skysight-inc/HackerNews huggingface dataset:
Totally agree. Most companies using mirrors or proxies like Artifactory aren’t getting much real protection.

- They cache packages but don’t analyze what’s inside.

- They scan or review the first version, then auto-approve every update after that.

- They skip transitive deps — and in npm, that’s 79 on average per package.

- They rely on scanners that claim to detect supply chain attacks but just check for known CVEs. The CVE system doesn’t track malware or supply chain attacks (except rarely), so it misses 99%+ of real threats.

Almost everything on the market today gives a false sense of security.

One exception is Socket — we analyze the actual package behavior to detect risks in real time, even in transitive deps. https://socket.dev (Disclosure: I’m the founder.)
The result of boomer cultural and capital domination. Millenials need to grow up and yank power from them, first starting with massive government handouts given to olds
Schemaless can be accomplished with well-formed formats like json, xml, yaml, toml, etc. from the producer side these are roughly equivalent interfaces. There's zero upside to using CSVs except to comfort your customer. Or maybe you have centered importing of CSVs into your actual business, in which case you should probably not exist.
>and AOSP by itself is not that useful of an operating system

Why not? What useful feature is gated behind a proprietary API. Casting is one I can think of. But I think you can still get plenty of use out of a phone without casting.

There is technically a casting API in AOSP but it's old and doesn't integrate with Chromecast as well.
The data was retrieved from the public HN dataset on BigQuery: https://news.ycombinator.com/item?id=40644563

SELECT
id,
title,
url,
FORMAT_TIMESTAMP("%Y-%m-%d %H:%m:%S", timestamp, "America/New_York") AS
submission_datetime,
score,
descendants as comments
FROM
`bigquery-public-data.hacker_news.full`
WHERE
type = "story"
AND REGEXP_CONTAINS(url, r"daringfireball\.net")
ORDER BY submission_datetime
Heh. This would have been just a bit more fun if you’d used it correctly—without the surrounding spaces.
It's an ad hoc text format that is often abused and a last-chance format for interchange. While heuristics can frequently work at determining the structure, they can just as easily frequently fail. This is especially true when dealing with dates and times or other locale-specific formats. Then, people outright abuse it by embedding arrays or other such nonsense.

You can use CSV for interchange, but a duck db import script with the schema should accompany it.
I wish this was a joke. I'm always trying to convince data scientists with a foot in the open source world that their life will be so much better if they use parquet or Stata or Excel or any other kind of file but CSV.

On top of all the problems people mention here involving the precise definition of the format and quoting, it's outright shocking how long it takes to parse ASCII numbers into floating point. One thing that stuck with me from grad school was that you could do a huge number of FLOPS on a matrix in the time it would take to serialize and deserialize it to aSCII.
Capability-based security within Node. The main module gets limited access to the system (restricted by the command-line, with secure defaults), all dependencies have to be explicitly provided with capabilities they need (e.g. instead of a module being able to import "fs", it receives only an open directory handle to the directory that the library consumer dictates). Deno already does the first half of this.
Blacklisted and censored?

See: 120 submission in the past 12 months- https://news.ycombinator.com/from?site=daringfireball.net&ki...

multiple submissions with > 100 points.

eg:

* Publishing AI Slop Is a Choice (daringfireball.net)
167 points by mpweiher 10 months ago | past | 76 comments

* Why can't we screenshot frames from DRM-protected video on Apple devices? (daringfireball.net)
173 points by ingve 25 days ago | past | 217 comments
To be fair to Android, this is a limitation of the MTP protocol and not android.
To mount your storage as a mass storage device then the host device (your computer in this case) does raw sector read/writes to the device, the host device provides the filesystem services. For this to work it has to be completely unmounted from the phone as obviously having the block mounted in two filesystems at once would corrupt everything very badly.

Android used to split storage into various partitions, which is why this used to work - It was able to unmount the partition and let your PC manage it. This meant any apps using that partition needed to be stopped, etc etc. It was a pain, and I can totally understand why they moved away from this approach.

Personally I prefer the new way, yes using MTP has some limitations as you've noticed but it does mean the storage can remain mounted on android while your PC accesses it.
The HTML 5 spec says exactly how you're supposed to deal with broken HTML files.
Exactly. Linus’s Law — “given enough eyeballs, all bugs are shallow” — falls apart when everyone assumes someone else is doing the watching. In reality, most packages (and especially their transitive dependencies) get zero meaningful review. Attackers know this and exploit it. Community vigilance just doesn’t scale — we need better tools to actually inspect what code is doing.
Cilium eBPF-Go on Windows
It's relatively easy to make a thick leather wallet that will last a couple decades.

It's hard to make a thin leather wallet that will last a couple decades.

Most of the online leather brands that popped-up in the past 20 years are the former, not the latter.
I did something similar the other day but I end up using a circular buffer of fixed size. Everytime you push a new state the oldest state gets discarded.
>Android is look-but-dont-touch source

What do you mean by this? I have had changes upstreamed into AOSP and I'm not a Google employee.

>Its massive codebase that requires immense resources to build is not open for negotiation

So is every other operating systems. Do you think the millions of lines of codes for Windows builds instantly? You can get by building AOSP on a normal desktop workstation.
I am interested in the mechanistic approach which would drive the interventions by the feds.

* are people suggesting targets? who would that be? is this organized online somewhere?

* is there a 'u-tip' number people can dial anonymously?

* is this based on some metric over feed analysis, and smart tools so there's a threshold test in software and a priority list which is run as a join over immigration status?

I'm not asking people to break OPSEC, this is in the spirit of "how exactly did Hollerith cards help the bad people do the information processing" of past times.
If I had to guess they are really behind right now. Everyone I know is doing this. I checked my email and I emailed mine to myself in 2018 thank goodness. Told them to destroy my sample today and delete my data (don’t know if it will be done but at least I did it).
They've been saying that kind of shit about everything AI related since fuzzy logic was the next big thing. It will never happen. AI will be used to cut staff and increase the workload of those remaining. The joke is on you for being susceptible to their hype.

I use a couple of different tools because they're each good at something that is useful to me. If Jetbrains AI service had a continue.dev/cline like interface and let me access all the models I want I might not deviate from that. But lucky for me work pays for everything.

You also seem awfully fixated on Copilot. How much exactly do you think your $12/month entitles you to?
Great question. A few reasons:

– The JavaScript ecosystem moves faster — way more packages, more frequent updates, and more transitive dependencies (avg 79 per package).

– npm has lower barriers to publishing, so it’s easier for malicious actors to get in.

– Java developers often use internal mirrors and have stricter review processes, while npm devs tend to install straight from the registry.

– But to be clear, supply chain attacks do happen in other ecosystems — they’re just underreported. We’ve seen similar issues in PyPI, RubyGems, and even Maven.

JavaScript just happens to be the canary in the coal mine.
$5 mil would have been my opening bid if Zuckerberg asked me to write that, I would have done the deal for any offer over $999,999.99.
The stock market is mostly based on the greater fool theory. You can’t really escape that.

Most VCs doing 99 investments for the 1 big are akin to YC. They’re not doing series C for $100m and expecting 99 of those to fail. They’re expecting to get a return somewhat shortly back.

Holding the stock isn’t helpful for a VC unless they’re going to be using some financial mechanism for leverage - which means they’ve given it up for the other institution who now essentially owns it. A lot of these stocks aren’t giving you meaningful dividends. You have to sell or give up some form of control on them to be a successful VC. How else would you continue to invest?
I somewhat resonate with this. Working in mature industries where competition has condensed down to larger players with enormous scale and embedded product distribution, don't need to compete _much_ on innovation or product, just on price.

I don't think specifically AI has done this compared to a broader view of constant stream of digitilisation of every departments function.

Orgs don't need grads to learn the ropes from the bottom and make their way up the career ladder, when the ladders might only be 3-4 rungs high now.
https://archive.md/PsBXp
HIPAA isn’t really a personal privacy regulation at all ...

Like other privacy regulation, it’s there to protect the industry and their business/commercial interests.

Barriers to access mean less controversy, fewer lawsuits, fewer investigative news stories, fewer insurance disputes.

I’d say it’s also designed to reduce contamination or adulteration of data: if every facility needs to do new testing and new evaluation then they can be sure they got the results they need, instead of taking some rando’s word for it.

HIPAA isn’t the most onerous barrier to personal access to records, but it’s a huge hassle for someone who wants it opened up for family, friends, and other entities because those forms are onerous. With good transparency in patient portals, authorized users can manage a lot on their own.

Also, good luck reading anything but textual notes, because imaging and other medical data is often always distributed in proprietary file formats that don’t simply import into Gimp!
Yes, that is a single spec with correspondingly-small importance. Generally parsing html remains extremely difficult.
> The deluge of solar power has thrust electricity prices into negative territory in regions with liberalized energy markets, which bodes ill for the economics of further expansion.

No, it doesn't. This is the market sending energy developers and policymakers a signal to stop installing solar in this particular location and start installing storage or transmission.

The market is sending California the same signal now, and they are responding accordingly.

There is no boding ill here. This is everything working as it should be.
> We're (the US) are done. We're cooked.

I think I've written this comment a few times already, but it'll never stop being relevant:

The curse of growing up in a rich country during prosperity is that every single issue is the most serious problem your country has faced in your entire lifetime.

Chill out. It's going to be fine. You're still going to be a high-income country with good standard of life, even if it falls a little.

And even if you're right and the US as we know it is done, it's not because of one orange man with an attitude. It's because of bigger forces. The US became so strong because it used right the once-in-a-millenium opportunity where its engineers would run circles around other countries. When US was sending men to the Moon, China was recovering from an unfortunate incident of having forgotten how to grow rice. That's how big the gap was. Circumstances for such a situation to arise appear extremely rarely, and during "normal times" country's wealth is pretty much tied to its population size. With China and India being together seven times as populous as the US, it's just not possible for the US to maintain its hegemony no matter whether you vote Republican, Democrat, or draw a penis on your ballot, unless the US happens to be lucky enough to again stumble upon some revolutionary discovery comparable to the invention of computers, and have it impossible to produce in rival countries. Spoiler alert: seems like AI is the next big thing, and even if the US still has the lead, China is already technologically closer than Soviets were during their peak.
The real point of the original comment was that outside the US iMessage is not dominant and so nobody cares about what color a chat bubble is.
> Did DF ever allow comments on its own website?

Not that I'm aware. There's some discussion about it in this post from 2010:

https://daringfireball.net/2010/06/whats_fair
The False Promise of ORMs
Isn’t that good?
The Californians yearn for a cult.
It's not being blacklisted or censored (see other comment with link to submissions).

My suspicion: it's not relevant to the HN audience. DF is opinion pieces (mostly) about Apple. While I'm sure many DF readers use some Apple device(s), I suspect many (most?) DF readers do not care about "inside baseball"[0] for Apple.

[0] https://en.wikipedia.org/wiki/Inside_baseball_(metaphor)
... based on Microsoft Lync :-) Yes, what a step forward.
Agreed, you can buy into it when it’s in a shipping product.
It's all a bit surreal. As a Brit we did our own bit of shooting ourselves in the foot by mucking up our trade with Brexit. Life goes on but it caused a lot of expense and hassle and reduced economic growth to near zero.
Praise Kier!

I want that keyboard so bad...
completely 100% disagree with this.

Businesses are better and more efficient places with blunt honesty.
Imagine you're having an in-person conversation with someone in a crowded restaurant. Rather than addressing their next response to you, they wait until you go to the bathroom. Then they turn to everyone at the next table and say, "that guy doesn't get it, but fine."

I personally think that in a no-holds-barred debate, you don't bother trying to convince your interlocutor of anything. You focus on persuading everyone else in the room. But it's rude to treat every polite conversation as a smackdown debate. Such a strategy can also backfire by turning off your intended audience, as evidenced here.
I would 100% do that if I had enough money to shield me from any consequences of such attitude.
> People now associate Google AI/Gemini with shitty search results and bad answers

I'm curious how valid this statement is. Anecdotally, I really like those results. For whatever reason, I don't directly interact with Gemini, I just type questions into google and if an AI response comes up I definitely give it a first look before clicking through links. If for some reason no AI response comes up for a question, I copy-paste it into ChatGPT and I usually get the answer I'm looking for.

As I typed that^ I realized something funny. I used to make fun of my parents for typing certain questions into google e.g. "What's the best pizza place in New York?". I would tell them to type "Best pizza place New York", because Google seemed to work better that way. But then that sort of stuff was hijacked by the SEO industry. So the meme of typing "Best Pizza Place New York Reddit" started so we could get actual answers from real people. With the rise of LLMs in search I'm personally back to typing "What's the best pizza place in New York?" right into Google/ChatGPT and it's been pretty successful so far. I'm curious what the next thing will be.
Used car salesman in more than one way
I think I’m starting to see the potential.. So I could MPC cursor to my local Postgres (or, after some practice to build confidence, prod Postgres). Then use cursor to help debug.

This sounds risky but very useful if it works as intended!
> baby being fed this equality all countries are good blergh blergh bs all my life.

Nobody in this thread has made anything like those kinds of sentiments. The very fact that we are taking note of Botswana's satellite nearly 70 years after Spitnik 1 makes it quite obvious how much less developed they are in aerospace. I would think that especially if someone is against such things as foreign aid to non-Europeans, and culturally relative assessment of intelligence, that they would be in favor of seeing countries like Botswana take steps to develop home grown expertise in engineering, reducing the need to rely on outside largesse, and coming a step closer to achieving developmental escape velocity.
The first five points are fixed by using Mill

https://mill-build.org/mill/comparisons/why-mill.html#_perfo...
More and more Apple has been adding ads into iOS. Always have another Apple credit card ad in wallet, or Apple Music ad in settings, etc.
> Scala 3 was an attempt to fix that by appealing to Pythonistas

Could you elaborate? I changed jobs while it was still v2, stopped using it, and haven't kept up with the changes.
they're dying
MusiCoT, a chain-of-thought (CoT) prompting technique for music generation [pdf]
It may have been a dumb comment, but there's some truth to it. Go was to solve a Google problem of devs that needed to write system management programs, not systems themselves. The choices of Python or C/C++ left a large gap that Go filled.

I used Go for most of my own projects and as I got deeper into it began to realize its warts, but the worst was that you can't get performance by "share memory with communicating"--channels are slow. Reading the non-idiomatic stdlib implementation shows the difference of who it's made by vs who it's for (which isn't the authors).
"Energy is too cheap" is only a problem when the people who own whatever equipment is generating energy are interested in a direct return on their investment. From the perspective of Kardashev, "Energy is too cheap" is a fantastic opportunity for a civilization.

While yes, too much surplus capacity would eventually indicate overinvestment, for now it seems like great news for the compute and software industry in China. If you reliably have times when energy is better-than-free, that's the ideal time to scale up and generate embeddings from your stored data, or train LLMs, or do all sorts of other batch-able but intensive tasks.
Space-wise, as long as you compress it, it's not going to make any difference. I suspect a JSON parser is a bit slower than a CSV parser, but the slight extra CPU usage is probably worth the benefits that come with JSON.
Presumably if it's due to negligence (ie intentional lack of investment) it will happen again if the underlying issue isn't fixed. So you have to factor that in.

If it happens repeatedly presumably the percentage will go up.

I think the only way this gets written off is if saving the money opens you up to such a low level of additional risk that you don't reasonably expect the event to happen more than once (if ever). But if the risk level is actually that low (I don't believe this to be the case, just playing out a hypothetical here) then arguably they wouldn't be in the wrong.

To put this in regular person terms, 3% of a 6 figure salary is $3k. That's more than enough to get most people's attention.
Yes, I'm guilty of painting with an overbroad brush here in an attempt to emphasize the difference in scale between then and now. It's not the case that the collapse of Roman authority had no effect on the people of the former territories; it certainly led to an indisputable loss of living conditions across the board, including in industrial output. But my point is that, in the event of a modern collapse, we aren't going to revert to some "checkpoint" of irreversible technological progress; we could just as likely revert to the living conditions of a denizen of the remnants of the Eastern empire as of 600 AD (and that might be an optimistic outcome!). Technological progress is not a one-way street, is my meaning, and from our lofty perch, we are entirely capable of crashing hard to Earth.
I have written a new database system that will convert CSV, JSON, and XML files into relational tables.

On of the biggest challenges to CSV files is the lack of data types on the header line that could help determine the schema for the table.

For example a file containing customer data might have a column for a Zip Code. Do you make the column type a number or a string? The first thousand rows might have just 5 digit numbers (e.g. 90210) but suddenly get to rows with the expanded format (e.g. 12345-1234) which can't be stored in an integer column.
That makes sense. Although previous model's image gen wont bad as well with Ghibli style. I guess "maintaining a particular art style" is the point here. Thank You.
Europen Union creates Fedora-based Linux distribution for the public sector
What do you mean you miss it? What is stopping you from doing exactly that now? Plug it in, drag down the drop-down and make you phone identify as storage. Then you can copy video off it while moving music onto it, if that is what you want.
The Royal Australian Air Force shut down airspace over an air force base to test fire a “high-powered” single-shot .50 caliber rifle. They are a parody of themselves.
One thing that struck me after reading this article as well as all the comments here - we are providing excellent free training for the next generation of agents coming up. We are literally training our replacements!

Like others I agree humans are not getting replaced anytime soon though. For all the current hype current AI technology is pretty dumb. Give it a decade or so though and everything we are currently doing will seem like Stone Age technology.

Aside: sometimes I really wonder if humanity is trying to automate itself out of existence.
Length-delimited binary formats do not need escaping. But the usual "ASCII Delimited Text" proposal just uses two unprintable bytes as record and line separators, and the signalling is all in-band.

This means that records must not contain either of those two bytes, or else the format of the table will be corrupted. And unless you're producing the data yourself, this means you have to sanitize the data before adding it, and have a policy for how to respond to invalid data. But maintaining a proper sanitization layer has historically been finicky: just look at all the XSS vulnerabilities out there.

If you're creating a binary format, you can easily design it to hold arbitrary data without escaping. But just taking a text format and swapping out the delimiters does not achieve this goal.
https://news.ycombinator.com/item?id=43486855
They make a great database?
This is the way.

Deny deny deny. Those that have already drunk the kool-aid will believe your denial. Those that are too lazy to look or only get their info from one source will not know any different than your denial. The rest are just wrong from being in opposition anyways.

It works anywhere as long as you are large enough of an entity
I loved this hands-on presentation Containers From Scratch by Liz Rice from few years ago https://www.youtube.com/watch?v=8fi7uSYlOdc.

Today, Linux containers in (less than) 100 lines of shell by Michael Kerrisk was published https://www.youtube.com/watch?v=4RUiVAlJE2w.