skysight-inc/HackerNews huggingface dataset:
You're in a thread about proof assistants. I'm not saying it's useful to prove number theory facts in your business code. I'm saying it's useful to embrace programming and intentionally think like a programmer to do proofs. You're the one who asked about number theory proofs.

It is also useful to think like a mathematician to do programming, and I find that e.g. scala's ecosystem is a lot easier to work with for business problems than others like go or php because things tend to have more structure and predictable design, but that's a separate issue.
That's another problem: you really don't know. Anyone may hack your cloud account/server.
In the summer in the inner city of Brooklyn, you would be sweeping all day, everyday. NYC was a cesspool in the 70s. Newpapers blowing around, overfilled trash receptacles, insufficient street cleaning, and the public's general lack of respect for their fellow denizens. Homicides were at 1890 in 1989 in NYC compared to <400 nowadays and the population was a lot smaller then.
GitHub Actions could use lock files, and they would be useful specifically for composite actions, but they don't really solve the full problem at hand.

First, many GitHub Actions use a Docker image to do their work. This runs into basically the exact same problem in container land. So even if I pin the commit hash of an action, if that action doesn't pin the digest hash of its container image, then it's still ultimately a mutable reference.

Second, lock files don't protect against officially distributed malware when you intentionally update your dependencies. The lock file is designed to produce a repeatable build, and that does protect against a lot of supply-chain attacks when you never change anything, but you generally can't get away with never changing anything forever.

Third, commit hashes are SHA-1, and while it is exceedingly difficult to produce SHA-1 collisions through Git, it isn't impossible and it will only get easier over time. Git already technically has SHA-256 support but it's basically never used in the wild. This needs to be addressed sooner rather than later.

EDIT: The third point may not be as practically pressing as I thought. While SHA-1 is broken and shouldn't be used in new protocols, the techniques to break it faster than brute-force can be detected [1], and GitHub already rejects commits that are flagged by the detector [2]. I still think Git should more aggressively use a better hash, and should also be designed to migrate to new hash algorithms more easily in the future, but at least there are mitigations against attacks.

[1]: https://github.com/cr-marcstevens/sha1collisiondetection

[2]: https://github.blog/news-insights/company-news/sha-1-collisi...
Nice to see someone willing to stick their head above the trench wall. I worked on a "Vercel clone" for a year. After that experience I'd also warn friends to stay clear of Next.js. That said, we don't owe Vercel anything and if they want to ship a framework that's essentially a dongle for their service, they're perfectly entitled to do that.
Are the companies behind messengers like Signal, and VPNs like Mullvad, or the Tor Project, or any number of crypto-currency projects, are they aiding and abetting criminals?
I hate this so much. I don't want to do this, as its not cost efficient for development
Show HN: The Dead Web
I think perhaps that “possibly” needs to be nailed down a little better
Best part is after amassing all of this wealth I don’t feel any more protected. I don’t trust brokers/banks to allow sufficient withdrawals, FDIC or NCUA to pay out in a timely way, cash to not be inflated, BTC network fees and trouble causing more lost wealth, my physical ability to protect precious metals from government or thieves, etc.

The reality is we are naked and pretending otherwise is a prisoners dilemma.
I guess you have not heard that NVidia is generating frames with AI on their GPUs now: https://www.nvidia.com/en-us/geforce/news/dlss4-multi-frame-...

> “DLSS Multi Frame Generation generates up to three additional frames per traditionally rendered frame, working in unison with the complete suite of DLSS technologies to multiply frame rates by up to 8X over traditional brute-force rendering. This massive performance improvement on GeForce RTX 5090 graphics cards unlocks stunning 4K 240 FPS fully ray-traced gaming.”
I agree, but most Americans don't; I suspect we'll see in the coming decade or two, unless the US executes some kind of implausible course correction.

On the one hand, studies have suggested that nearly half of highly successful entrepreneurs/founders in the US are immigrants or children of immigrants. As the US becomes more authoritarian and more corrupt, its easy to imagine people choosing to do their new startup from, say, Berlin.

On the other hand, lots of people choose Singapore, too; rule-of-law-based country with relatively easy access to capital and relatively low taxes — but without actual democracy.

I'm aware of my own inherent bias of wanting democracy to be important to people when making this kind of calculation, but I'm not sure that we have any real evidence of that.
The comment you are replying is literally about someone convicted of hacking crimes (not someone alleged to have aided a cybercrime group with CDN services) working for the government. So no, your assertion that 20 years ago everyone would be horrified by such a situation is dead wrong. Did you reply to the wrong comment? It kinda seems backward when your own parent comment gave a great example that disproves your point.
Minor traffic offenses are also used in cities to pressure, search, and arrest people that are not liked by those with power, such as minorities.
10k words was the word count for my 3rd year undergraduate dissertation in the UK. Typically, this is tirelessly worked on over months. The quality of this far exceeds anything I produced during that time and anything I saw from my peers.
I tried the beta version of this model to write a business plan (long story).

I was impressed at first. Then it got really hung up on the financial model, and I had to forcibly move it on. After that it wrote a whole section in Indonesian, which I don't speak, and then it crashed. I'd not saved for a while (ever since the financial model thing), and ended up with an outline and a couple of usable sections.

I mean, yes, this is better than nothing. It's impressive that we made a pile of sand do this. And I'm aware that my prompt engineering could improve a lot. But also, this isn't a usable tool yet.

I'm curious to try again, but wary of spending too much time "playing" here.
> Compile times are crazy

This is also heavily influenced by the build too you use. Don't use sbt or Maven or Gradle. Use the good stuff. Use Mill.

https://mill-build.org/mill/comparisons/why-mill.html#_perfo...

Or Bleep, if you're feeling more experimental https://bleep.build/ .
Tuesday. But I have odd hobbies.
Depending on what this means it could be a big deal. There was always the catch 22 of authorization and agency sponsorship that the biggest players could YOLO and throw money at, but kept smaller less established companies out.
Ah, you're right. Thanks! Fixed: https://github.com/mtlynch/hn-popularity-contest-data/pull/3...
Well, he's 88.
There is a small country road near where I grew up with a highly visible Y intersection that never had a stop sign, because there was almost no traffic and, well it was very easy to see people coming from far away and traffic was quite slow on the bumpy road. Inexplicably, the county came along and installed a stop sign there a few decades ago. People who grew up on that road still run that stop sign to this day, more as a testament to the lack of awareness of the county authorities than anything. But it is an unnecessary annoyance as well.

That is how I feel about the takeover of the .local domain for mDNS. Why step in and take a widely used suffix that is shorter for something that will almost always be automated, instead of taking something longer to leave us alone with our .local setups. I will not forgive, I will not forget!
Are you saying a piece of clothing designed to be mass-produced is not highly engineered and doesn't involve many contributors?
You're still my favorite of the three of you.
They certainly seem to have moved from "it is literally skynet" and "FSD is just around the corner" in 2016 to "look how well it paces my first lady Trump/Musk slashfic" in 2025. Truly world changing.
> So then have BigBalls at least do his time before handing him the keys to the kingdom.

Given that he hasn't been charged with a crime (much less convicted), the "time" he is due to serve is zero.
Especially since it fits nicely into a mental model that includes !*, !^, !$, !-2 and such. ^something^somethingelse is also useful.

And the sudo !! pattern is something I do even when I realize that I need root ahead of time. There’s something about hitting enter on a command that makes me realize I’ve made a mistake, so doing that before I’ve granted root permissions is helpful. Up/ctrl-p are more awkward to use this way.
Medication is already mostly affordable but the hospitals are allowed to hyper-inflate prices for their shareholders.

We need to make sure the medical industry can't run like a back alley mafia loan shark before giving the crooks more money.

source: https://www.youtube.com/shorts/R2DKolx_zFI?feature=share
>It's trivial to delete social apps off your phone, and claim you don't have accounts on (at least) the less common ones.

I have to wonder how long before we see someone get flack for not having social media presence at all. Maybe in 2030 I'll finally be forced to create a LinkedIn just as a safety measure for social media presence checks.

>My question is, do they have backdoors to the major ones? Say you go on a wild rant a few times, delete it afterwards -- can "they" root through the DBs and examine the deleted posts? Is that something meta/twitter/etc even keep long-term?

Given we had stories back in 2013 about how they tracked how often you typed and deleted without posting. (but not what was typed) It might be best to assume the worst as always.

https://www.dailymail.co.uk/sciencetech/article-2525227/Face...
The hostility to outsiders is usually also part of the community spirit...
>pretend like they were a servant class

This is what I like to do, and it really is worth putting in the effort so that you end up really liking to do it.

I've been on both sides of the coin, building engineering labs for petroleum or chemical engineers who are going to spend more expert effort on the data than it took the labs to creatively collect what was needed.

Then more often eventually building and adding capabilities to chemical labs where I have some leading data insight for the clients myself. Either way fresh engineers and chemists often have to really start from scratch if they want to become industrial workers, and that's going to take more than a year right there.

It's the same amount of work in the lab, but the engineers' output is the product of the engineering outfit, while OTOH the data itself is the product of an analytical lab.
Add Gitea to that list.
Indeed, many Americans probably feel unsafe visiting Russia or China in the same way that a lot of citizens of the modern world are feeling increasingly unsafe visiting the U.S. The U.S. is quickly devolving into one of those Travel Advisory countries.
A missed opportunity to teach https://en.wikipedia.org/wiki/Commutative_property
> Can you recommend a setup guide?

Depends how far up the chain you want to go (e.g. use step-ca or not), but at the most primitive level, you are looking at something along the following lines of the below (the below is based off my rough notes, I might have missed something).

Note that I have ignored any Yubikey setup considerations here like setting PIN, touch-requirement etc. etc.

I have also assumed plain Yubikey, not the YubiHSM. The YubiHSM comes with SSH certificate signing functionality "out of the box".

Client Yubikey:

- Use Yubikey ykman[1] to generate a PIV key according to your tastes
- Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $client_key.pub`

Issuer Yubikey:

- Use Yubikey ykman[1] to generate a PIV key according to your tastes
- Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $issuer_key.pub` (save this for the next step and also put it into your sshd CA config)
- Sign with the issuer Yubikey with `ssh-keygen -s $issuer_key.pub -D $path_to/libykcs11 -I $whatever_identity -n $principal_list -V +$validity_period $client_key.pub`

(libykcs11 is the yubikey library,it ships with yubikey-piv-tool[2])

[1] https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Com...
[2] https://developers.yubico.com/yubico-piv-tool/Releases/

====
Edit to add links to various more verbose discussions on the subject (in no particular order):

- https://liw.fi/sshca/
- https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication/
- https://jamesog.net/2023/03/03/yubikey-as-an-ssh-certificate-authority/
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-ssh_certificate_pkcs_11_token

Also some verbose discussions on the possibility of doing so with FIDO2. Altough note that the native version of ssh on Apple OS X does not support FIDO2, therefore if you want native Apple support you are best sticking with the PIV method instead.

- https://developers.yubico.com/SSH/Securing_git_with_SSH_and_FIDO2.html
- https://medium.com/@harrishcluo/yubikey-ssh-git-super-secure-your-development-workflow-2-2-1899379fb882
- https://blog.millerti.me/2021/05/16/strengthen-github-ssh-access-with-fido2s-pin-support/
More discussion: https://news.ycombinator.com/item?id=43462783
> This genuinely threw me because in my experience the suburbs are the antithesis of this, just lots of people occupying neighboring space and rarely talking to each other.

This post and the comments here are genuinely interesting to me, because it shows how much people have different experiences in "suburban" and "urban" living. That, in turn, puts a whole new spin on everything I read about NIMBYism and urban development and whatnot. People don't even have a shared basis for what a city or suburb is and totally different experiences in each, so it calls into question how well we can even agree on or communicate what we want!

Personally, having lived over (urban: Manhattan, Boston, suburban: Houston-ish, Chicago-ish, rural: California, Missouri), I tend to agree that suburbs are the sweet spot for knowing your neighbors to some degree. In my Manhattan apartment, I lived in a tiny studio crammed into a building with tons of other people who I never met. In my rural living, people were mostly too far apart to mingle. In my suburbs, we were "friendly" with people about 6-7 houses in either direction, and front or back.

I live now in what I'd call a suburb (along this street: https://maps.app.goo.gl/7VfBtjzq3fMJRGXL9), and there's lots of people frequently "going for walks". There's not that much to walk _to_ but people are generally pretty active when the weather is nice, and so you run into your neighbors a fair bit. I'd say I know by name the families (so, multiple people) of about 10 houses in my near vicinity, and have the cell phone numbers of a handful.

I love this stoop coffee idea, and am going to have to try it here with my wife and kids.
> This argument could be made for every level of abstraction we've added to software so far... yet here we are commenting about it from our buggy apps!

No. Not at all. Those levels of abstractions – whether good, bad, everything in between – were fully understood through-and-through by humans. Having an LLM somewhere in the stack of abstractions is radically different, and radically stupid.
> Do you need a study for every little thing?

I didn't say that. What I said:

> What "good for you" would look like to me would be longer life expectancy, better health outcomes at different stages of life, etc. "Strong feet," for example, doesn't meet that standard for me. I'd want to see a link that work to actively strengthen one's feet creates those better life outcomes.

"It feels good" isn't an objective outcome that necessarily means something is "good for you."

> And you can also objectivly meassure. (E.g. how long you walk without pain)

This is a better outcome but I'd say it's not objective because I walk without pain while wearing shoes.
I thought Sophia officially closed down working on both Nushell and Jakt, but it appears I mis-remembered: it was Nushell and another language named June.

https://www.sophiajt.com/following-new-paths-ahead/
The shock of Hacker News covering news about a hacker.
Oh. I always assumed that v2 here was a branch, not a moving tag.
> and .local is for multicast DNS.

Does reusing it cause any problem for the mDNS, or does mDNS usage cause problem for the internal-domains usage?
The life expectancy of white people in Washington DC says a lot.
I don't have a great writing style -- it's too verbose and often has run-on sentences that seemingly never end.

And I do use the en-dash / em-dash a lot -- probably incorrectly.

All flaws aside, it would be very unfair of anyone -- much less any purported expert in AI -- to suggest that frequent usage of this punctuation -- irrespective of whether it is tasteful or not -- is a sign of AI generated text (or slop).
> It just seems insincere for you to advertise browser features that are built in as features of your app specifically

Sorry but I honestly don't understand this line of reasoning. Advertising a product having a feature in no way means claiming other products do not have the same or similar features.

I could list dozens of things not in Firefox, Chrome or any other browser that Polypane has (and in fact, you list off a few that definitely aren't in Firefox. ) but even so, listing the features a specific product has is the whole point of a marketing website.

Do you also expect Apple to list HP and Acer laptop alongside their Macbooks because those also have screens and keyboards, or otherwise it would be insincere they advertise (on their own marketing website) the screen of a Macbook?
My mildly grumpy opinion: this is not the first paper to show correlation between brain activity and the layers of a transformer. I know that Wang et. al (2024) have done it last year[1], but I doubt they're the only ones - I just have them in my head because I was reading their paper last week. Bonus fact: Wang et. al's paper also shows that test scores are a relevant factor in said correlation.

The point that always comes to mind is: correlation does not imply causation. I guess the main contribution would be a better mapping of the areas of the brain associated with speech production, but jumping from "these two things correlate" to "these two things are essentially the same" seems to me a bit of a stretch.

[1] https://arxiv.org/pdf/2407.10376
Some Reflections After a Month of Tracking My Own Online Activity
There is a breakdown in UX
if your references need to look like this

SHA `11bd71901bbe5b1630ceea73d27597364c9af683`

That means absolutely nothing to a human being
Whereas

> hashicorp/setup-terraform@v3

Is easy to understand.

How about

> hashicorp/setup-terraform!v3.0.1

This version, and only this version, fails if the version cannot be found.

Or

> hashicorp/setup-terraform@v3-2025-03-26-15-01

Give me the version of the library as it was at this specific time
or fail if it can't be found

Presumably it would be wise to check the SHA as well to
ensure no changes have taken place maliciously

One could go old school and import the code from the
various needed libraries, into the main project.
Now you have complete control over what runs and
it can be audited and will be in a safe state until
explicit action is taken to update the code.
> Languages definitely follow grammars

But it's the other way around! Grammars follow languages. Or, more precisely, grammars are (very lossy) language models.

They describe typical expectations of an average language speaker. Grammars try to provide a generalized system describing an average case.

I prefer to think of languages as a set of typical idioms used by most language users. A given grammar is an attempt to catch similarities between idioms within the set and turn 'em into a formal description.

A grammar might help with studying a language, and speed up the process of internalizing idioms, but the final learning stage is a set of things students use in certain situations aka idioms. And that's it.

> Statistics are just another way to record a grammar

I almost agree.

But it should be "record a language". These are two approaches to the problem of modeling human languages.

Grammars are an OK model. Statistical models are less useful to us humans but given the right amount of compute they do show much better (see LLMs).
Same here, feels so natural to have my local machines at <host>.lan
And the efficiency of spam is so low, that with a high enough cost per message, it would not be a net gain for the spammers. If you pay a million dollars to send a million messages, but only gain $100 000 from the subsequent scams, then it's a bad venture.
I like your diligency, thats pretty impressive track record. Although I need to point out a little readability issue: For me (likely ADHD) your blog is very hard to visually parse. It looks like single wall of unstructured text. It's hard to see where one post ends and where another one begins. The strongly emphasized links inside the content itself does not help. You have a lot of whitespace on left and right, but almost none in vertical direction and there is little use of font sizes. In the end every element seems the same importance. I see that you don't want to overdo with styling, which is fine, but a little more styling here and there could go a long way to help people get around.
Your intentions are good, but your execution is poor.

I cannot figure out what the comment is trying to get across either. It's easy for you because you already know what you are trying to say. You know what the pasted output shows. The poor execution is in not spending enough time thinking about how someone coming in totally blind would interpret the comment.
Tarrant County. Mentally ill but competent to stand trial. I’m sure there’s more than one. Source: 1 year in lockup (solitary) with them, often criminal trespass or public urination charges.
Overlord Systems Mission Statement
So in the three hours between you reading the puzzle in the parent comment, you stopped what you were doing, managed to get some other "random" person to stop what they were doing and spend half an hour of their time on a maths puzzle that at that point prior experience suggested could take a day? All within three hours?

That's not to say that you didn't, or you're recalling from a previous time that happens to be this exact puzzle (despite there being scant prior references to this puzzle, and precisely the reason for using it). But you can see how some might see that as not entirely credible.

Best guess: this random person is someone that really likes puzzles, is presumably good at them and is very, very far from being representative to the extent you would require to be in support of your argument.

Read: just a heavy flex about puzzle solving.
And then 2 years later you discover there was a security bug in that code you copied..
This is interesting, from the article it seems that authorities broken the law multiple times

"[...] people regularly spend months behind bars without charges filed against them, much longer than state law allows."

In such a litigious society like the one in the USA, what stops convicts from hiring the lawyer and suing authorities, there are many lawyers who would gladly work for success fee, if indeed the law was broken and they can expect an easy win for a huge amount that people get in US courts because, say, they spilled hot coffee on their laps and it turned out the coffee is hot?
I dont know. I feel the same way you do about Scala but love FSharp even though it is also both functional and imperative/OO.