MurphyA/hacker-news huggingface dataset:
Show HN: Nightcrawler – A scanner that finds low-hanging fruit while you work
by thesp0nge | 2025-07-22 07:14:54+00:00
Hi HN,

I wanted to share a project I built in a strange but productive pair-programming "trip" with a large language model. The goal was to create my own automated "First Officer"—a tool that handles the tactical grunt work of finding common vulnerabilities while I focus on the strategic, human-led parts of a security assessment.

The result is Nightcrawler, an open-source CLI proxy and scanner built on Python & mitmproxy.

How it works: You run it and browse a target app through it. While you navigate, Nightcrawler passively finds insecure headers, outdated JS, and JWTs, while its active scanners autonomously test every discovered link and form for XSS, SQLi, Directory Traversal, and more.

The development process felt exactly like Captain Picard directing Commander Riker. I'd give the strategic orders ("We need to detect Stored XSS"), and the LLM would execute the tactical implementation. It was incredibly fast, but also highlighted the current limits of AI—it required constant human oversight to fix the subtle bugs and "hallucinations" it introduced.

The tool is still in beta (pip install nightcrawler-mitm). I'd love to get your feedback, bug reports, or ideas on what to build next.

Thanks for checking it out!
by wizzwizz4 | 2025-07-22 07:15:47+00:00
Unless you wire the two-year-old's brain up to the one-year-old's so the two-year-old can stimulate the one-year-old's motor cortex, I don't see how that experiment would test my theory. (Maybe I explained it badly.)

Adults already show the one-year-old how to walk, encourage the one-year-old to crawl and try to stand, and so on – but the adults aren't teaching the one-year-old how to coordinate muscles. That's all the doing of the one-year-old. Some of it's instinctual (as it is in other mammals), and we have some relevant reflexes once you're actually up and standing (assuming you stay within their domain of efficacy), but overall, walking isn't instinctual for humans.

Consider physiotherapy in adults recovering from a nervous system issue. The physiotherapist has to guide the patient through exercises to rebuild motor coordination ability. (Some adults figure this out on their own, invent and practice their own exercises, and breeze through the physiotherapy, but in general physio is long and boring and arduous, because it's very frustrating and doesn't come naturally.) That's the sort of thing infants do on their own volition (with some encouragement from caregivers), but I don't see how it makes sense to say it's not their volition.
by Muromec | 2025-07-22 07:16:00+00:00
Merchants have to deliver their stuff somewhere and put something in the invoice, so of course. Literally what pay pal was doing since forever too, just more federated and standard-based.

Since it's EU with it's data minimization principles and privacy boner, of course they though about a checkbox to not share the address when not needed and argued about the default behavior in various committees for about half a year at least.
by queenkjuul | 2025-07-22 07:16:52+00:00
Based on my experience with Claude Code so far, my coworkers mostly use it because they think it's fun, or cool, not because it writes great code or saves tons of time, because i can attest it isn't doing those.

I'm not saying it isn't useful, I'm just also seeing lots of crappy output that gets totally rewritten, and useless docs people keep creating for some reason, that is eating all the time they supposedly saved by relying on it in the first place.
by Kon5ole | 2025-07-22 07:17:15+00:00
>Great comparison to use the most delayed neuclear power plant constrution in human history to extrapolate an argument. Really fairly done.

Not as unfair as disregarding my points entirely just because I used the latest reactor built in europe as an example. ;-)

We can use Hinkley point C instead?

When Hinkley point C is completed, estimated 2029 at the earliest, it will have taken 12 years and will produce as much electricity per year as the solar panels installed in Germany last year. And those panels are already producing, now.

Hinkley point C is estimated to cost 44 bn euros by 2029, and it will still cost money after that of course, for maintenance and operations.

If that money had been spent on battery storage for solar instead, the UK might have gotten way more energy at a way lower cost per GWh, and they would have had it _already now_.

When they are in place, battery banks and solar panels have a basically negligible maintenance cost compared to a nuclear plant. Its an investment where you pay upfront and get benefits down the line.

I don't see how nations that wait 10 years for 2-3 GW of nuclear will be competitive in any energy-consuming endeavor against countries that add 40-50GW of solar every year.
by eclecticfrank | 2025-07-22 07:18:07+00:00
This person refers to the German television and radio fee (Rundfunkgebühren).[1] It is a state-mandated system that ensures free (as in free speech) and (relatively) neutral public broadcasting institutions. There is a constant and engaged discussion, because every household in Germany has to pay this fee. Exceptions are made only for low-income households.

[1] https://en.wikipedia.org/wiki/ARD_ZDF_Deutschlandradio_Beitr...
by haiku2077 | 2025-07-22 07:18:37+00:00
I've noticed this also happens in english Whisper models with the phrases:

"[ sub by sk cn2 ]"

or

"Anyways, thanks for watching! Please subscribe and like! Thanks for watching! Bye!"

or

"This is the end of the video. Thank you for watching. If you enjoyed this video, please subscribe to the channel. Thank you."
by decimalenough | 2025-07-22 07:20:28+00:00
Depends very much on the country. Many countries don't care, some like Japan will absolutely refuse to let you drive a car without one.

And it has to be the correct flavor of IDP too, meaning proper 1949 Geneva Convention on proper 1940s cardboard, none of that new-fangled 1969 Vienna Convention nonsense. Oh, your country has signed up to 1969 but not 1949? No car in Japan for you then.
by SV_BubbleTime | 2025-07-22 07:20:52+00:00
There is a LOT of data on Trump/Russia out now. I find it hard to believe anyone informed is still using that. It’s kind of an intellectual red flag my man.

The smarter liberals have moved on to just hating Trump for being himself.

Do the true believers here think that the I formation Gabbard is releasing is fake? We’ve had it for 9 years now about Ohrs and FusionGPS and FBI lying to FISA.
by adrian_b | 2025-07-22 07:20:52+00:00
Most organic pigments have 2 or more absorption bands, but this is not always apparent for humans, because the second band is located in near ultraviolet or in near infrared.

Like I have said, in marine algae you can find a variety of colors, as already seen in their names, e.g. red algae, yellow algae, brown algae. Most of them have strong absorption for green light, due to the auxiliary pigments that they happen to use.

Only the green algae and their descendants, the land plants, do not absorb green light and as a consequence they are competitive with the other algae only in places with abundant light, i.e. in very shallow waters or on dry land, where they can get all the energy that they can use without damage, so they do not need better coverage of the solar spectrum.

The energy of the captured photons does not matter much, because even the red photons have enough energy.

The captured photons are not used for "photosynthesis", which is a misnomer whose origin lies in a time when the mechanism of "photosynthesis" was not known.

In oxygenic phototrophs, a part of the captured energy is used to oxidize some manganese atoms so strongly that they can oxidize the oxygen from water, converting it into free dioxygen. The hydrogen from water is bound into a reduced organic substance (NADPH), which will be used later as a reducing agent (without needing light) to make carbohydrates from carbon dioxide.

The rest of the energy of the captured photons is used to pump ions through the membrane of the chloroplasts. The energy stored in an ion gradient will be used later to power all organic syntheses.

The ionic pumps could work even with infrared photons, as they do in phototrophic bacteria that live under algae, so they have modified chlorophylls whose red absorption band is shifted into infrared, away from the red band that is removed from solar light by the algae sitting above. However, those bacteria cannot split water, the energy of infrared photons is too low for that (splitting water needs around 1.25 eV, while red photons have over 1.5 eV).
by lucyjojo | 2025-07-22 07:21:01+00:00
as long as there are people and HR out there screeching "unprofessional", why take the risk?

writing mails/messages used to take me a long time. now i have a "make it professional" llm window, let it do its magic and edit out the most egregious stuff. it does 80-90% of the job.

that said, sometimes it fails spectacularly, so i just write by hand.

so.. many... hours... saved.
by anon7000 | 2025-07-22 07:21:49+00:00
Seems like if they built it out after fiber was cheaper and more common, they have it good. Meanwhile, to this day, my parents get, at best, 6mbps down from the ancient, shitty copper infra the telco put up ages ago. Thankfully, other options like various 5G home internet products are a common in rural towns now, at least in the Midwest. But wouldn’t beat fiber!
by st_goliath | 2025-07-22 07:22:02+00:00
That's interesting, the few times I tried playing with whisper, I had the impression that YouTube style videos or random cellphone videos was something it did particularly bad with (compared to movies). My guess at the time was that most of the training material might be sub titles and raw screen plays.

The videos I tried to transcribe were also Mandarin Chinese, using whisper-large-v3. Besides the usual complaints that it would phonetically "mishear" things and generate nonsense, it was still surprisingly good, compared to other software I played around with.

That said, it would often invent names for the speakers and prefix their lines, or randomly switch between simplified and traditional Chinese. For the videos I tested, intermittent silence would often result in repeating the last line several times, or occasionally, it would insert direction cues (in English for some reason). I've never seen credits or anything like that.

In one video I transcribed, somebody had a cold and was sniffling. Whisper decided the person was crying (transcribed as "* crying *", a cough was turned into "* door closing *"). It then transcribed the next line as something quite unfriendly. It didn't do that anymore after I cut the sniffling out (but then the output switched back to traditional Chinese again).
by TeMPOraL | 2025-07-22 07:22:31+00:00
Found that user who memorized KnowYourMeme and thinks they're a scholar of culture now.

Or a cheap LLM acting as them, and wired up to KnowYourMeme via MCP? Can't tell these days. Hell, we're one weekend side project away from seeing "on the Internet, no one knows you are a dog" become true in a literal sense.

s/
by SV_BubbleTime | 2025-07-22 07:23:19+00:00
> Most of Trump's outrageous policies are incredibly unpopular, even among his base.

News to me. I read liberal and conservative sites; I think you are dead wrong from what I’ve seen.

The most common comment I see on conservative sites is “I voted for this” “This is what I voted for” or some variation. Everything except the handling of the Epstein information.
by tarikozket | 2025-07-22 07:26:09+00:00
this happens in Turkish too. I believe the reason is that the movie subtitles were used for training without cleaning up the comments / intros subtitle authors leave in them.

leaving personal comments, jokes, reactions, intros in subtitles is very common in eastern cultures.

Turkish readers will probably remember “esekadam iyi seyirler diler” :)
by salviati | 2025-07-22 07:26:24+00:00
I agree 99% with you. I think you're doing the right thing installing Windows in your position.

BUT in my opinion the reason for this is not inherent in Linux or Windows.

It's the myth around them. The myth around windows is that it works. If it didn't, it would not be installed on most PCs on the planet, after all...

The myth around Linux is that it's difficult to use. Only expert people choose it, after all...

If a windows PC has a problem, the fact that it's Windows is last in the list of things to blame. If a Linux PC has a problem, it's he other way round.

...and don't get me started on the myth that Apple computers "just work". Sometimes they don't, just as everything that's not been engineered with NASA style of rigorous testing. And when they don't work, sure as hell you can't fix it yourself.

I've been told from a "Genius" in an Apple store that I should reboot my iPad once a week. I commented the OS was quite bad if it requires that. I'm used to be proud of my server uptime... (I know about kernel security updates, and I'm making a different point, that the kernel should not require you to reboot regularly). The "Genius" talking to me completely failed to understand my point, and insisted I "need to take care of it".

To summarize, I'm 99% with you, but that 1% of my opinion is that we need to dismantle a false myth. One bit at a time. Whenever we can.
by Frieren | 2025-07-22 07:27:48+00:00
> They’re clearly trying to start rationalizing that now, including with AWS where they’re starting to address some of the bloat there and lack of a coherent strategy at scale outside EC2, storage, and a few other core services.

So, now that they have a defacto monopoly they will jack up prices and profit from companies being slow to move out. IBM did the same thing.
by kinj28 | 2025-07-22 07:27:49+00:00
AI is still in an experimental phase for many teams, especially when it comes to handling complex, long-term projects. For PMs and EMs, the cost-benefit analysis of AI credits vs. manual tasks is a big concern before fully committing to AI adoption. Some teams have seen great success, particularly in areas where speed and flexibility are key, but others are still waiting for clearer ROI before diving in. It’ll be interesting to see how the balance of risk and reward evolves as AI tools mature.
by mschuster91 | 2025-07-22 07:28:08+00:00
> Even Apple iphone(tbf, also made in China) double-source important components inside their phone(modem)

Samsung goes a bit further. Depending on where you buy e.g. a S23 FE, you'll get entirely different SoC architectures - the US model ships with Qualcomm Snapdragon, the international model with Samsung Exynos.

[1] https://en.wikipedia.org/wiki/Samsung_Galaxy_S23
by rob74 | 2025-07-22 07:29:19+00:00
Ah, ok, thanks for the info, TIL! "We are funk – the first public service content network that started on October 1, 2016. We create online-only content on social networks and third-party platforms, including YouTube, Instagram, Snapchat, TikTok, Spotify, Apple Music or Twitch for 14-29 year-olds." (https://presse.funk.net/das-ist-funk/, scroll down for the English version). I live in Germany, and I even watch public broadcasters regularly, but this is the first time I have heard about funk (I even initially thought it was misspelled, usually it's written with a capital F). But I'm not part of the targeted audience (not now, nor even back in 2016 when it was launched), so all good...
by genezeta | 2025-07-22 07:29:51+00:00
Nice :)

One small quirk/bug:

1. Browse all ( https://www.cancateat.food/search ). There are 174 results found in "All foods".

2. Go on to page 2.

3. Now click on a smaller category, like Diary. There are 7 results found in that category... but you can't see any.

The problem is the pager remains on page 2 when clicking a category. "Page 2 in Diary" is empty because there aren't enough results to fill a second page. Not only that, but the pager is actually hidden if the number of results is less than one page. So you get "7 results" but you can't see them and you can't page back down.

I'd guess you need to reset page back to 1 whenever you click a category.
by ZenoArrow | 2025-07-22 07:30:33+00:00
> 75%

You already admitted that I only said most, which this qualifies as.

> I literally did the math...

You did, and I'm saying that the transistor per mm2 information is a better metric to track semiconductor manufacturing node improvements than just using transistor counts.

It's really not that hard to understand what I'm saying when you take my comments at face value.
by Elucalidavah | 2025-07-22 07:30:43+00:00
> dependencies = ["httpx"]

I heavily recommend writing a known working version in there, i.e. `"httpx~=0.27.2"`, which, in the best case, would allow fixes and security patches (e.g. when httpx 0.27.3 releases), and, in the worst case, would let you change to `~=` to `==` in case httpx manages to break the backwards compatibility with a patch release.

And, of course, always use `if __name__ == "__main__":`, so that you can e.g. run an import check and doctests and stuff in it.
by fch42 | 2025-07-22 07:31:36+00:00
"secrets in env vars" (or program arguments) always triggers squeamy smirks off me.

It's a bullsh*t rule. One that would work is a clear mandate, "if you're found to use env vars / args for secrets, you must demonstrate within four weeks of finding that you have implemented code to clear your process' args/env vars immediately after program startup, for the lifetime of the process (and that you moved all secrets to non-cleartext memory)". Given how frameworky-frameworky much modern software is, such action items make folks think ("how on earth do I get state to openssl&Co without env vars", ...).

But alas, the regulations people shy away from any such precise prescriptions - because then, they have to involve themselves with SRE, SOC, CI/CD, and developers for monitoring, enforcement and training/assistance.

So instead, as you say, byzantine Reuben-Goldberg constructs are created exploiting "every loophole in the book" to comply with the rule but not the spirit; software becomes even more of a performance art.

I think, over time, I have moved into the camp that strongly believes all practical security is security-from-obscurity. Starting with the compliance rules around it.
by Kon5ole | 2025-07-22 07:31:43+00:00
Short term for self-reliance Finland can use natural gas (won't need much), wind and hydro. Since they are a nation with many friends they can also buy electricity from neighbors.

To solve the variable production from solar and wind, most nations should probably have a safety valve in the form of synthesized fuels. Meaning that during summer when energy is abundant and has to be dumped at negative prices, we use the surplus to synthesize fuels instead.

Synthesizing fuel is inefficient, but since you use surplus energy that doesn't matter.

These are options that are viable right now, but there are also promising developments in batteries that could make them viable for season storage too.
by stouset | 2025-07-22 07:31:45+00:00
The staging area is a hack in that it is its own unique concept that doesn't work with any of the rest of git's tooling without needing special, inconsistent flags for commands to target it (git stash, git reset, etc.).

I use a staging area with jj! I would surmise most jj users do too. It's just a real, honest-to-god commit in the repo instead of a special snowflake.

# do some work … # prepare a new, empty commit if you don't already have one jj new --no-edit --insert-before @ # move changes into it; repeat ad nauseam jj squash --interactive

Since it's just a commit, all your tools work with it out of the box. And you don't need to stash changes when you jump around between branches.
by jdiff | 2025-07-22 07:33:55+00:00
That's the magic of money. Download your favorite artist's discography for personal use? If the MPAA had its way (and it occasionally has), torrenting that could bankrupt you.

The AI industry - soaking up every bit of media available online for commercial purposes, often reproducing it nearly identically - has enough money and capital to influence things its way. And only its way, in case anyone was hoping this might change anything at all for the little guy.
by ryanjshaw | 2025-07-22 07:34:06+00:00
This is SharePoint on-premise, so Google Workspace isn’t a good comparison?

Also, even if we do look at cloud: Workspace isn’t bad (exception: sheets vs Excel), but SharePoint is the center of Teams, Power Platform, PowerBI… to replace M365 with Workspace means a lot of research, setup and testing of 3rd party alternatives to the above.

If you’ve ever worked in a well configured Microsoft stack, nothing beats the integration.

There’s no reason to believe Workspace would be more secure if it had the same feature set/integration configured.
by JumpCrisscross | 2025-07-22 07:34:13+00:00
> but the CIA is quite out of line, quite a lot of times

More than other intelligence agencies? Extant or historical?

Intelligence is messy. Here. And among our enemies. We have to contain that messiness domestically, to keep it from consuming us. In that way, it's analogous to our immune system. And just like our immune system, turning it off means all the other out-of-line elements around the world now have easy pickings over you.

The CIA has been more destructive than other modern agencies because it's far reaching. It's not more evil than other ICs. Just more capable. I'm not thrilled to learn who occupies that vacuum if the CIA goes away; almost by definition, it won't be anyone benevolent.
by arp242 | 2025-07-22 07:34:40+00:00
I don't choose anything; I just use the xterm defaults. Some colours inherently conflict. Blue on white is fine. Yellow on black is fine. Yellow on white is not. White on white is even worse. There are many combinations that don't really work brilliantly. Some applications set background colours, some don't. pamix, ngrok, and npm are examples of applications that hard-code background colours. Configuring the terminal to use text colours that work well with both the default white and hard-coded black (for some applications) is hard.

That I need to spend a bunch of time setting all of this up (among other things) is exactly how this thread started.