skysight-inc/HackerNews huggingface dataset:
Typically, it's Friday and it's sprint planning:

- a bunch of Jira tickets get assigned to be worked on the next sprint. The vast majority of them are product features, and a tiny bit are about tech debt and known bugs (if any)

- depending on the team, you may allocate 15%-20% of the team's capacity for unexpected/new bugs in the next sprint if they do impact the business

> I'm curious about how a software developer's time is distributed across different phases of a product's lifecycle, how much time is spent writing code, reading code, writing design docs during each of these phases.

There's no such a distinction. I don't distinguish the time I spent between writing code and reading code, writing design docs vs reviewing them. There are no "phases", everything is mixed up (some call that an iterative process) in the sprint. You may have Jira tickets tagged with "brainstorm" or "spike", used to "think about the requirements of a specific product ticket", but they could be as well be part of the jira ticket designated to that specific product feature. This distinction is mainly used by your engineering manager, but for engineers is just a silly distinction.

Feature development doesn't usually slow down in favor of bug fixes. Rarely, if the bug is big enough and impact a big client, then 1 or 2 team members are allocated to it, but the rest of the team keeps pushing features.

This is my experience in a typical mature "cool" (in their own view) startup. They pay top notch, but they also ask for the moon. Not FAANG, though.
> which by itself would motivate a few of them

Motivation in the abstract is not enough to counter GP's point—they have to have enough motivation that it's worth more than $10,000 to them and also have more than $10,000 to spend and also have the connections necessary to get in touch with someone who's able to sell a vulnerability like this and also be able to exploit it in a timely manner or at least think they can.
Which stands for Jolkien Rolkien Rolkien Tolkien.
I haven't watched this channel recently, but from what I saw I the past he seems to have a bias of reassuring the public that air travel is safe and problems are uncommon and usually not as bad as they might seem to the uninitiated. E.g. airline mechanics on the wing applying "duct tape" is normal, not shoddy maintenance.
You didn't make a case for any of that. No one did. This whole discussion is just a bunch of people who have their feelings hurt when other people tell them a LLM is modeling language, not reasoning. It's so narcissistic. "My opinion on AI is criticized so I'm oppressed."

That is not how oppression and power work. That's not how discussion works. That not how Foucault's analysis of power works.
It's entirely possible, technically. The problems become more about design and what's fun.

If you want to see state of the art in physics and collision, check out Dennis Gustafsson's work. He created the game Teardown.

https://x.com/voxagonlabs
This stuff worries me. I have already seen colleagues using LLMs and not checking the results. Really it just makes stupid people more dangerous. And there is a weird absolutist mechanical faith among certain people to the point even criticising the things is blasphemous and yes everyone is going to be replaced by LLMs and that's a good thing.

Real problem: crap is being normalised because no one wants to call the vendors out on it, because it'll devalue their business.

I figure I'm just going to sit this out at this point and watch everything burn.
I found some benchmarks in the ANTLR project: https://github.com/antlr/grammars-v4/blob/master/java/java/B...

Project Parsing/Lexing Ratio
----------------------------------------
jdk8 5.34x
Spring Framework 3.81x
Elasticsearch 5.76x
RxJava 5.69x
JUnit4 4.51x
Guava 5.37x
Log4j 2.92x

Obviously this is just one toolkit, one language, and one set of examples. But in these benchmarks, the tokenization (lexing) time is a small fraction of the total parse time.
This terrifies me. My mom died when of cancer I was 11, and I am much more anxious about things happening to my kids than my wife is.

One day my wife said she was going to give our 4 year old daughter a bath, then I find my daughter by herself in the bath and my wife all the way across the house in the bedroom. I asked “Why aren’t you watching her?” The reply, “She’s fine. She knows how to swim and the water isn’t even that deep.”

I work remotely in the upstairs bedroom and will occasionally come down for water. Half the time I find my one year old eating alone in his high chair in the kitchen, with my wife doing something in the bedroom. “Where are you? What if he chokes?” “You don’t trust me. He’s fine. I can hear him from the bedroom.”

My wife will get in road rage incidents. People flip her off and yell threats at her as she slingshots through traffic with our little kids in the back seat. “You’re going to crash driving like that.” “Stop telling me how to drive.” Someone pretended to pull a gun out on her after she swore at them. “You’re going to get shot.” “No I’m not. I can tell if any of those people would have a gun.”

She also has severe ADHD. Our daughter got under the sink when she was two and ate half a dishwasher detergent pod before my wife noticed and called poison control. Another day when my daughter was two my wife forgot to shut the gate at the bottom of the stairs when she came upstairs to talk to me during the workday. Suddenly I hear a series of thuds and cries. Our little girl had fallen down the flight of stairs after trying to follow my wife without her noticing. Same thing happened to my 1 year old son under the watch of my wife’s mother.

I’m so scared that one day I’m going to get a call about something horrible that has happened to my kids either because of my wife’s inattention or anger issues.
> Day-Month-Year is the standard everywhere in the world apart from the US

Nope, the standards are day.month.year, year-month-day, or month/day/year. The problem happens when the delimiter doesn't match the ordering.
I meant pro-Democrats, which is a different kind of left-wing.
The (Un)Reasonable Effectiveness of Raw Power
My first impression is that the tutorial is exceptionally well-written. This project looks very interesting!
Ahhh I missed that! That's completely fair then
Marquee – performant marquee component built using Web Animations API
Lol you can hardly get a 7.5’’ for that price. I once looked into making a few programmable ePaper “posters” for myself, and noped out of it when I saw the price.
I see it as everyone having access to an AI so they can iterate very fast through ideas. Or do research at a level not possible now in terms of speed.

Or, my favorite outcome, the AI to iterate over itself and develop its own hardware and so on.
Newer cars read the outside temperature, and adjust the auto. I don’t know if they sense condensation on the inside. I know that they sense water on the outside to automatically engage wipers.

I have found even the best ones though, to get the rear defrost right, but fail to get front defrost correct in high humidity conditions that aren’t just normal rain. (Very dense fog, snow, sleet ).
It's also a bit woolly on real dangers that governments should maybe worry about.

What if ASI happens next year and and renders most of the human workforce redundant? What if we get Terminator 2? Those might be more worthy of worry than "gender equality, linguistic diversity" etc? I mean the diversity stuff is all very well but not very AI specific. It's like you're developing H-bombs and worrying if they are socially inclusive rather about nuclear war.
Just as movie stars get paid a lot to compensate for dealing with the unpleasant life-ruining consequences of fame, CEOs get paid a lot to compensate for the monotony.
Libertarianism leads to lack of checks and balances regarding Popper's paradox. It is a key component for authoritarianism to breed, via accelerationism.
He posted the source as a reply.

https://x.com/WholeMarsBlog/status/1889501251106447392
yes, I understand this is not a security risk.

but my fear is precisely that I my be sending data to a remote host while I'm completely unaware of this fact.

I tried to create a POC with some popular url shortner services, but doesn't seems to work.

what I wanted to create was a link like <host.tld>/innoc󠅥󠅣󠅕󠅢󠄝󠅙󠅔󠄪󠅑󠅒󠅓ent that redirects to google.com. in this case the "c" contains some hidden data that will be sent to the server while the user is not aware. this seems possible with the correct piece of software.
I understand why you feel that way. There's a little "Hide" button under every story. It makes the stuff you're not interested in go away. There's no shame in using it. Story's gone, no harm done, move on to stuff you are interested in instead.
Got stuck in my spam folder, but for posterity. I've censored the N word out of this, it was uncensored in the email. Also other people's names

> [truth/truth] N***R BALLS (Issue #303)

> { A list of a bunch of users }

The email I received had no further context or content.
https://www.wired.com/story/youtube-bitcoin-scam-account-hij...
Dr. Strange, is that you?
BTW, if you're like me and have been wanting to target WASM bytecode directly for ages without any of the heavy existing toolchains, but unable to put the separate pieces of the spec together yourself: the core maintainer of this library is co-authoring a book for that[0]. I decided to take the risk of giving the early access version a try and it's really nice and accessible.

I'm mentioning it because it implements a toy language using Ohm to explain how WebAssembly works (gee wonder why). So it actually includes a mini-Ohm tutorial.

Funny enough, since WASM bytecode is designed to be compact, and speccing out parsers tends to be a more verbose business, the book technically ends up spending more words on implementing the parser than on WASM itself (all with the goal of developing a mental model for WASM though, which it succeeded at for me so this is not a critique).

[0] https://wasmgroundup.com/
It's funny. Further up in this discussion is someone sharing their demo of using XSLT to dynamically assemble a page from parts. This process properly caches the fragments as well. No JS required, just the default rendering process for the browser. But XML+XSLT is the "red-headed stepchild" that everyone seems to hate.

Writing a SPA just to recreate the built-in functionality of rendering a static page on the client side is overkill IMHO. If it's an actual application (the A in SPA), then fine. But for what is essentially a static website... why?
Can't say about AAC, have never tried.

Vorbis fooled me at 160-192 territory... over a decade ago.

Opus is very hard, even at 128kbps, tested relatively recently (3-5yr ago)
government does not influence society as much as society influences government. if the government is bad, then that's a clear sign that society is bad too, and the only way to change the government is to change the society too. simply abolishing government doesn't solve the problem.
Vibe Coding Starter Pack: Build Apps by Talking to AI
I recently explored Vibe Coding, a new approach to building apps using voice and AI, and wanted to share my experience.

It’s an exciting way to develop without writing every line of code manually. Here’s a quick breakdown:

Vibe Coding Starter Pack: Build Apps by Talking to AI

What is Vibe Coding?
Vibe Coding allows you to create apps by speaking to AI tools like Cursor and Whisper Flow, which convert your ideas into working code. This approach makes development accessible, intuitive, and efficient for both beginners and experienced developers.

How It Works:
Say your idea → AI writes the code.
Cursor handles coding; Whisper Flow converts speech to text.
No coding experience? No problem—just describe what you want.

Benefits of Vibe Coding
Effortless development: Voice replaces manual coding.
Flexible and fast: Iterate with real-time feedback.
No syntax struggles: AI does the heavy lifting.
Security matters: Store API keys securely and document everything.

Tools for Vibe Coding
AI Coding Assistants
Cursor – AI-powered coding assistant.
Whisper Flow – Speech-to-text tool.
Super Whisper – High-performance voice-to-code transcription.

Open-Source Alternatives
Aide – Lightweight AI coding assistant.
DSNote – AI-powered note-taking tool.
Say – Open-source speech-to-text for coding.
Speech Transcription Tools

For more tools, check out Awesome Whisper.

Curious about Vibe Coding? Explore these tools and start turning your voice into apps today!
"In 2022, San Marino’s City Council proposed a ballot measure to levy a $10,000 tax on vacant commercial and residential properties, but it ultimately failed to pass. "

Considering the values of some of this housing, that's probably not enough to force units back onto the market.
It is not. And you must be new around here when it comes to the comments level.
https://archive.md/ARWaq
I'm not sure why the level of snark is so high there, given I'd already mentioned the potential security implications meaning those keys should not also be used for non- dev/test resources.

A key reason for maintaining secure connections for everything in local dev environments is to practise for best practice: keeping your dev environments close to production configuration without doing that by lowering production's level of doing-stuff-right accidentally (or intentionally) through insecure settings (like not verifying certificates) leaking out of dev into other environments.

At least this thread isn't full of people complaining that UAs (and related libraries) should still just trust self-signed certs, and not accepting any explanation of why that is a bad idea, which used to be the norm…
PyCharm is excellent; have not found anything as good for heavy python development

update: emphasis on "heavy". It's good for python projects. For some one-off script I'm more likely to use Zed. pyCharm indexing drives me nuts sometimes. But Zed lacks the features that I use in pyCharm for larger projects.
> local JS requests from internet

I really don't understand what this means.
It's common in tech for employees to know things about software that are different from what the CEO says. It's his job to decide when and what to say, not the employee's. I'm surprised the guy didn't already know this.
It is already common for flooring material to yield when stepped on, for ergonomic reasons. Normally that energy all becomes heat. In principle at least, you could capture some of it as electricity without causing pedestrians to exert extra effort.

Seems useless though. Every dollar spent on this sort of fancy flooring, which is doubtlessly more expensive than carpet and/or foam rubber mats, is a dollar that isn't being spent on solar panels.
Are VC start ups even around long enough to ... care or should care?

Or is this more bout the VC organizations themselves?

I'll be honest this was a bit of a difficult read for me. Not sure I get what it is saying.
Boring, I like it.
You can do everything in Git really. I don't see anything in jj that Git literally can't do, but as someone who spends a lot of time faffing around rebasing huge branches I can really see the appeal of something that does all the same stuff better.

If I mostly worked on a small-to-medium size project with close connections between developers, where mostly you just get your code merged pretty quickly or drop it, then I wouldn't see any value in it. But for Linux kernel work git can often be pretty tiresome, even if it never actually gets in the way.

I thought that nothing could beat Git until I tried Fig (Google's Mercurial thing). It ends up being awful coz it's so bloody slow, but it convinced me that a more advanced model of the history can potentially life easier more often than it makes it harder.

Fig's model differs from Git in totally different ways than jj's does but just abstractly it showed me that VCS could be meaningfully improved.
I recently worked on a steganographics project which could be useful for this problem. See: https://github.com/shawnz/textcoder
That was the original idea. They realized that they could also run the risk equations in reverse and make index beating returns, at least in the short run, and pretend that they could also do it in the long run. Hedge funds got a reputation as overpowered mutual funds for the wealthy.
Show HN: Abso – TypeScript LLM Client
Hi HN,

I made a TypeScript library that unifies queries with different LLM providers like Anthropic and Gemini into the OpenAI format.

When playing around with new models like the new Gemini 2.0, it's frustrating to adapt to the differences in things like streaming, tool calling, json formatting, output formats, etc.

This library aims to make it easy to switch between providers, while keeping the OpenAI format, which seems to have become the de-facto standard.
Maybe this can be helpful to others.
Judge orders Trump admin. to restore CDC and FDA webpages by midnight
Vitruvian-1: Data-Centric Cot-Thought Reasoning in Multilingual Language Models [pdf]
Although the results are just preliminary, wouldn't it be quite groundbreaking for a 14b model to have such high scores?

an article about the technicalò report here (itailan): https://www.notizie.ai/vitruvian-1-analizziamo-il-technical-...

you can't chat with it yet, although the page is online there is a waitlist https://vitruvian.asc27.com/
Learning from open source PHP projects – Part 1 – Code formatting
Part 1 of a little tour of open source PHP projects to gather some interesting best practices from the community.
counterpoint: I've been running my own mail server for 20 years and until a while ago it was: Install Ubuntu LTS, install the needed packages, don't touch the machine except for security upgrades until LTS runs out and I would (after skipping one LTS) use the next one for 4-5 years.

Yes, not a company, but I can imagine many more scenarios like this.
Trump administration declares 'most powerful' AI chips will be built in America
Yeah there is no link of those , so wanna see what they are doing.
I gave up on having decent and reliable design of controls in cars. Even if someone would come up with something having minimal (preferably zero) cognitive disruption that is easy to learn and used to, the constant self-forced and determined nervous pressure of providing new, and new, and very new, and revolutionary, and new revolutionary, and disruptive, will make me re-learn whatever new idea is forced on me with a new car. I dread replacing our 20 yo car. But we have to. Maybe - considering all other troubles with modern cars, like very poor computerization and inherent safety issues, optimization to the level of corruption or unreliability, sales hostility (subscription), nauseating design nightmares - better move to a city and country with decent mass transit system. Could be a win-win for us and the environment. For the missed cases there is taxi and rental. Car dominated societies are not nice to live in anyway.
Could be solved with a tax policy, durable plastics being made more expensive to encourage reuse and conversely biodegradable less durable plastic taxed less. Eventually things converge naturally towards an equilibrium.
PyCharm with CoPilot plugin works well for me
It wasn’t pretty, and for their crimes some of them were sentenced to positions as top scientists for the US government after the war.
a useless comment lacking any kind of comparison

why don't you say what they meant to say but better, in less words?
https://news.ycombinator.com/item?id=42965816
https://news.ycombinator.com/item?id=43017673
The emails were just "[truth/truth] (SLUR) BALLS (Issue #849)"

"@truth mentioned you: (100 users mentioned with @)"
i gotta try a bit then.
Actually it is hard to understand because that employee's device isn't an attack vector.
How do you feel about replacing general labor, period, and doing so for a class that no longer maintains a semblance of a social safety net? Do you think there's a difference between displacing one profession and displacing most professions at once?

Do you people ever step out of the abstract and think about the actual context you're living in?
The art of calling out room dynamics (2024)
> Unfortunately many new developers don't believe in powerful "power" tools anymore.

I have to use IntelliJ due to Kotlin codebase, but I'm still more of a fun of Emacs and I don't like Idea that much. I think IDEs somewhat lack the power that simpler tools have, which is automation.

One thing I miss from IntelliJ is programmability. That's why I still use Emacs on workplace for anything outside of Kotlin (git, grepping, note-taking etc). I even edit code in Emacs from time to time when it's easier to write a Lisp function which will batch edit code than doing keyboard macro.

Another thing I'm missing from IntelliJ is determinism. Everything is asynchronous, so the same combinations of actions can lead to different results, making automatisation painful.
I misunderstood it to mean they are selling any YouTuber’s email address for $10k
> This exploit could have been used to create a massive near-complete database of every Google account has automatically had a Youtube account created.

Massive email databases are extremely cheap, often free. For this vulnerability to be worth more than $10k there would have to be something about it being a near-complete library of Google accounts (rather than just another massive mailing list).

And that's assuming the prospective buyer believed that they could exploit this vulnerability in full before discovery. If I'm reading this exploit right, each email recovered requires two requests, one of which needs to make one of the fields 2.5 million characters long in order to error out the notification email sent to the victim. Presumably that email sending error would show up in a log somewhere, so the prospective attacker would have to send billions of requests fast enough that Google can't block them as suspicious or patch the vulnerability, all the while knowing full well that they're filling up an error log somewhere and leaving an extremely suspicious pattern of megabyte-sized request bodies on a route that normally doesn't even reach kilobytes.

I'm honestly not seeing how you could make an email list out of this that is anywhere near complete, and even if you could I'm not sure where the value to it would be.
Linux 6.15 to Bring More Improvements to DRM Panic "Screen of Death"
Does codeberg just not have proper limits? Why would you let someone mention 100 users in a single message and create like 800+ issues with one account in a very short time span
Oh this is just the tip of the iceberg when it comes to abusing Unicode! You can use a similar technique to this to overflow the buffer on loads of systems that accept Unicode strings. Normally it just produces an error and/or a crash but sometimes you get lucky and it'll do all sorts of fun things! :)

I remember doing penetration testing waaaaaay back in the day (before Python 3 existed) and using mere diacritics to turn a single character into many bytes that would then overflow the buffer of a back-end web server. This only ever caused it to crash (and usually auto-restart) but I could definitely see how this could be used to exploit certain systems/software with enough fiddling.
The old Nova instruction set, which lived on into the 16-bit and eventually 32-bit Eclipse instruction set, did have some curiosities: only four registers, and as I recall you couldn't do indirect byte addressing. The book does say that the architect on West's team had a much more VAX-like instruction set in mind for a project he didn't get to do.

That said, I was once at a customer's site that had an original "blue and white" MV/8000 (the MV series in general were brown-clad). If I remember correctly what the admin said, they boot up the new 32-bit OS, AOS/VS, for part of the day, and an older 16-bit OS, either RDOS or AOS, for the rest. I wish I remembered this more clearly.

And of course the VAX-style instruction set that West's architect envied fell out of style, didn't it?