skysight-inc/HackerNews huggingface dataset:
> Unless you're logging user input without proper validation, log4j doesn't really seem that bad.

Most systems do log user input though, and "proper validation" is an infamously squishy phrase that mostly acts as an excuse. The bottom line is that the natural/correct/idiomatic use of Log4j exposed the library directly to user-generated data. The similar use of Apache parquet (an obscure tool many of us are learning about for the first time) does not. That doesn't make it secure, but it makes the impact inarguably lower.

I mean, come on: the Log4j exploit was a global zero-day!
Do you pay taxes on money you spend?
He's a SV/SF investor who basically just invests in tech. His returns are about the same as QQQ which makes sense. If he's getting valuable inside information from Nancy to help his trading he's not using it well.
that's not the hard part. it's the out-of-band key exchange. (or key discovery/verification. so basically how to avoid the trust on first time use problem.)
Related fun fact up to maybe a decade ago: If you had a disk labeled/partitioned in FBSDs 'dangerously dedicated' style, and tried to image that, or reading the image of that with some forensic tool called Encase (running under Windows of course, how else could it be?), this tool would crash that Windows with an irrecoverable blew screen :)

I loved that!
total_cmp is precisely IEEE's separately specified total order for floats. It's just that the more common operators do something different, and that's perhaps better for most uses where NaN are inherently unexpected and generally indicate that some kind of error condition has occurred.
AFAIK the 1st Amendment is about whether the government can prevent you from speaking, not there are 0 consequences to all speech.

When I think that, I also think, "but isn't it bad to Illegal talking decryption?"

Then I think: Law is ambiguous compared to a logical proof, and can only be seen through cases.

I resolve that I'll be the first to stand up and scream if they deport someone for simply discussing the academics of DVD decryption, and that's enough to make me feel comfortable saying it's okay the DMCA is used to prevent stealing.
I'm a big fan of liberal use of saturating_mul/add/sub whenever there is a conceivable risk of coming withing a couple orders of magnitude of overflow. Or checked_*() or whatever the best behavior in the given case is. For my code it happens to mostly be saturating.

Overflow bugs are a real pain, and so easy to prevent in Rust with just a function call. It's pretty high on my list of favorite improvements over C/C++
Just like they replaced bash with zsh. Most Big Tech firms are allergic to GPL3.
Same exact story here. I was heavily leaning towards Bosch because "buy once, cry once" and their products seemed very high quality. I'll be looking elsewhere now.
That might apply in a handful of cases, but the vast majority will check out when a quick diff against a reference license file shows that the only changes are party names.
Find the government doing something you disagree with. Call it "fraud" and axe it. Announce to the world how much "fraud" you found. Rinse. Repeat.
> Prompt engineering is [...] a form of spellweaving where you have to find the edges of all relevant forms of existence and non-existence, codify them into imperative language, add the right nuance to finesse the style and have the confidence to cast the spell — over and over and over again.

This brought a tear to my eye.
Not to be outdone here, Go introduces multiple null values that are considered distinct, yet they all exhibit the same problem.
> We’re literally torching two billion dollars a day on the military when we’re not at war and not under threat.

We were in a (physical) proxy war with Russia via Ukraine until very recently, and we are currently in a digital war against Russia, China, Iran, North Korea, and probably other nation-states.

Should this be under the purview of the actual military? I don't know, although that arrangement is effective for Israel's cybersecurity command.

Regardless, there is an active need for defense spending now, just not the way we've been spending it.
The difference is that often, particular things are more concretely defined. A ban on advertising might be so onerous you wouldn't even be able to 'advertise' your FOSS projects on HN.

In what way could you learn about novel commercial things in the absence of advertising? Word of mouth alone?
It's called openrsync because it's developed for and by OpenBSD.
Almost all non-Tesla EVs offer a heat pump option. Most non-Tesla EVs sold do not have one. Just go to your local VW dealer or whatever and see what the specs are on the ID.4's on the lot is.
EV targets watered down to help tariff-hit UK car industry
Satelite linked Robot spy dogs,going walkies,I likd it! but everything is sp...I mean gathering anonomised data, any way, so where exact....oh right...china...
Announcing Think Stats 3e
Advertising is a tax on the rich.

It subsidizes basically all modern entertainment, from the filmmaking and sports industries (through TV Shows and sports broadcasts, respectively), to musicians and amateur filmmakers (through Spotify and Youtube).

The costs of advertising are ultimately passed down to consumers in the form of higher prices for products and services, not unlike a VAT or sales tax. Because rich people spend more money than the poor (citation needed), they end up paying a lot more of this "tax" while getting the same amount of entertainment for it.

Targeted advertising only exacerbated these dynamics. Because high-spenders are very desirable customers to have, companies can now demand more money for the ability to target them, which turns advertising from a linear to a progressive tax.

Advertising turned the internet into a sort of public commons, with no government intervention and the inevitable inefficiencies and inflexibilities that come with those. It gave us free, high-quality video and voice calls to anywhere across the world, free unlimited texting, including picture messaging and group conversations, free video hosting for everybody, regardless of scale, free music (through Youtube, Spotify and the radio), with at least some compensation to artists, free movies and TV shows (on free-to-air TV as well as through services like Pluto), excellent free educational content (e.g. 3b1b, university lecturers hosted on Youtube at no charge), as well as cheaper entertainment overall through ad-supported tiers.

I think framing things this way is important when discussing advertising regulation. Maybe we want more cheap groceries, don't care about cheaper luxury cars and don't mind less free entertainment, so maybe we should ban grocery ads and encourage more Mercedes ads. Maybe we're fine with less free entertainment if it gets us fewer alcoholics, so we ban ads for alcohol. Those are tradeoffs worth thinking about, perhaps tradeoffs worth making, but they are tradeoffs, and it is important to be conscious of that.
macOS is a BSD.

If you're used to Linux (I am) it feels there are lots of quality of life changes, but I realized it's because I'm used to Linux.

The OS itself is fine.
I’m thinking these responsibilities can be shifted to the states. That’s defacto what’s going to happen as the federal government keeps cutting services.

If I want to live in a high tax state with a social safety net, cool. Others can move to Mississippi pay no taxes and brag about how they have a higher GPD than Spain ignoring the actual quality of life is much worse
I implemented rsync's binary diff/patch in .NET several years ago: https://github.com/zmj/rsync-delta

It's a decent protocol, but it has shortcomings. I'd expect most future use cases for that kind of thing to reach for a content-defined chunking algorithm tuned towards their common file formats and sizes.
Still missing a bunch of features like USB-C displays. Isn't ready for newer CPUs yet either.
The neurotoxin found in hammerhead worms, Tetrodotoxin, has shown efficacy for the treatment of cancer-related pain in phase II and III clinical trials.

ref: https://pmc.ncbi.nlm.nih.gov/articles/PMC10221257/

Tetrodotoxin in Zombie Powder may be responsible for persistent reports of zombies in Haiti.

https://www.harvardmagazine.com/2017/10/are-zombies-real
NPR: "Trump signs order ending union bargaining rights for wide swaths of federal employees"

-- https://www.npr.org/2025/03/28/nx-s1-5343474/trump-collectiv...
You don't need books on how to think. You already know how to think. What you need is raw material (knowledge) to think with. This means reading books, lots of books, in a variety of fields. It also means shutting off your smartphone and reading.
> Going from $1M ARR to $100M ARR in 12 months, Cursor is the fastest growing SaaS company of all time

Just because it's not reaching the insane hype being pushed doesn't mean it's totally useless
How are these levels actually encoded? Do they use special unwritable tokens to wrap instructions?
You guys are under threat - from your President.
> The left wing excesses of the 2010s

What on earth does that even mean
Grounding entire fleets of aircraft when a safety issue is discovered is completely normal, and that's the way things should happen. Remember when the MCAS issue was discovered on Boeing 737 MAXes after 2 fatal crashes? They were all grounded for a while, and rightfully so.
"free" != open

open != "free"
A US senator argued these are not an economic measure, but a coercive measure.

Donald now has tariffs on you; if you stay in your place, and do nice things for Donald, they will be removed on a temporary, ongoing basis.

I also read that Congress controls spending only from internal taxation; it does not control spending from tariffs. That money goes directly to executive, which is to say Donald, and he does with it as he pleases.

One possible way this is to play out is the internal taxation being progressively eliminated in favour of tariffs, as a way to apply coercion to others and to eliminate Congress.

Donald is running the country as if it were a business, which means being a CEO with absolute power. He does not seem to understand the idea of running a country, where you lead and are in power by consent. So USA now has moved a long way to dictatorship - the CEO - and we see also the enormous and soul-destroying horrors of ICE and abuses of State power.
For any arithmetic expression that involves only + - * operators and equally-sized machine words, two's complement will actually yield a "correct" result. It's just that the given result might be indicating a different range than you expect.
That’s why I liked the suggestion of a count up timer versus a count down timer. It’s a small difference, but removes immediacy while still allowing competition.
How is maintaining two operating systems simpler?
I'm guessing the authors here are referring to the fact that many places were really poorly drawn. There was high detail in regions where the map makers were local to but this got fuzzy real fast. Some would even do things like plant fake cities on their map as a means of fraud detection. A secret signature if you will. Someone who copied their map was likely to copy the fake place.

You're definitely right that this has a lot to do with early mathematics but remember that that is a small part of map making. How do you define coast lines? Rivers? Borders? The devil is in the details. With older maps the general shapes would be (usually) accurate but it could get fuzzy around the edges. Literally. It's not like they could get a picture from space, or even from the sky. It would take years to measure many things that would take us minutes now
Not sure what you’re suggesting. I’m well aware that things like SHARP exist.
That sounds like you are asking for a play.
Are you trying to imply that GPL is not open source?
Event Notify Test Runner – run arbitrary commands when files change
If they shipped a gpl3 version of bash on iOS, they would be in violation. This isn’t really a question: gpl3 requires you to not only provide the source if you use it in a product, but the ability to modify it and run your modified version. Which iOS doesn’t let you do.

Now, macOS would be fine in shipping a gpl3 bash. But not iOS. (Yes, iOS has bash. Or ar least they used to, they may be all on zsh now, I’m not sure.)

So, the question becomes to Apple, do we ship different bash versions for different devices, and treat macOS as being different, and have to worry about only using newer bash features on macOS? Or do we keep the same old version on all platforms, and just eschew the new bash everywhere? It’s a pretty simple decision IMO, especially because users can just use brew on macOS and put their own bash on there if they want.

Others are pointing out that gpl3 is less tested in court and that lawyers are just more uncertain/afraid of gpl3 than gpl2, especially with respect to patents… but I don’t think these are mutually exclusive. It’s clear that they can’t ship gpl3 on 4 out of their 5 operating systems. macOS is an outlier, and from an engineering standpoint it’s a lot simpler to just keep them all the same than it is to ship different scripts/etc for different platforms. It can be both reasons.
> The only issue I have is when companies can play both sides and in one breath claim they're neutral for the purpose of section 230 protection, and then in the next breath take part in censorship because it's better for business.

The entire point of §230 is to immunize companies for the consequences of that which you decry as censorship (i.e., moderation).
What teams bother to do that, though? It's easier to call an API or spin up a cloud cluster.
I'm pretty sure most app support will be dropped before that.
It would by a "correlational clusters" gender definition put some transwomen in a mostly male gender (though, again, you'd have a lot more than two genders with with that definition).

And correlational clusters is one of the few ways it's not just semantics.
GPLv3 is a legal landmine. In fact, GPL itself is wildly unpopular compared to more open licenses. The FSF is getting what it deserve here. Open source predates the FSF and will remain long after the FSF is dead.
https://standardebooks.org/bulk-downloads/authors

Links in the first column.
This is great, congrats for launching!

A couple of ideas .. I would like to benchmark a remote headless server, as well as different methods to run the LLM (vllm vs tgi vs llama.cpp ...) on my local machine, and in this case llamafile is quite limiting. Connecting over an OpenAI-like API instead would be great!
Benchmarking My Laptop
Except if safety blocked this, it would have also blocked the linked conversation. Alignment definitely distorts behaviors of models, but treating them as information retrieval systems is using a screw driver to drive nails. Your example didn’t refute this.
military bases are also a carrot.

theyre stocks to the neighbors but not the host
Show HN: Shellmates – Rent bare metal and divide into VMs with firecracker
Hello devs, weekend passion project here. It started with this burning desire I've have for a while to rent a bare metal server from Hetzner. Sure it's all the way in Germany and I'm in the USA but the price! $34 a month for 64 GB RAM, 4 core cpu, 512 GB SSD. That's like 90% less from AWS ec2 instance of same specs.

How shellmates works:

1. Rent a powerful bare metal server from providers like Hetzner or OVH at prices starting from $34.50/month
2. We help you setup Firecracker VMs to divide your server into smaller VMs
3. Keep what you need and rent out the rest to other developers at fair prices
4. Save up to 90% compared to cloud providers like AWS while building relationships with other developers

So I'm eating my own dogfood with:

https://shellmates.andrewarrow.dev/spots/c8f3c470-f353-4804-...

Looking for someone to share the cost with me. There is a real stripe link for $18.07 a month. (Exactly half my actual cost + stripe fees.)

Learned a ton about Firecracker and Firecracker's jailer and how to setup everything with iproutes.

The homepage tries to explain everything:

https://shellmates.andrewarrow.dev

Thanks for checking it out! And I'm totally serious about sharing this server.

[video demo: https://www.youtube.com/watch?v=MNcnoMVRC68]
Spike Protein–Fibrinogen Interaction Novel Immune Evasion Strategy of SARS-CoV-2
I thought that immediately too!
> It also means they’re more free to lock down macOS from running your own code on it in the future, without worrying about having to rip out all the gpl3 code when it happens. Better to just not build on it in the first place.

how does locking down macOS have anything to do w/ GPL compliance? Apple is free to do whatever BS with the OS they ship in terms of terminal access, user permission level, etc regardless of GPL of any code on the device. I could ship a GPLv3 system tomorrow that disallows user root access and as long as I make the OS source freely available and redistributable, it's fine.
At this point, HN is the only place I see positive reception of AI products. Everywhere subreddit or gaming forum or social media I follow is overwhelmingly negative. Usually characterized as slop, stealing, low quality, or stealing jobs from craftsmen.

I’m not saying AI is bad, but people are very strongly opposed to these kinds of products. In that sense, HN is the only place that seems to resonate with those.
I truly respect OpenBSD, but I hope they won't end up writing openopenssl :-)

(I will admit: I had to check and openssh is actually "the OpenBSD Secure Shell" project, so I guess it makes sense :-) ).
Discussion (46 points, 1 day ago, 30 comments) https://news.ycombinator.com/item?id=43594572
Have you heard of the bitter lesson? Bigger means better in Neural Networks.
That one was missing a comma: "I know, it's hard". I'll do my best.
I used this in a project or two and I really like what it does to the code and error handling. Can recommend checking it out.
This is how `noscript` tags are hidden by UA styles.

https://www.naiyerasif.com/post/2023/12/17/detect-scripting-...
The author has acknowledged their error in the article you’re referring to in a later post https://utcc.utoronto.ca/~cks/space/blog/programming/RustSor...
(Late reply, but thanks for the correction - I had meant to link to the pdf but copied the wrong link. My bad.)
Where is the material? "reasonable grounds" is not evidence. I'll just leave this here from the same report[1][2][3]

But the world did see how Palestinian prisoners were raped in prisons.

[1] https://imgur.com/a/TmKGadc
[2] https://imgur.com/a/C6bsMp7
[3] https://imgur.com/a/ADsmgWy
I think it's very unlikely to happen, in general. I'm just saying a large corporation will want to check every time because they cannot really afford to do otherwise.
Totally. The march continues with userspace drivers and exclaves[1]. I think it's fair to say that security is a big driver for their kernel evolution.

[1] https://www.theregister.com/2025/03/08/kernel_sanders_apple_...
but it is false advertising when it's used all over the internet with: rust is safe!
telling the whole world to rtfm for your co-opting of the generic word "safe" is like advertisers telling you to read the fine print: a sleazy tactic.
Most LLM users don’t want models to have that level of literalism.

My manager would be very upset if they asked me “Can you get this done by Thursday?” and I responded with “Sure thing” - but took no further action, being satisfied that I’d literally fulfilled their request.
Current versions of macOS use a signed system volume [1], much like iOS - under a standard system configuration, the user can't replace system executables or other files, even as root. Unlike iOS, the user can disable SSV, but I'm not certain that's sufficient for GPLv3 - and I can't imagine Apple feels comfortable with that ambiguity.

[1]: https://support.apple.com/guide/security/signed-system-volum...
There was one in the first term too. Farmers suffered quite a bit if I remember correctly.
Show HN: Spend Elon Musk's fortune on AirPods, NFL teams, etc as fast as you can
Well, you're free to revive this issue: https://github.com/c3lang/c3c/issues/1451. I'd need a more solid proposal.
They need to win any ideological battle that they can get in order to start the "assault" against Medicaid and Medicare, which I guess it's where most of the money goes to (that and the Military, but I don't think they'll drastically touch that, no matter the current discourse).

In other words, if you show people that the Government can be dismantled little by little without any big revolution coming their way, then they'll next have the impetus to go for the jugular, i.e. Medicaid and Medicare.
> What is the alternative to advertising, for capturing human attention?

Unsponsored product reviews, I suppose. I'm not a proponent of a complete ban on advertising—I just find the argument being made in favour of deregulation to be deeply silly.

> Not sure those are good examples, because none of them were “regulated” or banned until there was already a decent alternative available.

The argument I'm responding to there is, "Disrupting natural markets with authoritarianism usually ends up worse than any downsides of the decentralized market regulation of that scarcity." There's no mention there of the availability of alternatives—that's not the point being made.
Z-Wave is remaking itself into an open source protocol
John Ousterhout and Robert "Uncle Bob" Martin Discuss Software Philosophies [video]
> if you want to control it

In the context of sending a secure message, the sender maintaining control goes in the negatives column. At best it's a compromise in exchange for specific security features.
> It is yours to provide evidence of your claims, not mine.

This is a common weird mistake people make on HN - I'm not publishing a paper so, no I don't. Really there's minimal rules of engagement here. You could say you think I'm wrong, which I'd be curious to hear why.

It's more productive to first discuss things casually, and then if there's specific disagreements to dig in. If you disagree with my statement, please tell me which countries you think specifically I'm more likely wrong about. You don't need to cite anything, either do I. If we actually do disagree, then we can go off and do our own research, or if we're really motivated bring it back here.

But there's no burden for anything, and it's actually better in many cases to first chat before we dig in and try and out-cite each other.
Eavesdropping on smartphone 13.56MHz NFC polling during screen wake-up/unlock
I always understood it as, the email with link notification thing started as soon as email providers began regularly scanning users' emails. Before then, an email included all the information you needed without having to login to another site.
You get to choose your own, more efficient "PI" for your model. Still, it's a valid question.
I’m still amazed that people take the Pelosi bait when many other politicians have been far ahead of her on the charts. Most of them are Republicans, though, and haven’t had the same amount of headlines and Twitter/Reddit traffic.

The services pushing politician trade tracking and ETFs really leaned into Pelosi to capitalize on it.

As the other comment already said, her (more specifically, her husband’s) returns haven’t actually been noteworthy or suspect, it’s just the implication that gets people worked up.
Yes both are implemented as attributes `@weak` and `@init` respectively.
Digital recording system with time-bracketed authentication by on-line challenge