MurphyA/hacker-news huggingface dataset:
Show HN: AnthroShield – AI Human Verification Without Captcha or ID
by OneWithTech | 2025-07-28 16:08:26+00:00
Hey HN,

I built AnthroShield to verify that users are human — without relying on CAPTCHA, ID uploads, or annoying email loops. It’s real-time, frictionless, and works anywhere with a webcam.

The tech runs at the edge using Cloudflare Workers, React/TS, and encrypted facial capture. Designed for login flows, checkouts, admin panels—anywhere human presence matters.

I come from a background in physical security (access control, alarms, surveillance) and shifted into AI to solve digital problems with the same mindset: don’t trust — verify.

Live demo: [https://demo.AnthroShield.com](https://demo.AnthroShield.com)

UN: ASFaceVerifyDemo PW: .fAcE!420@ASai

Would love your thoughts on the flow, use cases, or what you'd want in a system like this.
by jabroni_salad | 2025-07-28 16:08:41+00:00
It is also doing a lot with DNS and device management via group policy and is one of the only 'it just works' high-availability services I've ever used. Making a new node is usually as easy as doing a dcpromo and logging out.

You can replicate a lot of it in *nix but I've never seen anything as cohesive as a windows domain controller.

I think the only windows services I 100% would give a thumbs down to is websites (I do not like IIS) and print management.
by wang_li | 2025-07-28 16:09:44+00:00
There is a naive approach to making this kind of thing that reduces the component images to such a small size (2-3 pixels in large image) that turns this into more of a dithering exercise than looking for artifacts in each component image to match up lines. It's still a nice effect, but it's quite different when the component images are > 10% the size of the final image, instead of < 1% the size.
by haniehz | 2025-07-28 16:10:47+00:00
I didn’t build this to beat the market...it started as a way to reduce my own decision fatigue and make sure I wasn’t missing obvious signals. That said, it’s more of a research agent than a trading bot. For ROI, it’s not auto-trading, but it has helped me avoid a few bad calls and made my reports more consistent and thorough.
by mijoharas | 2025-07-28 16:10:52+00:00
It's not a "religion" to have people disagree with you on philosophical points.

In addition, I'd say most of this thread is a bunch of people debating what issues there are with the NHS (I don't see anyone claiming there aren't any) with some people for it, and some against it.

A fair few people believe that it is the duty of the state to care for individuals, and that one right that people have is free access to healthcare.

If someone expresses that viewpoint I don't think it's fair to say that they're being religious or dogmatic about it, just like it wouldn't be fair for people to argue that your view (which I assume is for a more privatised healthcare system) is religious or dogmatic, it's a simple disagreement.
by WorldMaker | 2025-07-28 16:10:52+00:00
There's also that the Royal Society [0] sponsored some of Newton's work (and Newton was even President of it for a time). That was a group also chartered by the British government (and some centuries financed by it more than other centuries).

(Leibniz had a more complex web of patrons over the course of the decades, including parts of German and French governments and even briefly being a Royal Society fellow. Some of Leibniz's patrons did include private [rich] donors, but it is said that Leibniz was the last scientist/mathematician to find patronage in that way/the last time in history that private donors had shown much interest in direct science/math patronage.)

[0] https://en.wikipedia.org/wiki/Royal_Society
by mystraline | 2025-07-28 16:10:53+00:00
A city nearby here in America also does something similar.

After 10:30pm through 6am, the main road's lights go blinking yellow, and the side road's lights to blinking red.

Its basically easy to get around, since most lights are now a yield or stop. No app goofiness or any of that. And it has been implementable for decades.
by gruturo | 2025-07-28 16:11:12+00:00
> some games and apps will stop supporting ipv4 on the basis that nat traversal is a pain and dual stack networking is a pain

None of these are actually the game/app developers' problem. The OS takes care of them for you (you may need code for e2e connectivity when both are behind a NAT, but STUN/TURN/whatever we do nowadays is trivial to implement).
by dsr_ | 2025-07-28 16:11:30+00:00
Way back when, the president of the company had a habit of sending out email on a Monday to schedule a company-wide meeting for Tuesday. These were weeks to months apart from each other.

Every single time, I wondered if it would be routine, or an acquisition, or a bankruptcy...

One day I mentioned my anxiety to him. He immediately apologized, and from then on, the company-wide meetings had agendas. Eventually that stopped -- when we started doing regular company-wide meetings with a standing agenda.

Sometimes everyone needs to communicate better. Without bug reports, what are you going to fix?
by pron | 2025-07-28 16:11:38+00:00
While there is a proof assistant for checking TLA+ proofs and a couple of model checkers for subsets of TLA+, TLA+ itself is no more and no less than a formal language for expressing mathematical formulas that describe dynamical systems.

There is no notion of code, program, or execution in TLA+ any more than the formula y(t) = y0 + v0t - 0.5gt^2 has the notion of a ball, a vacuum, or of Earth. When the author talks about "sets of behaviours" (really, classes of behaviours, but that's getting too technical) it is precisely in the same sense that the formula `x > 3` denotes the set of all integers > 3 in a logic over the integers.

What's interesting about TLA+ (or, really, about TLA, the temporal logic at the core of TLA+) is how change over time is represented. Rather than with an explicit time variable, TLA intrinsically represents the evolution of the values of variables over time in a way that makes abstraction-refinement relations (the relation between more and less detailed descriptions of a dynamical system) particularly easy to express.

Dijkstra's pre/post conditions can be expressed in TLA+ just as anything that could be stated precisely could be expressed in any sufficiently rich mathematical language.

We can choose to interpret some TLA+ formulas as "programs" just as we can choose to interpret some formulas as describing the motion of a baseball in a vacuum, but TLA+ allows us to express things that are more abstract than programs, which can be very useful (e.g. no program can express the Quicksort algorithm in its full generality, as that algorithm is too abstract to be a program, but it is nevertheless very useful to show that a particular program is a particular implementation of that algorithm).
by mattmanser | 2025-07-28 16:11:54+00:00
The Poles we've historically had a great relationship with and there was already a huge ex-pat community of Poles here from WW2.

It was more the later additions to the EU a few years later that were actually problematic and got people's backs up.

It didn't help that we were allowed to restrict immigration from those countries but didn't as the government needed mass immigration to disguise the fact there was no growth.
by tobyjsullivan | 2025-07-28 16:11:54+00:00
It depends on your usage patterns, presumably.

In my case, I ended up accruing $100/day w/ Claude Code (on github workflows) so Max x20 was an easy decision.

Pro seems targeted at a very different use case. Personally, I’ve never used the chat enough to break even. But someone who uses it several times per day might.

ETA: I get that the benefits transfer between the two, just with different limits. I still think it’s pretty clear which kind of usage each plan is intended for.
by mytailorisrich | 2025-07-28 16:12:08+00:00
> Objectively, they are.

Subjectively (and subjectively anything can be anything so...), but not objectively because, as said, there is nothing "far right" in their manifesto. Again, being anti mass migration and eurosceptic does not make a party far right.

> by refusing to even discuss reducing government aids...

I would argue that their refusal to really cut government spending in general makes them more left-leaning... So perhaps they are indeed centrists overall, then?

> It's funny, because the minister of the interior has been very strongly anti-immigration for quite some time now

Ah yes the nominally LR guy who's serving in Macron's government and who has objectively not done anything in practice (well he has no power to and has been in the job for less than a year...) although he is good at talking tough but that 'talk' is in fact mostly calling for existing laws to be enforced...

And so we get back on my previous claim that the narrative has been so skewed against any action on issues like immigration that he is described as "hardline"

> And it's always funny how the people most voting for RN ... where there are few migrants"

That's clearly not true since even the days of the FN. There are post-industrial areas that used to vote communist and switched to RN and there are areas with immigrants, historically the South East for instance. Now it is widespread, anyway: for instance in the 2024 general elections they came in first in the first round in 297 out of 577 (basically half) constituencies.

It's odd to see this refusal to face reality and to keep denying that immigration is an issue throughout Europe.
by lucasoshiro | 2025-07-28 16:12:13+00:00
There are many approaches. For example, constructive solid geometry, where you use boolean operations on simple 3D shapes to create a more complex object. Another one is the extrusion of 2D shapes, which adds volume to 2D shapes.

My main tool is OpenSCAD, as I am a programmer and I model for 3D printing, which support both CSG and extrusion, but not the mesh manipulation like Blender.

One paradigm is not better than the other. Blender is nice for modelling, for example, characters, but it's really painful for doing precise shapes. For modelling multi-part action figures for 3D printing you'll need both things, sometimes modelling something in a tool and finishing it in other
by ViewTrick1002 | 2025-07-28 16:12:15+00:00
What do you optimize for?

Person on scene?

Time to hospital for patient?

Time to arrival of a fully equipped ambulance to deal with emergencies?

Risk and time from dealing with a complex handover of the patient from fire truck crew care to ambulance care?

For me it seems like in the vast majority of cases optimizing for getting a fire truck on scene fast is the wrong solution. Waiting a few extra minutes for the ambulance would improve outcomes.

And it is of course possible to differentiate on calls.

A life or death situation like a cardiac arrest or someone bleeding out would select from all available units. Including the fire department, ambulances and police. But those are a tiny sliver of 911 calls.
by eddythompson80 | 2025-07-28 16:12:32+00:00
> As someone totally uninformed, are you saying that all those YouTube ads about e.g. Private Internet Access (et al), which specifically cite getting around geo restrictions in the ad copy, are BS?

Yep, they are all lying to you, but with a wiggle room for a workaround or to point the blame at Netflix. Once you get in, you'll notice that Netflix, Prime Video, Steam, some of YouTube, and pretty much any legitimate service with geo-fencing not working. You then email support complaining that this is not working for you. The answer varies depending on the company. For example:

- Private Internet Access will try to up sell you for your own static IP. That hopefully remains undiscovered by Netflix et al for a bit. (Obviously you're trading anonymity and privacy aspects of a VPN if it's a static ip attached to you, but I don't think people trying to stream Netflix from Italy or where ever care about that)

- Mullvad will tell you: yeah that doesn't work. We never advertised that. Don't renew next month.

- Proton will keep asking you to try endpoints manually (each country has hundreds of endpoints and their app picks a random one. Just keep trying different ones manually. They might give your account access to some "new endpoints" (if they have them) that are not blocked yet. Hopefully once the refund period has passed, they will tell you "sorry we're having trouble with Netflix currently. we're working on it"

Some of them will suggest using "another streaming service??" because "Netflix is having issues in [INSERT_COUNTRY]"
by fsflover | 2025-07-28 16:12:46+00:00
Librem 5 is my daily driver, buy I'll just give links to good, extensive reviews:

https://forums.puri.sm/t/nine-months-librem-5-as-my-only-pho...

https://forums.puri.sm/t/a-l5-review-1-week-to-my-ready-to-s...
by yieldcrv | 2025-07-28 16:12:54+00:00
I think it fits because it is substantive and has capability of providing introspection

The article and study doesn't address its disposable nature of the elk in favor of "look at the trees"

When there are animals suffering, which to most actual people is a matter to highlight. This entire discussion about wolves in Yellowstone has always contorted itself to spare the reader's thoughts on the gruesome reality of what's actually happening.
Show HN: TrackJ – Track your job applications via web, Chrome extension and App
by Andrea11 | 2025-07-28 16:13:00+00:00
Hi HN! I built TrackJ – a cross-platform tool to help you track, organize, and analyze your job applications. What is TrackJ? TrackJ is a job application tracker made of: • A web app where you can manage and analyze all your job applications • A Chrome extension that detects job offers on major job boards and lets you save them in one click • A mobile app (coming soon) to complete the on-the-go experience and quickly choose which work application best suits your profile. Why did I build this? I made it for myself, frustrated with spreadsheets and scattered notes while applying for jobs. It started as a small script but grew into something I now use daily. What I find most helpful: • being able to save applications with one click directly from the job site, • seeing time gaps between interviews or applications, • understanding what kinds of jobs I have the most success with, • keeping everything in sync across devices. What makes it different? TrackJ is intentionally simple. It focuses only on helping you track your job applications, without overwhelming you with dozens of fields, resume scores, or AI suggestions. It’s just a clean, minimal tracker that works across web, browser, and soon mobile—so you can stay organized without extra noise.

Can I try it? Yes! The website is public and you can browse it without signing up. If you want to save applications or sync across devices, you can register with email or Google.

If you have any questions, please comment below or contact me at support@track-j.com.
by NitpickLawyer | 2025-07-28 16:13:33+00:00
> It's a naive and dangerous view that the defense efforts are only as strong as the weakest link.

Well, to be fair, you added some words that are not there in the post

> The output of a blue team is only as strong as its weakest link: a security system that consists of a strong component and a weak component [...] will be insecure (and in fact worse, because the strong component may convey a false sense of security).

You added "defense efforts". But that doesn't invalidate the claim in the article, in fact it builds upon it.

What Terence is saying is true, factually correct. It's a golden rule in security. That is why your "efforts" should focus on overlaying different methods, strategies and measures. You build layers upon layers, so that if one weak link gets broken there are other things in place to detect, limit and fix the damage. But it's still true that often the weakest link will be an "in".

Take the recent example of cognizant desk people resetting passwords for their clients without any check whatsoever. The clients had "proper security", with VPNs and 2FA, and so on. But the recovery mechanism was outsourced to a helpdesk that turned out to be the weakest link. The attackers (allegedly) simply called, asked for credentials, and got them. That was the weakest link, and that got broken. According to their complaint, the attackers then gained access to internal systems, and managed to gather enough data to call the helpdesk again and reset the 2FA for an "IT security" account (different than the first one). And that worked as well. They say they detected the attackers in 3 hours and terminated their access, but that's "detection, mitigation" not "prevention". The attackers were already in, rummaging through their systems.

The fact that they had VPNs and 2FA gave them "a false sense of security", while their weakest link was "account recovery". (Terence is right). The fact that they had more internal layers, that detected the 2nd account access and removed it after ~3 hours is what you are saying (and you're right) that defense in depth also works.

So both are right.

In recent years the infosec world has moved from selling "prevention" to promoting "mitigation". Because it became apparent that there are some things you simply can't prevent. You then focus on mitigating the risk, limiting the surfaces, lowering trust wherever you can, treating everything as ephemeral, and so on.
by manmal | 2025-07-28 16:14:20+00:00
> Tests are the source of truth more so than your code

Tests poke and prod with a stick at the SUT, and the SUT's behaviour is observed. The truth lives in the code, the documentation, and, unfortunately, in the heads of the dev team. I think this distinction is quite important, because this question:

> Do we have a bug? Or do we have a bad test?

cannot be answered by looking at the test + the implementation. The spec or people have to be consulted when in doubt.
by sirwhinesalot | 2025-07-28 16:14:22+00:00
Don't compute first and follow sets. Just branch on the current token. It is trivially unambiguous since 1 token = 1 branch. Expressions can be dealt with using precedence climbing / pratt, which still just amounts to branching on the current token after the "lhs" has been computed.

If the language doesn't fit this LL1 + operator precedence mold then I would not use a recursive descent parser.
by rompic | 2025-07-28 16:14:39+00:00
My best was 5000:1 by updating the outdated SQLite in one of the companies' products.

I found that we were hit by a bug that was fixed 6 years before I discovered it (https://sqlite.org/src/info/6f2222d550f5b0ee7ed). Sqlite's query planner assumed that a field with a not null constraint can never be null, which isn't the case for the right hand table in a left join.
by johnisgood | 2025-07-28 16:15:54+00:00
Yes, my parents pick up my medications because I have mobility issues.

But on the other hand, my grandma MUST talk on the phone (even if my mother is there) if we want to talk to the ISP's customer service. Then my grandma has to tell customer service that she is giving permission to my mother. Sure. What if something happens to my grandma? Pharmacies are too lax, ISPs are too strict. Certainly there should be a middle path, similarly to how post offices do it.
by graemep | 2025-07-28 16:16:26+00:00
That has changed in recent years. Now greater than in France in absolute spend per capita, would need a 7.5% increase to match in terms of GDP. It would still require a 15% increase to match Germany in absolute per capita, but only 8.5% in percentage of GDP.

https://data.worldbank.org/indicator/SH.XPD.CHEX.PC.CD?locat... https://data.worldbank.org/indicator/SH.XPD.CHEX.GD.ZS?end=2...
by ellenhp | 2025-07-28 16:17:37+00:00
Sibling commenter covered most of what I have to say but the other reason this is wrong is because many bicycles can go 20-30mph, and I'm just going to leapfrog you anyway at the red light you're racing me to wait at.

Other times cars try to kill me to save themselves a few seconds:

1. turning right into a parking lot ahead of me

2. turning right out of the parking lot ahead of me

3. rushing to open their driver's side door right in front of me so they can get out and get to their destination faster

I've had a crash for #1 and #3, so this isn't theoretical. Watch for bicycles.
by _jab | 2025-07-28 16:17:39+00:00
There’s a lot of ideation for coding HUDs in the comments, but ironically I think the core feature of most coding copilots is already best described as a HUD: tab completion.

And interestingly, that is indeed the feature I find most compelling from Cursor. I particularly love when I’m doing a small refactor, like changing a naming convention for a few variables, and after I make the first edit manually Cursor will jump in with tab suggestions for the rest.

To me, that fully encapsulates the definition of a HUD. It’s a delightful experience, and it’s also why I think anyone who pushes the exclusively-copilot oriented Claude Code as a superior replacement is just wrong.
by FirmwareBurner | 2025-07-28 16:17:42+00:00
Nothing I said is imaginary. That's like saying Hitler's rise to power was imaginary or that the Holocaust was imaginary. If it were imaginary they won't be spending so much effort on censorship.

It's the classic subversion and propaganda stages of denial, the deeper you dive:

Stage 1: It's not happening, you're just imagining it Stage 2: OK, it's happening but only a little bit no need to exaggerate Stage 3: OK it's happening a lot but here's why it's a good thing that it's happening
by tzs | 2025-07-28 16:17:46+00:00
If we are assuming terrorists that can get real time access to government servers, we should assume they will access the servers used by the dispatchers and so can find out when an emergency vehicle leaves and where its destination is.

That is probably more useful for planning an attack on emergency vehicles.

Although why even bother with servers? Just call in a fake emergency (or cause a real emergency) at a place of your choosing, and the government will send emergency vehicles to you.
by simianwords | 2025-07-28 16:17:48+00:00
After having thought a long bit about why I find LLM's useful despite the high error rate: it is because of my ability to verify a certain result is high enough (my internal verifier model) and the generator model which is the LLM is also accurate enough. This is the same concept as red and blue team.

Its the same reason I find asking opinions from many people useful - I take every answer and try to fit it into my world model and see what sticks. The point that many miss is that each individual's verifier model is actually accurate enough so that external generator models may afford to have high error rates.

I have not yet completely explored how the internal "fitting" mechanism works but to give an example: I read many anecdotes from Reddit, fully knowing that many are astroturfed, some flat out wrong. But I still have tricks to identify what can be accurate, which I probably do subconsciously.

In reality: answers don't exist in a randomly uniform space. "Truth" always has some structure and it is this structure (that we all individually understand a small part of) that helps us tune our verifier model.

It is useful to think of how LLM's would work with varying levels of accuracy. For example, generating gibberish to GPT O3 to ground truth. Gibberish is so inaccurate that even extremely high levels of accuracy of our internal verifier model may not allow it to be useful. But O3 is high enough that combined with my internal verifier model it is generally useful.
by _alternator_ | 2025-07-28 16:17:52+00:00
Yup. I do read and review the tests generated by LLMs. Often the LLM tests will just be more comprehensive than my initial test, and hit edge cases that I didn’t think of (or which are tedious). For example, I’ll write a happy path test case for an API, and a single “bad path” where all of the inputs are bad. The LLM will often generate a bunch of “bad path” cases where only one field has an error. These are great red team tests, and occasionally catch serious bugs.