2025-08-14

40 篇热帖

1. PYX: The next step in Python packaging (astral.sh)

A Python-native package registry from the creators of uv.

2. Meta accessed women's health data from Flo app without consent, says court (www.malwarebytes.com)

A jury has ruled that Meta accessed sensitive information from women's reproductive health tracking app Flo without consent.

3. Why LLMs can't really build software (zed.dev)

From the Zed Blog: Writing code is only one part of effective software engineering.

4. Blood oxygen monitoring returning to Apple Watch in the US (www.apple.com)

Apple will introduce a redesigned Blood Oxygen feature for some Apple Watch Series 9, Series 10, and Apple Watch Ultra 2 users.

5. AI is different (www.antirez.com)

AI的独特性与潜在社会经济影响

AI系统尽管存在缺陷,但其在复制某些人类技能方面的能力持续令人印象深刻。几年前,能够理解人类语言、编写程序和检测复杂代码库中漏洞的机器还仅是科幻概念。这些漏洞甚至可能逃过资深程序员的代码审查。

由于大型语言模型(LLM)和广义的深度模型原理尚不清晰,且该领域最顶尖的专家在预期管理上屡次出现严重失误(既有低估也有高估),因此很难预测未来的发展。但在Transformer架构出现之前,我们就已目睹了多年的惊人进展,目前尚无明确迹象表明这一趋势会停滞。当然,当前系统可能遭遇发展瓶颈,但若真如此,反而可能激发下一阶段架构研究的巨大投入。

如果AI能避免长期停滞,变得更具实用性并减少对人类的依赖,那么这场革命将与以往的技术革命截然不同。然而,当前经济市场的反应却如同被“随机鹦鹉”(stochastic parrots)所主导。市场固有的模式匹配思维认为,过去的技术繁荣创造了更多商业机会,因此投资者倾向于相信AI也会带来同样的结果。但这并非唯一可能的结局。

虽然目前尚未实现,但如果AI能够替代相当数量的劳动力,经济体系将面临严峻考验。此外,企业可能更不愿意为内部AI能够处理或从头构建的服务付费。同时,也无法想象一个由少数巨型公司垄断智能提供者的系统:要么AI最终会成为大宗商品,要么政府将介入干预——在这种单一行业完全主导其他所有行业的异常经济格局中。

未来可能会削弱经济繁荣,并推动人类转向某种不同的(或许是更好的)经济体系。市场迄今不愿接受这一点。尽管经济前景不明朗、战争正在 destabilizing 世界、AI的发展时间表难以预测,股市却仍在持续上涨。然而,从人类历史的宏观视角看,股票市场的影响微不足道。许多比现行制度存续时间长得多的体系,最终都因社会与人类知识的根本性变革而被淘汰。AI可能正是这样一种变革力量。

6. "None of These Books Are Obscene": Judge Strikes Down Much of FL's Book Ban Bill (bookriot.com)

In a major win for intellectual freedom, a judge rules against Florida law that led to removing hundreds of books from school libraries.

7. Kodak has no plans to cease, go out of business, or file for bankruptcy (www.kodak.com)

Kodak clarifies it is not closing or filing bankruptcy; plans debt repayment and pension fund transaction for a stronger balance sheet in 2025.

9. Illinois bans use of artificial intelligence for mental health therapy (www.washingtonpost.com)

Illinois banned therapists from using artificial intelligence to treat patients, joining a small group of states regulating the use of AI chatbots for mental health.

10. OCaml as my primary language (xvw.lol)

A detailed explanation of why I chose OCaml as the ‘default’ programming language for every project.

11. What does Palantir actually do? (www.wired.com)

Palantir is often called a data broker, a data miner, or a giant database of personal information. In reality, it’s none of these—but even former employees struggle to explain it.

13. Linux address space isolation revived after lowering performance hit (www.phoronix.com)

Several years ago Google engineers began exploring address space isolation for the Linux kernel and ultimately proposing Linux ASI for better dealing with CPU speculative execution attacks

14. Show HN: I built a free alternative to Adobe Acrobat PDF viewer (github.com)

A PDF viewer that seamlessly integrates with any JavaScript project - embedpdf/embed-pdf-viewer

15. Zenobia Pay – A mission to build an alternative to high-fee card networks (zenobiapay.com)

Why we're

16. How to rig elections [video] (media.ccc.de)

Enter the fascinating world of corruption, chicanery, low-tech fraud, and forensic tools that uncover it. The story is told through the e...

17. NSF and Nvidia award Ai2 $152M to support building an open AI ecosystem (allenai.org)

Ai2 has been awarded a combined $152 million from the U.S. National Science Foundation (NSF) and NVIDIA as part of a jointly funded project to advance our research and develop truly open AI models and solutions that will accelerate scientific discovery.

18. NIST Finalizes 'Lightweight Cryptography' Standard to Protect Small Devices (www.nist.gov)

Four related algorithms are now ready for use to protect data created and transmitted by the Internet of Things and other electronics.

19. iPhone DevOps (2023) (clearsky.dev)

作者通过三个应用程序的组合,在iPhone SE上实现了单手编码的开发工作流,支持任意编程语言,并解决了在移动设备上运行网络服务器的挑战。

背景与动机

  • 作者此前探索过在iPhone上进行单手开发,最初使用Pythonista应用。
  • 为挑战Protohackers(一个实现服务器协议并通过测试的平台),需要突破限制:无法在iPhone上直接开放端口,且希望使用Go语言而非Python。

核心工具组合

  1. Secure Shellfish
    • 关键功能:离线文件夹,实现手机与服务器之间的双向实时同步。
    • 工作流:在编辑器中修改文件,切换到Shellfish后自动同步至服务器,便于在终端中执行代码并快速迭代。
  2. Textastic
    • 作为代码编辑器,通过“外部文件夹”访问Shellfish的同步目录。
    • 支持搜索替换、文件管理等功能,需注意保存文件后再切换应用以确保同步。
  3. Working Copy
    • Git客户端,同样连接至同步文件夹,实现版本控制。

开发环境

  • 使用Contabo VPS(Linux系统)托管代码,通过Docker管理项目环境。
  • 替代方案可为家中运行的Linux机器。

成本

  • Shellfish永久授权:€24.99
  • Textastic:€9.99
  • Working Copy永久授权:€24.99
  • Contabo VPS:€7.25/月(存在偶尔中断问题)

结论

  • 该工作流可行但需耐心,适合在碎片时间使用,可作为替代社交媒体的创造性活动。
  • 效率虽低于笔记本电脑,但通过工具组合实现了在移动设备上的高效编码。
20. Funding Open Source like public infrastructure (dri.es)

To protect the digital foundation of essential government services, governments should invest in Open Source as public infrastructure and shift from consumption to contribution.

21. Open Banking and Payments Competition (www.bitsaboutmoney.com)

Why the banks really hate fintechs that allow businesses to learn your account number easily.

23. US national debt reaches a record $37T, the Treasury Department reports (apnews.com)

The U.S. government’s gross national debt has surpassed $37 trillion, setting a new record. This highlights the rapid acceleration of debt on America’s balance sheet and the increasing cost pressures on taxpayers.

25. Jujutsu and Radicle (radicle.xyz)

The Radicle forge is an open source, peer-to-peer code collaboration stack built on Git.

26. Arch shares its wiki strategy with Debian (lwn.net)

The Arch Linux project is especially well-known in the Linux community for two things: its roll [...]

27. Igor Babuschkin, a co-founder of xAI, has announced his departure (techcrunch.com)

Igor Babuschkin is leaving xAI less than three years after he co-founded the startup with Elon Musk, following a series of scandals at company.

28. Wholesale prices rose 0.9% in July, more than expected (www.cnbc.com)

美国批发价格指数(PPI)七月大幅上涨

美国劳工统计局周四发布的报告显示,七月份批发价格指数(PPI)环比上涨0.9%,远高于道琼斯预期的0.2%涨幅,创下自2022年6月以来的最大单月涨幅

关键数据要点

  • 整体PPI:环比上涨0.9%,同比上涨3.3%,为自二月以来的最大年度涨幅,并远超美联储2%的通胀目标。
  • 核心PPI(剔除食品和能源):环比上涨0.9%,预期为0.3%。
  • 核心PPI(剔除食品、能源和贸易服务):环比上涨0.6%,为2022年3月以来最大涨幅。

上涨主要驱动因素

  • 服务业通胀:七月份环比上涨1.1%,是主要推动因素。
    • 贸易服务利润率增长2%,部分归因于特朗普政府关税政策的持续影响。
    • 机械和设备批发价格上涨3.8%,贡献了服务业涨幅的30%。
    • 投资组合管理费飙升5.4%,航空客运服务价格上涨1%。

市场与政策影响

  • 市场反应:数据公布后,股市期货下跌,短期国债收益率走高。
  • 美联储政策预期:尽管此前市场几乎完全预期美联储将在九月降息,但PPI数据公布后,市场对九月降息的预期概率仅小幅下降,不过对年内降息三次的预期概率大幅降低
  • 分析师观点:部分分析师认为,企业可能正自行吸收关税成本,但未来可能将成本转嫁给消费者。此次PPI的意外飙升被视为对近期乐观降息预期的打击。

背景与数据可靠性问题

  • PPI是衡量批发层面价格压力的关键指标,其变化会影响美联储青睐的通胀指标——个人消费支出(PCE)价格指数。
  • 美国劳工统计局(BLS)正面临数据准确性受质疑的困境。此前,特朗普总统解雇了前任BLS局长,并计划提名一名批评该机构的人选继任。由于预算削减和裁员,BLS已改变数据收集方式,七月份的PPI报告是自该局取消约350个输入成本类别后的首份报告
  • 白宫在数据发布后表示,报告细节显示企业并未将关税成本转嫁给消费者。
29. April Fools 2014: The *Real* Test Driven Development (2014) (testing.googleblog.com)

Update: APRIL FOOLS! by Kaue Silveira Here at Google, we invest heavily in development productivity research. In fact, our TDD resea...

30. Job Listing Site Highlighting H-1B Positions So Americans Can Apply (www.newsweek.com)

When companies want to sponsor workers for Green Cards, they first have to prove there are not qualified U.S. citizens for the role.

31. Show HN: Yet another memory system for LLMs (github.com)

Persistent memory for LLMs and apps. Content-addressed storage with dedupe, compression, full-text and vector search. - trvon/yams

32. Cross-Site Request Forgery (words.filippo.io)

Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.

33. A case study in bad hiring practice and how to fix it (www.tomkranz.com)

网络安全领域招聘实践问题重重,企业常抱怨人才短缺,实则是招聘流程自身存在严重缺陷。本文以Canonical公司招聘安全运营主管的案例,剖析典型问题并提出改进建议。

招聘中的两大主要问题

  1. 滥用招聘平台:公司发布不切实际的职位要求与低薪,或重复发布相同职位(如Canonical在欧洲多国及美国各州发布同一远程职位),干扰求职者搜索,浪费其时间。
  2. 糟糕的招聘实践:职位描述冗余且存在错误(如拼写错误“endpoitns”),未标明薪资范围,常基于地域差异支付不等薪酬,反映出对员工价值的不尊重。

Canonical案例分析

职位发布问题

  • 泛滥发布:同一远程职位在多个地区重复发布,造成信息泛滥,降低可信度。
  • 要求不合理:要求“高中和大学阶段的卓越学术记录”,与网络安全高管职位关联甚微,可能排除优秀非传统背景人才。
  • 缺乏薪资信息:暗示公司可能根据地域差异支付不同薪酬,进一步削弱吸引力。

申请流程问题

  • 平台设计低效:使用Greenhouse.io申请系统,要求上传简历后手动重复填写信息,耗时费力。
  • 过早深度提问:在初始申请阶段要求回答本应在面试中探讨的复杂问题,文字字段限制无法充分解答,导致优秀候选人放弃申请。
  • 学术背景过度强调:申请中进一步聚焦无关学术经历,与实际工作能力脱节。

面试流程缺陷

  • 评审团队不合理:申请由无关部门的领导团队审查,缺乏专业相关性,可能偏向“文化契合”而非能力评估。
  • 依赖无效测评:使用能力和性格测试,这些工具长期被证明效果不佳,并对神经多样性群体存在歧视,与公司宣称的多样性承诺相悖。
  • 沟通渠道混乱:申请者会收到来自不同平台和外部合作伙伴的邮件,增加网络诈骗风险,尤其在安全岗位招聘中极为不妥。

外部评价佐证

Glassdoor上对Canonical的评价呈现两极分化,负面评论指出公司文化排外、领导层脱节,印证了招聘流程中反映的深层管理问题。

改进建议

  1. 放宽学历要求:除非高级职位要求“相关学位或同等经验”,否则不应强制要求学位。
  2. 相关性认证:仅要求与职位相关的证书(如高级职位要求CISSP)。
  3. 优化职位描述:由岗位直接管理者撰写,明确实际所需技能。
  4. 简化流程:面试不超过三轮,由相关管理者负责,采用案例研究和对话式评估。
  5. 尊重候选人:避免无效测评,真诚回答候选人疑问,维护招聘专业性。

总结

Canonical的案例反映了广泛存在的招聘弊端:不尊重候选人时间、低估员工价值、流程设计脱离实际需求。此类问题不仅导致关键职位长期空缺,也可能使企业在未来面临可避免的安全漏洞。改进招聘实践并非难事,需从根本上转变观念,重视专业能力与人性化流程。

34. Launch HN: Golpo (YC S25) – AI-generated explainer videos (video.golpoai.com)

Make AI whiteboard animation videos free in 2 minutes. Turn a prompt, script, or document into a whiteboard explainer — no design skills needed.

36. U.S. alcohol consumption drops to a 90-year low, new poll finds (www.sfchronicle.com)

根据提供的标题,核心信息是:美国酒精消费量降至90年来的最低水平

  • 关键点:一项新的民意调查(poll)发现,美国的酒精消费量出现了显著下降。
  • 下降程度:消费量达到了自大约90年前以来的最低点(a 90-year low)。
  • 信息来源:此结论基于一项新的调查结果。

请注意:所提供的正文内容因加载失败而无法获取,因此以上总结仅基于标题信息。无法提供关于调查细节、原因分析、具体数据或其它相关内容的更多概括。

38. What Medieval People Got Right About Learning (2019) (www.scotthyoung.com)

Apprenticeships beat schooling. Here's why they're a superior method for learning, and how you can apply this to the things you want to master.

39. Google Play Store bans wallets that don't have banking license (www.therage.co)

New Google Play Store policy now requires FinCEN registration, state banking license, or MiCA license for non-custodial wallets.

40. That 16B password story (a.k.a. "data troll") (www.troyhunt.com)

Spoiler: I have data from the story in the title of this post, it's mostly what I expected it to be, I've just added it to HIBP where I've called it "Data Troll", and I'm going to give everyone a lot more context below. Here goes:

Headlines one-upping each other