MurphyA/hacker-news huggingface dataset:
by knorker | 2025-07-26 12:50:53+00:00
1. Have (and maintain!) a list of addresses you trust to not lie (e.g. your own proxy layers, cloudflare's proxy IP list, akamai, GCP LB, AWS LB, etc…)

2. If the connecting party (real TCP connection remote end) is in the trusted list, then take the rightmost address in XFF and set as remote end.

3. Repeat 2 until you get an address not in the trusted list.

4. That is now the real client IP. Discard anything to the left of it in XFF. (though maybe log it, if you want)

The article seems to forget the step of checking the real TCP connection remote address (from my skimming), which means that if the web server can be accessed directly, and not just through a load balancer that always sets the header, then the article is a security hole.
by mholleville | 2025-07-26 12:51:09+00:00
Hi !

First news for me ! :-)

I just open‑sourced MCP Gateway, a flexible reverse‑proxy / management layer for Model Context Protocol servers, written in Go.

Why ?

- Centralize multiple MCP servers behind one endpoint - Add OAuth2 / JWT auth, fine‑grained permissions and (soon) rate‑limiting - Built‑in Prometheus metrics, structured logs and more

What it does ?

- Automatically discovers tools on each proxied server and namespaces them (server:tool_name) to avoid collisions. - Keeps long‑running SSE / streamable‑HTTP connections alive with heartbeat monitoring and graceful restarts. - Ships a ready‑to‑run Docker image for quick trials (soon k8s deployment).

Looking for feedback

The project is still early ( welcome!). I’d love reviews on: - the permission model (scopes ↔ JWT claims) - performance under heavy SSE load - missing observability knobs - anything that would make adoption easier

Thanks for reading!

— Matthis
Show HN: GitHub's built-in repo analytics sucks, so I built a better one
by m4xshen | 2025-07-26 12:52:00+00:00
As a maintainer of a few open-source projects, I’ve always wanted to better understand the traffic sources and trends for my repos. Unfortunately, GitHub’s built-in analytics only show limited data from the past 14 days, which doesn’t provide much insight.

That’s why I built Repohistory, a better GitHub repo analytics platform. It automatically fetches and stores your traffic data every day, so you’re no longer limited to just 14 days. The dashboard shows you:

- Daily star growth

- Total views & clones over time

- Top referral websites

- Most-viewed pages in your repo

So if you have any public repos on GitHub, Repohistory can give you a much clearer picture of your traffic trends!
by youatme | 2025-07-26 12:52:14+00:00
A current delusion of mine is creating the iphone of self-hosting. Claude has me stuck in a manic state where I think I can do anything.

https://thebox.youatme.email/

Bonus points if you can spot the dick joke on that page. I'll send you a free prerelease unit if you can recognize all the layers to the joke.
by jqpabc123 | 2025-07-26 12:53:01+00:00
Thanks for your concern but all my personal data is perfectly safe. I keep it in an old fashioned thing called a "backup" --- complete with encryption.

I maintain 3 copies --- no hosting required. One copy is strapped to my wrist at all times so it is always just as safe as I am --- if not safer.

https://www.thingiverse.com/thing:6784665
by andyferris | 2025-07-26 12:54:06+00:00
The whole UTF-8 vs UTF-16 thing makes this way more messy than it should be.

I'd love for some native way of handling UTF-8 in JavaScript and the DOM (no, TextEncoder/TextDecoder do not count). Even a kind of "mode" you could choose for the whole page would be a huge step forward for the "compile native language to WASM + web" thing.
by louthy | 2025-07-26 12:54:09+00:00
You don’t get to sidestep a country’s laws just because you happen to sit outside of the country. If you want to provide services to people within any country then you must obey their laws.

If you’re unwilling to accept this, then you must be extremely careful when you travel internationally or turn off access to that country altogether.

This is true for every country on Earth. This is the price of doing business internationally.
Show HN: WTMF Beta – Your AI bestie that understand
by ishqdehlvi | 2025-07-26 12:54:39+00:00
We're excited to announce the beta launch of WTMF (What's The Matter, Friend?), an AI companion built to offer real emotional presence and understanding, unlike anything else out there.

What is WTMF? In a world saturated with AI tools designed for productivity, we built WTMF to be something different: an emotionally available AI best friend. It's for those 2 AM spirals, the "I don't know why I feel this way" moments, or simply when you need to vent without judgment or unsolicited advice.

Why WTMF is different:

Truly understands: Our AI learns your communication style and responds with genuine empathy, remembering your past conversations. It's not about "botsplaining" or toxic positivity; it's about being present and listening.

Pick your Vibe: Choose how your AI responds – soft, sassy, chaotic, or zen. Your conversation, your rules.

Voice Conversations: When typing isn't enough, connect via natural voice calls that feel like talking to a real friend.

AI Journaling & Mood Tracking: WTMF helps you track your emotions, spot patterns, and journal your thoughts, remembering so you don't have to.

Private & Secure: Your conversations are yours. We prioritize your privacy and emotional safety.

We're building AI that actually stays, offering a unique blend of emotional intelligence and conversational authenticity. It's AI that feels human, not clinical.

We're currently in beta and actively inviting early adopters to help us shape the future of emotionally intelligent AI.

Try Beta & Join the waitlist: https://wtmf.ai

We're eager to hear your thoughts and feedback!
by h4p0 | 2025-07-26 12:54:46+00:00
Want to test a notification platform that understands natural language prompts? Say hello to Notificamy.com — a new smart notification engine now in private beta, and we’re looking for curious, sharp beta testers to break it, stress it, and help us make it amazing.

What is Notificamy? It’s a platform where you can type something like: "Remind me to email Marco every Wednesday at 10AM" …and boom — you’ll get real notifications via Slack, WhatsApp, email, and more.

As a beta tester, you can:

Try our AI-powered prompt parser

Schedule real-world alerts from simple text commands

Help shape how natural language and automation come together

If you love testing fresh tools, enjoy breaking things (constructively), and want to help build something useful, join the beta here → https://notificamy.com

We’re keeping the group small to prioritize high-quality feedback. Share your experience — the best ideas go straight into development!
by mmarian | 2025-07-26 12:56:02+00:00
If by "capital product", you mean business, there's plenty. The most popular in these circles is: https://www.pragmaticengineer.com/

But it's not easy. I tried it for a TikTok content ideas, gave up after a few months: https://tiktokexamples.com/blog/shut-down-newsletter/
by omnimus | 2025-07-26 12:56:07+00:00
I was unclear. Yes of course you write these classes “font-heading-2” in CSS. Tailwind is essentialy big list of premade classes to dynamically pull from. I think the functional approach/structure is the interesting part why people like Tailwind. On very small projects i even make “Tailwind by hand” creating those utilites as i go.

> There is little advantage in using the tailwind shorthand classes in your own class definitions.

There are few massive advantages. I dont have to figure out how to name these classes. Other people in the team know them too. And when they see class they dont know they know its something custom probably for a reason.

> You're bringing back the supposed downsides of cascading and shared classes

I never said cascade is bad. Creating new flat class with 0-1-0 specificity doesn’t break Tailwind. I’ve been through enough of - everything has specific class that’s nested/scoped… from my experience and usecase it’s harder for little benefit except neater html.

> simple Gzip compression will achieve similar size reduction as the utility classes

I meant custom css that you write by hand and have to scroll trough. Not the result pushed to browser. With functional css you manage to do most of the work in html and what doesn’t make sense you can do traditionaly. For example i dont like doing complex hover interactions in Tailwind so the html has all the layout utilities but also custom class that only has this custom interaction behaviour.

> Working on your codebase now requires full knowledge of the Tailwind utilities, layers, directives, pseudo-classes, theming, and all the complexity that comes along with them.

Is knowing Tailwind naming conventions worse than not having any convention at all? My experience is that Tailwind are just classes that are documented. Without it we would have classes that are undocumented.

There are cases where functional css is not that beneficial. Like in long running products which have single file component workflow where css is scoped and html/css live in same file. But in work i do in small team we just found it to solve many our painpoints.
by LegNeato | 2025-07-26 12:56:58+00:00
The demo is admittedly a rube goldberg machine, but that's because this was the first time it is possible. It will get more integrated over time. And just like normal rust code, you can make it as abstract or concrete as you want. But at least you have the tools to do so.

That's one of the nice things about the rust ecosystem, you can drill down and do what you want. There is std::arch, which is platform specific, there is asm support, you can do things like replace the allocator and panic handler, etc. And with features coming like externally implemented items, it will be even more flexible to target what layer of abstraction you want
by martin-t | 2025-07-26 12:58:38+00:00
I agree with the trans example because 1) it's a great example of one individual being allowed to do something that directly harms another individual; 2) it's fairly easy to prove that someone who grew up with male bone and muscle structure does not suddenly get the female structure because of a reassignment surgery or hormones. I am all for letting people do what they want with their bodies but their freedom stops at interacting with other people's bodies.

I cannot agree with the toddlers example: 1) it's possible it does some damage but as I said, to even consider it, we need proof; 2) even if they are bad at life, it doesn't automatically harm another individual - don't hire incompetents and they won't harm your business. They might harm society in general but society does not IMO have any right to force people to optimize for society's goals. The balance might change if this was true and happened on such a scale that society measurably declined but then I am still of the opinion that we should have mechanisms how a group of people should be able to get together separate themselves from others. We have no right to force the Amish to start using modern tech, even if a few more able bodies would probably be beneficial on some scale. Similarly, if the majority feed TikTok to their toddlers and a minority does not, they should be able and allowed to form their own society with its own rules, as long as everyone participates willingly.
by Incipient | 2025-07-26 12:58:42+00:00
I do this for larger requests I make, however I find large requests end up giving me nonsense due to the amount of context 10 odd relevant files + design context.

I'm just using vscode edit mode, so I expect I'm being too simple, mostly as I haven't found out how to make agent mode work with front and back end in separate docker containers.

Would you mind sharing a bit of insight into how you've configured your environment such that you get good results?
by tmtvl | 2025-07-26 12:59:50+00:00
Which is weird considering there have been over 10 times the amount of school shootings in the U.S. compared to Europe... including an incident where a gun went off in the backpack of a second grader at an elementary school.

Europe: 4 shootings distributed across 4 countries - <https://en.wikipedia.org/wiki/List_of_school_shootings_in_Eu...>

U.S.: 41 shootings across 19 states - <https://en.wikipedia.org/wiki/List_of_school_shootings_in_th...>
by breckinloggins | 2025-07-26 12:59:54+00:00
My story is similar. I’ve been programming nearly every day for over 35 years and don’t see myself stopping any time soon.

Occasionally someone (usually at work) will ask “why do you know that?” or “how did you learn how to do that?” (where “that” is typically something outside of my direct job responsibilities).

I’ve been programming for so long and have dabbled or seriously worked with so many parts of the computing landscape - mostly out of simple curiosity and love of craft - that I admit to being somewhat annoyed at questions like this. I have trouble connecting with the premise.

But I don’t want to offend, and it’s not my place to judge when it feels like my interlocutor works in my field simply because the money is there. So I came up with a succinct way to answer those questions.

“I like computers.”
by K0balt | 2025-07-26 13:00:12+00:00
Dominican Republic. The medical tourism industry here is booming as well. The public sector facilities are not as nice, but you can get free care for the vast majority of basic things that a person needs, without worrying about a bill. Still, people that can usually use private clinics because the experience / comfort/convenience is much better.

What they do subsidize here is education. Anyone with the drive and family support to do so can become a doctor, but you have to do a rotation in the public medical facilities to maintain your licence, and all public hospitals are teaching hospitals, so your case will be observed by 10 to 15 students and a bunch of residents if it’s interesting.

The system seems to work well.

I should also clarify that 75 dollars is about a weeks wages here at minimum wage, so roughly equivalent to $400 in the us economy. That figure tracks for most cost of living expenses here, except luxury items which are typically more expensive here than in the USA.
by Archit3ch | 2025-07-26 13:00:54+00:00
I write native audio apps, where every cycle matters. I also need the full compute API instead of graphics shaders.

Is the "Rust -> WebGPU -> SPIR-V -> MSL -> Metal" pipeline robust when it come to performance? To me, it seems brittle and hard to reason about all these translation stages. Ditto for "... -> Vulkan -> MoltenVk -> ...".

Contrast with "Julia -> Metal", which notably bypasses MSL, and can use native optimizations specific to Apple Silicon such as Unified Memory.

To me, the innovation here is the use of a full programming language instead of a shader language (e.g. Slang). Rust supports newtype, traits, macros, and so on.
by db48x | 2025-07-26 13:00:56+00:00
> "megaseconds" and "gigaseconds" rather than days/years.

More like weeks and decades. Arranging to meet someone in a megasecond is like meeting them on the weekend; a megasecond is ~11.5 Earth days. A kilosecond is short enough to be used for moment–to–moment planning. They’re about a quarter of an hour each so they’re good for scheduling work tasks, scheduling time to meet people for a meal, etc etc.

Gigaseconds are more rarely used, since each one is ~32 Earth years.

Diaspora by Greg Egan has some fun with this too. The main character is a software emulation; called a citizen rather than a flesher. Most emulations live at a subjective rate 800× faster than the flesher normal. The second chapter is three flesher days after the first but 256 megatau, or ~8 years, have passed for the main characters. The fourth chapter is two thirds of a teratau later, over 20k subjective years. For the fleshers of Earth a mere 21 years have passed. The main character has actually forgotten the events of the third chapter; one of his friends brings it up and he has to search his archived memories to figure out what his friend is talking about.
by huem0n | 2025-07-26 13:01:44+00:00
> it doesn't translate to engineering careers

From one teacher to another, I'm sorry what?

If teaching kids how build things doesn't encourage them to become engineers, what does?

If you're taking about attention grabbing Youtuber-engineers, I think that is very different than the makerspace movement that gives people access to CNC machines/3D printers/welders without a person needing to personally own a CNC machine/3D printer/welder.

All of the greatest engineers I know spent their childhood playing with legos, hot glue, solding irons, and hobby rocket kits.
by LegNeato | 2025-07-26 13:01:47+00:00
Many of us working on Rust + GPUs in various projects have discussed starting a GPU working group to explore some of these questions:

https://gist.github.com/LegNeato/a1fb3e3a9795af05f22920709d9...

Agreed, I don't think we'd ever pull in things like wgpu, but we might create APIs or traits wgpu could use to improve perf/safety/ergonomics/interoperability.
by omnicognate | 2025-07-26 13:02:11+00:00
Right, but that doesn't mean WGSL/WebGPU solves the "problem", which is allowing you to use the same language in the GPU code (i.e. the shaders) as the CPU code. You still have to use separate languages.

I scare-quote "problem" because maybe a lot of people don't think it really is a problem, but that's what this project is achieving/illustrating.

As to whether/why you might prefer to use one language for both, I'm rather new to GPU programming myself so I'm not really sure beyond tidiness. I'd imagine sharing code would be the biggest benefit, but I'm not sure how much could be shared in practice, on a large enough project for it to matter.
by gargan | 2025-07-26 13:02:29+00:00
Isn't the Mac way a good thing though? For example everything on Windows is moving to web apps where I feel they can load just as many trackers onto you eg https://www.theverge.com/news/710509/whatsapp-windows-app-we...

Whereas on Mac, Meta are keeping their native app presumably because they can't be in the Mac app store with just a web wrapper

But maybe I've just got the exact delusion youre talking about in that I view the app as having more functionality. Maybe they need to free web apps to be on a level playing field as you say
by nabla9 | 2025-07-26 13:02:46+00:00
"If you want more taxes and are rich, just donate to treasury argument" again.

We want systemic changes, not patrons.

Taxes are for equity and fairness. Taxes are compulsory, donations are voluntary.

Taxes are payment for being for being rich.

Donations are taxes for being a good person.

Great rant: David Mitchell on Tax Avoidance from The Last Leg https://youtu.be/xc8epam4NyY?t=150

Then Mitchell being more serious: You can't blame the rich for paying as little tax as possible. I do the same https://www.theguardian.com/commentisfree/2010/oct/31/david-...
by samwillis | 2025-07-26 13:02:50+00:00
It's great that the rust community are finding ways to improve the performance of decoding strings from WASM to js, it's one of the major performance holes you hit when using WASM.

The issue comes down to the fact that even if your WASM code can return a utf16 buffer, to use it as a string in JS code the engine needs to make a copy at some point. The TextDecoder api does a first good job of making this efficient, ensuring there is just a single copy, but it's still overhead.

Ideally there should be a way to wrap an array buffer with a "String View", offloading the responsibility of ensuring its utf16 to the WASM code, and there being no copy made. But that brings a ton of complexities as strings need to be immutable in js, but the underlying buffer could still be changed.
by acomjean | 2025-07-26 13:03:47+00:00
I’m add to existing legacy Code. I can’t be judgy most of the time. Sometime I can suss out the first build then the additional features tacked on at later dates which is where things get messy.

I’m at the fourth update and I did a little clean up. I didn’t tear it and start from zero, but I cleaned it up so future me will be happier when the next change comes (and we now know they keep wanting updates to this)

The original way worked and was clean and I just assume that the next updates were done under some time constraints. A lot of code here just keeps working for years with no updates so it made sense to do it faster with less flexibility. Not everything needs to be great when more good enough functionality is more useful.
by adamtaylor_13 | 2025-07-26 13:03:49+00:00
This seems almost uselessly simple to me. The “cognitive overhead” of a list of notes feels trivial considering this is a person who managed to put their words online.

The issue isn’t cognitive overhead, it’s not having rituals to review and refine your thoughts. Everyone has to jot down ideas from time to time, but if you never take time to stop, review, and organize your thoughts then sure it’ll feel like a lot of cognitive overhead.
by Rygian | 2025-07-26 13:04:10+00:00
Interestingly, the author dodged that one:

>A few questions immediately pop into readers' minds on hearing this news. The ones I get most often are,

> Why now? What took you so long?

>which quite frequently combines with

> What changed? Are previous editions now useless?

Which somehow contribute to highlight the inadequacy of the reader for not knowing what PF stands for in the first place.
by haya21_8 | 2025-07-26 13:05:02+00:00
Thanks for asking! Here's how the extended context support works:

Context Management Features:

• Dynamic File Selection - Instead of loading entire files, we intelligently select relevant code sections based on the query

• Automatic Conversation Summarization - When approaching context limits, conversations are automatically summarized to preserve essential information while staying within bounds

• Provider-Specific Optimization - Automatically adjusts to each model's context window: Claude (200K), GPT-4 (128K), Gemini (2M tokens)

• ENFIY.md Memory Files - Hierarchical context files (global, project, component-level) that provide persistent context across sessions

How it works in practice:

# Even with massive codebases

enfiy "find performance issues in this 1000-file React poject"

# → Analyzes only relevant files, dynamically loading what's needed

The system monitors token usage and triggers summarization when approaching 95% of the model's limit. For models like Gemini with 2M context, you can process entire large projects. The key is leveraging each provider's strengths while working within their constraints.

More technical details in our GitHub README!
by eska | 2025-07-26 13:07:07+00:00
So real people without beauty surgery are unrealistic to you, although they exist in reality.

That obviously can’t be it. So I take it what you actually are trying to say is “this shouldn’t be considered the standard”? But it’s not the standard, it’s the top. And people (both men and women) like to play as characters that aren’t standard but at the top.
by hahajk | 2025-07-26 13:08:10+00:00
It doesn't have to be difficult to self-host. Like another commenter said, in a diffe world that could be the default. iCloud gives apps an API to sync. The backend doesn't have to be a data center, it could be a time capsule in your living room. You could connect using a private wireguard lan. The protocol could even be built out to support redundant time capsules in case one failed.

But my parents wouldn't want to pay $500 for the hardware, and companies don't want to give up the monthly fees.