Hacker News Reader

Normal_gaussianon UK intelligence censored report on global warming and homeland security

https://animal.law.harvard.edu/wp-content/uploads/Eating-Awa...

This covers moving the UK to self-sustain by reducing animal products and repurposing animal feed cropland to direct consumption cropland; it also covers reforestation.

So while it isn't possible today, its possible to become possible without relying on any technological advancements.

Normal_gaussianon UK intelligence censored report on global warming and homeland security

Farmland is ~69% of the total area of the UK with it being quite stable in the last decade, and most of that being grassland. Solar accounts for ~0.1% of (former) agricultural land, and after 2030 it should be around ~0.6%. The Land Use Framework aims for 1% of land (mainly agricultural, so ~1.5% of ag) for renewables by 2050. Housing doesn't have as comparable figures, but I'm envelope mathing it to about 1.5% by 2050 again. Which makes 3% of ag land, of which crops are roughly 1/3rd, and google says 60% of solar is on good crop land. So a reduction of up to ~6% at the top end.

There are a few flip-sides here - things that many don't like to hear or acknowledge:

There are alternate diets that are suitably nutritious that are achievable on this land, largely by reducing meat consumption. Meat production uses much more land than other food sources, and a lot of that is input crops. Its inefficient. A change in diet can make the UK self-sufficient on much less land.

Solar is a developing technology; it will improve, requiring less land for the same production. If long term trends push up the value of crops and down solar production, the panels can be removed and crops grown instead - its either/or but it is reversible. This is especially important for bringing in non-solar power sources which take longer to realise (nuclear, tidal). I will also note that solar farms are built on the good crop land because it is convenient and the price is right. We will see south facing hills covered soon enough.

Housing and social housing are the same problem; where housing prices are so high compared to salaries, social housing demand increases. Building houses - any houses - solves the problem. The question of density, location, style is a question about what kind of problems we want in 10-20 years time. High rises did not work well at all.

Normal_gaussianon The Claude Code Leak

Its unclear whether there is sufficient human authorship in cc for copyright to stick on a court. Anthropics arguments would hinge on the curation of plans and the direction decisions, which haven't been properly tested as the source of authorship yet. Typically contracted implementers sign over copyright to the project owners, and this is where there is case law.

Normal_gaussianon Claude Code's source code has been leaked via a map file in their NPM registry

The policy is https://docs.npmjs.com/policies/unpublish

    Packages published less than 72 hours ago
    
    For newly created packages, as long as no other packages in the npm Public Registry depend on your package, you can unpublish anytime within the first 72 hours after publishing.

There are 231+ packages that depend on this one, and I imagine they mostly use permissive enough version ranges that this was included.

Normal_gaussianon I use excalidraw to manage my diagrams for my blog

My approach:

Do use diagrams to explain an abstraction, and attach a word to it. Don't use diagrams to represent the exact state of a system.

Normal_gaussianon Ask HN: Where have you found the coding limits of current models?

Respecting instructions around tool use, even on small codebases, where the tool isn't its favourite way of doing things.

For example, models repeatedly try and not use my Makefile's (build / run / test / test-file / check) and instead spend several cycles attempting to invoke using system tools and getting it wrong.

I've got to the point where I run most models with an extra path folder which overrides typically bad commands tells them off and redirects them back (more effective and portable than hooks). But then sometimes the model reads the makefile, discovers the workaround, and does the stupid anyway.

Normal_gaussianon Anatomy of the .claude/ folder

Yeah skills get loaded into context which in effect pollutes context.

Normal_gaussianon Wine 11 rewrites how Linux runs Windows games at kernel with massive speed gains

A solution to itself

Normal_gaussianon France's aircraft carrier located in real time by Le Monde through fitness app

The modern AI security onion

Normal_gaussianon Node.js needs a virtual file system

This can't be overstated. The main benefit with yarn berry (v4+) is being able to commit the dependencies to the repo - I have yarn based tools that I wrote years ago that just work wheras I frequently find npm and python tools are broken due to version changes. However this benefit comes at a setup cost and a lot more on disk complexity - one off tools are just npm and done.

Normal_gaussianon Node.js needs a virtual file system

This is quite spammy; you could mitigate it by explaining what you think the "needless suffering" is. Having been using npm, pnpm, and yarn for many years the only benefit I find with pnpm is a little bit of speed when using the cli, but not enough that I notice; I've outlined the major yarn benefit to me 'in a peer comment' (which I didn't realise was you when I answered) https://news.ycombinator.com/item?id=47415660

I expect yarn to have a real competitor sooner rather than later that will replace it; and I do wonder if it is this vfs module that will enable it.

Normal_gaussianon Node.js needs a virtual file system

yarn with zero-installs removes an awful lot of pain present in npm and pnpm. Its practically the whole point of yarn berry.

Firstly - with yarn pnp zero-installs, you don't have to run an `install` every time you switch branch, just in case a dep changed. So much dev time is wasted due to this.

Secondly - "it worked on my machine" is eliminated. CI and deploy use the exact same files - this is particularly important for deeply nested range satisfied dependencies.

Thirdly - packages committed to the repo allows for meaningful retrospectives and automated security reviews. When working in ops, packages changing is hell.

All of this is facilitated by the zip files that the comment you replied to was discussing, that you tangented away from.

The graph you have linked is fundamentally odd. Firstly - there is no good explanation of what it is actually showing. I've had claude spin on it and it reckons its npm download counts. This leads to it being a completely flawed graph! Yarn berry is typically installed either via corepack or bootstrapped via package.json and the system yarn binary. Yarn even saves itself into your repo. pnpm is never (I believe) bundled with the system node, wheras yarn and npm typically are.

Your graph doesn't show what you claim it does.

Normal_gaussianon Node.js needs a virtual file system

yes and no. Waiting 40mins for every test run is pure pain, platform specific ramfs type mounting is quite scriptable. Yes some devs might need to install a dependency, but its not a complex script.

Normal_gaussianon Node.js needs a virtual file system

The way to do this today is to do it outside of node. Using an overlay fs with the overlay being a ramfs. You can even chroot into it if you can't scope the paths you need to be just downstream from some directory. Or, just use docker.

Normal_gaussianon Node.js needs a virtual file system

    node -e "new Function('console.log(\"hi\")')()"

or more to the point

    node -e "fetch('https://unpkg.com/cowsay/build/cowsay.umd.js').then((r) => r.text()).then(c => new Function(c + 'console.log(exports.say({ text: \"like this\"}))')())"

that one is particularly bad, because umd messes with the global object - so this works

    node -e "fetch('https://unpkg.com/cowsay/build/cowsay.umd.js').then((r) => r.text()).then(c => new Function(c)()).then(() => console.log(exports.say({ text: 'oh no'})))"

Normal_gaussianon Node.js needs a virtual file system

yarn pnp is currently broken on Node v25.7+;

- https://github.com/yarnpkg/berry/issues/7065

- https://github.com/nodejs/node/issues/62012

This is because yarn patches fs in order to introduce virtual file path resolution of modules in the yarn cache (which are zips), which is quite brittle and was broken by a seemingly unrelated change in 25.7.

The discussion in issue 62012 is notable - it was suggested yarn just wait for vfs to land. This is interesting to me in two ways: firstly, the node team seems quite happy for non-trivial amounts of the ecosystem to just be broken, and suggests relying on what I'm assuming will be an experimental API when it does land; secondly, it implies a lot of confidence that this feature will land before LTS.

Normal_gaussianon AirPods Max 2

"AirPod" to mean both tiny buds that go in your ear and full on over-ear headphones is a ridiculous collision of naming.

Normal_gaussianon I beg you to follow Crocker's Rules, even if you will be rude to me

I love that site.

The most ridiculous thing about the "hello" senders is that they end up sitting there waiting for you to reply.

Normal_gaussianon Don't post generated/AI-edited comments. HN is for conversation between humans.

This rule is very important. Like many of the other rules, it is open to interpretation, but it is a line in the sand that defines allowable behaviour and disallowable behaviour.

This rule will have an effect on the behaviour of the 'good players', and make the 'bad players' a lot easier to spot. Moderation needs this. I see this as stopping a race-to-the-bottom on value extraction from HN as a platform.

Normal_gaussianon Lego's 0.002mm specification and its implications for manufacturing (2025)

"that familiar click is the sound of a carefully engineered interference fit designed to hold firm but still be easy for small hands to pull apart."

My recent experience calls bs on pulling them apart.

Normal_gaussianon Cloudflare crawl endpoint

"Well-behaved bot - Honors robots.txt directives, including crawl-delay"

From the behaviour of our peers, this seems to be the real headline news.

Normal_gaussianon Cloudflare crawl endpoint

This presumably is going to be cheap and effective. Its much easier to wrap a prompt round this and know it works that mess around with crawling it all yourself.

You'll still be hand-rolling it if you want to disrespect crawling requirements though.

Normal_gaussianon Ki Editor - an editor that operates on the AST

You are quite right to call this out - and quite right in general. With AST verification alone your statement holds strongly.

I was remembering a professor I had who was very into formal verification and had an IDE that would only accept valid programs - however his validity checks were more than just tree based, they involved passing a type check. Which now you've called me on it, is quite definitely beyond valid AST editing.

The base case: if you have a structure with a mandated cyclical reference that doesn't accept a second (e.g. nil) type, you cannot construct it without creating an intermediate invalid program. This doesn't tend to show up if the cyclical reference is all the same type (A1 -> A2 -> A1) because you can often cheat and self reference, but it does if it is different types (A1 -> B1 -> A1). You can't construct an A without a B, which cannot be constructed without an A.

But that's still not a problem you cry! And quite right, you can edit the type itself to remove and re-add the reference.

That is until the type is built into the language, or a library.

Normal_gaussianon Put the zip code first

Yeah, post codes are a huge pit of an implementation. Each country has their own way of presenting and formatting them, as well as additional validation rules (e.g. valid postal districts). This should be amazing (and is), but if you maintain such a validator you'll have a continuous stream of bugs where clients were able to make a mistake they shouldn't have been able to (often breaking downstream where it is hard to recover) or where you refuse to accept somebodies very real address and they are very personally upset (rightly so).

That said, the obvious solution is <country> <post code> where <country> is prepopulated from geo-ip or browser signals or similar.

Normal_gaussianon Ki Editor - an editor that operates on the AST

> The challenge is getting this to be a useable way of entering programs.

Well exactly.

When the path between Program A and Program B can only be valid programs, you are going to end up with either a much longer, less intuitive path, or deleting everything and starting again. It can also be quite possible to invent structures which are valid but have no valid path to creating them.

Normal_gaussianon A decade of Docker containers

Exactly. "so I hung the radiator out the window" vibes.

Normal_gaussianon Hardening Firefox with Anthropic's Red Team

In many cases, the difference between a bug and an attack vector lies in the closed source areas.

This is going to be the case automating attack detection against most programs where a portion is obscured.

Normal_gaussianon Plugtest

I'd love to read this story.

The issue I've always found with testing on human users is their willingness to ignore deficiencies.

There is a strong benefit for people "just getting on with it" and "working around" a problem; but it seems like many people are not very good at identifying when a problem is worth solving.

An analogous anecdote I'm aware of was a small in-house call-centre team being moved to digital playbooks (vs those A5 ring bound / tabbed sets). While time-to-resolve each issue got lower and time-to-adapt to new workflows a lot faster, many tracked metrics got worse. Suddenly they were picking up fewer calls, time to answer was increasing, job-satisfaction decreased.

It turns out the new system was forcing the team to be sitting at their desk. In a small and busy multi-team office these people were usually doing all kinds of other small things - be it making coffee, liaising with other teams, etc. - whatever it was they weren't always at their desk. They did have wireless handsets however, so they used to answer the phone, start the call from memory, and move to use the nearest playbook.

The big issue with the digital playbooks was needing to "follow along", you can't reasonably start it away from your desk.

The team knew this was an issue very quickly, it was quite fixable, but they sucked it up for months.

Normal_gaussianon Privacy-preserving age and identity verification via anonymous credentials

This is exactly it. It is a huge issue if the authentication can trivially become non-privacy preserving in a way that is impenetrable to users.

Normal_gaussianon Jolla phone – a full-stack European alternative

If the app truly just plumbed a webview and cert verification - which has been doable for over a decade - it would be very portable and this wouldn't be a problem.

The apps don't just do that though; they call into and use an awful lot of the system APIs for user tracking / semi-native experience / biometrics and probably a whole host of other things. Its the incompatibility in these that drags compatibility.