skysight-inc/HackerNews huggingface dataset:
I'm right there with you, except at times I have thrown caution to the wind and made my sites available.

My current setup is to rent a cheap $5/month VPS running nginx. I then reverse ssh from my home to the vps, with each app on a different port. It works great until my electric goes out and comes back on the apps become unavailable. I haven't gotten the restart script to work 100% of the time.

But, I'd love to hear thoughts on security of reverse SSH from those that know.
Isn't this one of the main selling points of apps like Balsamiq, you can present something that looks sketch like rather than a completed page.

https://balsamiq.com/product/
What does event sourcing have to do with searching or "instant keypresses"? It's a storage pattern for recording events, not a way to search.

Like, you're searching a single table for text messages, not a stream of events.
1s/0s
Hurray! I thought I was the only one that understood this. There are two of us!

I've seen so many performance issues with hashcode because devs will put all fields into it. Even though there's an id column or even fields that imply other fields. Hashing 1000 char strings when there's a UUID or int field that guarantees identity is silly.

I think it's because devs have an preference for symmetry. I see the same thing happen when they preferably add setters for all fields even though they aren't necessary.
> A VPS with a software firewall is more than enough.

You want VPS-provider firewall. Docker's going to punch holes through your software firewall.
but they don't seem to be lagging behind with this new image tool they've added
Best I've seen today I might have fallen for it had I not been stung already.
> Edit: It's saddening that this apparently cannot be said or discussed.

The sad part is that you can't make the distinction between a paper being opinionated and it being propaganda. Plenty of newspapers have historically had a very strong bias but also a strong commitment to journalism ethics and standards.
In real life, even today, a lot of systems have to run fully automatically because humans are too slow to respond: https://en.wikipedia.org/wiki/Phalanx_CIWS

But specifically manoeuvres, rather than weapons systems? Today, I doubt it: the ships are too slow for human brains to be the limiting factor. But if we had an impulse drive and inertial dampers (in the Trek sense rather than "shock absorbers"), then manoeuvres would also necessarily be automated.

In the board game Star Fleet Battles (based on a mix of TOS, TAS, and WW2 naval warfare), one of the (far too many*) options is "Erratic Manoeuvres", for which the lore is a combination of sudden acceleration and unpredictable changes in course.

As we live in a universe where the speed of light appears to be a fundamental limit, if we had spaceships pointing lasers at each other and those ships could perform such erratic manoeuvres as compatible with the lore of the show about how fast they can move and accelerate, performing such manoeuvres manually would be effective when the ships are separated by light seconds. But if the combatants are separated by "only" 3000 km, then it has to be fully automated because human nerve impulses from your brain to your finger are not fast enough to be useful.

* The instructions are shaped like pseudocode for a moderately complex video game, but published 10-20 years before home computers were big enough for the rule book. So it has rules for boarding parties, and the Tholian web, and minefields, and that one time in the animated series where the Klingons had a stasis field generator…
HN is now a federal organization. Your account is marked for deletion in the next efficiency round.
Imagine if this had happened under a Harris presidency.
I can self host many applications, but their security must be outsourced to a company. I don’t have time to keep on top of vulnerabilities.

Cloudflare Tunnels is a step in the right direction, but it’s not end to end encrypted.

The question is then, how to secure self hosted apps with minimal configuration, in a way that is almost bulletproof?
Oh I agree. Was just addressing OP’s argument that surely React is as optimised and small as it can possibly be. I’m personally not convinced.
Self-Hosting like it's 2025...uhhgg...

Don't get me wrong I love some of the software suggested. However yet a another post that does not take backups as seriously as the rest of the self-hosting stack.

Backups are stuck in 2013. We need plug and play backups for containers! No more roll your own with zfs datasets, back up data on the filesystem level (using sanoid/syncoid to manage snapshots or any other alternatives.
You can go hunter2 my hunter2-ing hunter2
Show HN: Smart AI tool for project planning
I host tons of web-facing apps behind a reverse proxy. I used to have it all running in a swarm cluster with several underlying vms but decided to move everything to Unraid a while back for simplicity.

Would highly recommend.

https://unraid.net
Why Does Claude Speak Byzantine Music Notation?
America's Moral Moment on the Senate Floor [video]
You could try Better Help, they have people available to help with anger management.
> I have more than 140k LOCs of Typescript in production, and that would not be manageable without types

The Svelte team achieved it with JSDoc. Google's JS style guide also focuses on JSDoc for the same reasons[0].

And to be just a tad pedantic: you have JS in production; your TS is only in dev.

> Go, Java, C#, etc. that would work end to end, that would have been amazing.

It's not that you can't; it's that you choose not to (and yes, generally for good and valid reasons). There are end-to-end solutions for C# (e.g. Blazor), for example, that are perfectly fine depending on your use case (not great for all use cases). Fable is another example using F#[1]

There are also libraries like Bootsharp[2] that are doing interesting things, IMO, and has some of the same energy as OP's project (moving the typing and logic into a runtime that supports runtime static types and interfacing minimally with JS)

[0] https://google.github.io/styleguide/jsguide.html#jsdoc

[1] https://fable.io/docs/

[2] https://sharp.elringus.com/
Now would be a great time for her to pop out a few kids though, if Holmes is any guidance.
I thought it was an April fools joke, glad I'm not the only one.
AI stealing yet again.
Neo-feudalism. It's like original feudalism, but with the internet.
Advanced Dialyzer Usage in Elixir: Types and Troubleshooting
Show HN: Top Hacker News
Hi HN, I built a top Hacker News website to help you quickly browse tech news, reducing the burden of information filtering and keeping you focused.

Features:

1. AI immersive translation: 中(简/繁), 日本語, 한국어, ...

2. AI summary

3. Article cover(open graph image), favicon

4. RSS

5. PWA

6. Responsive UI for mobile, pad, PC

7. Dark mode

It's free. Welcome to try.
I moved us off docker swarm to GKE some years back. The multi node swarm was quite unstable, and none of the big cloud providers offered managed swarm in the same way they offer managed k8s.

It's a shame I agree because it was nicely integrated with dockers own tooling. Plus I wouldn't have had to learn about k8s :)
That's why I always set my password as 8 asterisks - that way when my password gets leaked the hackers still think it's encrypted.
>The site wants to over estimate clicks, the advertiser wants to under estimate

Only if you show the ads. Many companies do not, but still use lots of trackers. Why? Because their performance marketing team is trying to find the right mix of advertisement channels, so they go for paid search and clicks to Google, Meta and lots of other AdTech. In that case trackers are needed to optimize spending by analyzing user behavior. If certain cohort spends more time on the site, they will get more ads of it. If another cohort leaves the site quickly, they will see less ads. The promise of AdTech in general is that they personalize ads as much as possible to reduce your customer acquisition costs (CACs) - you won't waste money on showing ads to people who won't buy your product. So they need the data and they have to own it, because personalization is their competitive advantage.
Whoa! Lot of hostility there. You know most of the people responsible for that are dead, right??
I use Oracle Cloud for my personal projects because of their generous free tier[1] which includes 4x Ampere A1 cores, 24 GB of RAM, and 10 TB of outbound data transfer per month.

I was ready to jump ship if they changed the terms, but I was not expecting a security incident.

[1]: https://www.oracle.com/cloud/free/
The Heat Death Company: Solving humanity's ultimate challenge
The bloat isn't coming from "huge frameworks" like React.

To give some concrete numbers: a barebones react project created with `pnpm create vite -t react-ts` clocks in at ~60KB compressed:

dist/index.html 0.46 kB │ gzip: 0.30 kB
dist/assets/react-CHdo91hT.svg 4.13 kB │ gzip: 2.14 kB
dist/assets/index-D8b4DHJx.css 1.39 kB │ gzip: 0.71 kB
dist/assets/index-9_sxcfan.js 188.05 kB │ gzip: 59.16 kB

A vue project (`pnpm create vite -t vue-ts`) is even smaller at ~25KB:

dist/index.html 0.46 kB │ gzip: 0.30 kB
dist/assets/index-1byZ3dr3.css 1.27 kB │ gzip: 0.65 kB
dist/assets/index-CKXNvRRZ.js 60.77 kB │ gzip: 24.44 kB

I've created plenty of medium-sized projects with React/Vue clocking in at 200-300KB compressed (excluding image assets). You can still realistically use those on 2G — yes I've tried, not just in dev tools, but when I was actually rate limited to 2G.

> When a simple home page dashboard or a notes page takes more than 10s to load on a 10G connection peered within 5ms of the host, and 95% of this is spent in JS.

You can create that kind of garbage with any framework, or without framework. You can actually do worse with the traditional way of using third party dependencies wholesale (the jQuery way), you can be downloading 200KB for 1KB of actually used code.

Edit: Also, the comparison in the article is pretty stupid. A full view in React is not much larger than "a React button", it's upfront cost + marginal cost.
hmm, it looks like you've got a bug in the demo app. if you type too quickly into the search bar, the entire app slows to a halt.

seems like you'd want to move the filtering logic off the main thread, or you'd want to reinvent React's "Fiber" suspendable rendering architecture.
Why would tuning be necessary for a regular setup, does it come with such bad defaults? Why not upstream those tunes so it can work out of the box?

I remember spending time on this as a teenager but I haven't touched my MariaDB config in a decade now probably. Ah no, one time a few years ago I turned off fsyncing temporarily to do a huge batch of insertions (helped a lot with qps, especially on the HDD I used at the time), but that's not something to leave permanently enabled so not really tuning it for production use
> Over the past few weeks, I’ve spoken with several VCs who confidently claim that companies won’t need to hire anyone in the next year or two because AI will handle everything.

An important part of being a VC appears to be the ability to believe anything, no matter how stupid, as long as it is currently on-trend, then to abandon it as if it had never existed when fashions change (for instance, see the blockchain craze, which was shortly followed by a distinct NFT craze that was just the blockchain one resprayed). I would not take what _VCs_ say as any particular guide to reality.

> Even Bill Gates recently said we might all be out of work soon and won’t need to do anything in an "age of abundance."

This would be the same Bill Gates who was claiming in the late 90s that by the early noughties our primary means of interfacing with our computers would be by talking to them, yes? I mean, again, you've got to consider the source.
Only since Vue 3 though, and the types are still not as good as React.
OpenAI → ClosedAI on Spotify
Is there something specific to the browser-in-a-desktop app domain that's different from normal frontend web development, where you have to support a variety of different browsers? How is it any different for Tauri?
Not knowing what "number of gaps" means has no consequence. Just use the app.
Understanding Trump Tariffs Through the Lens of "The New Conservatives"
All this is illegal:

The Impoundment Control Act

The Administrative Procedure Act

The Civil Service Reform Act

The Museum and Library Services Act

The Appointments clause of Article II of the Constitution

The Take Care clauses of Article II of the Constitution.

Executive orders are not laws and cannot override laws.
[preflagged for convienence]
Maybe try running your services in docker, I don't know how difficult that would be to implement for you, but if you run it in containers you can get it to start up after an outage pretty reliably.
I suspect you would have trouble hosting long term in China. I don’t recall the specifics now but IIRC every website hosted in China needs a special government ID which requires getting approval. My memory is hazy but it does feel like one of the poorer choices to host unless you live in mainland. There are many better options in the world that both do not restrict information as well as not requiring paperwork.
Some portion of Guardian readers might see the state as the main provider of benefits to society, but I very much doubt most would. Guardian is a (in the European sense) liberal paper, with a readership ranging from the centre and toward the left, with a large proportion along that entire range being totally fine with non-state organisations structured for the public benefit. You'll also find plenty who look on the state with suspicion to outright hostility and would actively prefer if more businesses had ownership structured this way, whether or not the handover of wealth that creates them "avoids taxes".
The thing to really emphasize about autocrats is not that they're just big ol' meanie heads, but that they and their teams are generally wildly incompetent at actually operating the systems they control.

These regimes attract the least competent people possible because those people know that so long as they're sufficiently loyal, they'll never be accountable for competence. It's a great opportunity for exactly the people you don't want making important decisions!
Mission accomplished!®
The potential demerit is: how compliant is Verso compared to Chromium and Safari?
JS with JSDoc is basically just awkward Typescript.
How much benefit does Dialyzer still bring now that Elixir is getting an inbuilt type system?
Sorry, autocorrect changed stateful to started.
sounds like my wife, when me did not put up the toilet lid, again.
You sharing that crystal ball?
As mentioned in another comment, I'm currently still happy with (single node) Docker Swarms (with the reverse proxy as described on https://dockerswarm.rocks/ ). I like that I can basically use the docker compose files published by a lot of project to deploy. How does Unraid compare in your experience?

And I like that I can deploy images which basically don't have any requirement to be deployable to Docker Swarm. Is that also the case with Unraid?
Just a friendly heads up, for the Japanese exercises the video starts just a bit too late and the word you're listening for is cut off. This might only be pertinent for languages where vocab words are appearing at the beginning of sentences, French and Spanish didn't have "gap words" at their sentence start for the few exercises I tried.

This is a cool app, I would have enjoyed this when I was grinding on Japanese back in the day.
Hot take: workplace and social media April Fools jokes aren't funny and are often inappropriate and disrespectful to people's time.

It's cool to do these to your friends in High school, but I once wasted a good amount of time at work because of an April's fool joke. I already didn't want to do the work so I got really upset to have wasted time doing something boring and useless.

Additionally, the scale of social media can create situations where it wastes everybody's time several times per day... Including on HN.

Feel free to prank your friends, but don't bring it to work or the Internet, please.
> Then what were the literally room full of formal process and spec documents, meeting reports and formal agreements (near 100.000 pages) by the analysts on either side for? And how did those not 'solve' the understanding problem?

Sure.

There are many possible factors (eg. somebody had a shitty idea and a committee of people sabotaged it because they didn't wanted it to succeed, or it was good but committee interests/politics were against it, or it was generally a dysfunctional org) but it's irrelevant so let's pretend people are good and it's the ideal case.

There was likely somebody who had a good idea originally. However somebody failed to communicate it. Somebody brought vague vibes to the table with N people and they ended up with N different ideas and could not agree on a specific.

It just reiterates the original problem that I described doesn't it?
I own a Kindle Oasis 2. Amazon stopped software updates for it so I just jailbroke it and loaded KOReader. It's way better than the official software, probably the most feature-rich and customisable document viewer I've ever seen. I regret not installing it earlier.
I think the majority of people still know how to grow their own food. We only passed 50% of the population living in cities a few years ago. https://data.worldbank.org/indicator/SP.RUR.TOTL.ZS says 43% of the population is still rural, and I'm guessing about 80% of that 43% (32%) knows how to grow their own food. So do all the people who have moved from the country to the city over the last 40 years.

There's a big gap between "pretty much nobody" and the reality, which is somewhere between one third and two thirds of everybody. You might want to reflect on exactly how your perception diverged so radically from reality.

Do people in cities suffer from not being able to grow their own food and make their own clothes? I don't know for sure, but official statistics claim that, even today, they commit suicide at much higher rates despite having much less material scarcity. Robinsonades have been a popular genre of fiction for centuries, suggesting that people long for that kind of autonomy. Today, we also have zombie apocalypse fiction, RPGs, and preppers.

From another angle, sports consist entirely of skills and challenges which aren't needed and never have been, suggesting that they don't get forgotten. Hobbies also consist of skills and challenges which aren't needed.
propaganda, noun: information, especially of a biased or misleading nature, used to promote a political cause or point of view.

Well if it is "opiniated" and has a "very strong bias" I call it propaganda. Again, they are not the only ones and I am not singling them out.

I used a blunt term that seems to ruffle some feathers but it is better to be aware than to take everything we read at face value.
Are you actually advocating for an inheritance tax close to 100%?

Because that is completely unworkable IMO, for several reasons:

1) Unless you introduce comparable "wealth transfer"/gift taxes, it becomes completely meaningless for the average case.

2) This would be insanely harmful in cases of unexpected deaths; inheritance is a really bad compensation already when someone close dies, this would make it even worse. And dealing with any kind of shared assets would be a nightmare, too (father dies, mother has to pay tax on half the house?)

Could be workable with large allowances though, but I don't hink you would ever get this pushed through in a democracy because it is too easy to put negative spin on it (even if it was in the majorities economical best interest).

I don't think that inheritance tax is a bad concept, but setting it higher than the gift tax rate is actively harmful and would not achieve anything.
I’ve worked with plenty of developers who will argue that it’s fine on their development environment and their machine on the same network with test data and that it must be $OTHER_TEAM who is causing it. Arguably more of them than ones who really care. The problem is it only takes 2-3 of those people to bring the whole thing crashing down.
It's entirely a joke based on the two different versions of "Chinese" offered on most websites, it's not really meant to be taken seriously. But I've heard that there's an island in New England somewhere whose local accent is closest to Elizabethan English.
Other countries have locks and self defense weapons even firearms. marshal arts have existed in all cultures world wide.

Denying self defense isn't a core part of human history and desire for political reasons is very unscientific.
> It really feels the same as weed/nicotine/alcohol/sex/other vices ... banning them only makes them into forbidden fruit.

How many 10 years old smoke weed, have sex, and drink alcohol ?

10 years old spending hours per days on their phone on the other hand...
Still "rsync"ing the result of "hugo build" to a subfolder on a shared webhost. Works like a charm, hope it will do so forever. :-D
They still existed and wrote shitty code 20 years ago, or 30 years ago.
Filesystem backups may not be consistent and may lose transactions that haven't made it to the WAL. You should always try to use database backup tools like pgdump.
LLMs Are Not Security Mitigations
Thanks! That's the reason I'm building it - I needed something like this but there was nothing abailable.

I'm very close to releasing an alpha, will post here when ready!
I'll need to work on the diagram to make it clearer next time.

What it's trying to communicate is, in general, a human operating a computer has to turn their imprecise thinking into "specific and exact commands", and subsequently, understand the "specific and exact output" in whatever terms they're thinking off, prioritizing and filtering out data based on situational context. LLMs enter the picture in two places:

1) In many situations, they can do the "imprecise thinking" -> "specific and exact commands" step for the user;

2) In many situations, they can do the "specific and exact output" -> contextualized output step for the user;

In such scenarios, LLMs are not replacing software, they're being slotted as intermediary between user and classical software, so the user can operate closer to what's natural for them, vs. translating between it and rigid computer language.

This is not applicable everywhere, but then, this is also not the only way LLMs are useful - it's just one broad class of scenarios in which they are.
Because it discourages people from trying. It's hard enough to survive as an artist, and now there is even less sense in trying to start. This will hurt art, and humanity.

It's like pupils using an LLM to do their homework. They get the grade, but Idiocracy is awaiting.
I've got an openbsd server, postgres installed from the package manager, and a couple of apps running with that as the database. My backup process just stops all the services, backs up the filesystem, then starts them again. Downtime is acceptable when you don't have many users!
Could you give an example of a guide that helped you self host a system or service by telling you how to do the security? One that shows what information would be missing from a regular setup tutorial?

I'm a security consultant so this is not a problem I have. To me it seems very straightforward and like most things are secure by default (with the exceptions being notorious enough that I'd know of it), so I'm interested in the other perspective
> But wasn't the "society" paid off by all the "living taxes" before the person died?

Governments look holistically at their tax revenue. If there is an inheritance tax, and they expect to get a certain amount of revenue from it, then other taxes will be lower to compensate.

And vice versa: if an inheritance tax is producing revenue, eliminating it will result in higher taxes elsewhere. This is one reason such a tax continues to exist. Inheritance taxes tend to have very high exclusions so most people don’t pay them. And getting rid of them looks like charging everyone else more in order to lower taxes on the rich.