MurphyA/hacker-news huggingface dataset:
Show HN: ZeroNotes – Client-side encrypted notes (AES-256-GCM and Argon2id)
by Bjoern_Dev | 2025-12-08 11:34:33+00:00
Hi HN, I'm Björn, the creator of ZeroNotes.

I built this because I wanted a note-taking tool that offers the convenience of cloud sync but strictly ensures privacy and that anyone could read the data.

The Architecture: Unlike apps that manage keys on the server, ZeroNotes is built on a strict zero-knowledge architecture.

Frontend: Angular (hosted on Nginx). All crypto operations happen here.

Backend: Node.js + Supabase (PostgreSQL) for storage and auth.

Encryption: We use Argon2id for key derivation (from your password + salt) and AES-256-GCM for the content encryption. Keys are never sent to the server, only the ciphertext. All meta data is encrypted.

Sharing: This was the hardest part. I implemented ECIES (Elliptic Curve Integrated Encryption Scheme) to allow secure sharing of categories between users without sharing the master password.

Why another note app? Most "secure" apps are either clunky to use or closed source/proprietary. I wanted something fast, clean, and transparent about its cryptography. Mobile app (iOS/Android) and file storage is on the way.

I'd love some feedback on the Pro features, so here is a code for 1 month free on the Pro Monthly subscription (limited to 10 redemptions): ZERONOTES_PRO_FREE_MONTH (Can be cancelled immediately in the Dodo user dashboard)

Feedback / Bugs / Security? You can reach me directly at bjoern [at] zeronotes.me.

I'd love your feedback on the crypto implementation and the UX!
by ChrisMarshallNY | 2025-12-08 11:36:23+00:00
> VSS

I just had trauma!

I will say that SourceSafe had one advantage: You could create "composite" proxy workspaces.

You could add one or two files from one workspace, and a few from another, etc. The resulting "avatar" workspace would act like they were all in the same workspace. It was cool.

However, absolutely everything else sucked.

I don't miss it.
by dzdt | 2025-12-08 11:36:44+00:00
> The latest work has again been made possible by funding from Time Team, for a new programme they will be making next year.

This is funded by a TV show whose primary concern is ratings earned by how exciting is the entertainment value. I think that explains the low-content but very breathless press-release article now: they want to hype it up for the show to get viewers. This smells like show-biz hype rather than scientific excitement.
by Lio | 2025-12-08 11:36:49+00:00
>> Also, if you want privacy, don't use crypto.

> Can you tell me another way of buying something over the internet without tying the purchase to a government ID?

Isn't the real question more, does crypto actually allow you buy things without tying the purchase to a government ID?

I'm no expert but I regularly see articles about de-anonymisation. This leads me to be sceptical about claims to privacy, certainly given enough time and motivation by a government actor.
Show HN: Web app that lets you send email time capsules
by walrussama | 2025-12-08 11:37:22+00:00
I had an issue where I would journal stuff, and then never look at what I wrote. So I thought it'll be cool to schedule something that will get sent to you at a later time (like a time capsule). Also, was inspired by futureme, where you can send yourself letters that'll arrive in the future.
by ethbr1 | 2025-12-08 11:38:45+00:00
I'd extend that a bit, in the same vein as TFA: you should always be aware of who you're taking freedom away from and who you're giving it to, in practical actual terms, when designing or deploying revolutionary technology.

If you deploy a non-government fiat monetary system... most of your users are going to be people who want to avoid government currency controls.

Consequently, without a counterbalance, they're going to skew the industry towards their needs.

In the same way that allowing the largest advertising company in the world to own the most popular browser in the world has some conflicts of interest.

Money sets strategic direction over the long term.
by FieryMechanic | 2025-12-08 11:39:25+00:00
Warnings are often ignored by developers unless you specifically force warnings to be compile errors (you can do this in most compiler). I work on TypeScript/C# code-bases and unless you force people to tidy up unused imports/using and variables, people will just leave them there.

This BTW can cause issues with dependency chains and cause odd compile issues as a result.
Ask HN: Which domain name registrar do you use?
by not-so-darkstar | 2025-12-08 11:39:30+00:00
is it still a smart move to choose cloudfare considering the recent accidents? the prices are low and you have the guarantee they will not disappear in 10 years or sold to an ad agency (see Gandi).

P.S. i'm interested in users with their own website for personal use
by tranq_cassowary | 2025-12-08 11:39:59+00:00
Google has implemented lots of privacy and security features in AOSP over time. The app sandbox and permission model has evolved a lot, in a good direction. The codebase is also modernized with the increasing adoption of memory safe code. At least Google seemes to have a thought out development strategy to enhance security and privacy, contrary to the projects you mentioned elsewhere in this Hacker News thread.

Also, what you link doesnt prove what you think it does. Manifest V3 is a very good thing for privacy and security. It restricts and controls the access of extensions much more. With MV2 you have much less control over your data.
by ohc | 2025-12-08 11:40:26+00:00
Great article, very impressive to solve the entire game, rather than just individual puzzles.

PS: Good chance that if you're reading these comments that you will appreciate this video by 2swap, visualising solutions to Rush Hour in 3D: https://youtu.be/YGLNyHd2w10?si=fGFqzEbmV3utbA0O
by jll29 | 2025-12-08 11:40:54+00:00
A great reason to try and support small distros is that older computers can still be used as long as they work.

There are also some charities that ship old PCs to Africa, install a small Linux distro on them, e.g.:

https://www.computers4charity.org/computers-for-africa

https://worldcomputerexchange.org/
by pta2002 | 2025-12-08 11:41:27+00:00
I have an X1 extreme. I’ve never gotten it to last over 2h on Windows. On Linux it can last an hour or so more if I turn off the NVIDIA GPU, but otherwise it’s still abysmal.

Then there’s the stupid BIOS warning that requires you to press ESC for the computer to boot if it’s not plugged in to the official charger, which means that if it ever reboots at night it’ll just keep you awake (because the power management hasn’t been initialized yet so it’s stuck at 100% CPU) until you go press ESC.

Oh and it thermal throttles all the time so the CPU performance is good for a few minutes and then it’s just awful.
Show HN: I Built an AI platform for trainers to manage workouts and diets
by shuvrokhan | 2025-12-08 11:42:37+00:00
Hi HN, I built ExtremeFitness to help personal trainers manage workout and diet plans without relying on PDFs, WhatsApp, or Google Sheets.

It allows trainers to: - Create personalized workout plans - Add diet plans - Use a 700+ exercise library - Let clients access everything in one place - Use AI to assist in plan creation

This is still early-stage and I’m actively improving it. I would really appreciate honest feedback on the product, UX, and feature direction.

Happy to answer any technical questions.
by amluto | 2025-12-08 11:42:54+00:00
You seem to be talking mostly about the CD part. Some thoughts:

On the one hand, CD workflows are less exposed than CI workflows. You only deploy code that has made it through your review and CI processes. In a non-continuous deployment model, you only deploy code when you decide to. You are not running your CD workflow on a third-party pull request.

On the other hand, the actual CD permission is a big deal. If you leak a credential that can deploy to your k8s cluster, you are very, very pwned. Possibly in a manner that is extremely complex to recover from.

I also admit that I find it rather surprising that so many workflows have a push model of deployment like this. My intuition for how to design a CD-style system would be:

1. A release is tagged in source control.

2. Something consumes that release tag and produces a production artifact. This might be some sort of runner that checks out the tagged release, builds it, and produces a ghcr image. Bonus points if that process is cleanly reproducible and more bonus points if there's also an attestation that the release artifact matches the specified tag and all the build environment inputs. (I think that GitHub Actions can do this, other than the bonus points, without any secrets.)

3. Something tells production to update to the new artifact. Ideally this would trigger some kind of staged deployment. Maybe it's continuous, maybe it needs manual triggering. I think that, in many production systems, this could be a message from the earlier stages that tells an agent with production privileges to download and update. It really shouldn't be that hard to make a little agent in k8s or whatever that listens to an API call from a system like GitHub Actions, authenticates it using OIDC, and follows its deployment instructions.

P.S. An attested-reproducible CD build system might be an interesting startup idea.
Ask HN: Async updates: Input friction vs. Output friction?
by sangkwun | 2025-12-08 11:43:27+00:00
I'm building a tool for async standups, but I'm torn on where to focus the automation first. I see two distinct failure points:

1. Input Friction (The Maker's Tax)

Context Switching: Stopping coding to recall yesterday's work and writing a paragraph is a huge flow-killer for devs.

Result: Updates become vague ("fixed stuff") or treated as a mindless chore.

2. Output Friction (The Manager's Tax)

Signal-to-Noise: Managers have to parse scattered logs across Slack/Jira to reconstruct the actual project state.

Result: Updates are posted but ignored because consuming them takes too much cognitive effort.

In your experience, which bottleneck is the bigger problem?

Should I prioritize making it easier to write (auto-drafting from logs) or easier to read (auto-summarizing context)?
by jillesvangurp | 2025-12-08 11:43:43+00:00
The main obstacle here is the energy density of those is much lower. We're talking 20-30wh/kg. So you would need about 7-8x more mass compared to a 170wh/kg battery. For ships like this (capable of 5000km), the tanks would take up most of the ship with barely any space for useful load.

Otherwise, it's not a bad idea as you could pump the pre-charged fluids in/out and even ship the fluid around with tankers; which opens up the possibility of fueling at sea. Spills would be bad. But probably better than oil as the toxic fluids dilute more easily. But it would still be a bad day for marine life. It might work for shorter ranges.
by Gualdrapo | 2025-12-08 11:44:04+00:00
Location: Bogotá, Colombia Remote: Yes Willing to relocate: No Technologies: HTML, CSS, JavaScript, SVG, TeX/ConTeXt, PHP, Jekyll Portfolio: https://miler.codeberg.page/ Résumé-CV: https://codeberg.org/miler/curriculum-vitae/raw/branch/main/curriculum-en.pdf Email: Please see Portfolio or CV/Résumé GitHub: https://github.com/acidrums4/

Professional graphic designer with experience in both frontend and backend web development (PHP; Wordpress, Framer, some Joomla and some Typo3), iconography, editorial design/typesetting with ConTeXt and general graphic design. Please feel free to check my portfolio for some examples of my work.
by maaaaattttt | 2025-12-08 11:44:15+00:00
In recent months I changed views and shifted from the desilluioned "this is a casino" mindset that is described in this article to a "we need this now" one. An example in this article [1], the US can now unilateraly decide to prevent an individual anywhere in the world from having a functioning financial life and this because of the quasi (western) duopoly that is Visa and Mastercard. Nothing against the US in general, this is simply too much power to put in a single decisional entity, whatever/wherever it is. The "crypto" related systems now seem like a needed extra option to the current payment system (the same way cash is almost always an alternative to credit/debit card payment and vice versa)

[1] https://www.lemonde.fr/en/international/article/2025/11/19/n...
by shuvrokhan | 2025-12-08 11:44:36+00:00
Hey, I am Nazmul

I built ExtremeFitness after watching trainers manage clients with PDFs, WhatsApp, and Google Sheets — which gets messy the moment they try to scale.

This is still early-stage, and I’m actively improving it. I’d really appreciate blunt feedback on: - What feels unnecessary - What feels missing - What would make this actually useful long-term

Happy to answer any technical questions as well.
by luckys | 2025-12-08 11:46:08+00:00
The speedy success of Germany invading France in 1940 had more to do with their use of radios and giving commanders on the field some latitude on how to accomplish objectives than with the consequences of the Versailles treaty on the population. The French Army and the British Expeditionary Force were more stuck in a WWI style of command from the top that proved vulnerable to speed. But it wasn't clear cut as the "fast attack" plan was initially rejected by the German top brass, themselves still stuck in the past.
by Gualdrapo | 2025-12-08 11:46:35+00:00
SEEKING WORK | Remote

Location: Bogotá, Colombia Remote: Yes Willing to relocate: No Technologies: HTML, CSS, JavaScript, SVG, TeX/ConTeXt, PHP, Jekyll Portfolio: https://miler.codeberg.page/ Résumé-CV: https://codeberg.org/miler/curriculum-vitae/raw/branch/main/curriculum-en.pdf Email: Please see Portfolio or CV/Résumé GitHub: https://github.com/acidrums4/

Professional graphic designer with experience in both frontend and backend web development (PHP; Wordpress, Framer, some Joomla and some Typo3), iconography, editorial design/typesetting with ConTeXt and general graphic design. Please feel free to check my portfolio for some examples of my work.
by Kim_Bruning | 2025-12-08 11:46:47+00:00
All three appear to be technically correct, but are (normally) only incidental to the operation of neurons as neurons. We know this because we can test what aspects of neurons actually lead to practical real world effects. Neurophysiology is not a particularly obscure or occult field, so there are many many papers and textbooks on the topic.(And there's a large subset you can test on yourself, besides, though I wouldn't recommend patch-clamping!)
by Bombthecat | 2025-12-08 11:47:00+00:00
Damn, and before that, Titan from Google: https://research.google/blog/titans-miras-helping-ai-have-lo...

We are not at the end of AI :)

Also, someone claimed that NVIDA combined diffusion and autoregression, making it 6 times faster, but couldn't find a source. Big if true!
by RealityVoid | 2025-12-08 11:48:01+00:00
You can definitely have local variables on the stack. I don't know where you got that you don't use the stack. Heap is kind of a no-no, although memory pools are used.

> If every variable has a fixed address, and one of those addresses goes bad, a patch can be loaded to move that address and the mission can continue.

You can and do put the stack and heap pool at fixed memory ranges, so you can always do this. I'm not sold at all with this reasoning.
by reactordev | 2025-12-08 11:48:42+00:00
They need to have very strict security clearance requirements and maintain them throughout the life of the project or their tenure. People don’t realize this isn’t some little embedded app you throw on an ESP32.

You’ll be interviewed, your family, your neighbors, your school teachers, your past bosses, your cousin once removed, your sheriff, your past lovers, and even your old childhood friends. Your life goes under a microscope.
by palata | 2025-12-08 11:48:54+00:00
> We don't have to bring Google or Apple into this relationship, it's a choice people make because the prefer texting and being available to everyone they ever met 24/7

You're changing the discussion now.

The original point is this: Given that people want to be able to text with their friends in what is perceived as a normal way, how can they do it without a smartphone?

If you change the rules ("Given that people are fine being disconnected"), of course it changes everything.
by josters | 2025-12-08 11:49:15+00:00
While the article makes several implicit references to studies, it doesn’t actually cite any. After some quick research I found what seems to be the "6 A.M. to eat old rice" study[1].

Abstract:

"Background: Globally, hot cooked refined rice is consumed in large quantities and is a major contributor to dietary glycaemic load. This study aimed to compare the glycaemic potency of hot- and cold-stored parboiled rice to widely available medium-grain white rice.

Method: Twenty-eight healthy volunteers participated in a three-treatment experiment where postprandial blood glucose was measured over 120 min after consumption of 140 g of rice. The three rice samples were freshly cooked medium-grain white rice, freshly cooked parboiled rice, and parboiled rice stored overnight at 4 °C. All rice was served warm at 65 °C. Chewing time was recorded.

Results: incremental area under the curve (iAUC) of the control rice, freshly cooked medium-grain white rice, was the highest: 1.7-fold higher (1.2, 2.6) than reheated parboiled rice (p < 0.001) and 1.5-fold higher (1.0, 2.2) than freshly cooked parboiled rice (p = 0.001). No significant difference in postprandial glycaemic response was observed between freshly cooked and reheated parboiled rice samples (p = 0.445). Chewing time for 10 g cold-stored parboiled rice was 6 s (25%) longer and was considered more palatable, visually appealing and better tasting than freshly cooked medium-grain (all p < 0.05).

Conclusions: For regular consumers of rice, reheating cooked rice after cold storage would lower the dietary glycaemic load and, in the long term, may reduce the risk for type 2 and gestational diabetes. More trials are needed to identify the significance."

[1]: https://pmc.ncbi.nlm.nih.gov/articles/PMC5452205/
by weinzierl | 2025-12-08 11:49:46+00:00
In git you can have only one worktree per branch. For example, if you have a worktree on main you cannot have another one on main.

I personally find this annoying. I usually like to keep one pristine and always current working copy of main (and develop if applicable) around for search and other analysis tasks[1]. Worktrees would be ideal and efficient but due to the mentioned restriction I have to either waste space for a separate clone or do some ugly workarounds to keep the worktree on the branch while not keeping it on the branch.

jujutsu workspace are much nicer in that regard.

[1] I know there are tons of ways search and analyze in git but over the years I found a pristine working copy to be the most versatile solution.
by chris_wot | 2025-12-08 11:50:15+00:00
There is also the “Fuck off support ticket”. I got this from FreshService - they changed the way they did loan requests in such a way that you could loan out one item twice with the status of delivered on both requests. So then you have two people who have been delivered the same item, which is clearly impossible.

Anyway, after arguing with them from for months, they acknowledge it as a bug. I wait for it to be fixed, months roll away. Then they tell me it has been lodged as an “enhancement request”.

Don’t deal with FreshService. Needless to say, we are soon to be leaving them.
by sholain | 2025-12-08 11:51:31+00:00
- I don't think it's even reasonable to suggest that 1000 people all coming up with variations of some arbitrary bit of code either deserve credit - or certainly 'financial remuneration' because they wrote some arbitrary piece of code.

That scenario is already today very well accepted legally and morally etc as public domain.

- Copyleft is not OSS, it's a tiny variation of it, which is both highly ideological and impractical. Less than 2% of OSS projects are copyleft. It's a legit perspective obviously, but it hasn't bee representative for 20 years.

Whatever we do with AI, we already have a basic understanding of public domain, at least we can start from there.
by ramon156 | 2025-12-08 11:51:51+00:00
Can I change the topic to the current hiring process?

Decline mails feel like an even bigger fuck you. Sometimes you don't get a proper reason and it leaves you confused.

There's this one company I applied to, I already knew someone there (not close or anything) and from his tone it seemed like I could help them out a lot. They simply needed more manpower, and I already worked with that stack.

I got declined via mail within an hour. How am I supposed to interpret this as "hmm, they checked my resume, had a long thought and decided it wasn't worth it to invite me for a quick 1:1"? It just screams "we either automate everything or don't even bother looking at our options".

They also finished with a "please subscribe to our newsletter".

How am I supposed to take these applications seriously if they basically tell me to fuck off?
by jijijijij | 2025-12-08 11:54:05+00:00
I mean, the process is on-going, but it's not like those are isolated incidences. The wikipedia article has quite a collection of facts which are extremely sus, especially in concert. Like systematically using their parliamentary rights to "liberate" oddly specific defense information.

Listen, I don't want to defend Merkel or Schröder. They both did a lot of damage to Germany. But I do believe, they genuinely thought Russia could be checked by economic integration. This was evidently false in hindsight. Merkel's politics is characterized by inaction and aversion, so not going into conflict with Russia absolutely tracks. Gas dependency and collapsing bridges have this in common.

Did you know Merkel is fluent in Russian and Putin is fluent in German? They never spoke the same language in any meeting. Then there was the dog incident. Merkel for sure was no friend of Putin, and certainly did not entertain any late soviet imperial fever dreams.
by tranq_cassowary | 2025-12-08 11:54:17+00:00
GrapheneOS doesnt really proactively attack GNU/Linux. What happens is that there are posts on the internet about GrapheneOS or mentioning GrapheneOS in which or under which completely wrong comparisons between GrapheneOS and GNU/Linux get posted. It makes sense that you care to clarify or correct if you spot people are talking about your project and are (intentionally or unintentionally) spreading wrong information about it by making comparisons based on misconceptions or falsehoods.

The thing you link about restricting network traffic doesnt make much sense. GrapheneOS has a proper network permission which other OSes dont have. The outbound traffic restrictions to certain destinations which are being referred to are just a bad approach. You can send the traffic to one server and just process it there and send out to other servers.

You also say :

> Also, if I explicitly don't trust Google with anything, GOS is extraordinarily insecure for me until a new vendor

If thats the case, dont opt for GNU/Linux either given the large code contributions made by Google. Also avoid any software built with LLVM, written in Go, written in Flutter, using Angular, ...

The two "problems" you link arent really huge security issues. How is GrapheneOS having access to the embargoed patches and being able to ship them a security issue? Also the planned sideloading restrictions dont even apply to GrapheneOS. It would only apply to certified OS that license Google Mobile Services. Also, that isnt even a security issue. Its a freedom issue.
by syklemil | 2025-12-08 11:56:34+00:00
I think another macro, `json!()` works better as an example for that: inside the `json!()` you write something very similar to actual JSON. So when you see a `!` you know that there might be something out-of-the-ordinary following: https://docs.rs/serde_json/latest/serde_json/macro.json.html

Incidentally it also means that formatters like `rustfmt` won't apply the usual rules. For the macros that don't really deviate from ordinary Rust syntax, that can be a bit annoying.