MurphyA/hacker-news huggingface dataset:
Show HN: An open-source, air-gapped threat detector for Active Directory
by saeros | 2025-11-27 16:37:23+00:00
Hey,

I built Saeros because I was frustrated with the current state of Active Directory security in secure/air-gapped environments.

As of today, solutions that detect live threats such as DCSync, Golden Tickets, or Kerberoasting require heavy agents that pipe gigabytes of logs to the cloud (Splunk, CrowdStrike, SentinelOne) or sync your AD to Azure (Defender for Identity). Other alternatives such as OSSEC, Wazuh or Elastic require heavy setup and are very time consuming. Chainsaw and Hayabusa do not support live detections.

For critical infrastructure or disconnected networks, that isn't an option.

What it does: Saeros is a single-binary agent written in C# that runs on domain controllers. It subscribes to Event Tracing for Windows (ETW), matches them against Sigma rules in real-time, and outputs alerts locally through a powerful console.

Key Takeaways:

- User-Mode Only: This does NOT use kernel drivers. It cannot BSOD your domain controller. - Performance Critical: The agent consumes minimal resources while handling tens of thousands events per second. - Read-Only: It does not attempt to block or terminate processes. - Air-Gap Native: It requires zero internet connection.

The code source is located here: https://github.com/Saeros-Security/Saeros. I released this under the AGPL-3.0 license so security teams can audit the code and verify that it only listens and never talks to the outside world.

I’m looking for your feedbacks.

Thanks!
by whitehexagon | 2025-11-27 16:37:40+00:00
Not quite dead yet. For me the rise of LLMs and BigTech has helped me turn more away from it. The more I find Ads or AI injected into my life, the more accounts I close, or sites I ignore. I've now removed most of my BigTech 'fixes', and find myself with time to explore the fun side of hacking again.

I dug out my old PinePhone and decided to write a toy OS for it. The project has just the right level of challenge and reward for me, and feels more like early days hacking/programming where we relied more on documentation and experimentation than regurgitated LLM slop.

Nothing beats that special feeling when a hack suddenly works. Today was just a proximity sensor reading displayed, but it invloved a lot of SoC hacking to get that far.

I know there are others hacking hard in obscure corners of tech, and I love this site for promoting them.
by gambiting | 2025-11-27 16:38:11+00:00
But....the human stories are the whole point of this, no? I just finished the article and it shows clearly(to me) that there are patients who suffer horrible consequences of having those transplants and the system just mostly.....doesn't care? Like one of them says - he can't afford a $100 uber to the hospital, so the hospital just writes him down as non-compliant. So in the medical stats behind this he's probably recorded as healthy and happy, since he doesn't even turn up to his appointments anymore! As one of the surgeons is quoted later "most patients are happy and don't complain" - that's the entire point of this article, maybe they don't complain because they can't or they feel like they can't. If they are being wheeled around to be shown publicly as the pinacle of human surgery they feel like they can't go and say "actually this isn't working for me".

Again, it just sounds like the fault of the system, mostly the American non existent healtcare system. When my dad was treated for cancer using an experimental treatment at a leading oncological hospital in warsaw, he had all his travel costs covered by the hospital. But it sounds like in US insurance companies are just not interested in actually helping these people, I guess it's cheaper to let them die from complications?

>>when what I really want is to learn something about the medicine

I think you can learn - the fact that for some procedures the interest in outcomes ends with patient survival and not with long term prognosis. I imagine it's not universal, but the article describes specific cases of specific people. They are essential to the story.
by chucksmash | 2025-11-27 16:38:21+00:00
Starlink has a use case.

At Voyager 1 speeds, it'll take 70,000 years for a probe to reach Proxima Centauri. So you'd just be launching a probe a year for the next 70,000 years to create a temporary chain on a course to fly by one particular star. And for what purpose? Okay, in 70,000 years, if everything works out as expected, we have a chain of probes on a course to fly by Proxima Centauri. What problem does that solve for us ("us" here being whatever is kicking around on Earth after a period of time 5x that of recorded human history thus far).
by Hendrikto | 2025-11-27 16:38:22+00:00
Needs (2003) in the title, but still an interesting read.

TL;DR:

> Anders Hejlsberg: I see two big issues with checked exceptions: scalability and versionability.

> Anders Hejlsberg: Let's start with versioning […]. Let's say I create a method foo that declares it throws exceptions A, B, and C. In version two of foo, […] foo might throw exception D. It is a breaking change for me to add D to the throws clause of that method, because existing caller of that method will almost certainly not handle that exception.

> Adding a new exception to a throws clause in a new version breaks client code. It's like adding a method to an interface. After you publish an interface, it is for all practical purposes immutable, because any implementation of it might have the methods that you want to add in the next version. So you've got to create a new interface instead. Similarly with exceptions, you would either have to create a whole new method called foo2 that throws more exceptions, or you would have to catch exception D in the new foo, and transform the D into an A, B, or C.

> Anders Hejlsberg: The scalability issue is somewhat related to the versionability issue. […] With a little example, you can show that you've actually checked that you caught the FileNotFoundException […]. Well, that's fine when you're just calling one API. The trouble begins when you start building big systems where you're talking to four or five different subsystems. Each subsystem throws four to ten exceptions. Now, each time you walk up the ladder of aggregation, you have this exponential hierarchy below you of exceptions you have to deal with. You end up having to declare 40 exceptions that you might throw. And once you aggregate that with another subsystem you've got 80 exceptions in your throws clause. It just balloons out of control.

> In the large, checked exceptions become such an irritation that people completely circumvent the feature. They either say, "throws Exception," everywhere; or—and I can't tell you how many times I've seen this—they say, "try, da da da da da, catch curly curly." They think, "Oh I'll come back and deal with these empty catch clauses later," and then of course they never do. In those situations, checked exceptions have actually degraded the quality of the system in the large.
by Aurornis | 2025-11-27 16:39:28+00:00
> Just because I said to someone 'Brexit was dumb', I don't expect to get fed 1000 accounts talking about it 24/7. It's tedious and unproductive.

I’m not the biggest Twitter user but I didn’t find it that difficult to get what I wanted out of it.

You already discovered the secret: You get more of what you engage with. If you don’t want to hear a lot of Brexit talk, don’t engage with Brexit content. Unfollow people who are talking a lot about Brexit

If you want to see more of something, engage with it. Click like. Follow those people. Leave a friendly comment.

On the other hand, some people are better off deleting social media if they can’t control their impulses to engage with bait. If you find yourself getting angry at the Brexit content showing up and feeling compelled to add your two cents with a comment or like, then I suppose deleting your account is the only viable option.
by imtringued | 2025-11-27 16:39:42+00:00
A DSP contains analog to digital and digital to analog converters plus DMA for fast transfers to main memory and fixed function blocks for finite impulse response and infinite pulse response filters.

The fact that they also support vector operations or matrix multiplication is kind of irrelevant and not a defining characteristic of DSPs. If you want to go that far, then everything is a DSP, because all signals are analog.
by Diesel555 | 2025-11-27 16:39:44+00:00
I really wish microeconomics was a high-school or secondary school required course. It's one of the most applicable to life and voters well-studied disciplines that describes the effects of certain actions towards or away from a competitive market, market elasticity and barriers to entry, explains positive and negative externalities of government action, and how those actions affect consumer pricing and supply (a lot of the topics here and below). Without studying this topic we view words with different underlying assumptions or definitions and it's a lot more effort / time / replies to not talk around each other. It's like two people who only use Windows for Instagram trying to argue about why Apt requiring Rust is good or bad. I'm not weighing in for or against the topic in this thread or its replies, just a plug to study Microeconomics if this stuff interests you!
by shipman05 | 2025-11-27 16:40:10+00:00
A text-based tool like this certainly puts a ceiling on presentation quality. Whether that really matters is situational. In most cases, content is more important than style once a certain threshold of "not hideous" is reached.

The same tradeoffs apply to a text-based diagram tool like mermaid.js vs more traditional diagramming tools like Miro.

My coworkers' Miro diagrams are prettier than my mermaid diagrams. But mine are composable and able to be versional controlled. I'm able to create complex diagrams many times faster using a text-based tool.

Ultimately, slides and diagrams are for conveying knowledge. If you're able to convey the same knowledge with significantly less effort, that outweighs the loss of "style points" in most situations (internal knowledge-transfer, meet-ups, etc).
by virgil_disgr4ce | 2025-11-27 16:40:28+00:00
Yeah, imgur had very simple & humble origins and fostered a surprisingly active, reddit-like community (though I'm sure imgurians would resent that particular comparison), and then holy shit it just turned into a bizarrely bloated overstuffed hodgepodge of fire-garbage. I just looked at the homepage for the first time in forever and—wait, what? "Arcade"?

Bleh.
by u_sama | 2025-11-27 16:40:51+00:00
You claim EU hate speech laws protect vulnerable groups. But 96% of Jewish respondents in Europe experienced antisemitism in 2024 despite decades of anti-negationism and hate speech laws . Antisemitic content online increased thirteen-fold in German during the pandemic, the laws don't work and the censorship of the information just makes it more attractive. Yet these laws remain, which means they're not actually about protection but as control.

Look at how they're actually used. France criminalized calling for BDS, claiming to protect Jews. Lithuania banned advocating for same-sex partnerships under a law claiming to "protect minors". Patriot act was about "protecting". Same protective language. Different targets. The "vulnerable people" you claim to protect become the prosecuted.

Germany proves it even more, a 74-year-old woman was fined thousands of euros for criticizing Germany's immigration policies on Facebook. Germany's authorities prosecute individuals for online speech, with 17,007 hate crimes recorded in 2023, a significant increase from 8,585 in 2019, and most of them are about political disagreements not true hate. There is a whole NGO-state industry whose work is just to stop "misinformation" which just means non-state approved information. The government claims the NetzDG law protects vulnerable immigrants. Instead, it criminalized criticism of immigration policy. Once you grant the state power to define "harm," it becomes a tool against disfavored politics, not protection. And these same tools will be used by the opposite side another day, just like Trump is doing to protect the Jewish Zionists but instead it is to censor universities and immigrants.
by coffeecoders | 2025-11-27 16:40:53+00:00
I actually think we’re overestimating how much of "losing our voice" is caused by LLMs. Even before LLMs, we were doing the same tweet-sized takes, the same medium-style blog posts and the same corporate tone.

Ironically, LLMs might end up forcing us back toward more distinct voices because sameness has become the default background.
Show HN: In The Office Tracker – Track your RTO requirements automatically
by jryan49 | 2025-11-27 16:41:50+00:00
Hello HN! I wanted to share my free, native, MacOS app that uses Wifi scanning to automatically keep track if you're in the office or not! It let's you keep track of your RTO requirements to make sure you don't get in trouble :)

If people really like it I can make an iOS version and an Android version and a Windows version and a Linux version.

After RTO, we all started using spreadsheets to track our time, but I hated having to remember to go into that spreadsheet every day and mark when I was in or not. So, I decided to waste months learning Swift UI to make this app instead! Please share your RTO stories below if you need some catharsis :)

It's my first time making a "real" app. I'm by day a Java backend engineer.

https://intheofficetracker.com
by Aurornis | 2025-11-27 16:42:55+00:00
I’m surprised at how much regulation has become viewed as a silver bullet in HN comments.

Like you said, the implicit assumption in every call for regulation is that the regulation will hurt companies they dislike but leave the sites they enjoy untouched.

Whenever I ask what regulations would help, the only responses are extremes like “banning algorithms” or something. Most commenters haven’t stopped to realize that Hacker News is an algorithmic social media site (are we not here socializing with the order of posts and comments determined by black box algorithm?).
by zeerg | 2025-11-27 16:43:27+00:00
Hi HN, I'm Claudio. I built Readit (https://readit.md) because I was tired of keeping my system prompts and documentation in sync across different LLM chats.

Every time I started a new session for a project, I found myself manually copy-pasting the same stack definitions, coding guidelines, and API references. I wanted a way to pass a "state" to the agent via a single URL, without relying on custom GPTs or copy-paste fatigue.

HOW IT WORKS

Readit serves dynamic Markdown. You point the LLM to a URL, and it fetches a rendered context. Unlike a static Gist or Pastebin, Readit treats Markdown as a dynamic template:

- Templating: It uses Liquid to handle variables, loops, and logic.

- Transclusion: You can embed other markdown files (local or remote) directly into the main response.

- Searchable: The URL accepts query params (?q=...), allowing the server to filter content before rendering the markdown for the LLM.

THE TECH

The stack is Node.js, TypeScript and Fastify, paired with a React frontend. We rely on Postgres for data storage and to manage the recursive file structures. I am also currently working on integrating pgvector to enable semantic search capabilities. And a lot of coffee.

It's free to use. I'd love to hear your feedback on the architecture or if you find this "context-as-a-URL" approach useful for your workflows.

TRY THE META-DEMO (NO SIGNUP)

The documentation is hosted on a readit (of course). You can verify it by pasting the docs URL into ChatGPT, Claude, or Gemini and asking technical questions about the tool itself.

1) Copy the docs URL: https://readit.md/gi0wQgl6GoFx37MY/readit-docs

2) Paste into your LLM

3) Ask: "Write a Python script to push a commit log using the API described in these docs." or "Explain how the templating engine handles search results."
by vladms | 2025-11-27 16:43:27+00:00
My view is that they are just exposing issues with the people in the said societies and now is harder to ignore them. Much of the hate and the fear and the envy that I see on social networks have other reasons, but people are having difficulties to address those.

With or without social networks this anger will go somewhere, don't think regulation alone can fix that. Let's hope it will be something transformative not in the world ending direction but in the constructive direction.
Tell HN: It should be okay to use AI for code and papers
by nis0s | 2025-11-27 16:44:06+00:00
Mulling over some thoughts before Thanksgiving dinner.

As long as someone isn’t plagiarizing or putting out falsehoods which bring down institutional or industry standards or norms, prompt-engineered AI-composed code and academic writing should be acceptable.

LLMs have access to a lot more information than any group of people combined, depending on the knowledge domains under consideration. If you have access to foundation models fine-tuned on in-house or secret data, those models are still more knowledgeable than any group of people in your cohort, unless you’re seeking specific lived experiences which can drive decision making.

I don’t like the industrial scale levels of hypocrisy where we’re gearing up for an “AI revolution” but at the same time punishing its legitimate use.

Improper use, in my view, is uncritically putting out falsehoods or invalid information.

If you’re using AI for academia, write your paper with it as long as you go over each line, make sure it’s not plagiarized, make sure it makes sense in the confines of the current state of knowledge and information, and any new claims are backed up by quantitative or qualitative verifiable evidence.

If you’re using AI for code, make sure you go over each line, and it works as expected (via TDD, for example).

The human element is necessary for going beyond what’s currently known, for quality assurance, and for incorporating understanding of uniquely human qualities which our automated systems currently lack, and perhaps may never possess.

What’s wrong with this way of thinking?
by adrian_b | 2025-11-27 16:44:25+00:00
A tape can be checked much faster than a HDD, because its sequential read/write speed is several times higher than that of a HDD.

However, there is little need to check the tapes, because the likelihood of them developing defects during storage is far less than for HDDs.

Much more important than checking the tapes from time to time is to make multiple copies, i.e. to use at least duplicate tapes that are stored in different places.

Periodic reading is strictly necessary only for SSDs, and it is useful for HDDs, because in both cases their controllers will relocate any corrupted blocks. For tapes it is much less useful. There is more risk to damage the tape during an unnecessary reading, e.g. if the mechanism of the tape drive happens to become defective at exactly that moment, than for the tape to become defective during storage.

The LTO cartridges are quite robust and they are guaranteed for 30 years of storage after you write some data on them.

In the past there have existed badly designed tape cartridges, e.g. the quarter-inch cartridges, where the tape itself did not become defective during storage, but certain parts of the cartridge, i.e. a rubber belt, which was necessary to move the tape, disintegrated after several years of storage. Those have disappeared many years ago.
by wltr | 2025-11-27 16:44:36+00:00
I don’t agree you have to copy Windows. I agree it’s nice to copy it to lure those who touched no other system and know only Windows. But actually, it’s good to have just simple and usable interface, and people would learn it no problem. There are not many things to learn after all. Gnome does that. Also, it’s very good as a simple macOS replacement. Even simpler than macOS itself. And when I install Gnome, I advert it as ‘very similar to macOS’ (good) ‘but without need to buy their expensive hardware’ (also good). And sometimes I say it’s simpler too (also good). Yes, there are situations when I’d like to have a 1-to-1 (visually) for cases when I want people to not notice they are using not Windows. But actually having something with just a simple interface is more valuable. For a Windows copycat, I use KDE, as it’s somewhat similar, more or so. I know there are ‘more Windows-like shells’ but I just don’t like them personally. Other systems, actually change a lot, including Windows itself. So that’s not an issue in my opinion.
by quickthrowman | 2025-11-27 16:45:19+00:00
NASA procurement was (is?) full of pork barrel politics meant to provide jobs in as many states as possible. I would expect a lean private organization to easily beat NASA in cost per launch. What SpaceX has done is very impressive, I have a lot of respect for what they’ve accomplished.

Space travel is also far less mature than tunnel boring technology, I’d expect advances in space travel before tunnel boring because there’s low hanging fruit. Space travel used to be done only by nation-states, only in the last 25-30 years has private space travel been possible. Tunnel boring machines were invented 200 years ago and were useful about 150 years ago.
by DarrenDev | 2025-11-27 16:45:32+00:00
I don't know where the recent idea that em dashes are difficult to type came from. MS Word automates turning a hyphen into an em dash as you type in the same way that it converts "teh" into "the" and has done so for as long as I can remember.

I find the whole AI / em dash thing frustrating as I used to used them all the time. They have meaning that hyphens don't. I've now had to stop using them because they are seen as AI generated, and structure my sentences differently as a result.
by mewpmewp2 | 2025-11-27 16:46:00+00:00
Ultimately, what I'm trying to do though, is to build myself such a life that if my internal principles are good, I shouldn't have to worry in most cases about what I'm saying since I want to believe in my principles. I want my interactions with people to be win-win, and I want to surround myself with people who want that too. If someone displays lose-win behavior, I should always naturally have the "moral" upper-hand assuming other people around me are reasonable. And if none of the people around me are reasonable, I should go and find the reasonable people.

People seem to be romanticizing the term "vulnerable" though. I think it would be important to go deeper into this. What does "vulnerability" exactly mean. I have had depression, anxiety diagnosed in the past and addictions and other similar issues, are these vulnerabilities because they may interfere with me acting optimally or are they vulnerabilities because they provide someone a tool to try and get at me if they so wanted because they think there's stigma around those labels to influence others to think worse of me?
by DrierCycle | 2025-11-27 16:46:56+00:00
In 1990 I built an SE/30 from spare parts, used an 800K fujitsu rather than a 1.2 superdrive, an Ehman grayscale page-sized monitor (remember those) all in an AT tower using a PC power supply, wired to the logic board using the Addison-Wesley wiring diagrams; I could never cover it because the Ehman card exceeded the tower dimensions, and it powered up the moment I pressed the AT's switch.

When I brought in a polaroid of the unit to that early TekServe spot on 18th street, David made a sign around it and wrote, "Why pay full price? SE/30s can be made for $1500 all-in!"
by Aurornis | 2025-11-27 16:47:07+00:00
Better suggestion: Ignore the feed if you don’t like it.

Don’t visit the site unless you have a reason to, like searching for jobs, recruiting, or looking someone up.

I will never understand these posts that imply that you’re compelled to read the LinkedIn feed unless you delete your account. What’s compelling you people to visit the site and read the feed if you hate it so much? I don’t understand.