interface to something like Linux is really low overhead and low implementation burden for Wasm engines. This makes it easier to then build things like WASI just one level up, compiled against the kernel interface and delivered as a Wasm module. Thus a single WASI implementation can be reused across engines.
I'm pretty confident that anything involving a central government database won't really fly under the current political climate. Definitely not in the US, but many other countries are bowing to US pressure to limit regulation.
It isn't mangled. The commit is there as-is. Instead the repository has a file, ".git/shallow", which tells it not to look for the parents of any commit listed there. If you do a '--depth 1' clone, the file will list the single commit that was retrieved.

This is similar to the 'grafts' feature. Indeed 'git log' says 'grafted'.

You can test this using "git cat-file -p" with the commit that got retrieved, to print the raw object.

> git clone --depth 1 https://github.com/git/git
> git log

commit 388218fac77d0405a5083cd4b4ee20f6694609c3 (grafted, HEAD -> master, origin/master, origin/HEAD)
Author: Junio C Hamano <gitster@pobox.com>
Date: Mon Feb 10 10:18:17 2025 -0800

The ninth batch

Signed-off-by: Junio C Hamano <gitster@pobox.com>

> git cat-file -p 388218fac77d0405a5083cd4b4ee20f6694609c3

tree fc620998515e75437810cb1ba80e9b5173458d1c
parent 50e1821529fd0a096fe03f137eab143b31e8ef55
author Junio C Hamano <gitster@pobox.com> 1739211497 -0800
committer Junio C Hamano <gitster@pobox.com> 1739211512 -0800

The ninth batch

Signed-off-by: Junio C Hamano <gitster@pobox.com>

I can't reproduce the problem pushing to Bitbucket, using the most recent Git for Windows (2.47.1.windows.2). It only sent 3 objects (which would be the blob of the new file, the tree object containing the new file, and the commit object describing the tree), not the 6000+ in the repository I tested it on.

It may be that there was a bug that has now been fixed. Or it may be something that only happens/happened with GitHub (i.e. a bug at the receiving end, not the sending one!)

I note that the Stack Overflow user who wrote the answer left a comment underneath saying

"worth noting: I haven't tested this; it's just some simple applied math. One clone-and-push will tell you if I was right. :-)"
The best solution would allow both. Nothing quite as portable as shoving a .html file on a usb stick.
I don't know about europe but I follow the UK as I live there and he says some weird stuff like civil war is inevitable (I'm not sure who's going to fight who) and slagging Starmer. A lot of the info is inaccurate and he seems to get it off far right cranks on xitter.

Amusingly @Inevitablewest who he followed claiming to be a British patriot was recently exposed as "Saurabh Chandrakar, an Indian former fruit juice seller accused of masterminding one of the most high-profile betting frauds in Asia" who isn't a brit and doesn't live here https://www.dailymail.co.uk/news/article-14381309/Far-Right-...

There's also https://x.com/PeterSweden7 "Holocaust denier white nationalist, extreme-homophobe, (former?) Flat Earther, (former?) Moon landing denialist, Islamophobe and conspiracy theorist crank" who Musk sources. https://rationalwiki.org/wiki/Peter_Sweden

Which goes to explain how a lot of what Musk says about the UK is odd.
I could not be happier that they are deprioritizing fleet. I am not a fan of the VS code style editor and that’s all I saw fleet as.
A year ago, I played around with jj out of curiosity, and within a couple weeks, I was ready to abandon git forever, despite jj still being so new.

I only use git directly when I have to now.

(As others have pointed out, jj uses git as a storage/network layer, so you don't need a new forge to start using it.)
Because WASM sandbox only works, to the extent hackers have not bothered attacking existing implementations to the same level as they did to Java applets, which is anyway one implementation among many since 1958 UNCOL idea.

Additionally, it is a kind of worthless sandbox, given that the way it is designed it doesn't protect against memory corruption, so it is still possible to devise attacks, that will trigger execution flows leading to internal memory corruption, possibly changing the behaviour of an WASM module.

> Nevertheless, other classes of bugs are not obviated by the semantics of WebAssembly. Although attackers cannot perform direct code injection attacks, it is possible to hijack the control flow of a module using code reuse attacks against indirect calls. However, conventional return-oriented programming (ROP) attacks using short sequences of instructions (“gadgets”) are not possible in WebAssembly, because control-flow integrity ensures that call targets are valid functions declared at load time. Likewise, race conditions, such as time of check to time of use (TOCTOU) vulnerabilities, are possible in WebAssembly, since no execution or scheduling guarantees are provided beyond in-order execution and post-MVP atomic memory primitives :unicorn:. Similarly, side channel attacks can occur, such as timing attacks against modules. In the future, additional protections may be provided by runtimes or the toolchain, such as code diversification or memory randomization (similar to address space layout randomization (ASLR)), or bounded pointers (“fat” pointers).

--> https://webassembly.org/docs/security/

Finally, WASM is only as secure as its implementations, whatever the bytecode promises only matters if the runtimes aren't exploitable themselves.
I believe all of them are configurable in Rider, no?
This is a fun parody but just in case you’re being earnest - that’s completely missing the point. Similar to saying “if you want more of $RPG just open a spreadsheet and slowly make arbitrary numbers go up”.
Show HN: Open-source RSVP app using Supabase and Flutter
I'm doing a new Show HN[1] as we have now made this open source, and got some interest in comments in the past few days.

We initially built this app for some friends in a co-living community - they were using pen and paper to track who's attending lunch - but it was error-prone.

First I suggested a shared Google Sheets or Calendar, but that was also messy to maintain.

Eventually, I developed something just for them. They used it for a couple of years, they loved it and wanted to use it for more things, too.

So I took all the learnings from what was now the MVP, and with some friends we now launched this new version, built on Flutter and Supabase.

Supabase was to give us some better control on the data; dealing with events and especially recurring events gets really messy really quickly. The data model on Firebase was horrible (so much duplications...).

And Flutter to quickly offer good mobile apps for everyone, since a feedback I often got before was that the "PWA" didn't really feel like a real app at times (especially on iOS).

We decided to make it open source as there'd be many possibilities to extend it, from making it more compatible with business features (say a CalDAV integration); to allowing more "rich" events and anonymous access to compete with Apple Invites or Partiful; to introducing some discovery and ticketing features and compete with Meetup or Eventbrite.

[1]: https://news.ycombinator.com/item?id=42510407
Python 3.14 Alpha 5 Released with New Tail-Call Interpreter
What would an appropriate payout be? I mean, the classification ("high exploit probability, abuse-related impact") seems about right to me. Are you saying that abuse bugs should be more valuable? That all bugs should pay more? That this is a rich company so they should pay more?

> If they poked around a bit more they may have found a better GAIA->Email vulnerability

They still can! Report more bugs, get more bounties. I don't see how this is related to how much they paid for this one.

> A database of emails for every major youtube channel would be worth an awful lot.

It's pretty clear from the article that you can't use this API to scrape at that kind of volume. This kind of thing was never in the offering. As the title says, you can leak "any" email, not "every" email.
See my top-level response, but basically nothing is mangled. Instead Git internally treats it as a 'graft' and knows not to look for parents of the prior commit.

I started that comment as a reply to you but I realised that a) it may just have been a bug that might already be fixed and b) it looks like the Stack Overflow answer was speculative and not tested!
I'm in the same boat alienated by a 30+ year partner that won't even discuss the issues.

After 9 months what I have realized is that my 30+ year partner was not a good fit for me. The mental space cleared by not worrying about my ex-partner's contentless has feared up most of my brain power.

What I realize now is that my partner was wasting many of my brain cycles that are now freed up. I actually have fallen back into a brain space that feels like my early college graduate brain. The brain I had before I took responsibility for my partner's happiness.
The idea-execution value gap is shrinking.
Build the index as a static file and query it using js? This has been my approach so far — admittedly, this isn't with millions of pages, but I'll continue to use it for as long as it works. When hosted on the internet, the search is still blazingly fast, way better than most other sites I come across.
Not just a random quote too, several.

> Following his senate confirmation last month, Rubio told State Department employees that “All men are created equal because our rights come from God our Creator” — comments at odds with Beattie’s statements about some people being “trash.”

I wish these guys believed that stuff. The religious right in the US always seem to point to god when they’re telling others what to do… less so themselves or allies.
Getting rid of pennies/nickels sure, but where does the gold standard come in?

You want to tie the economy to a material that doesn't capture economic growth and which also has its remaining stores in areas of the world not owned by your nation?

If Google wasn't lying to me with its response, the current USA gdp is over $20 trillion, and the US owns around $200 billion in gold.

Wouldn't tying gold to the current economy either devalue the dollar or inflate the current value of gold before locking the country into a state of economic stagnation?
So Ghostbusters II is now reality? :)
The Pentagon probably won’t mind dumping that velocity into a building.
Cool! I make this as a hobby project: https://framed.news/

Would be cool to have a color option too
I ones worked for a company that used to hire 70 developers from Vietnam to work on their product. Then one day they decided to hire ~5 developers from US. These 5 developers did the job faster, better and cheaper than 70 Vietnamese developers. So they fired all overseas developers and doubled the size of US team to about a dozen.
Nobody's arguing that the talent isn't there, but it's very hard to commercialize results compared to the US. Which is why a good chunk are employed in US companies or immigrate to the US.
I'd take away "security is complicated and multi-faceted", not "fake".

It's not a black and white of "an app is truly secure" or "an app is truly insecure", but rather a continuum from "secure enough in practice for this threat model and purpose" to "an insecure mess".

Like, plenty of websites and apps have launched, existed for years, and then shutdown without a single security incident. In those cases, surely the app was secure, right? At least secure enough? Signal so far has been "secure enough in practice" for most people, while iMessage has in practice been "secure enough if you're a normal person, but with serious security issues for anyone who might be subject to serious targeted attacks"

Say more about what you mean by "no app is truly secure"? Especially in the context of signal?
German bureaucracy is terrible but that is not the same as the topic here.
Wikipedia says "Depression is a mental state of low mood and aversion to activity" - that's what I meant.

Mental illness is I think a different thing. Depression doesn't imply mental illness, nor does mental illness imply depression. I understand and agree that many people let mental illness come between them and whatever. It's a problem. It's just a different problem.
> Forcing users to run code just to render some boring text seems like a waste.

Do you serve your content with "Content-Type: text/plain"? Client-side parsing of HTML and CSS, layouting, etc, is a looot of code.
Everyone connected to spacex via brain implant with him in control - i.e. the borg.

If the guy has demonstrated anything, it's that he wants total control.
You’re significantly underestimating the value of dox-style exploits. Author could have partnered with a black hat vendor who would offer (for example) $25 per lookup. Or they could’ve done bulk scraping of YouTube channels to get emails and sold the dataset.

It requires some legwork but they could’ve seen somewhere in the ballpark of 6 figures over 1 year if the exploit wasn’t patched.

Oh, and if they had no ethics.
> There are plenty of examples of Elon regularly engaging in bullying of others who may not have access to the resources he does, its not just limited to these few examples.

As written about by Sam Harris recently and discussed in the (now dead) thread: https://news.ycombinator.com/item?id=42716926

Musk is a terrible person, but also a deeply dishonest and selfish one.
I didn't use Reader. What was so special about it? Iirc it was an RSS aggregator, which sounds pretty simple to replace. Nobody has an open source equivalent?
Wonder what the returns would look like if they set aside 5% of that sum to fund things like Euro competitors to Shopify & Stripe.
Omg
Thanks for warning me!
> https://schwarztech.net/snippets/oh-look-misplaced-transphob...

This is a very misleading blog post. All evidence revealed so far indicates that Khelif is a male who was erroneously assumed to be female at birth due to having underdeveloped external genitalia.

In particular, a leaked medical report states that Khelif has a disorder of sexual development, specifically 5-alpha reductase deficiency (5-ARD), which is consistent with this.

This isn't that uncommon an occurrence: most famously, Caster Semenya - another male athlete who competed in women's sport - has this condition. In fact every medal winner in the women's 800m at the 2016 Olympics was male.
very cool on wasmer; does it support python + local ai / gpu use cases, ffmpeg, etc. have some customer use cases & really don’t want to go docker etc? helpful if can be included in electron & browser extensions or other supercontainers
This is someone accusing me of transphobia in a situation where no one involved is trans, and no claims are being made about trans people. Which strikes me as extremely ageist.
Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations:

* Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneously, that has effectively no half-life once discovered, and whose exploitation will generate reliable telemetry from the target.

* Similarly, bugs like full-chain Android/Chrome go for hundreds of thousands of dollars because Google competes with a well-established grey market; a firm can take that bug and sell it to potentially 6 different agencies at a single European country.

* Even then, bounty vs. grey market is an apples-oranges comparison. Google will pay substantially less than the grey market, because Google doesn't need a reliable exploit (just proof that one can be written) and doesn't need to pay maintenance. The rest of the market will pay a total amount that is heavily tranched and subject to risk; Google can offer a lump-sum payment which is attractive even if discounted.

* Threat actors buy vulnerabilities that fit into existing business processes. They do not, as a general rule, speculate on all the cool things they might do with some new kind of vulnerability and all the ways they might make money with it. Collecting payment information? Racking up thousands of machines for a botnet? Existing business processes. Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no.

A bounty payout is not generally a referendum on how clever or exciting a bug is. Here, it kind of is, though, because $10,000 feels extraordinarily high for a server-side web bug.

For people who make their nut finding these kinds of bugs, the business strategy is to get good at finding lots of them. It's not like iOS exploit development, where you might sink months into a single reliable exploit.

This is closer to the kind of vulnerability research I've done recently in my career than a lot of other vuln work, so I'm reasonably confident. But there are people on HN who actually full-time do this kind of bounty work, and I'd be thrilled to be corrected by any of them.
AI forward people talk in terms of oppprtunities at the scale of the 10s of trillions global labor market- in other words, not necessarily "taking" jobs but seeing opportunity to "collapse" the cost to the supplier of those income flows- employers- letting them turn a $10k/$30k/$50k/$100k expense into a $1k/$3k/$5k/$10k expense, some of which becomes income to the AI provider. From that lens, $100B capex to get recurring slices of $T pies is easy to defend.