MurphyA/hacker-news huggingface dataset:
by unscaled | 2025-05-27 08:49:09+00:00
In that case, when and how would you reload the statuslist?

Again, it doesn't matter if TTL and caching is optional, what matters is that this specification has NOTHING to do with a pub/sub-based or push-based mechanism as described by GGGP. This draft specifies a list that can be cached and/or refreshed periodically or on demand. This means that there will always be some specified refresh frequency and you cannot have near-real-time refreshes.

> There is also a practical limit to how frequently you refresh a token revocation list. Some organizations have a 5-10min tolerance period for basic, genera-purpose access tokens, and fall back to shorter-lived and even one-time access tokens for privileged operations. So if you have privileged operations being allowed when using long-lived tokens, your problem is not the revocation list.

That's totally cool. Some organizations are obviously happy with delayed revocations for non-sensitive operations, which they could easily achieve them with stateful refresh tokens, without the added complexity of revocation lists. Stateful and revokable refresh tokens are already supported by many OAuth 2.0 implementations such as Keycloak and Auth0[1]. All you have to do is to set the access token's TTL to 5-10 minutes and you'll get the same effect as you've described above. The performance characteristics may be worse, but many ap which are happy with delayed revocation are happy with this simple solution.

Unfortunately, there are many products where immediate revocation is required. For instance, administrative dashboards and consoles where most operations are sensitive. You can force token validity check through an API call for all operations, but that makes stateless access tokens useless.

What the original post above proposed is a common pattern[2] that lets you have the performance characteristics (zero extra latency) of stateless tokens together with the security characteristics of a stateful access token (revocation is registered in near-real-time, usually less than 10 seconds). This approach is supported by WSO2[3], for instance. The statuslist spec does nothing to standardize this approach.

[1] https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-r...

[2] See "Decentralized approach" in https://dzone.com/articles/jwt-token-revocation

[3] https://mg.docs.wso2.com/en/latest/concepts/revoked-tokens/#...
by lynx97 | 2025-05-27 08:50:48+00:00
The unnecessary verbosity of some OpenAI answers, and the general "teacher" tone of it feels very inappropriate to me. When I casually use a TLA, I don't need it to expand the acronym to me. Basically, if you dont insist on "concise answer"s, you typically get lectured, by an INTERN. Its so weird. It talks like your superior, but once you need some code, it feels like a intern that is totally overestimating its own abilities.
by Jommi | 2025-05-27 08:51:18+00:00
Things like Monerium (programmable, regulated EU e-money), card integrations (pay with stables abstracted to current visa/MC), mobile wallets (only build a frontend for a fintech app, everything else is done by soemone else) is a pretty huge combo.

Especially with UX, the likes of https://www.privy.io/ is interesting, now we finally have "non-custodial" wallets with just a google-login. (check how it works, its pretty cool). This means any user for any web app can have a "bank accocunt"

Other stuff is zkEmail/zkTLS for verifiable data portability without exposing raw private data (huge for things like "vampire attacks"), and TEEs with fine-grained, 'OAuth 3.0'-style access control for private compute are compelling.
by stuaxo | 2025-05-27 08:52:08+00:00
GIMP - The team is small, and some devs can be funded.

WACUP - DrO is building upon the parts of winamp that were open sourced around the Winamp 3 era and gradually building all the other parts (since Winamp was plugin based this is doable piece by piece).

Other: a couple of artists on patreon.

If I didn't have to work 5 days a week I might devote time to projects like these, since I can't donating some small amount £ feels right.
by Daedren | 2025-05-27 08:52:29+00:00
I disagree with a lot of things in the blogpost. I did feel like Arc had cohesion and a purpose. The problem was marketing. The website had zero information, zero screenshots and zero way to sign-up for the longest time.

You had no way to know anything about this browser unless it was by word-of-mouth, not to mention the invite system. I don't think "asking to change browsers is a big ask" at all, otherwise you might as well just shut down the company right now.

Honestly the reasons laid out + the novelty of a new "AI Browser" makes me have a very negative future outlook on The Browser Company.
by exe34 | 2025-05-27 08:53:35+00:00
I've actually gone the other way - not everything is meant to be run. If it's not in the nix repos, I'll try the fhs, and if that doesn't work - well I probably don't care enough to beg it to run. For me the fact that my base installation can never break is not negotiable.

I definitely didn't learn much of nix(os|pkgs). I never bothered learning about flakes. I just have a configuration.nix and a user config.nix, and a "fhs" default.nix and that's it.
by lightbulbish | 2025-05-27 08:54:21+00:00
As an engineer founder I can only agree this is likely solving a real problem.

1) I don't understand your product based on your demo. It looks like a simulated thing, but it doesn't tell me about _my_ user experience. How much eye to eye contact would I break using your app? Where is the video? How does it look if the bot is with me instead of calling through your app? Those type of questions are unanswered by this quite lackluster 15 second demo.

1.5) The demo also feels very scripted. A call is way more messy.

2) Your "investors" page shows 3 types of products: transcription, in sales call, and sales training. I'm curious, do you really need all three right now?

3) Your logo should be remade. When sized down (to the size of your homepage) its not clear what it is. I had to zoom ni to understand it's an ai generated oil painting of a sunset (I presume). I believe a logo should be clearly identifiable in all presented format, otherwise it doesn't fulfill the purpose of a logo. (Look on appicon designs. Apple has a lot of guidelines on how to rerender your logo for lower pixel environments if needed, just for this purpose. A simple initial fix is just to remove complexity from it).

Cool job though! I can definitely understand the potential.
Show HN: WinCse – Access Object Storage in Windows Explorer (Now AWS, GCP, etc.)
by cbh34680 | 2025-05-27 08:54:54+00:00
I previously introduced WinCse on Hacker News (original post: https://news.ycombinator.com/item?id=43947599). At the time, it only supported AWS S3, but this update adds compatibility with GCP, OCI, and more object storage providers!

Object storages tested for compatibility: - AWS S3 - Google Cloud Storage - OCI Object Storage - Wasabi Hot Cloud Storage - Cloudflare R2 - Backblaze B2 - Storj DCS - IDrive e2

With WinCse, you can access and manage object storage directly from Windows Explorer as if it were local files.

If you encounter any bugs, please report them on GitHub. I also welcome suggestions for improvement and will consider implementation where possible.

Give it a try! Bug reports, feedback, and contributions are always welcome.
Ask HN: Why does MCP need to exist?
by kostyal | 2025-05-27 08:55:44+00:00
Why can't we just use REST APIs with OpenAPI specs provided to the LLM (possibly alongside x-llm-* hints to give additional contextual information)?

Arguments I've seen focus on advantages of MCP for stateful or bidirectional connections, but it's not obvious that additional complexity is worth the tradeoff to me. Help me understand why this exists
by bmacho | 2025-05-27 08:57:22+00:00
> This is a rational rationale to explain why Nvidia is not terribly interested in all the bullshit that B2C requires in general and the oceans of it that the gamer segment of the market involves.

In the article this is a strawman, and the very next paragraph refures it (or tries at least):

But that feels like a good argument for Nvidia to stop caring whether its gaming GPUs sell, not why it might feel the need to meddle with reviews. If the desktop RTX 5060 doesn’t hit sales goals, the company will be more than OK. Nvidia would be less OK if everyone started questioning its integrity.

IMO Nvidia has been doing shady marketing for decades (also shady behind-the-courtain deals). No particular reason for that, especially when they have the better product, this is just how they operate. But the market rewards it, and IMO it helped them to get where they are now.
by throwaway2037 | 2025-05-27 08:57:58+00:00
I am pretty sure that early childhood education (until fifth grade) is a very active area of research in all highly developed nations. Almost, by definition, it you want to (a) become or (b) stay a highly developed nation, you need to have a high quality public education system.

My mother was a first grade teacher for 30+ years. In her school system, first grade is the year that students learn to read. Each year, she was also required to take professional training classes for a certain number of days. She told me that, in her career, there were many changes and improvements and new techniques developed to help children learn how to read. One thing that changed a lot: The techniques are way more inclusive, so non-normie kids can learn to read better at an earlier age.
by dr_dshiv | 2025-05-27 08:58:29+00:00
I contribute to the Embassy of the Free Mind, in Amsterdam. They have one of the world’s largest collections of Neo-Latin books/manuscripts from 1400-1600s. Their library has so many fascinating esoteric works—on alchemy, spiritual practices, Neoplatonic philosophy, natural magic, etc. But, 80% of the library hasn’t been digitized or translated. This digitization and translation is what I’m supporting — and making the works accessible to AI (and through AI).

I somehow feel very motivated to make sure that the intellectual works that inspired the Renaissance, European Enlightenment and Scientific Revolution are accessible, both to people and for LLM pretraining.
by StalwartLabs | 2025-05-27 08:58:47+00:00
I understand your perspective, many open source communities are built on transparency, and it's natural to want to know the people behind a project.

That said, I personally value privacy highly, which is actually one of the main reasons I started Stalwart Mail Server. I don't maintain a personal presence on LinkedIn or other social media platforms, not because I'm trying to be anonymous, but because I prefer to focus on the work rather than promoting myself. I’ve found that platforms like LinkedIn are more noise than signal for me, especially with constant recruiter spam.

That being said, Stalwart Labs as a company is far from hidden. You can find our company page on LinkedIn here: https://www.linkedin.com/company/stalwartlabs/. We're also active on:

* Mastodon: https://mastodon.social/@stalwartlabs * Twitter/X: https://x.com/stalwartlabs * Reddit: https://www.reddit.com/r/stalwartlabs/

While I may not be putting my personal life on display, I’m committed to transparency where it matters most: through the project’s code, documentation, and community engagement. I hope that helps clarify things!
by forgotoldacc | 2025-05-27 08:59:00+00:00
I was ready for flat design to die 10 years ago. It's astonishingly unintuitive, ugly, the opposite of style, and straight up anti-human. There are still abstract icons in some apps and UIs that I can't wrap my head around and I have to just click and hope I'm right. There are things that I cannot figure out whether they're interactive or not unless I just tap randomly. There are so many occasions where I can't find what I'm looking for because some goober decided contrast and color coding is a sin.

Flat design stands against every single principle of proper design. All I can hope is 40 years from now, there isn't some "retvrn to tradition" BS where a new wave of the youth decide we should return to the "cool classic style of the 2000s-2020s". Let me be an old man and die with the software around me looking beautiful.
Show HN: Search 100k Shopify stores in under 300ms
by astronautmonkey | 2025-05-27 08:59:18+00:00
Hi HN! Agora is a search engine for e-commerce products.

I originally built Agora as a side project to find a pair of red shoes for my wife. The MVP search took 5 - 10 seconds to return results and the app looked like it was designed in MS Paint (by yours truly). https://web.archive.org/web/20231214000400/https://www.searc...

Here are a few technical challenges that we've been working on recently:

1. Figured out how to return results in under 300ms. We are using Mongo as our primary database and a self-hosted version of Meilisearch for search on a high memory Digital Ocean server. The app is built with Remix, specifically to optimize for pre-fetching of data. To power the AI search, we convert our products into both text and image embeddings. Text embeddings with Cohere and image embeddings with Clip. We are now working on further server optimizations and data sharding to get the search speed under 200ms.

2. Expanded the crawler to index stores built with Shopify, WooCommerce, and major retailers like Walmart and Target. Because e-commerce data is constantly updated by store owners, we also built a "recrawler" that updates all stores on Agora every 24 hours. Then when a user clicks on a product, we do a live check of the variants and stock. This ensures that product data is always up to date.

3. Added deeper e-commerce query detection. We noticed that some searches are objective keywords like "camping tent" and others are subjective queries like "what is the best camping tent under $500". When a user searches on Agora, we pass the query through a text classifier to determine if it's subjective or objective, then change the AI tooling and UI accordingly. We served 2.1 million search queries in 2024 and are now using this data to get even more precise about query detection.

I'd love your feedback. And let me know if you have ideas on how to make the search faster.
by ipachanga | 2025-05-27 08:59:52+00:00
I landed on this randomly and it just shows one word: “Remember?”

Then a few cryptic lines and what looks like some kind of psychological interaction. No buttons, no nav, no clue what it’s for.

It doesn’t behave like a normal site. Feels more like something you're supposed to feel rather than use.

No idea if it’s an unfinished ARG, art piece, or someone’s experiment. But it’s... sticking with me.

Just curious if anyone else has seen this or knows what’s going on with it.
by rads | 2025-05-27 09:00:39+00:00
You might see this and think, "great, another hyped up vibe coding tool". If Clojure is about simplicity and understanding your code deeply (with the end goals of long-term maintenance and reliability), why would you need this?

When working with Clojure, I've been using LLMs primarily for two use cases:

1. Search 2. Design feedback

The first case is obvious to anyone who's used an LLM chat interface: it's often easier to ask an LLM for the answer than a traditional search engine.

The second case is more interesting. I believe the design of a system is more important than the language being used. I'd rather inherit a well-designed codebase in some other language over a poorly designed Clojure codebase any day. Due to the values of Clojure embedded in the language itself and the community that surrounds it, Clojure programmers are naturally encouraged to think first, code second.

The problem I've run into with the second case is that it often takes too much effort for me to get the context into the LLM for it to answer my questions in detail. As a result, I tend to reach for LLMs when I have a general design question that I can then translate into Clojure. Asking it specific questions about my existing Clojure code has felt like more effort than it's worth, so I've actually trained myself to make things more generic when I talk to the LLM.

This MCP with Claude Code seems like the tipping point where I can start asking questions about my code, not just asking for general design feedback. I hooked this up to a project of mine where I recently added multi-tenancy support (via an :app-id key), which required low-level changes across the codebase. I asked the following question with Claude Code and the Clojure MCP linked here:

> given that :app-id is required after setup, are there any places where :app-id should be checked that is missing?

It actually gave me some good feedback on specific files and locations in my code for about 10 seconds of effort. That said, it also cost me $0.48. This might be the thing that gets me to subscribe to a Claude Max plan...
by Cthulhu_ | 2025-05-27 09:01:11+00:00
Try it manually first, can't automate a process if you don't know the process yet. That will prove the business case too, with a lot less upfront investment.

The problem is that it doesn't scale; unless you have quality and reliability guarantees on the batteries, you won't be able to sell it in anything but unregulated markets, meaning that demand will always be low and investments in "smart AI robotics" will never earn themselves back.
by spwa4 | 2025-05-27 09:01:53+00:00
You're arguing semantics. We seem to agree they're a bunch of politicians that are bought and sold for propaganda purposes, and that they do essentially nothing.

Okay ... if that's "every other court", and it's just par for the course that governments both commit the worst atrocities imaginable and do nothing about accountability afterwards, then I just failed to consider just how incredibly cynical you are.

I, however, call that a fake court, I also call their other actions corrupt (both in what they DO, like when it comes to Israel, as what they DON'T DO, like acting against governments where it comes to Putin, or frankly most of their other cases). Their very existence is a lie (in that countries create this court, but have ZERO intention to actually provide any justice). You may claim this is all just normal, but that is certainly not what they say on TV, what their website says, what they argue in the UN. That's lying, at best. They selectively enforce their agreements for political reasons, frankly for money, e.g. again against Israel. Their elected official got caught committing slavery, rape, theft, tax evasion. They didn't even get fired for that. And, of course, they take a massive amount of money for all this "government service". Again

And, like in WW2, Israel and the Jews are once again having the same function of a canary in a coal mine. Racism. Corruption. Selective justice. Justice for sale. Bad governance. For some reason Israel and Jews keep being the first victims or should I say targets, much more apt. But like in WW2, they quickly move on to everyone else if their case against Israel moves even a nanometer forward.
by ChrisMarshallNY | 2025-05-27 09:02:25+00:00
> My pessimistic view is that most people do not like learning, let alone learning in their leisure time with their own bucks.

Sadly, I have come to the same conclusion.

I have been training and giving seminars for ages. I don’t think that I’m the world’s best teacher, but I’m not that bad.

Geeks can be fun to teach, because they actually enjoy learning. It’s really a fundamental requirement for our industry.

Non-geeks; not so much. I often try to teach non-geeks how to do some small thing (usually around using tech). They almost always basically tell me that they don’t want to learn. Instead, they want me to do it for them.

There are definitely geeks that have leveraged this, to become fairly wealthy, but I find it kind of depressing.
What are you using for embedded analytics?
by lane_g | 2025-05-27 09:02:26+00:00
We’re getting ready to launch and want to better understand what tools teams here are using to give their customers real-time data visibility inside their app/product.

Not internal dashboards that took dev time to build— I mean actual embedded analytics that work at scale, ideally with support for multi-tenancy and row-level security.

What’s working for you? What have you outgrown? Curious to hear what’s actually holding up in production.
by skissane | 2025-05-27 09:03:54+00:00
I wonder… does the UEFI spec mandate any particular behaviour in these cases? Does the UEFI SCT test for it?

Seems like an inconsistency which could be addressed by adding it to the spec and/or test suite.

I guess the other thing I don’t know, is whether there is any actual real world pressure on firmware vendors to pass the test suite.
by desman | 2025-05-27 09:04:13+00:00
I've been thinking about similar setups with lots of batteries as I have excess energy I can generate during the day and a lot of otherwise barely usable space in my attic. Fire hazard is my major concern. How do you make sure old (or even new) batteries don't do their usual thing, especially if they are in an environment with unstable temperatures and scarce monitoring?
by avodonosov | 2025-05-27 09:05:25+00:00
My "all time" stats:

Played 145 times Max credits 49 Max combo 8 Win 56 (39%) Draw 35 (24%) Loss 54 (37%)

My "this game" stats:

Played 94 times Current credits 45 Max credits 49 Max combo 8 Win 39 (41%) Draw 25 (27%) Loss 30 (32%)

I was playing mostly as with a living oponent.

When playing I was not exploiting any assumptions about it being Markov learner (I don't even understand how it learns and how to exploit it)

While it can not learn to beat me most of the time, it is playable.

How do you know it learns with markov chain? How exactly? (What states the chain has? Other details?)

Why does camera shakes at every move? To me that's very annoying.

The game needs stats of the total credits I spent including previous rounds, so that I see the total spent/won balance. I am clearly winning on that measure.
by throwaway2037 | 2025-05-27 09:05:35+00:00
I can say from some working experience in the United States that way too many jobs require a university degree. I remember being an intern or my first job after uni (which I struggled a great deal to complete), looking around and thinking: "There is no way that all of these people need a uni degree to do their jobs." I couldn't believe how easy work was compared to my uni studies (it was hell). I felt like I was playing at life with a cheat code (infinite lives, or whatever). I don't write that to brag; I am sure many people here feel the same. So many jobs at mega corps require little more than common sense: Come to work on time, dress well, say your pleases and thank yous, be compliant, do what is asked, etc. Repeat and you will have a reasonable middle class life.
by audunw | 2025-05-27 09:06:34+00:00
But crypto isn’t the only way to change the banking system.

In many cases you can now transfer money instantly and free across European countries. If there’s a will there’s a way.

Turning crypto into an acceptable banking system is probably just as hard, if not harder, than making the existing banking system better, faster and more user friendly.

We’ve been promised crypto would revolutionise payment for more than a decade now. In the same timespan I’ve seen my little country develop a common payment app shared by all banks which has made payment to shops and between people instant and super easy. We didn’t need crypto to make progress.

If banking regulations were relaxed to the point where crypto could be used more widely, traditional banks would also be able to innovate much more quickly without crypto.

In the end, I don’t find it entirely unlikely that banks may use a blockchain to do some of their international settlement. It’s a nice algorithm in the cases where you don’t want a single master arbiter. But it’ll probably be a fairly boring behind-the-scenes kind of thing.