MurphyA/hacker-news huggingface dataset:
by paul2495 | 2025-11-24 10:39:37+00:00
Really appreciate the detailed feedback—this is exactly what I need to hear.

GPU/CPU question: Yes, Syd supports both. It auto-detects CUDA if available and falls back to CPU if not. With GPU (tested on RTX 3060), inference runs at 30-50 tokens/sec. On CPU it drops to 5-10 tokens/sec, which is usable but noticeably slower for larger responses. The model is quantized (Q4_K_M) to keep VRAM requirements reasonable(6GB).

On the video: You're absolutely right Ive been staring at this for months and forgot what it looks like to someone seeing it fresh. The lack of audio and the jumpy editing makes it hard to follow the actual workflow there are more videos on the website 5 in total I'll redo the demo with: - Narration or at least on-screen captions explaining each step - Slower pacing on the important bits (the parsing LLM rule generation flow) - A clear "here's the input here's what Syd does here's the output" structure - Maybe a side-by-side showing manual workflow vs. Syd's automation

The automation is the whole point—scan directory, hit YARA match, auto-parse, explain in plain English, suggest next steps—and the current video completely fails to demonstrate that smoothly.

On the payment page: Fair point. It's bare-bones right now because I've been heads-down on the tool itself, but that doesn't inspire confidence if you're considering backing it. I'll add: - Current development status (what's working today vs. what's planned) - Roadmap with realistic timelines - Maybe a shorter "state of the project" video or changelog - Clearer communication on what backers get and when you will recieve weekly or monthly updates and obviously ill answer any questions

Current state for transparency: - Core features working: YARA, Nmap, Volatility, Metasploit, PCAP analysis with RAG-enhanced explanations - 356k chunk knowledge base indexed and searchable - Exploit/CVE database integrated - GUI and CLI both functional - Still refining: UX polish, additional tool integrations, documentation

I'm actively developing this (clearly evidenced by me responding to HN feedback at [current time 10:38am). The idea of local LLM + security tool orchestration is genuinely useful—I use it daily—but I need to do a better job showing how it's useful and building confidence that it's not vaporware.

Thanks for being direct. This kind of feedback makes the product better. I'll update the demo and payment page this week and can ping you when it's improved if you're interested. and if you sign up on the website thats a great way for me to keep in touch
by WJW | 2025-11-24 10:39:54+00:00
> bad actors will spoof their location

Isn't that exactly the point? Why are North Korean hackers even allowed to connect to the service, and why is spoofing location still so easy and unverifiable?

Nobody is expected to personally secure their physical location against hostile state actors. My office is not artillery proof, nor does it need to be: hostile actions against it would be an act of war and we have the military to handle those kind of things. But with cybersecurity suddenly everyone is expected to handle everyone from the script kiddie next door to the Mossad. I see the point in OPs post: perhaps it would be good if locking down were a little easier than "just setup zero-trust network".
by kace91 | 2025-11-24 10:41:01+00:00
>I was told that both scales must be high to be diagnosed with ADHD.

My understanding is that this is not the case, that ADD (without the hyperactive part) used to be considered a separate diagnosis but this is no longer the case, and one of the scales qualifies.

I am not a proffessional though, so take it with a grain of salt, but it might be worth double checking just in case.
by goku12 | 2025-11-24 10:41:30+00:00
> because local effects have proven too inconvenient to voters.

I don't think you need a reminder that their inconvenience is about to get a whole lot worse. When I said they should convince everyone, I meant the voters too. A renewed awareness campaign at this point is not such a bad idea. It's definitely not as costly as the fantasies as these people are proposing.
by trymas | 2025-11-24 10:41:39+00:00
At least before you are grown up - that’s absolutely proven truth.

Until you are an adult - you must get outside light (even if it’s overcast winter). On average - luminosity (I hope that’s the term) outside is orders of magnitude above indoors, even when it’s overcast.

Kids without enough light have much bigger risk of shortsightedness. Because eyeball development is related to light.

There was even an article about this on HN couple weeks ago.
by DrScientist | 2025-11-24 10:42:04+00:00
The question is do you take control of your update cycle - or outsource it.

That's balancing the effort and risk of managing it yourself versus the risk and busy work generated from dependency churn.

What evergreen update policies have done is increase development velocity ( much easier to make breaking changes if you assume everyone is upto date everywhere ) - but also increases churn.
by latexr | 2025-11-24 10:42:31+00:00
Fairly, respectfully, and without exploitation?

Most business conducted in the world does not require someone to reject their lawful rights. For consumers in the EU, for example, the law even offers explicit protections by stating specifically that contract terms which are unfair have no legal binding.

https://europa.eu/youreurope/citizens/consumers/unfair-treat...
by razodactyl | 2025-11-24 10:42:33+00:00
Absolutely Tom and all of the HN community!

I've been reading HN for a very long time now and it has brought years of joy, intellectual curiosity, news and learnings.

Your comments have been most salient in my random reads through the threads so I've just associated you as the HN moderator but I had a passing thought this morning that due to the tremendous efforts of the community and its moderation team do I have the privilege of enjoying the content surfaced on this platform.

So again, even though we all get busy, caught up in discussions or just simply forget to do so: Thanks, all of you.
by squigz | 2025-11-24 10:42:57+00:00
> It's somewhat self-contradictory though. When you look closer at these patients with "attention deficit", you find that a high number of them are capable of hyperfocus. There's almost always something that deeply engages them. For some it's computers, for others it's car engines, there's always something. You find that all these people with "attention deficit" can suddenly display the ability to pay attention to specific things for ten hours straight.

The problem is that even that hyperfocusing is not always helpful. Focusing on something for 10 hours straight while ignoring everything else - obligations, one's body's needs, etc - is not very much healthier than not being able to stay focused.

(Not that I disagree with much of what you're saying; just feel it's necessary to point out, as many people do think the hyperfixating on things is strictly an advantage)
by tialaramex | 2025-11-24 10:42:57+00:00
Also stopping is a state which definitely might happen anyway and must be planned for. The pacemaker's wires can be dislodged or damaged, power sources fail, these things will stop the pacemaker regardless of how much you love the "just keep going" approach to software engineering. Which means medics have already thought about what they're going to do when this happens to a patient, and "The software failed" just goes on the same list as "10 year battery only last 8 years" in terms of undesirable but hardly impossible scenarios which constitute a medical emergency.
by isodev | 2025-11-24 10:43:26+00:00
> The answer lies in the structure of creative labor markets, which are brutally concentrated. Creative workers bargain with one of five publishers, one of four studios, one of three music labels, one of two app marketplaces, or just one company that controls all the ebooks and audiobooks.

> The media industry isn't just a monopoly, in other words – it's also a monopsony, which is to say, a collection of powerful buyers. The middlemen who control access to our audiences have all the power

I'm happy to see apps included here, I feel sometimes folks forget these are also a form of creative works and having the two gatekeepers constantly filter and influece what can and can't be released is absolute nightmare for both developers and consumers (who don't even know the things they could've had but were denied by big A or big G).
by nananana9 | 2025-11-24 10:44:14+00:00
"Free" software resulting in your data being sold is the software working as intended, it's orthogonal to the question of software robustness.

Software isn't uniquely high stakes relative to other industries. Sure, if there's a data breach your data can't be un-leaked, but you can't be un-killed when a building collapses over your head or your car fails on the highway. The comparison with other industries works just fine - if we have high stakes, we should be shipping working products.
by Kbelicius | 2025-11-24 10:44:22+00:00
> Define runtime then.

From GP: "But you don't use AI to define rules on the fly."

Neither Claude nor Perplexity change the rules they work by on the request to request basis. Code that Claude outputs isn't the code the Claude runs on and Perplexity did not on its own decide to create python scripts because other ways it was calculating large sums did not work well. Those tools work within the given rule set, they do not independently change those rules if the request warrants it.
by etamponi | 2025-11-24 10:46:11+00:00
Ex-Meta employee here. I worked at reality labs, perhaps in other orgs the situation is different.

At Meta we did "fix-it weeks", more or less every quarter. At the beginning I was thrilled: leadership that actually cares about fixing bugs!

Then reality hit: it's the worst possible decision for code and software quality. Basically this turned into: you are allowed to land all the possible crap you want. Then you have one week to "fix all the bugs". Guess what: most of the time we couldn't even fix a single bug because we were drown in tech debt.
by makeitdouble | 2025-11-24 10:46:18+00:00
Every major maker is decades ahead of the competion in some specific niche. By that token Lenovo is 30 years ahead of Apple in customizability and Asus 20 years ahead in RGB lights. I'm not sure that that wins hearts.

On what I care the most, and as a goal Apple set for themselves, Apple still couldn't make the iPad Pro a general use computer. Microsoft is 10 year ahead of them in that regard, even Samsung's Chromebooks end up being more powerful for a "Pro".

Apple couldn't overcome their gaming aversion, and the Vision Pro is such an unattractive product in no small parts because it's at the crossing of that and the iPad "what is a computer" syndrome. I waited for its launch before renewing my headset, and honestly regretted the wait.

Valve came up last week with a set of devices that genuinely looks fresh and opens new doors. Lenovo keeps pushing the boundaries of what a mobile computer looks like, with actually interesting screen/keyboard combinations I'd buy in a heartbeat if I was still commuting. Asus keeps showing the world what a real "Pro" tablet looks like.

Innovation is happening in spades, while Apple still hasn't fulfilled its own promises.

> e-ink display

Chinese makers are already on that beat, and that's where we saw the first e-ink smartphones. Computer wise, I'd expect Lenovo to hit the mark first. Now I get that many here won't touch a laptop with Windows on it, but Linux support is also getting decently good.
Show HN: Textpilot – Stop copy-pasting into ChatGPT
by rawraul | 2025-11-24 10:48:18+00:00
I built this tool simply because I need it for myself. I'm not a native English speaker, and every time I write something, I like to double-check if the grammar is good

Key features: - Fix grammar and clarity with one click - Rephrase, shorten, or expand text instantly - Generate content from scratch - Translate to multiple languages - Works on any website (no copy-pasting needed)

It's built with Next.js and Plasmo. I wanted something lightweight that stays out of the way until you need it.

I'd love to hear your feedback!
by zeroCalories | 2025-11-24 10:48:55+00:00
This type of testing is incredibly expensive and you'll have a startup run circles around you, assuming a startup could even exist when the YC investment needs to stretch 4x as far for the same product.

The real solution is to have individual software developers be licensed and personally liable for the damage their work does. Write horrible bugs? A licencing board will review your work. Make a calculated risk that damages someone? Company sued by the user, developer sued by the company. This correctly balances incentives between software quality and productivity, and has the added benefit of culling low quality workers.
by johnisgood | 2025-11-24 10:49:29+00:00
At https://github.com/drduh/YubiKey-Guide?tab=readme-ov-file#co..., these options are not the most secure one.

personal-cipher-preferences CHACHA20 AES256 AES192 personal-digest-preferences BLAKE2B SHA512 SHA384 SHA256 personal-compress-preferences Uncompressed personal-aead-preferences OCB EAX default-preference-list BLAKE2B SHA512 SHA384 SHA256 CHACHA20 AES256 AES192 Uncompressed OCB EAX cert-digest-algo BLAKE2B s2k-digest-algo BLAKE2B s2k-cipher-algo CHACHA20 s2k-count 65011712 charset utf-8 no-comments no-emit-version no-greeting keyid-format 0xlong list-options show-uid-validity verify-options show-uid-validity with-fingerprint require-cross-certification require-secmem no-symkey-cache armor use-agent throw-keyids weak-digest SHA1 RIPEMD160 MD5 disable-cipher-algo 3DES CAST5 IDEA BLOWFISH TWOFISH CAMELLIA128 CAMELLIA192 CAMELLIA256 disable-pubkey-algo RSA1024 trust-model tofu+pgp keyserver hkps://keys.openpgp.org keyserver-options no-honor-keyserver-url keyserver-options include-revoked keyserver-options auto-key-retrieve force-mdc require-compliance compliance de-vs

These are the most secure options (correct me if I am wrong). The only drawback you may encounter is that you need GnuPG 2.3+, and some compatibility tradeoffs.
by phaylon | 2025-11-24 10:49:46+00:00
Something else I usually don't see: A system hitting a fail-safe is a lot easier to detect and handle from the outside than one that just enters an unknown invalid state.

Like, if the rule were "Always-Keep-Running" then hospital equipment power supplies wouldn't have circuit breakers that cut the power when something is wrong. But cutting power seems lot easier to detect for the backup power supply so it can fully take over.
by yunruse | 2025-11-24 10:50:04+00:00
I prefer to default to `develop` and then eventually branch out to `release`: that way my branch names are pretty explicit. It seemed silly to me to start with a "central" branch, no matter the wording, because that's not actually how Git works (and it's rather uninformative).

For... some in the comment section, please recall the HN guideline: "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive."
by Quarrel | 2025-11-24 10:50:47+00:00
FWIW, IPv6 has worked just fine for me since they enabled it (I don't think I had it when I initially got them as my ISP). I also have found them pretty responsive to even technical feedback, but maybe I've just been lucky.

Of course, there was that one time they "upgraded" our building and forgot to re-plug my line to the router, but, oh well..

Overall, this seems like a super niche topic for HN. :)
by noduerme | 2025-11-24 10:51:00+00:00
So, let's say the TSMC is the modern equivalent in "supply chain" terms as Czech guns made in Plzeň, like the Škoda 75mm cannon - wait, let's rewind. I'm not saying Czechoslovakia was politically stable in 1939. I'm saying that when your neighbor claims they need to rescue you from instability - like when America says they need to rescue a Latin American or Middle Eastern country from "political instability" when that country elects someone who doesn't want the country's resources owned and run by companies with imperialist backing - that is code for a green light to conquer them and take their resources. The same as it was for the Germans. The same as it is for China re: Taiwan and Russia re: all the former Soviet republics. Declaring your neighbor "politically unstable" and presenting yourself as its savior was the clearest way in the 20th Century to declare war without any casus belli. I'm sure you wouldn't like your country to be invaded again if the powers around it decide you can't manage your own affairs.

[edit] I also spent about a year living in Prague and I love your country, Czechs are the best, and their sense of freedom is an immense relief from let's say other countries in the EU, so, I think it's amazing that you have maintained your independence from the enormous forces surrounding you and pulling in all directions. I think part of this is something I observed, that Czechs act like they are part of one small family.
by skissane | 2025-11-24 10:51:28+00:00
> There's not a lot of "off the shelf" in terms of mainframes

Not true-there’s still a huge amount of off-the-shelf software for IBM mainframes, and in the 1980s there was a lot more than there is now - see e.g. https://lookupmainframesoftware.com/ - in particular, the early-to-mid 1980s and earlier were really the heyday of scientific and engineering software on IBM mainframes (e.g. the original mainframe-based versions of CATIA and CADAM), before it migrated to Unix workstations. From Ken’s comment above, I know Intel was actually using Amdahl UTS, a mainframe Unix port, which is a bit of a midpoint in that transition. And of course, someone like Intel (both then and now) is going to use a lot of custom software in CPU development, whatever off-the-shelf bits they might be able to leverage.
by gambiting | 2025-11-24 10:52:05+00:00
I used to work at the studio responsible for the Driver games, and few years back we dug out the code for the original PC Driver and tried to compile it again, mostly for fun - we had to change a lot of hand written assembly code to make it build, and discovered that yeah, the game worked but none of the game replays worked - and it was for that exact same reason, better/different floating point precision issues. Really fun thing to investigate though.
by pjmlp | 2025-11-24 10:52:28+00:00
There is the advantage that GCC will be only way for Rust to be available in some targets where LLVM isn't an option.

Regarding Go, gccgo was a way to have a better compiler backend for those that care about optimizations that reference Go compiler isn't capable of, due to the difference in history, philosophy, whatever.

Apparently that effort isn't seen as worthwile by the community.
Show HN: Python UI-ME – Bringing life to Python functions
by tusharnaik | 2025-11-24 10:53:25+00:00
I built python-uime, a simple tool that lets your Python functions say “make elegant UI forms out of me.” Add a single @ui_enabled decorator and UI-Me library instantly generates a clean web control panel for your script — with forms for each argument, type-inferred inputs, grouped tabs, global variable setters, rich JSON output. It is like a toned down version of python click-web. Or like Swagger UI, but for your Python functions, built entirely with vanilla HTML/CSS/JS + a small Flask server. No React, no design systems, no heavy front-end stack.

- Automatically maps function arguments - Works with regular python functions - It is UI first, and not CLI first - Supports json and nested objects as inputs and responses.
by elsjaako | 2025-11-24 10:53:38+00:00
I would argue that having to pay more than $20 for an address, having to do weird NAT hole punching to get a direct connection between two machines, and having an internet that can easily be completely scanned by hackers are all things that are not "working".

Working for you != working for everyone

Basically functioning != Working as well as it could

There are more advantages to IPv6. We don't see all of the advantages because we can't use them, because we are still largely stuck in an IPv4 world. This is a problem caused by not enabling IPv6.
by decimalenough | 2025-11-24 10:53:51+00:00
Ryukyu was an independent kingdom with its own ruling court, language, culture etc until 1872, when it was annexed by Japan. Quite a few Okinawans would rather like to return to the previous state of affairs, although probably not if it involves exchanging the Japanese yoke for the Chinese one. (Ryukyu was a Qing tributary, but the Qing had bigger problems on their hands than worrying about a bunch of small islands.)
by beAbU | 2025-11-24 10:53:56+00:00
Irish Rail wants to charge me €15-€20 for a single trip from Wexford to Dublin, a 150km trip that would cost roughly €5 when taking my EV and can be an hour quicker with nice traffic. Buses aren't much better.

Sure, parking and wear/tear on my car needs to be factored in, but the moment I'm not travelling alone, the public transport costs are completely blown out the water. A trip to the big city for me and my wife will be €60 when taking the train, and with the car it will be about €20-€30 depending on where I park.

It's crazy frustrating, because I would LOVE to take public transport more.
by darkwater | 2025-11-24 10:55:16+00:00
> A bug description at the beginning is some observed behaviour that seems to be wrong.

Or not. A bug description can also be a ticket from a fellow engineer who knows the problem space deeply and have an initial understanding of the bug, likely cause and possible problems. As always, it depends, and IME the kind of bugs that end up in those "bugathons" are the annoying "yeah I know about it, we need to fix it at some point because it's PITA".
by matt_kantor | 2025-11-24 10:55:17+00:00
I know I've seen some people recommend 50 (my guess is that's to make some room for metadata from commands like `git log --online` in an 80-column terminal?) but I've personally always capped all lines at 72, including the first. 100 seems like a reasonable limit too, but I probably wouldn't go above that.

> git says they're all illegal by some margin

Git will accept almost anything as a commit message. Is there a specific style guide you're referring to?

---

EDIT: Huh, I guess git does have an official recommendation. I'd never noticed this text in `git help commit`:

> Though not required, it's a good idea to begin the commit message with a single short (less than 50 character) line summarizing the change, followed by a blank line and then a more thorough description.

I wouldn't feel bad about not following this advice. Even the author doesn't seem dogmatic about it.
by vintagedave | 2025-11-24 10:55:26+00:00
Serious question: should someone develop new technologies using Node any more?

A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about.

I just keep reading more and more stories about dangerous npm packages, and get this sense that npm has absolutely no safety at all.
by burnt-resistor | 2025-11-24 10:55:36+00:00
This isn't such a great idea for personal SSH or GPG keys that should be locked away in physical hardware thing that need to be moved to other devices/machines. What security processors are great for is corporate machine, system/service, and user key management IdM/MDM processes that need secret storage.

Furthermore, with portable devices like Yubikey it's possible to create a master Certify-only GPG key where the sub Signature/Encryption/Authentication-subkeys live on the Yubikey. The encrypted C private key part with the S/E/A stubs still needs to be backed-up to some durable, versioned storage that isn't tied to one device.

Finally, use GPG for SSH. And definely avoid file-based SSH local private key management for wherever possible for anything substantial because it doesn't scale well.