miki123211
Now bailing out somebody who over-invested in Nvidia but also holds the world's retirement savings... now that's something I can believe.
Imagine an e-commerce website that has a cart with some products. The site has a cart button showing the current total, a pop-up cart interface, as well as an assortment of 10 or 20 different components which let you add or remove products (E.G. the Christmas promotion page may be using a different, christmas-themed "Add to cart" button).
You need to keep all of these in sync. If you open the cart pop-up and remove the product you've just added on the Christmas promotion page, the button on that page must change color (and ARIA state / label) back to show that the product is not in the cart any more.
With traditional, imperative JS, you have ~20 places where this state is kept: The card array is the source of truth, the CSS classes, labels and aria properties of all these buttons must stay in sync with that array, but there's nothing that forces them to do so.
Sure, there are some software engineering patterns (I'm looking at event-driven design here in particular) which make this kind of bugs less likely, but they're still not really a guarantee of the code being correct by construction.
React and its ilk make it much, much harder to introduce that kind of bug, requiring you to basically go out of your way to do so.
Because AI agents love slop and "just one more edge case just to fix that one bug" thinking instead of addressing the underlying root cause of the bug class, this kind of thing is more important now than it ever was before. Agents are great only if you set them up for success, and the way to do that is to make bugs impossible to write.
The traditional free software approach to cryptography is "derive the key from a passphrase; require the user to make the passphrase strong; if the passphrase is weak, put the onus on the user."
This works well for HNers, but is terrible for normies. What normal users want is a locked down chip (potentially running open source firmware!), which securely stores something like an AES key protected by a 6-digit pin, which gets erased after 10 unsuccessful attempts and cannot be cloned. This is how TPMs, Apple's secure enclaves and bank and SIM cards work. This kind of design did more to bring full-disk encryption to end users than any free software ever did.
You probably want to see the pictures of your cousin's new kid, but you don't care for her flat Earth content or crocheting videos.
Why does this happen to some people and not others?
Most of my YT recs are videos from Technology Connections, CCC, 3Blue1Brown, Tech Potato, Welch Labs, Developer Voices, Ringway Manchester, some LegalEagle and UnderSparked (which I watch as mindless entertainment during household chores), and a fair bit of random lectures from top US universities and tech-related conferences. In other words, mostly videos from channels I have already watched and am very likely to watch more videos from.
Sure, there's a fair bit of slop; mostly things like "the unbelievable technology that powers the entire internet" or something where they're just describing asymmetric crypto in layman's terms, and there are periods where it gets more or less prevalent, but the feed is nowhere near unusable on most days.
My X feed is pretty much the same thing; very little spam, not that much politics, and when it does appear, it's not MAGA, plenty of academics and smart software engineers talking tech and AI. TikTok and Reddit are more geared towards mindless entertainment, but I do use these pretty differently, so that actually makes some sense.
With that said, I never disable personalization, try to stay logged in, share my data with companies freely, and accept the vast majority of permissions / consent prompts, which probably makes me unusual among the HN crowd, so that could be the reason why my experience is so different.
It is politically impossible to go back on KYC/AML measures in the traditional financial system, even if some of them were perhaps a bit too ill-advised. It's much easier to say "this is shiny new tech, very different from that old tech over there; we support innovation so we won't impose KYC requirements on it", even if there's no logical reason to do that.
As it stands, stablecoins let you make a keypair in the privacy of your own home (or your own agent sandbox, as it were) and immediately start transacting. They're allowed-by-default instead of blocked-by-default, with the US government still able to block you if they have a specific reason. No traditional bank I know of, in any country, works like this. This is a valuable capability to have, technologically, even if there's no technical reason why a Postgres database and a REST API couldn't provide the same service, but faster and more easily.
You want canvas to work for web games and design / drawing sites. Yet. minuscule differences in how canvas is implemented let other sites fingerprint you. The only way to fix this would be to have each browser be based on the exact same codebase and web engine, and do you really want that?
I have read many snide comments and personal ID numbers that way, mostly in public and public-ish documents.
You have Luna, Terra, Sol and Astra, each with 4+ reasoning levels. That's ~20 options to choose from.
On a repetitive task like customer support or something, where you have decent benchmarks, you can plot cost versus performance, but you can't really do that on coding.
In the software engineering world, we're accustomed to the reality that to do great work, all you need is a sharp mind and a cheap laptop. Better tools help, but aren't really a necessity. You could probably become a top-notch Linux kernel engineer with nothing but dedication and self-study, a $300 laptop and a shabby apartment with internet access.
You just can't really learn ML that way, just like you can't do it with banking, professional trading or medicine.
Meta and Google will never sell your data. They will collect it and use it for targeted advertising for sure, but they consider it far too valuable and useful to sell. This is because they have the tech and expertise to use their data well.
A grocery store or a gas station chain, though? They're clueless about tech, don't know what to do with the data, and have to aggressively compete on prices. If some savvy data broker comes to them, offering them a way to essentially gain market share by pushing prices lower than the competition and selling your data to make up the loss? That's an offer they can't refuse.
Hardware manufacturers are largely on the grocery store side; they're not data-savvy and they want to make things cheaper than the competition, so they're almost forced to do these shenanigans to win the competitive rat race.
If you want to meaningfully increase privacy, don't quit Meta, quit Target, Visa and LG.
We can't do that any more; the people who support tech regulation are so cartoonishly anti-corporate that any suggestion of embedding somebody who understands tech will be met with accusations of lobbying and a careful review of that person's employment history.
It's obvious to pretty much everybody that regulating banks, railroads or phone companies requires people who have previously worked for banks, railroads and phone companies, and have a good understanding of how such organizations work on the inside. We, generally, don't do that with tech.
Personalized advertising is a progressive tax. Because the rich spend more and the poor spend less, Meta et al makes more money from the rich than it makes from the poor, while offering the same service to everybody else. As a result, we get the educated rich upper-middle class complaining about advertising, while everybody else is happy about not having to pay their long-distance charges any more.
Neither do governments, incidentally. They're okay-ish at skyscrapers and bridges, but software is just beyond them.
Humans are a lot more expensive, it takes ~a year to find, interview, hire, onboard and offboard an employee, while an agent can be spun up for 10 seconds, do its work and vanish back into the ether.
Agents are lambda functions where humans are bare-metal servers that you have to rack yourself.
I want my type checker to check types and to scream at me when it can't. I don't want it to do "gradual typing", if it is unsure about what type something is, I want that to be a failure instead of it modeling the unsureness and not showing potential errors. We live in the age of agents, having to add an extra annotation here and there is not so much of a problem any more.
Meta's Pyrefly largely does what I want. I don't quite love Pyrefly either; I don't like the fact that it edge-cases and gives monopoly status to some popular packages (Pydantic, Django, attrs) instead of offering generalized mechanisms that less popular packages could also utilize, but purely on a type checking front, it's excellent.
The reason you need heavy scripting in those tiers is because the people you can afford to hire there are incapable of literally anything else. Keep in mind that your average HN user isn't your average customer support caller. The average customer support caller just wants to talk to somebody (yes I'm serious, this happens far more than you think), or has a routine issue which is trivial to fix but which they're nevertheless unable to fix themselves, think "router got unplugged, there's no internet, but the customer can't figure out why".
A well-designed AI system can be far, far more effective and pleasant than traditional CS, and a well-designed AI system scales well, so it's actually worth spending money on. AI turns good CS from a cost center to a profit center.
Accessibility with AI is hit-and-miss; if you don't tell it to make things accessible, it either will or it won't, and then it'll just continue with whatever trajectory it chose. If you tell it to do accessibility initially, it'll see its own ARIA later and continue in a similar vein.
From very anecdotal experience, I find OpenAI models more likely to consider accessibility for greenfield projects, even when not asked to, but this might just be an accident of statistics.
I think Trump mostly happened to be in the right place at the right time.
Notice how many countries had the then opposition party win (or come much closer than usual) around 2023-2025. It didn't matter which side they were on, Poland went right -> center-left for example, so did the UK.
People in 2024-ish were very unhappy about their economic situation (which was mostly caused by pandemic disruptions, with the war in Ukraine not helping things), but was usually attributed to whoever was in power at the time. In the US, that happened to be the democrats, so that's whom people blamed.
This gave the GOP a trump card (no pun intended) which they played reasonably well. I think the Democrats could perhaps have made some hay there (by focusing on "evil capitalists" causing "fakeflation"), but the Republicans automatically started from a position of strength by not being in power at the time that particular disaster happened. Even so, the DEM focused mostly on race and not economics, which was a bad play at the time.
In systems with a basis in technology, final means final. If the North Koreans take your money, your money is taken.
This piece from Patrick mcKenzie explains this well https://www.complexsystemspodcast.com/episodes/the-900m-wire...
Russia went all in on "digital sovereignty." This is partly because the Russian government cares deeply about censoring what their citizens can see (which they can't do if those citizens consume content from American services), partly because the American services themselves cut Russia off because of sanctions-related concerns.
This makes Russian datacenters a much more attractive target for the Ukrainians. While Russia can (and does) bomb Ukrainian datacenters, the fact that Ukrainians are so reliant on US infrastructure (and could rapidly move local workloads to western clouds if the need was great enough) makes such operations far less attractive. It's much easier for Ukraine to strike some facility near Moscow than it is for Russia to strike Ashburn, Virginia.
Given the geopolitical concerns from both the east and the west, this makes the question of whether Europe should move content off of US infrastructure a lot more complicated.
Keybase, Astral and Oven / Bun are other examples of this, I think Zed is on a similar path.
On some Windows layouts (those with the right alt = ctrl+alt trick), right alt is literally mapped to ctrl+alt. Right alt cannot be used to open the menu bar like the left alt can. This is only the case on those keyboards, on other keyboards, the right alt does move focus to the menu bar.
Mac uses cmd+arrows like Windows uses home, end, ctrl+home, ctrl+end. It uses option+arrows to move by word instead of control. (I doubt that what it considers a "word" is identical to Windows either, though many editors do override this anyway.
On some layouts (Polish is one I know of, though there are probably more), shift+backtick is a dead key on Windows and can be used to enter diacritics. Shift+accent followed by c inserts "ć". This is very painful to C++ (and Elixir) programmers, doubly so if you use the cFooManager systems Hungarian notation for class names. This is not the case on the Mac.
Option+letters are semi-dead (zombie?) keys on some layouts. For example, option+u inserts the ¨ accent, but option+u followed by another u combines them, so it inserts an ü. If you follow such a zombie key by a space, the space is swallowed and only the accent is inserted. Polish stupidly copied Option assignments from the US layout, replaced some with Polish diacritics, but never gave us replacements for the removed accents. So, we can now type symbols as useless as Ī or Ŕ, but "el niño" or "résumé" require the key hold and pop-up.
MacOS relies on menu options for things like copy and paste, as well as "Quit" and "Close Window". You should implement them by using the storyboard xCode gives you by default (or meticulously re-creating its included menu bar programmatically if your toolkit of choice doesn't let you do that), and then handle the appropriate selectors in your app if you need to. You should never handle these keyboard shortcuts yourself. MacOS is usually smart enough to figure out when these menu items should be dimmed and when they shouldn't. This doesn't work for custom UI frameworks, but if you use those, you ask for that kind of pain.
On both platforms, IMEs exist. Speakers of Chinese and Japanese want to type too.. Let them type. This involves painful OS integration that a lot of frameworks aren't doing.
On Mac, Option+backspace deletes to the beginning of the current word, but it keeps the space. On Windows (I think???) ctrl+backspace deletes the space.
On Windows, the shortcut to delete something (as in, an item in a list) is the delete key. Shift+delete is "irreversible delete" / "erase", AKA bypassing the recycle bin. On Mac, that's Cmd+Delete (which would be CMd+Backspace from a PC user's perspective).
On Mac, function keys are disabled by default (and perform the work of media keys). You need to combine them with fn to get the original behavior. Some older Macs (including older M-series macs) don't even have function keys at all, they instead have a touch bar. Don't rely on function keys for complex shortcuts.
On Mac, ctrl+arrows and command+space, while not being "reserved" in the traditional sense of the word, are often taken over by system functionality and never given to the app in the first place.
By law, every single government form you're able to file is supposed to have an XML Schema available in a centralized registry. This regulation is widely ignored in practice, particularly by local / municipal governments.
This used to be more important in the past, as such a form could automatically / semi-automatically get an entry in the EPUAP form catalog and be made electronically fillable (EPUAP being the now-deprecated centralized government bureaucracy portal basically). As far as I understand, the way that worked was through XSLT and XML Forms. There was some weirdness about each document having a fillable / form view and a preview, I think XML Forms was somehow used to generate the XHTML form, while the XSLT sheet could only generate an XHTML preview of a complete, filled-in version. There were also some custom annotations for auto-fill and such, that was partly done by most documents relying on standardized schemas for entities like "person", "address" or "company".
Since we moved to E-Deliveries and lost a central place for these forms to live in, this is (AFAIK) a bit less important and less common, but internally, things are still XML. If you're filing something like an ID renewal application, even through a newer, more user-friendly frontend, it's still just XML underneath. If you sign something through podpis.gov.pl (the standardized e-signature solution for government paperwork), you can even download that underlying document, both signed and unsigned, and see what that XML is. The pre-signing document preview generated by that site still comes from the XSLT I believe. The signatures themselves are, unsurprisingly, also done via the XML signatures spec.
Incidentally, the European E-Delivery system itself also relies on XML, WSDL and Soap pretty heavily. For those unfamiliar and/or not in Europe, it's basically "email but for the government", with all the guarantees and legal obligations of physical mail, cryptographically-attested confirmation of receipt, proper identity verification and assurance, cross-provider address portability, deployed to a lesser or greater extend in many EU countries and set to replace physical mail.
I was always wondering about that; it seemed to me that it would have been free advertising to Google if their users had to write and say @google.com all the time.
If you're an American company selling your stuff to German users, are you doing business in Germany? What if you don't have a German translation of your site, don't accept Germany-specific payment methods and don't advertise in Germany-specific channels, but still ship there? What if your products are delivered electronically, and you don't apply any IP blocks? What if you IP block Germany, but don't block VPN use? What if you do block VPN use, but still process personal data of German citizens (even without giving them access to your systems)? What if you do everything in your power to stop German users from using your site, but the site is free and VPN detection isn't 100% reliable, so some users do slip through?
Just to be clear, there are no good answers here, and the law (and international law in particular) is wholly unprepared for the realities of the internet.