MurphyA/hacker-news huggingface dataset:
Show HN: A native macOS guard to defend crypto wallets from malware
by feriancek | 2025-05-28 00:15:29+00:00
I’m Fer, a Mac user who learned the hard way that “normal” AV doesn’t catch modern wallet-stealer families (AMOS / Poseidon / Banshee / Atomic, etc.). So I built ShieldKey: a Swift/Rust, always-local layer that covers the specific attack surface of crypto wallets on macOS.

What ShieldKey does today

* Process-level wallet cage via EndpointSecurity + Sandbox: blocks anything touching wallet paths (~/Library/Application Support/…, browser Local Storage, USB HID for Ledger/Trezor) unless it’s on an allow list

* Network Extension blocks known phishing domains before the browser even loads them

* Clipboard / window-title watcher for seed patterns (base58 / hex)

* 1 800 macOS stealer hashes in a compact YARA+SHA table (mmap, ~20 µs lookup)

* One-click “wallet lock”: chmod browser-wallet storage to 000 and auto-eject HW wallets

* 100 % offline; UI is SwiftUI, engine is a 4 MB static Rust daemon

Why bother when objective-see or commercial AV exist?

- Objective-see is awesome but pops LOTS of alerts—ShieldKey ships wallet-specific heuristics so users get one actionable alert, not 200. - Commercial AVs flagged <10 % of the macOS stealer hashes we collected since Jan 2024 (VirusTotal data). They also don’t understand Ledger HID traffic or MetaMask’s plaintext vault.

Architecture

- shieldd (daemon): Rust, Tokio, subscribes to EndpointSecurity, FSEvents, HID, NetExt - shieldctl (CLI): sends YAML → gRPC to daemon, emits JSON for UI - ShieldKey.app: SwiftUI menu-bar wrapper - Rules pack compiled into a single kcdb file (mmap B-Tree, O(log n))

Limitations

- No in-browser JS detection; if you paste a seed, JS phishing can still grab it - No rule revocation yet - whole pack must update - Only tested on Monterey through Sonoma

Roadmap

- Signed rule updates over Tor (opt-in) - Hardware-wallet micro-firewall (USB endpoint filter) - Transparency log for notarized releases - Public repo once code is hardened

Try it / tear it apart

Get DMG : https://getshieldkey.com brew tap coming this week. shieldctl --dry-run shows every ES event.

Looking for feedback: missed attack surfaces, EndpointSecurity edge cases, UI nits. If you’ve got macOS stealer samples I don’t detect, send hashes (or encrypted zips) to bugs@getshieldkey.com.
by mdaniel | 2025-05-28 00:15:56+00:00
Yeowzers that FAQ is filled with watch-outs

The /forks contained https://github.com/csirlin/OpenTGPTPU which had a commit 3 hours ago but it seems they have not yet updated the FAQ for their version. Anyway, the fact it has commits greater than 8 years ago makes it seem like a more reasonable submission
by AStonesThrow | 2025-05-28 00:16:31+00:00
Perhaps because the police aren't arresting people over mere Tweets, or their speech alone. Perhaps, just perhaps, conduct or actions or monetary support are also involved, but the headlines can only trumpet the reason for arrest, or the stated charges.

JK Rowling, CH OBE FRSL is an author whose corpus of speech is mainly her novel-writing. Now how did nine letters come to be placed after her name, even as she shortened her first two initials? Because her writing (speech) has been in exemplary service and support of the Crown and the British Empire.

So why would police arrest JK Rowling for pushing back against one wedge-issue in the culture war?

The 70-year-old Guy being arrested outside the abortion clinic for holding a rosary and praying, is that the singular offence he committed? Possession of a phoenix feather? Did he rescue Tom Marvolo Riddle's mother? I don't know. Neither do you.
by gsf_emergency | 2025-05-28 00:16:39+00:00
My read on the social context: they want to make a VUV/EUV solid state laser (for you-know-what). But they can't make any publishable headway in that direction, so they hype their results with the impressive sounding "petahertz" (terahertz desktop lasers at ambient conditions are mostly already in the bag)

So, ask a trusted peer whether this is a something-burger or an attempted academic pivot. Since life is too short to spend on science you can't call your own: look at invites from ASML/TSMC/SMIC. That's what happened with Sn vapor lasers-- famously fickle things. The company that first got it to work properly (Cymer) isn't even on the relevant wikipedia page? And on the ASML they are associated with DUV? Really pushing the good faith here I think. I first paid attention thanks to interest from ASML.

(Disclaimer: don't know any experimentalists working in the exact domain)

E: sn vapor (laser-pumped) light source
by const_cast | 2025-05-28 00:16:47+00:00
This isn't true, education as a whole is built for the majority of people. If we look at K-12 it's explicitly built to work best for the neuro-typical child with a normal household. Outliers struggle, and they need other systems to catch them, like special education.

> basically wasted education

People say this but they don't understand how learning things works. Learning is inherently cummulative, everything builds off of everything else. We can't skip steps because then there will be holes. It's a big Jenga tower, and you're essentially advocating taking pieces out willy nilly because you don't think they're important.

Even coding, if you look at it, relies on English. English language arts and computer science are, in a lot of people's minds, completely opposite each other in the sphere of education. But they're actually not - because coding is a subset of the English language. Even naming variables, the people best at it are also the people who are good at conveying meaning in an essay. Because it's the same problem: conveying to an audience your intention as concisely, yet clearly, as possible.

Some relationships are obvious, like you can't learn calculus without algebra without arithmetic. But most are non-obvious.
by hirvi74 | 2025-05-28 00:17:13+00:00
I think you somewhat touched upon what I believe is the root of the problem:

> highly incentivized to get high grades, not necessarily to learn the material

Based on my own experiences and observations, I think grading is a far larger issue than cheating. I am not convinced that good grades are necessarily reflective of enrichment nor how much material has been learned. If a person makes the a high grade in a particular class, what does that actually mean?

I made high grades in plenty of classes that I couldn't tell you anything about what I actually learned.
Google is quietly burying the internet – is there a solution?
by stanislavb | 2025-05-28 00:17:35+00:00
Google’s new AI Mode doesn’t just summarize the web. It sidelines it.

What started with AI Overviews is quickly becoming a full takeover of how we interact with online information.

Here’s what you need to know:

↳ AI Overviews push actual links down the page AI Mode barely includes them at all.

↳ Instead of sending you to websites, Google now encourages follow-up prompts inside its own tools.

↳ The result: fewer clicks, less traffic, and a slow starvation of the open web.

↳ AI Mode feels cleaner and more useful because it skips the clutter Google’s own algorithm helped create.

↳ But it’s built on content scraped from the same sites it now sidesteps.

↳ This isn’t just innovation it’s an extraction. A move to own both the question and the answer.

↳ And it’s happening under the banner of “intelligence,” not search.

As discussed on /r/DigitalMarketing https://www.reddit.com/r/DigitalMarketing/comments/1kwfdt9/google_is_quietly_burying_the_internet/
by ValentineC | 2025-05-28 00:18:28+00:00
> the people who maintain starlight have some level of billions less at their disposal to keep the project going. If Astro and the company behind it go belly up now you have a new problem on your hands

Starlight and Docusaurus aren't much different in this aspect. Meta could decide to stop paying slorber (the main maintainer of Docusaurus) at any time. I hear from friends in Meta that Docusaurus isn't even widely used internally.

Both projects are MIT-licensed, at least, and that's a plus for continuity if someone ever wants to fork them.
by timschmidt | 2025-05-28 00:18:49+00:00
Exactly. They're still exploring limits and failure modes. Hence the effort to re-fly a used booster on an aggressive trajectory when they have multiple newer revisions ready to go. Looking forward to the first launch with Raptor 3.

Also really can't understate the importance of Starlink in the development program. Apollo jettisoned parachuting return capsules from the interstages so that engineers could get camera footage from inside the rocket during launch. SpaceX just gets an RTSP stream (or something similar).
by RajT88 | 2025-05-28 00:18:50+00:00
I do not even live in Portland - I live on the edge of a suburban area where people skew pretty conservative. I see the same thing - people who want to get rid of perfectly good stuff, and do not want it to go to waste. Even I do this occasionally if I cannot be bothered to repair a thing - it goes out a bit before garbage day and is usually soon gone.*

*Unless it is an old non-wide LCD monitor. Nobody wants those...
by const_cast | 2025-05-28 00:19:26+00:00
Yes, because it's hostile to democracy and freedom as whole. Even if we could let everyone not read and write and use LLMs, this is just asking for trouble. Reading and writing is precursor for other skills, in fact, just about every skill.

This includes analysis, critical thinking, skepticism, morality, you name it. Without literacy, people are easy to manipulate. It won't happen immediately, but it won't be long until we revert to a world state where organizations like the Catholic Church control everything and order around millions of people to kill each other.
by queenkjuul | 2025-05-28 00:20:51+00:00
Fuckin hell. A few hundred K? That's an unbelievable sum of money from where I'm sitting. Manny times how much I've been able to save over 4 years of an SWE career.

You'll be ok. Move somewhere cheaper and work in tech for a non-tech company. There's no shame in relying on your parents if you have to but as someone that doesn't have parents or anywhere near the savings you do i really think you'll be alright. Being a SWE at a non tech company really will eliminate most of your issues with the work i think.
by calmbonsai | 2025-05-28 00:21:36+00:00
While entertaining, this is nothing novel for anyone who's been to college during move-in/move-out days.

Quite simply, it's not worth people's time/effort to dispose of these items in another manner given the exhibited nature of these events and limited travel (esp. airline) cargo capacity. Most folks are simply making the best use of the economic utilities provided to them.

FWIW, some universities offer convenient "bulk disposal/donation" sites on-campus and some clubs/sororities/fraternities volunteer to help managing the logistics.
by msephton | 2025-05-28 00:21:47+00:00
You're quite right, the screen would be centred with margin/border around it.

Whilst the CRT is 9", according to period repair guides the screen should be adjusted so that the visible image was 7.11" x 4.75", pretty much exactly 1.5:1. This meant 72dpi, which was to match PostScript point size for print output and WYSIWYG.

So it's your 8.55" diagonal.

Some classic Macintosh users today are unaware of this screen size reasoning, or don't agree with it, and stretch the screen to fill the whole CRT. Yikes!

BTW, I posted pretty much the same info earlier today at https://news.ycombinator.com/item?id=44105531 — what synchronicity!
by 90s_dev | 2025-05-28 00:24:38+00:00
Yeah, move to a smaller town where apartments can be like $700/month and get a regular job to augment your hundreds of thousands of dollars of savings, you'll avoid starving and going homeless for a good 5 or 10 years that way, plenty of time to figure your life out. Plus you'll have more down to earth experiences that will help give you some seriously needed perspective.
by almosthere | 2025-05-28 00:25:16+00:00
Not only that, but can you imagine a new future where they train the "ai overview" with ads. For example, if you search "is Carlon the best for gang boxes or should I go with Cantex?" And if ABB/Carlon decide to pay Google - the answer can easily be:

Yes, many users in Reddit complain about Cantex... for these reasons.... To summarize, it makes sense to purchase Carlon boxes from your Home Depot in Sunnyvale.

Now, I don't think this is happening right now, but "AI Overview" already has a massive promotional feeling towards Carlon boxes (I was searching similar questions this morning).
ASK HN:MLIR and TVM, which one is more popular and suitable for learning
by zhongchengyong | 2025-05-28 00:25:39+00:00
I want to dive into the AI compiler and I have some experience on LLVM, which one is more suitable for me? Additionally, which framework is more widely adopted by AI chip companies? What's more, can you recommend some books or study materials for me?
by ValdikSS | 2025-05-28 00:25:39+00:00
Can't agree more!!

10 years ago, when I wanted to package my utility, there were 3-4 documentation snippets, each of which usually used different set of utilities.

- Should I create the package boilerplate with dh_make or debmake? The structure they create differs.

- What's the name of command which I use to update the version in changelog? deb... no, dh_... no, ... it's `dch`!

- You manage patches with `quilt`, but where do I get `dquilt` mentioned in the documentation? It's not in any package! Oh, it just an alias you should grab from `Chapter 3. Modifying the source` documentation and add into your .bashrc! And also `~/.quiltrc-dpkg`, or nothing would work.

- Packaging: dpkg-buildpackage, debmake, or maybe pbuilder?

- How do I append CFLAGS? It's DEB_CFLAGS_MAINT_APPEND, thanks dh_make comment inside the rule file! Too bad if you've created the structure with debmake!

- dpkg-gensymbols: warning: some new symbols appeared in the symbols file

- dh_missing: error: missing files, aborting

But to Debian's credit, once you've done everything more or less correctly, you can use all the power of the build system. It's very easy to cross-compile software, just a matter of a single command. On other systems it's usually much harder.
by muzani | 2025-05-28 00:25:52+00:00
They're able to "decode" base64 if you give it a popular quote, but if you modify the quote, it will often hallucinate the exact quote. If you enlarge images with it, it will often hallucinate bits and pieces of it.

So I'd do something that takes advantage of this behavior. It's like with morse code where many people know S.O.S. even if they don't know the other letters. You'd have to communicate in quotes and such.
by const_cast | 2025-05-28 00:26:31+00:00
They are doing this to protect Israel, and protecting Israel has nothing to do with antisemitism. Because Zionism and Judaism are pretty much unrelated!

Israel is strategically advantageous for the US and the rest of the West. Having a Western strong arm in the middle east is the goal geopolitically. Nobody actually cares about Jews or really thinks they're entitled to that land. We just really, really want that land because of course we do.
by zajio1am | 2025-05-28 00:27:41+00:00
I would say the proper way to apply Postel's law is to reasonable interpretations of standards. Internet standards are just text documents written by humans and often they are underspecified or have multiple plausible interpretations. There is no IETF court, which would gives canonical interpretation (well, appropriate working group could make a revision of the standard but that is usually multi-year effort). So unless we want to break up to multiple non-interoperable implementations, each strictly adhering to their own interpretation, we should be liberal about accepting plausible interpretations.
by jmyeet | 2025-05-28 00:29:22+00:00
SpaceX is, for many of us, what made many of us (myself included) not realize what a raging moron Elon Musk was and is for the longest time. I've come to believe that SpaceX succeeded in spite of Elon, not because of him. Whoever is really in charge has probably built an organization that is designed to insulate itself from Elon's influence.

And Falcon 9 is an unmitited success, to be sure. SpaceX basically owns the launch market because of it.

But eventually the chickens come home to roost and I really wonder if Starship will be the downfall of SpaceX. Let me explain.

Commercial space launches to LEO are SpaceX's bread and butter. There are over 100 a year now and whatever the cost of refurbishing used Falcon 9 first stage boosters is, I think the volume of launches (even if you exclude the induced demand from Starlink launches) has locked in an economic advantage for commercial launches for the next 10-20 years, in a similar way the 747 did for Boeing in the commercial aviation market. It's just that dominant.

But you have to ask what problem Starship solves. SpaceX already has a heavier launch capability (ie Falcon Heavy) but there's little demand for it. There have been 11 Falcon Heavy launches total AFAICT. So what is Starship going to launch? You might say that there will be new payloads once the launch capability exists.but we've simply seen no evidence of this thus far.

Starship is more complex, specifically the Raptor engines. You have two cooled propellants instead of one (because of coking with Merlin engines). In-orbit refueling is going to take so long to prove and perfect for some of the stated goals.

And Starship just isn't designed to land on things with a human crew. If a Starship booster lands on Moon (or Mars, which will never happen), your astronauts are 40 meters in the air. This is... far from ideal.

The US government simply won't allow SpaceX to fail. It's a national security issue. So I guess this doesn't matter. And it may be that the Falcon 9 cash cow props the company up from any number of boondoggles.

If Starship reaches its reliability and cost targets, it will lower the LEO payload cost per kg significantly but that's a lot of ifs and a ton of investment. But if you're not sending up a huge payload, you just don't need that. Starlink is fairly unique in being such a large constellation on similar orbits that you can launch them on a single orbit. Launching multiple satellites in vastly different orbits is not something a single rocket can do.
by tom_ | 2025-05-28 00:29:55+00:00
Interesting, thanks. I'd missed that particular detail, possibly because I used to do this stupid shit on the Atari ST and its instructions were quantized to the nearest nop (and so 6 cycles wasn't really a thing). Address register operations are always longs, and clearly the sign extension imposes some overhead. Given that pretty much every other long operation is slower, I imagine this is a case of getting lucky with the timing of the 16-bit internal operations.

ADDQ and ADDX are better instructions to look at, as are any with a Dn,Dn addressing mode. The long and word cases are the same number of instruction bytes, but the long case is still slower.

(Register-to-register moves are the same regardless of width, so presumably it has a 32 bit path for this. That's nice. But not as nice as it would be if it had a 32 bit path for everything. Which it really looks like it doesn't. This CPU has registers, but that can't save it.)
by gwynforthewyn | 2025-05-28 00:32:37+00:00
Figuring out the technique for this involved reading a number of github issues, so I tried to make it as simple as possible to see what the 2 step process is to be able to compile your migrations.

The benefit of this approach with migrations is being able to use golang itself to figure out if a migration should run e.g. you can check an environment variable to see if you're in the dev environment and if you are then you could run a migration to populate your seed data.
by const_cast | 2025-05-28 00:33:17+00:00
These people become citizens. There's this distinction people make between American people and then immigrants. Er... no. The immigrants are the American people.

My parents were immigrants. Most people I know had parents or grandparents who were immigrants. America, as a whole, is built off the backs of people from not-America. That's our entire thing, we're the melting pot.
by walterbell | 2025-05-28 00:33:27+00:00
Google TPU engineers used open-source Chisel for ASIC design (2018), https://youtube.com/watch?v=x85342Cny8c

"Google Edge TPU devices", 100 comments (2019), https://news.ycombinator.com/item?id=19130896 & https://news.ycombinator.com/item?id=19313813

"Coral Edge TPU review", 100 comments (2020), https://news.ycombinator.com/item?id=24808755

"TPU transformation: 10 years of our AI-specialized chips", 60 comments (2024), https://news.ycombinator.com/item?id=41148532
by mdaniel | 2025-05-28 00:34:30+00:00
e.g. https://github.com/kulfi-project/kulfi/blob/malai-0.2.5/kulf...

$ echo -n c1b2d4463e503765b7422e126ea7ff5633ba5903f97b700ac818 | wc -c 52

It would appear the leading "org-", "account-", et al are a separate namespacing of the id52 key
by mindwork | 2025-05-28 00:34:59+00:00
I've been working more on my homelab.

In short: installed immich(instead of Synology Photos), Beszel, Paperless-ngx(configuration pending), moved a bunch of tools out of my HTPC VM in to separate VM, did a proper backup of my proxmox cluster and set up cloud-init template with new ubuntu.

Due: gitops style deployment and terraformation of infrastructure(provision proxmox VMs via terraform) and auto redeployment of docker containers across 5 machines. Probably would need github runner in my network. Also Authelia is still missing in my lab, I need to get to that soon
by MPSFounder | 2025-05-28 00:36:04+00:00
I think this an excuse that people who hold no power like to believe to convince themselves it is a left/right wing issue and that they have a say in this. Free speech is one issue that every American embraces. The truth is no American has a say in this, because in our free market economy, the ones who hold power would rather see the Capitol burn than oppose Israel. Today, the head of Columbia is someone who gave speeches for AIPAC, sponsored by billionaires. If you sincerely believe this is a left/right wing issue, then I genuinely feel sorry for you. When foreign nations dictate who can come into our country, or what our universities should teach, then America's freedom is under attack. Also, it is explicitly stated as an Israel issue by Marco Rubio, who is a recipient of quite generous sums from 2 pro Israeli lobbies (his top 2 donors for quite a while have been Israel first lobby groups that advocate on behalf of a foreign nation in Florida). [0] https://www.opensecrets.org/members-of-congress/marco-rubio/...
by aaron695 | 2025-05-28 00:36:47+00:00
Not sure about the quality of this article (well... I am sure... it's bad) but a good example of how the minerals deal in Ukraine is not as the media portrays it.

Minerals are in the ground everywhere.

So that stock photo is really representative of lithium, 100's of uses on the web, it might be petalite, any rock nerds? -

https://i0.wp.com/mitechnews.com/wp-content/uploads/2023/01/...

So adobe stock photos lets you "Generate variations" - https://stock.adobe.com/au/search?k=petalite&asset_id=412946...
by nlh | 2025-05-28 00:36:58+00:00
Ok this is great and perfect timing -- I've been playing around with Warp (the terminal) and while I love the idea of their terminal-based "agent" (eg tool loop), I don't love the whole Cursor-esque model of "trust us we'll make a good prompt and LLM calls for you" (and charge you for it), so I was hoping for a simple CLI-based terminal agent just to solve for my lack of shell-fu.

I am keenly aware this is a major footgun here, but it seems that a terminal tool + llm would be a perfect lightweight solution.

Is there a way to have llm get permission for each tool call the way other "agents" do this? ("llm would like to call `rm -rf ./*` press Y to confirm...")

Would be a decent way to prevent letting an llm run wild on my terminal and still provide some measure of protection.