MurphyA/hacker-news huggingface dataset:
Show HN: Lateral Thinking Puzzles – AI host that only answers Yes/No/Unknown
by galaxy2roaming | 2025-08-26 13:35:14+00:00
I built a web app that turns “lateral thinking puzzles” into a playable, always-on experience. The AI acts as the host and only replies with Yes / No / Unknown—no hints or spoilers—so players reconstruct the backstory by asking binary questions.

What’s different • Host is strictly constrained to Yes/No/Unknown to keep the reasoning with the player. • 500+ curated puzzles across mystery/logic/psych/absurd categories; growing set. • Multilingual (English/Chinese to start). • Solo-friendly but also works for shared-screen or group play.

How it works • You read a short prompt (missing key info by design). • You ask questions; the host answers Yes/No/Unknown only. • You stop when you can state the full backstory. • Example starter (no spoiler): “A man orders turtle soup. After one sip, he pays, goes home, and shoots himself. Why?”

Tech notes • Next.js 15 (App Router), TypeScript, Tailwind, shadcn/ui. • State via Zustand; data via Drizzle ORM. • Prompting + guardrails to enforce the Yes/No/Unknown boundary and avoid accidental reveals. • Hosted on Vercel; anonymous play works—optional sign-in only to save progress.

What I’d love feedback on • Cases where the host leaks too much or answers inconsistently. • Puzzle quality: which ones feel fair vs. too obscure; which categories you want more of. • Mobile UX/latency reports. • Ideas for a “race mode” (fewest questions/least time) without making it feel grindy.

Roadmap • Race mode and public leaderboards. • Creator submission/review pipeline for new puzzles. • Better reasoning trace (question path visualization).

Happy to answer questions and share details about the constraint setup and evaluation harness.
by ulrikrasmussen | 2025-08-26 13:35:40+00:00
Thats ... false. Every bank I have used in Denmark allows me to log in and do all operations without an app. They require authentication and authorization using the national digital identity (MitID) which comes as an app, but also as a TOTP token and a FIDO (or similar) chip. No apps needed.

I guess the smartcard reader is equivalent. But my point is that locking down the OS of the phone is sufficient to establish client trust but not necessary. You should always be allowed to run the app without strong Play Integrity verification but then just be required to scan your hardware token with NFC in every authentication and authorization flow.
by ameliaquining | 2025-08-26 13:35:45+00:00
For convenience, here are the quotes that most directly answer the above question:

"Effective December 15, 2026, the CA MUST implement Multi-Perspective Issuance Corroboration using at least five (5) remote Network Perspectives. The CA MUST ensure that [...] the remote Network Perspectives that corroborate the Primary Network Perspective fall within the service regions of at least two (2) distinct Regional Internet Registries."

"Network Perspectives are considered distinct when the straight-line distance between them is at least 500 km."
by slipperydippery | 2025-08-26 13:35:53+00:00
> However, our current insurance industry based system (colloquially known as the ACA or Obamacare) has caused "health care" to pivot away from providing medical treatment to individual patients, and toward a system of "health care" companies charging insurance companies for services provided to a 3rd party (the patient).

I have never encountered the notion that the ACA is the cause of this, and I was around before the ACA and don't see how that part wasn't the same before it, except other things were worse (the whole "pre-existing conditions" thing, for one). What do you mean?
by blandflakes | 2025-08-26 13:35:57+00:00
My job has been making a tactical retreat from Scala, and it's really fascinating to look to alternatives like F# and see that they're even less "successful", from an adoption point of view. I'm surprised at how little success even marginally higher-level languages than C# or Java are having.

As you say though, really we've seen a shift in a direction I didn't expect as much, more toward languages that aren't bringing a virtual machine. Even the dialog at work talks about elastic computing where the JVM is less of a dominant player than something that uses fewer resources and starts fast.

Go has really become the poster child for a lot of this momentum in my circles... intentionally not an elaborate language, good ecosystem, good runtime characteristics. I personally don't really want to be moving to Go, but the gulf between status quo and "moves the needle" languages has grown, not shrunk, these last few years, it feels.
by kephasp | 2025-08-26 13:36:04+00:00
One typical way to resolve this is to use Voluntary Oblivious Compliance (VOC). In this capability-based pattern, every storage service could provide an opaque handler to a user that represents their authorization and it can be used to restrict on which documents indexing is done.

http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Compu...

http://www.skyhunter.com/marcs/ewalnut.html#proofOfPurchase

If the opaque handle is part of the Membrane pattern, you can even avoid most race conditions, because even during the indexing, the capabilities can be used to access documents and that removes the possibility of a TOCTOU race.

http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Compu...
by rollcat | 2025-08-26 13:36:14+00:00
Apple: m68k -> PowerPC (32), OS 9 -> OS X, PowerPC (32, 64) -> x86 (32, 64) -> Arm. They've dragged giants like Adobe (kicking and screaming) thru most stages.

Windows NT has always been portable, but didn't provide any serious compat with Windows 4.x until 5.0. At that time, AMD released their 64-bit extension to x86. Intel wanted to build their own, Microsoft went "haha no". By that time they've been dictating the CPU architecture.

I guess at that point there was very little reason to switch. Intel's Core happened; Apple even went to Intel to ask for a CPU for what would become the iPhone - but Intel wasn't interested.

Perhaps I'm oversimplifying, but I think it's complacency. Apple remained agile.
by linsomniac | 2025-08-26 13:36:18+00:00
We make extensive use of self-signed certificates internally on our infrastructure, and we used to manually manage year-long certs. A few months ago I built "LessEncrypt", which is a dead simple ACME-inspired system for handing out certs without requiring hijacking the HTTP port or doing DNS updates. Been running it on ~200 hosts for a few months now and it's been fantastic to have the certs manage themselves.

https://github.com/linsomniac/lessencrypt

I've toyed with the idea of adding the ability for the server component to request certs from LetsEncrypt via DNS validation. Acting as a clearing house so that individual internal hosts don't need a DNS secret to get certs. However, we also put IP addresses and localhost on our internal certs, so we'd ahve to stop doing that to be able to get them from LetsEncrypt.
Show HN: WP-Next – WordPress Admin Rebuilt with Next.js (No PHP Required)
by rnaga | 2025-08-26 13:36:20+00:00
I’ve been working on WP-Next, an alternative to WordPress Admin built in TypeScript with Next.js. Instead of PHP, it uses WP-Node for type-safe queries and hooks. Features include posts, pages, media, comments, revisions, multisite, and a NextAuth.js login system. It’s designed for devs who like WordPress’ data model but want a modern React/Next.js stack. https://github.com/rnaga/wp-next
by giancarlostoro | 2025-08-26 13:36:29+00:00
Yeah, I'm disappointed in their efforts. I do like the Kindle tablet for my preschooler because its cheap and gets the job done, though we limit her screen time.

I'm just name dropping from the perspective of a big org that could fund such a thing correctly, but they would need to start over IMHO.

I'm not sure of another big player who could invest billions into such an endeavour.
by atoav | 2025-08-26 13:36:35+00:00
Sure, FYI I am teaching Germany. Not exactly known to be a country of rule breakers, in fact more like the opposite. But rules that you don't know are easy to break.

E.g. beginners with electrical wiring may or may not know what is up to code and what isn't and thus violate said code without knowing it.

To know when certain rules can be bent or broken usually requires a deep understanding for why the rules exist and what they are meant to prevent. Beginners do not have that knowledge and thus I'd hessitate to give any general advice to skip rules to them, unless it is extremely specific and tied to one specific situation.

Usually the more useful advice to beginners is when to ignore conventions and how everybody is doing it and when to just use the boring stuff.
by mike_hearn | 2025-08-26 13:36:49+00:00
RA schemes don't lock down the whole software stack, just the parts that are needed to allow the server to reason about the behavior of the client. You can still install whatever apps you want, and those apps can do a lot of customization e.g. replace the homescreen, as indeed Android allows today.

You need to attest at least the kernel, firmware, graphics/input drivers, window management system etc because otherwise actions you think are being taken by the user might be issued by malware. You have to know that the app's onPayClicked() event handler is running because the human owner genuinely clicked it (or an app they authorized to automate for them like an a11y app). To get that assurance requires the OS to enforce app communication and isolation via secure boundaries.
by short_sells_poo | 2025-08-26 13:37:04+00:00
In a perfect world, nobody would be forced to wear a seatbelt and yet everyone would eagerly wear one.

I'd also much rather live in a world where everyone does the right thing, there's no greed, stupidity and short-sightedness. Unfortunately I have to make do with our current one. The fact is that a lot of people are stupid. Even very clever people often act irrationally and against their own interests. In the end, we have to strike a balance between personal freedom and the need to protect people from themselves.

Let's look at the case of mandatory seatbelts, and entertain your proposition that people don't need to be protected from themselves. What will happen?

Well, quite a few things are basically inevitable:

1. The issue will be politicized and there'll be hardliners who refuse to wear seatbelts. There are people who are vehemently against wearing full face helmets while riding motorbikes, even though the injuries from faceplanting into the road at speed are truly ghastly. 2. Once the number of people not wearing seatbelts goes up, a whole slew of interesting negative externalities pop up (and you seem to be gleefully ignoring these): 2.a) Simple fender benders will suddenly result in severe and fatal injuries instead of scuffs and bruises. 2.b) Insurance costs increase to cover the higher likelihood of injuries. 2.c) Fewer people can afford insurance. 2.d) Society has to bear the burden of treating and supporting people who get maimed and need lifelong care.

So what is your proposal to do here? What would you do with a person who didn't wear a seatbelt and got severely brain damaged due to this? Just abandon them to die? It was their choice after all. Who should bear the burden of treating these people? Do we now have tailor made insurance for those who don't wear seatbelts? What if these people will simply opt out of insurance?

At the end of the day, a society has to make a few pragmatic tradeoffs and limit certain freedoms as the cost is just not worth it.
by jerf | 2025-08-26 13:37:05+00:00
I think reading philosophical arguments masquerading as novels, or any sort of fiction, is an intellectual trap in general. Anything can be made to work in a fictional work simply by saying that it works. It means nothing.

"Genghis Khan the 73rd, who got high on some really weird drugs in the fifth year of his reign, decided that everybody in his empire should be tortured for at least 73 minutes every day. And everybody loved it and completely voluntarily sang his praises and said it was the best thing that ever happened to society and there were just all sorts of benefits and you should totally organize your society this way too because look how well it is working for this one."
by Cthulhu_ | 2025-08-26 13:37:27+00:00
> a contractual relationship with a foreign (unless you are in the US) third party that decides what you can or cannot do with it.

I see where you're coming from, but companies like Google have local legal representation (e.g. in Ireland for the EU), and have to operate under EU rules if they want to do business here (just like how a EU business has to operate under US rules). If the EU says that you should be allowed to do your own thing - and they have - then Google can either comply or leave.

Don't attribute more power to companies than they have - they want you to believe they can get away with this, but don't echo their rhetoric.
by compumike | 2025-08-26 13:37:28+00:00
It's strange: SSL certificates (and maybe domain name registrations?) are one of the only "ticking time bomb" elements present in every modern web stack, whether a static site or not. By "ticking time bomb" I mean that there's a hard date N weeks/months from now where your site will definitely stop working, unless some external pile of dependencies work smoothly to extend that date.

Software didn't have that sort of "ticking time bomb" element before, I think?

I think I understand why it's necessary: we have a single, globally shared public namespace of domain names, which we accept will turn over their ownership over the long run, just like real estate changes hands. So we need expiration dates to invalidate "stale" records.

We've already switched over everything to Let's Encrypt. But I don't think anyone should be under the delusion that automation / ACME is failproof:

https://github.com/certbot/certbot/issues?q=is%3Aissue%20ren...

https://github.com/cert-manager/cert-manager/issues?q=is%3Ai...

https://github.com/caddyserver/caddy/issues?q=is%3Aissue%20A...

(These are generally not issues with the software per se, but misconfiguration, third-party DNS API weirdness, IPv6, rate limits, or other weird edge cases.)

Anyway, a gentle reminder that Let's Encrypt suggests monitoring your SSL certificates may be "helpful": https://letsencrypt.org/docs/monitoring-options/ (Full disclosure: I wrote the most recent addition to that list, with the "self-hosted scripts".)
by realitydrift | 2025-08-26 13:37:52+00:00
Exactly. That’s the hard part. Meaning is often carried less by the literal words and more by context (time, environment, emotion, shared knowledge). My point with fidelity is that current benchmarks don’t check whether outputs preserve that function in context. An AI can echo surface words but miss the intended role: coordination, reassurance, accountability. And that’s where drift shows up.
Show HN: FreeResend – Drop-In Resend Replacement Using Amazon SES
by eibrahim | 2025-08-26 13:38:14+00:00
I built FreeResend after my email costs across multiple side projects started getting expensive with Resend (which I still think is fantastic, btw).

*What it is:* A self-hosted, open-source alternative to Resend that uses Amazon SES for actual email delivery while maintaining 100% API compatibility.

*Why it matters:* - 85% cost reduction (Amazon SES rates: $0.10/1k emails vs premium pricing) - True drop-in replacement - just set RESEND_BASE_URL env var - Auto-creates DNS records if you use Digital Ocean (optional) - Complete control over your email infrastructure

*Technical stack:* - Next.js 15 + TypeScript - Direct PostgreSQL (no external DB services) - AWS SES SDK v3 - Digital Ocean API integration - Docker ready

*The magic moment:* Add domain → auto-create 7 DNS records → sending emails in <60 seconds vs 15+ minutes of manual DNS setup.

I've been running it in production across multiple projects for months. MIT licensed, well-documented, includes test scripts.

*GitHub:* https://github.com/eibrahim/freeresend

*Medium post:* https://medium.com/@eibrahim/introducing-freeresend-the-open...
by mike_hearn | 2025-08-26 13:38:22+00:00
That's exactly what I'm saying. They don't let you take actions using only a web browser. If you don't use a mobile app they issue you with trusted hardware that performs a similar function (although usually less secure and not as convenient).

My bank does still allow login and txns to be authorized with a smart card reader. You have to type in fragments of the account number to authorize a new recipient. After that you can send additional transactions to that account without hardware auth.

Pure NFC tokens don't work because you need trusted IO.
by happytoexplain | 2025-08-26 13:38:32+00:00
Not to be too blunt, but the difference between the two seems obvious (of course that doesn't mean you have to agree with the law's treatment of that difference): Libel has the potential (and I think, by definition, the intent) to have concrete harmful consequences, while US-flag-burning is purely expressive - the harm is only emotional (if we assume the burning is done safely, since that's irrelevant to the topic).

Maybe you could argue that it "encourages" further action and should be covered under something similar to hate speech laws, but it doesn't seem specific/actionable enough to make sense - and anyway, that's tangential to the question of the difference between libel and US-flag-burning.
by pelagicAustral | 2025-08-26 13:38:45+00:00
I work for government and I can tell you the guys working infrastructure are still paying for shitty SSL certificates every year, in most cases for infrastructure that doesn't even see the light of day (internal), and the reason for that is none other that not knowing any better, and being unable to get their head out of their asses for enough time to learn something novel and implement it in their workflow. So yeah, there are those types out there in thew wild still.
by terminalshort | 2025-08-26 13:38:52+00:00
If I had said "you can't even find 2 extreme outliers among the 3 million 1%ers in the US that are opposed to one particular type of science because of their financial interests" then this would be a reasonable argument. But I didn't say that. And even then, Koch industries is a terrible example. They employ thousands of scientists and engineers.
Show HN: Image2PDF – Convert images to PDF online (fast and free)
by brnocstro | 2025-08-26 13:39:06+00:00
Hi HN,

I built a small tool: [https://image2pdf.vu](https://image2pdf.vu)

It’s a simple image-to-PDF converter, designed to be: - fast (runs directly in the browser), - private (no files are stored on the server), - free.

The idea came up when I needed to merge a few photos into a single PDF and most solutions I found were slow, full of ads, or required sign-ups.

I’d love some feedback: - How do you find the simplicity of the interface? - What features would you expect (e.g. batch conversion, more image formats, compression)?

Thanks!
by realitydrift | 2025-08-26 13:39:11+00:00
I agree. Words don’t carry intent by themselves. Intention is always embedded in use. That’s why I frame fidelity as about whether a system’s continuation still serves the same human purpose. The “conduit metaphor” you mention is exactly the trap: treating words as if they inherently encode meaning. Models fall into this because they optimize surface probabilities rather than checking whether the function of the exchange was preserved.
by ExoticPearTree | 2025-08-26 13:39:15+00:00
> The capitol storming and freeing all that participated.

I don't have an opinion on that. It is the president's prerogative to pardon whoever he wants, no justification necessary.

> Having major cities being taken over by the army.

That is the National Guard. Not the same thing as the Army. The Army would be a very bad option should that happen. The cities are not taken over. The mayor/police chief of those cities have no desire to reign in crime, the federal government has to step in. Depending on your political views, this is a good thing or a bad thing. Bottom line is that people much more safer now in DC than they were 2-3 weeks ago.

> Stifling free press.

For this I have zero information. Link(s)?
by jones89176 | 2025-08-26 13:39:19+00:00
Ah yes, sailfish is actually pretty usable. (Unlike Ubuntu Touch, tbh). I've used it in the past on my Nexus5 for some years. However, they are still not 100% open source and they're too much into the AI-Hype as of recently (Mind2). Also, I'd like to have more official ports. It's such a hassle to be dependent on that one guy who maintains that port for your device...
by subw00f | 2025-08-26 13:39:19+00:00
It's remarkable to me that even after all the scandals and whistleblowing going on in the last decades about intelligence agencies, the US government, and big tech collaborating to surveil and control their own citizens or other nations, the recent, full public alignment between the big tech billionaires and the executive branch, not to mention the whole history of US imperialism, which you can boil down to violent expansion of private markets and capital to the detriment of other peoples, there are still smart people like yourself that don't question it in the slightest. In fact, embrace it. Hopefully you're benefiting directly from it, otherwise, you're just a frog getting slowly boiled in a pot of crumbling social environment. Also, did you ever ask yourself where your "preferences" or "wants" come from or how they form?
by m-p-3 | 2025-08-26 13:39:26+00:00
I was looking at building a small home NAS, but after compiling the list of hardware I would need to achieve what I wanted, it was just cheaper to buy a small NAS enclosure with an Intel CPU and call it a day.

Now it's running Ubuntu, Cockpit, Podman and ZFS for the redundancy, plus some extra tweaks to make the chassis LED display the zpool and volume status from a glance.
by pors | 2025-08-26 13:39:49+00:00
Your comment was not in the category of an armchair dev/hater, otherwise I wouldn't have replied :)

I'm working on a "pivot" of paperzilla, which is paper discovery. Basically you subscribe to a research topic and you get a daily list of possible interesting papers for you in summarized form. If you are a scientist or following new science, please let me know. I'd love to hear what your daily ritual is for finding new papers and what tools you use (if any). You can reach me at mark at paperzilla dot ai.
by docdeek | 2025-08-26 13:41:12+00:00
I don’t think that it was the coverage (or lack of it) that had people associate that policy more with Trump than Harris. I think it is far more likely that Trump announcing it in June and talking about it for two months before Harris announced she also supported the policy in August was what made it seem more a Trump policy than a shared policy. The Democrats were slow to react and so - even if they decided to get on board a couple of months before the election - they were always going to be depicted as playing catchup.
by hollerith | 2025-08-26 13:41:38+00:00
Grandparent's 5% or less is "earnings as a fraction of revenue", which is called "net profit margin" or just "net margin", whereas your 50% is gross margin.

According to an LLM I just consulted Walmart's net margin for the last 5 years for which we have data never got above 3%.

To calculate net margin, we include every expense, e.g., management salaries, e.g., the cost (rent of depreciation) of the stores. To calculate gross margin, we include only the expense of obtaining (buying or making) the goods solds.

When considering whether a retailer can eat the cost of tariffs or must pass them on to the consumer, net margin is more relevant than your figure, which is gross margin.
by Cthulhu_ | 2025-08-26 13:41:39+00:00
Exactly this; the vast majority of people cannot be trusted with root access. And for those that can, the majority won't need or want it.

While I do believe root access should be possible, it shouldn't be easy. Because I'm confident my dad who wants to pirate F1 instead of pay for whichever overpriced premium streaming platform bought the rights this year would root his ipad and install a dodgy stream player if it was easy.