MurphyA/hacker-news huggingface dataset:
ZetaShare Building private file transfer with WebRTC
by masterdegrees | 2025-11-23 21:38:09+00:00
I built ZetaShare because I wanted a file transfer service that doesn’t spy on me — no tracking, no data collection. The project was inspired by ToffeeShare, but after seeing it abandoned and being unable to contact the developers, I decided to build my own alternative.

In case you're curious about how the system works under the hood, here’s a simplified explanation of the current architecture:

How ZetaShare works (simplified):

The sender uploads a file on the website. The server doesn’t store the file — After uploading, the sender receives a 6‑digit ID. This ID becomes the identifier for the transfer session.

The receiver opens the link with the ?id= parameter, for example: https://zetashare.com/?id=123456

When the receiver joins the link, the server sends the receiver’s SDP offer to the sender. (This is part of the WebRTC signaling process.)

The sender responds by sending back their own SDP answer.

Both sides then exchange ICE candidates through the server.

After the WebRTC handshake is complete, a direct P2P connection is established between sender and receiver — and the file starts transferring directly between the two devices.

So the server is only used for:

exchanging SDP offer/answer

relaying ICE candidates …and nothing else. No file, no metadata, no tracking.

Once the WebRTC connection is established, all data flows peer‑to‑peer, fully outside the server.

What works now:

WebRTC P2P transfers — files go directly between users.

No metadata collection — unlike other services that send file metadata through signaling servers (like ToffeeShare), our server only handles SDP and ICE candidates.

No accounts required — just drag, drop, and share.

Unlimited file sizes.

Completely free — no ads at all.

What’s missing (in my view):

Only TLS (WebRTC’s built-in), no proper end-to-end encryption yet.

No password protection.

Links will have an expiration option soon.

Mobile file transfer speed needs improvement.

Coming next:

Password protection

File expiration option

Mobile performance improvements

Proper end-to-end encryption

Try it out: https://zetashare.com

These are the features I could think of, but if you have better ideas, I’d love to hear them. I can’t promise to build everything, but I’ll definitely try.

I’m using AI to help me because my English isn’t perfect — sorry if it sounds a bit AI-generated!
by jclarkcom | 2025-11-23 21:38:36+00:00
Maybe I didn't make it clear from the post, the llm (cursor+claude 4.5 sonet) was actually driving the whole process from provisioning a server, installing wireguard, setting up certificates, configuring network, installing packages, and updating security - with some testing at each step. I never ran any commands manually, I just told it what to do.
by bostik | 2025-11-23 21:39:25+00:00
The thing that's missing is the difference between a unsolicited external content (ie. pay-for-play stuff) and directly user-supplied content.

If you're doing editorial decisions, you should be treated like a syndicator. Yep, that means vetting the ads you show, paid propaganda that you accept to publish, and generally having legal and financial liability for the outcomes.

User-supplied content needs moderation too, but with them you have to apply different standards. Prefiltering what someone else can post on your platform makes you a censor. You have to do some to prevent your system from becoming a Nazi bar or an abuse demo reel, but beyond that the users themselves should be allowed to say what they want to see and in what order of preference. Section 230 needs to protect the latter.

The thing I would have liked to see long time ago is for the platforms / syndicators to have obligation to notify their users who have been subjected to any kind of influence operations. Whether that's political pestering, black propaganda or even out-and-out "classic" advertising campaign, should make no difference.
by salesexec09 | 2025-11-23 21:40:47+00:00
My inbox was 300+ cold outreach messages a day and increasing week to week. Sales automation tools are generating so much noise.

Three weeks ago I switched my Calendly link to HiiPitch. Now every rep/recruiter/consultant who wants my time pays $59 (expensed exactly like any client lunch 90 minutes before the call I automatically get:

$25 Uber Eats for me $25 donated to feed the homeless on my behalf (or I tap once and turn the full $50 into a 100% tax write-off)

I can track all the donations via a dashboard and download IRS approved receipts for every meeting.

I'm 3 weeks in and I have deductions totaling $1100, and I haven't paid for a meal since I started.

Possibly the best hack of the year if you like money.
by BrenBarn | 2025-11-23 21:42:49+00:00
Another possibility would be to somehow incorporate the possibility of publishing the algorithm and providing some kind of "under the hood" view that reveals to people what determined what they're seeing. Part of the issue currently is that everything is opaque. If Facebook could not change their algorithm without some of kind of public registration process, well, it might not make things better but it might make it get worse a bit slower.
by bryanrasmussen | 2025-11-23 21:43:35+00:00
why would the native JavaScript not be something like (probably errors here, so like, not necessarily this precisely)

const div = document.getElementById('drawing');

div.innerHTML = `<svg width="100%" height="100%"><rect width="100" height="100" fill="#f06"/></svg>`;

obviously if the what is going in can have user input in some way then open to attack using innerHTML but otherwise it seems like the structure of the example native JavaScript is made in such a way as to make the SVG.js version seem super cool in comparison.
by james_marks | 2025-11-23 21:44:04+00:00
MCP is not just providing an API, it’s providing a client that uses that API.

And it does so in a standard way so that my client is available across AI providers. My users can install my client from an ordained URL without getting phished, or the LLM asking them to enter an API key.

What’s the alternative? Providing a sandbox to execute arbitrary code and make API calls? Having an LLM implement OAuth on the fly when it needs to make an API call?

MCP has a place.
by Manuel_D | 2025-11-23 21:44:04+00:00
It's still unclear what choice Hacker News and other sites will have to make to retain section 230 protection in your proposed solution.

Again, something like counting the number of views in a video is, in your framing, not an active choice on the part of user. So simply counting views and and floating popular content to the top of a page sounds like it'd trigger loss section 230 protections.
by npteljes | 2025-11-23 21:44:12+00:00
I'd guess so, yes. I think dark mode users leave the screen brighter than it should be, because in dark mode, it doesn't matter as much as it does in light mode. Then, after looking at dark things for a while, the eye gets used to the light level, and then opening a white page is like a supernova happening in front of the user's face. In short, with dark mode, the lightness baseline is much lower, and a light page disrupts this.

I'd say it's more of a courtesy thing. If you like a bit of a web design challenge, you can experiment with the prefers-color-scheme CSS feature. With this, the browser will automatically apply the dark mode for users that have it set, making the experience seamless (and state of the art).
by mindslight | 2025-11-23 21:44:14+00:00
I'd say ideas need to be judged on their merits, rather than ever trusting who they're coming from. Serial contrarians are interesting because they help us consider alternative analyses, not because they've found some hidden secret that makes them fountains of truths. So in general, I'd say the better assumption is that everyone is spewing motivated bullshit.

Which applies to the focus of which bullshit we choose to call out, as well. Maybe if I were 20 years younger I'd eagerly go down your list and pick apart Chomsky's positions and your framings of them to analyze for myself. But at this point I'd only care if he had actual serious power, otherwise he just doesn't seem all that relevant.

Which is why this focus on him makes it feel like a prong of the next stage of Trump's (boosters') flooding the zone with shit, putting everyone but Trump in the news to distract from the fact we have a rapist-in-chief.

And as far as the larger meta-analysis: of course the foreign agents, moneyed elites, etc play "both sides". Thinking otherwise is utterly naive. This however doesn't mean there aren't real principles and values at stake as well.
by ebbi | 2025-11-23 21:44:53+00:00
I'm assuming that bit you're quoting 'militants with handguns' was hyperbolic, but it serves its purpose to compare and contrast the two.

How much damage has those Russian and Iranian built rockets done in Israel? How many tanks do Hamas have? How many fighter jets do Hamas have? How many nuclear weapons do Hamas have?

The fact is, Hamas is a product of being a military in a territory that is subject to blockade by Israel. You can say Israel left Gaza in [insert year], but the fact of the matter is that a blockade has been there up to now.

And so if Hamas was a democratically elected government of Gaza, with the opportunity of becoming a 'Singapore' of the Middle East and having full agency (as Israel claims), why is it outside the bounds of reasonableness that they do acquire weapons from Russia and Iran, just like any other country in the world does for their own military needs?
by xrmagnum | 2025-11-23 21:45:08+00:00
Hosting your VPN is a fair bit of work. Plus, you need residential IP too which you don't really have if you host on any Cloud Provider. I had the same issue and decided to build TunnelBuddy.net so that a friend can share their internet connection with me or vice versa. It is entirely P2P and requires no sign up, no credit card. You download the app, share a code and that's it. It is like TeamViewer, but instead of sharing your screen you share your Internet Connection.
Tell HN: ChatGPT is freaking amazing and I don't get the negativity
by Red_Tarsius | 2025-11-23 21:45:41+00:00
tl;dr: I love AI chatbots because they allow you to look up the web without any intrusive content.

ChatGPT has become my favorite way to search through the web. It redefined the way I engage with the internet: the www is the content, traditional search engines are the shelves & aisles, and the chatbot is the librarian.

It's a shame that so much debate revolves around validating our preconceived fears. So many people are looking for one gotcha to dismiss AI altogether. If you use a default chatbot to draft your meal plans or to answer math questions, you're setting it up for failure. Its strength lies in the ability to map natural language to the data used in its training. In a way, AI is the pinnacle of user interface: it demands nothing more from the user than the ability to speak or write.

I tried to list the reasons as to why I like it so much:

- The relationship between a chatbot and its user is transparent: you know you're dealing with generated content in advance. Many other online services have devolved into a murky territory where you never quite know whether you're dealing with users, bots and/or shills.

- Asking something to the chatbot filters out all ads and sponsored content I might have seen on my way to the answer. Next time you google something, count all the ads you see from the search result page until you reach what you are looking for. It's like walking through the forced-path layout of a mall.

- The response of the chatbot is mostly devoid of images. If you want to be shown something, you need to ask for it. This is very different from the act of browsing, where the average user is ONE typo, ONE click or ONE scroll away from traumatic material.

- No more sidebars, recommended links or elements poking from outside the viewport! As someone with compulsive issues, the lack of clutter is chef's kiss.

I would like to read your thoughts on the matter. Imho in a few years we'll look back at old-school "browsing" and wonder how the heck we managed to find anything useful online. We're living in a Goldilocks time where AI chatbots are amazing search assistants and they have yet to be tarnished by sponsored content. Let's enjoy it while we can.
Show HN: SaaS waste calculator (most waste –$250/employee/year)
by aidanvalero | 2025-11-23 21:45:50+00:00
We're building a SaaS license management tool and kept hearing the same story: "We know we're wasting money on unused licenses, but we don't know how much."

So we built a dead-simple calculator. One slider (employee count) → three estimates: • Total SaaS apps (~13 per employee) • Annual waste (~$250/employee on ghost accounts, unused seats) • IT time burned on manual tracking

The ratios come from industry research + early customer data. Curious if HN folks are seeing similar patterns at their companies - are we close? Way off?

(Also: feedback on the calculator UX welcome. Tried to make it ridiculously simple.)
by Moldoteck | 2025-11-23 21:46:06+00:00
The proof is looking at open generation data past winter. Sadly energy charts gives only gwh/day but you can still do some inference about how much fossils were used/how much imported

There's no such thing as baseload power plant. If solar were able to supply the demand with some bess you'd call it baseload. What matters is firm power. And yes, Germany plans to expand gas plants. It's sad they didn't opt out for BWRs that can modulate faster, at 1%/sec
by throw0101a | 2025-11-23 21:46:24+00:00
> Why should optical fiber be standard? I want reliable, speedy network connectivity.

The second sentence answers the question.

> It’s up to my network provider to determine the best means to do that. I don’t care if it’s tin can and string if it provides the service I need.

You assume that your network provider wants to provide "reliable, speedy network connectivity" and not "maximize profits with the smallest possible outlay".

Given they already have a bunch 'legacy' infrastructure, they're going to try to milk that existing plant as much as possible before shelling out another dime on anything new. That is not a recipe for "reliable, speedy network connectivity".
by jclarkcom | 2025-11-23 21:46:40+00:00
> or how many services like streaming, banking, gaming will restrict, block, or otherwise treat the connection differently because the traffic now exits via a datacenter or VPN IP/ASN.

I did run into this and claude implemented a work-around (see step 8) to route some traffic through the normal exit IP for those special use cases. So far I've only run into this problem with 3 services (Ring, Blink, and Paychex). Surprisingly none of the streaming services seem to care (Netflix, Amazon, Apple TV).
by wavemode | 2025-11-23 21:46:41+00:00
I don't think that's quite it. In many statically-typed languages that we would typically refer to as having "Turing-complete type systems", types cannot be manipulated at runtime, and thus Type is not really a type in the same way that e.g. int or float are types.

It's sort of like having two languages in one. There is a first, interpreted language which manipulates Types and code and produces a program, and then a second language which is the program itself that ultimately gets typechecked and compiled. Typechecking in this case is not (necessarily) undecidable.

This paper is moreso about dependently-typed languages, where the type of one term can depend on the runtime value of another term.
by tomhow | 2025-11-23 21:46:57+00:00
This is not an acceptable comment on HN. It's not OK to scold or harangue people like this here. The guidelines foremost ask us to "Be kind" in comments, and that isn't negated just because you disapprove of what the parent commenter has done. Further, we've had to ask you repeatedly to observe the guidelines and refrain from trolling. We have to ban accounts that continue to act this way. Please stop this if you want to keep participating here. A reminder of the guidelines: https://news.ycombinator.com/newsguidelines.html

We detached this subthread from https://news.ycombinator.com/item?id=46022847 and marked it off topic.

Edit: on closer look, you've been posting so many bad (for HN) comments and breaking the site guidelines so frequently that we've banned the account.
by oAlbe | 2025-11-23 21:47:35+00:00
That has not been the case for quite a long time now. Lots of distros still have websites that look like a wiki, see Arch. But in their case the Arch wiki is one of the best wikis ever existed for what it covers.

If you look at modern yet established distros, I struggle to find the outliers that don't have professional looking, slick web pages. See all the *buntus, Fedora, Elementary OS, Cachy OS, Bazzite, Endeavour, Manjaro, Linux Mint, and so forth.
by gradientsrneat | 2025-11-23 21:47:37+00:00
Way too many social media CEOs claim that if they just force their users to dox themselves, that it will somehow prevent all the toxic engagement. You need look no further than Facebook to see where it goes. Not only does the toxicity not go away, but Facebook makes tons of money off political ads and "boosted" posts; they even have had an office of sorts in China, where Facebook is banned, for the purpose of making it easier for Chinese to sell ads/engagement on Facebook. And it's not just China doing this.

I'd reckon Twitter's long-term goal isn't to make the trolls go away, but to pay for the privilege of visibility.
by hermanzegerman | 2025-11-23 21:47:45+00:00
I flew multiple times with easyJet in the last years, and I never had to show my ID at the security checkpoints. Sometimes the easyJet agent at the gate wanted to see an ID, but this is done on behalf of the company, not the government.

The only time they ask for ID at the Check-In-Counter, is when you have checked luggage.

Here is an article by German Public Television that confirms there is no legal requirement for the Airline to check, except in Spain https://www.mdr.de/nachrichten/deutschland/panorama/fliegen-...
by why_at | 2025-11-23 21:49:02+00:00
>a big innovation of HL2 was the extensive use of a real physics engine. The door and the guard are both physical objects, both have momentum, they impart an impulse on each other, and although the door hinge is frictionless, the guard's boots have some amount of friction with the floor.

It's been a while since I've played HL2 but this isn't exactly how I remember it. While a lot of things were physics objects I thought the doors would just smoothly rotate towards their target position without any physics at all. You can't bump them shut with another physics object for instance.
by barcoder | 2025-11-23 21:49:39+00:00
Today I heard two negative cases from a friend interacting her clients. The first client replied to her emails by sending ChatGPT logs, apparently unable to communicate on his own. The second believed a ChatGPT hallucination that he was entitled to a special Amazon business account. She had to explain to him that ChatGPT will tell him convincing bullshit, which was news to him. One can only wonder what terrible choices and wrong beliefs he had made up until the moment of enlightenment.
by pfdietz | 2025-11-23 21:49:54+00:00
No, because it would require very high temperature. The air coming out of the compressor of a gas turbine would already be hotter than the water/steam coming out of a LWR. It would likely involve a core temperature of around 1000 C. The turbine inlet temperature of a modern jet engine is at least 1500 C. There would likely be thermal NOx production, so post treatment of the gas might be necessary in an open cycle system.
Show HN: BlankTrace – a Rust‑based MitM proxy to anonymize browser traffic
by mrorigo | 2025-11-23 21:50:25+00:00
Hey HN — I’ve built BlankTrace, a cross-platform (Linux/macOS) Rust CLI/daemon that acts as a local HTTP/HTTPS MITM proxy to anonymize your browser traffic.

## What it does / Why you might use it

Randomizes browser fingerprint: rotates User‑Agent (via rand_agents) and Accept‑Language headers.

- Strips or blocks cookies on requests/responses.

- Regex‑based tracker / domain blocking with whitelist support.

- Runs as a MITM proxy on localhost:8080 with full TLS interception (generates its own CA) for HTTPS.

- Logs proxy activity asynchronously into SQLite (requests, blocked domains, fingerprint rotations, cookie behavior).

- Provides a CLI interface: view stats, manage whitelist/blocklist, export data, etc.

## Technical details

- Written in Rust.

- Uses: hudsucker (for the MITM proxy), rand_agents (for realistic UA rotation), rusqlite (logging), tokio, clap etc.

- Configuration via config.yaml, allowing you to tune rotation mode, block patterns, retention policy, and more.

- Logging schema includes tables for domains, IPs, cookie attempts, fingerprint rotations, etc.

Requires trusting the generated CA certificate in your browser / OS for HTTPS interception.

MIT‑licensed.

## Current status

- Proxy is fully functional: HTTP/HTTPS interception works.

- Fingerprint randomization is working across requests.

- Cookie stripping and domain blocking are implemented.

- Async logging to SQLite is operational.

- Graceful shutdown, CA persistence, and log cleanup are supported.

- Known limitation: manual installation of the CA cert is required to intercept HTTPS.

## Why I built this

I wanted a lightweight, performant, and configurable proxy for browsing with more privacy — without relying on heavyweight browser extensions. BlankTrace gives you control over fingerprinting, cookies, and trackers, all under your own daemon.

## Get started

- GitHub repo: https://github.com/mrorigo/blanktrace

- Project homepage / docs: https://mrorigo.github.io/blanktrace/

- Build: cargo build --release → run ./target/release/blanktrace

Trust the generated CA certificate in your system / browser to enable HTTPS interception.

Use CLI: blanktrace stats, domains, whitelist, export, etc.

## Feedback / Help Wanted

I’d love feedback on configuration UX (are the defaults sane? what settings do you want exposed?)

It's new — testing on different platforms / browsers would help ensure stability.

Contributions (code, documentation, detection rules) are very welcome.

If you care about privacy, fingerprint randomization, or want to better understand your browser’s network behavior — I’d appreciate you checking it out.
by glitchcrab | 2025-11-23 21:50:47+00:00
FWIW, I've been daily driving Linux and an iPhone for almost 13 years now and I've never really had any issues with it. Maybe it's because I've not experienced some of the integration in the ecosystem and so I don't know what I'm missing.

I use Firefox as my browser across all devices so I can just share tabs via my account, and if I want to share text or files then LocalSend works just fine in lieu of Airdrop.
by emchammer | 2025-11-23 21:50:56+00:00
My macOS display system is pushing megapixels and with some good exceptions it feels like many apps have not much more visible information or options than an 80x25 VGA display. This is not to trash VGA displays which were often very well-designed. Some web pages now only show a single paragraph at a time on screen because of cumulative pop-ups, borders, and rounded corners.
by d4rkp4ttern | 2025-11-23 21:51:25+00:00
EDIT- forgot to mention the other part of issue (2): In cases where we want the LLM to decide task completion, in Langroid there's a DoneTool the LLM can use to signal completion. In general we find it useful to have orchestration tools for unambiguous control flow and message flow decisions by the LLM:

https://langroid.github.io/langroid/reference/agent/tools/or...
by vacuity | 2025-11-23 21:51:50+00:00
While the US education system is plenty bad, I expect that a substantial number of people who can't/don't cook are not held back due to illiteracy. To be fair, this thread seems to be discussing recipes and dishes, but even "tossing some meat in a crockpot and some rice in a rice cooker" is an improvement from ordering fast food.