MurphyA/hacker-news huggingface dataset:
Ask HN: Are they trying to hack me?
by dgrcode | 2025-12-23 15:52:36+00:00
I'm in the middle of an interaction that has raised a few red flags, and at this point I'm confident this is part of hacking attempt. But I thought asking here could give me a better perspective from an outsider. Here is the sequence of events:

Someone reaches out in Linkedin claiming to have full time and part time roles that match my profile. I say I could be interested in part time work and they immediately reply that there's a 4k monthly salary offer for 15-20 hours per week.

I reply that's half my hourly rate and they reply the client is almost willing to accept but wants to meet with me first. 1st red flag: no problem with doubling the offer

I accept and book a time with their technical person. 2nd red flag: the calendar had pretty much full availability

They tell me to complete a task before the meeting and provide a Microsoft Teams chat with someone from their team to talk about the task.

The person in the chat sends me screenshot of two issues. I ask if they have the code in github, to which they replied "github?". 3rd red flag

Then the same parson sends me a zip file and ask about my node version. 4th red flag

At this point I'm already suspicious and not willing to run that code on my machine. I get a fresh linux install on an old machine and download the code. I asked Cursor to find anything suspicious, and the only thing was a dependency mismatch between package.json and package-lock.json. I check the package present in package-lock, `json-map-source`, which is marked as a malicious package on https://security.snyk.io/package/npm/json-map-source. This package was removed from npm 18 days ago. Big red flag.

I check what's npm's resolution of that mismatch, and I find it would install `json-mappings`. I check on npm this package was created 18 days ago, and the first and only version is 2.3.8, which happens to be the same version flagged as malicious for the package `json-map-source`. Massive red flag

Furthermore, the package is not on git, it's uploaded by a throwaway email, and the README that is shown in npm list the yarn install command as `yarn add json-map-source` (the malicious package). In the code the package is just loaded and passed as middleware to an express app. The package has `sqlite3` as native dependency, which compiles native code.

As I'm writing this message I really don't see how this could be something other than a hack attempt, but I'd love to have someone else's input on this. Especially from people more knowledgeable about security than me, which is easy.

Thanks!
by exsf0859 | 2025-12-23 15:52:48+00:00
That particular code is idiomatic to anyone who worked with 2D bitmap graphics in that era.

pt == point, r == rect, h, v == horizontal, vertical, BSR(...,1) is a fast integer divide by 2, ORD4 promotes an expression to an unsigned 4 byte integer

The algorithms are extremely common for 2D graphics programming. The first is to find the center of a 2D rectangle, the second offsets a point by half the size, the third clips a point to be in the range of a rectangle, and so on.

Converting the idiomatic math into non-idiomatic words would not be an improvement in clarity in this case.

(Mac Pascal didn't have macros or inline expressions, so inline expressions like this were the way to go for performance.)

It's like using i,j,k for loop indexes, or x,y,z for graphics axis.
Show HN: Minimal ChatGPT App Starter Kit (MCP and SSE and Vercel)
by shuddha7435 | 2025-12-23 15:52:57+00:00
I open-sourced a minimal starter kit for building ChatGPT Apps backed by an MCP server
(Streamable HTTP + SSE) deployed to Vercel.

I kept it intentionally small and auditable after repeatedly running into issues with
SSE headers, CORS preflights, runtime differences, and deployment quirks.

The core repo is MIT licensed and meant as a working reference, not a framework.
There’s also an optional Pro package with extra examples, but the free repo stands on its own.

Feedback welcome.
by mindcrash | 2025-12-23 15:54:04+00:00
If you are mainly looking for a phone with user replaceable parts:

Fairphone: https://shop.fairphone.com/home

Widely available in the EU, in the US (and elsewhere) only through:

Amazon: https://www.amazon.com/dp/B0FTZFFVYC?th=1

Murena: https://murena.com/shop/smartphones/brand-new/murena-fairpho...

(Note: The Murena version also comes with /e/OS instead of vanilla Android)

If you're mainly looking for deGoogled phones:

Google Pixel w/ GrapheneOS (Pixel 10 support now in early beta)

Any Android phone compatible with /e/OS;

Any Android phone compatible with LineageOS;

Previously any Android phone compatible with CalyxOS would also be advisable but not any longer due to the lack of maintenance
by yabones | 2025-12-23 15:54:19+00:00
I agree, though it takes some discipline to keep it simple and small. It can be really easy to let your clusters get huge, tools get complex, operator sprawl, etc. but keeping it simple and understandable is worth it in the long term.

The biggest problem is that most of the popular tools are built for the target audience of "dedicated infra team", when in reality most k8s users don't really have that.
by OtherShrezzing | 2025-12-23 15:54:36+00:00
>but it turns out that not burning through VC cash on ping-pong tables and "growth at all costs" actually works.

This is at least a little disingenuous (or ill-thought-out), when you account for the fact the company is a spin-off/subsidiary of a large & successful Italian agency. While I'm certain these things helped keep the business sustainable, the fact of the matter is that the company was still incubated rather than bootstrapped. The only real difference is that it was incubated by its parent company, rather than by the VC industry.
by xoa | 2025-12-23 15:54:46+00:00
>The point of passkeys is that they're unexportable. Software implementations like Bitwarden/KeepassXC/etc. making them exportable go right against the point of the protocols.

No, that is absolutely not the point. The points of using pub/priv keys for asymmetric auth instead of passwords (symmetric, manually generated auth) are:

- Server-side (ie, central point) hacks no longer matter an iota from a user auth pov. No more having to worry about reuse anywhere else, about going around changing passwords, nada, because the server simply doesn't have anything that can be used for auth anymore at all. No more concerns about whether they're storing it with the right hash functions or whatever, they could publish all the public keys in plain text and it'd be irrelevant. This fantastically changes the economics of attacks, since now instead of hacking one place and getting thousands/millions/hundreds of millions of credentials you'd have to hack every single separate client.

- As a practical matter, the process means eliminating the whole ancient hodgepodge of password requirements (often outright anti-security) and bad practices and manual generation work. Everything gets standardized on something that will always be random, unique, and secure.

And that should be it. That's the point and the value, always was. The only goal should be to put a nice UX and universal standard around. But of course, modern enshittified tech being enshittified, they had to shove in a bunch of stupid fucking bullshit garbage like what you're talking about.
by packetlost | 2025-12-23 15:54:51+00:00
I think it's possible to write correct systems with dynamic languages, just not the ones we commonly use like Python and JavaScript. I find Clojure, for example to be one example of a dynamic language that is pretty easy to manage and I attribute that to the immutable nature and data-centric ethos. I'm sure there are other dynamic languages that would work as well.

Now, I wouldn't necessarily use Clojure on a huge multi-organization codebase (maybe it's fine, this is outside of my experience with it), but it can be the right tool for some jobs.
by fancyfredbot | 2025-12-23 15:55:45+00:00
Overly dismissive of the idea that you'd cut clock frequency to boost LLM inference performance by 46%. Yes, it's workload specific, but the industry is spending tens of billions on running that workload. It's actually quite smart to focus on it. People will certainly take that trade off if offered.

Still it's a good article and nice to see the old anandtech crew together. The random grammatical errors are still there but these days they are a reassuring sign the article was written by hand.
by BeetleB | 2025-12-23 15:57:53+00:00
From their privacy policy:

"If you are enterprises or developers using the API Services (“API Services”) available on Z.ai, please refer to the Data Processing Addendum for API Services."

...

In the addendum:

"b) The Company do not store any of the content the Customer or its End Users provide or generate while using our Services. This includes any texts, or other data you input. This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers.

c) For Customer Data other than those provided under Section 4(b), Company will temporarily store such data for the purposes of providing the API Services or in compliance with applicable laws. The Company will delete such data after the termination of the Terms unless otherwise required by applicable laws."
by heliumtera | 2025-12-23 15:58:15+00:00
Every single commit is Claude.
No human expert involved.
Would you trust your company database to an 25 dollars vibe session?
Would you live in a 5 dollars building?
Is there any difference from hand tailored suit, constructed to your measurements, and a 5 dollars t-shirt?
Some people don't want to live in a five dollars world.
by like_any_other | 2025-12-23 15:58:35+00:00
> AfD leaders frequently take positions favorable to the Kremlin, favoring a renewal of economic ties and gas imports and a cease of weapons aid for Ukraine. Their political opponents, however, have frequently accused them of acting not from conviction alone — but at the behest of Moscow. Greens lawmaker Irene Mihalic, for instance, last month called the party Russian President Vladimir Putin’s “trojan horse” in Germany.

If Politico has a an article calling the Green party's opposition to nuclear power a "position favorable to the Kremlin", I couldn't find it.
by steffoz | 2025-12-23 15:58:41+00:00
> Anyway, if I had my shot again, I'm not saying I'd renounce funding. Bootstrapping for a short period to figure things out is great, but funding also creates opportunities where an immediate business model is not clear. Opportunities exist for different approaches.

Absolutely! There are some problems that can only be tackled with some serious funding. There are people who enjoy the go-go-go attitude of VC-based startups so much. I'm not against VC funding per se. It's just important to recognize that it's not the only path and that there's nothing wrong if that route isn't for you, for any reason. You can be successful in other ways.
by davnicwil | 2025-12-23 15:58:49+00:00
I just think they genuinely don't know. I was years into travelling before I learned about this 'trick'.

For my part, I'd just always assumed the charge would be ultimately converted by my bank in any case. Seems obvious now I look back, but I honestly just didn't think about the trick.

Just as an example that gives evidence for this, sometimes you'll go to the same place multiple times and the norm is they ask but occasionally someone won't. So it's not a policy.

I presume the people who don't just don't know about it, don't want to bother me and aren't aware it will make a difference.
by MetaWhirledPeas | 2025-12-23 15:58:52+00:00
I lack the level of education and eloquence of the author, but I have my own notion that I think agrees with them: Specification is difficult and slow, and bugs do not care whether they are part of the official specification or not.

Some software needs formal verification, but all software needs testing.

On another subject...

> Tests are great at finding bugs ... but they cannot prove the absence of bugs.

I wish more people understood this.
Show HN: PremiumFlow – Track true cost basis for the "Wheel" strategy and LEAPS
by tchantchov | 2025-12-23 15:58:53+00:00
Hi HN,

Like many here, I started trading the "Wheel" strategy (selling puts/covered calls) to generate income. I quickly realized that tracking my true cost basis was a nightmare.

My brokerage shows the stock's purchase price, but it doesn't "know" that I've collected $400 in premiums over the last three months. I ended up with a massive spreadsheet that I had to update manually every Friday just to see if I was actually profitable.

I built PremiumFlow to automate this. It treats the option premium and the underlying stock as a single financial unit.

What’s inside:

Automatic Basis Adjustment: If you sell a call against a LEAP or stock, your "break-even" price updates instantly.

Assignment Risk: It monitors how close your short puts are to being ITM.

No Spreadsheet Mess: All the math (annualized returns, DTE, etc.) is handled in the dashboard.

I’d love for you to kick the tires and let me know what you think. I'm especially interested in feedback on the UI and any edge cases in your own options strategies that I might have missed!
by db48x | 2025-12-23 15:59:16+00:00
Yea, so? Debian goes back 32 or more years, and quilt dates to approximately the same time. It’s probably just a year or two younger than Debian.

At Mozilla some developers used quilt for local development back when the Mozilla Suite source code was kept in a CVS repository. CVS had terrible support for branches. Creating a branch required writing to each individual ,v file on the server (and there was one for every file that had existed in the repository, plus more for the ones that had been deleted). It was so slow that it basically prevented anyone from committing anything for hours while it happened (because otherwise the branch wouldn’t necessarily get a consistent set of versions across the commit), so feature branches were effectively impossible. Instead, some developers used quilt to make stacks of patches that they shared amongst their group when they were working on larger features.

Personally I didn’t really see the benefit back then. I was only just starting my career, fresh out of university, and hadn’t actually worked on any features large enough to require months of work, multiple rounds of review, or even multiple smaller commits that you would rebase and apply fixups to. All I could see back then were the hoops that those guys were jumping through. The hoops were real, but so were the benefits.
by lcnPylGDnU4H9OF | 2025-12-23 15:59:49+00:00
You could reduce it to a single hardware security key without a password and it would be more secure. The problem—in this case and in general—is using passwords and OTPs for anti-phishing; with a hardware key, there is no way for the phishers to gain access to the account (without being in the room or in possession of the key), even if they successfully convince their victim to log in.

No affiliation other than using their products:

https://www.yubico.com/
by ndiddy | 2025-12-23 15:59:59+00:00
> Our North Star is ‘1 engineer, 1 month, 1 million lines of code.’

How do they intend to accomplish this? Assuming 40 hour work weeks (160 hours/month), and even assuming a developer would spend their entire 8 hour work day solely reviewing generated Rust code, that would still be ~104 lines of code per minute. At that point what value does the engineer they're hiring even have if they'd just be scrolling through the code and giving it a cursory glance?
by WorldMaker | 2025-12-23 16:00:22+00:00
"Vote with your wallet" implies that the rich deserve more votes. Individual action in dollars per vote simply can't matter against the rivers of wealth in ad spend and investors. It's not just a flawed strategy, but sometimes believing in "vote with your wallet" signifies consent or at least complicity that the advertiser buying a lot of ads or the rich idiot with a lot of money invested in gaining your private data "should" win.

We need far better strategies than "vote with your wallet". I think it is at least time to get rid of "vote with your wallet" from our collective vocabularies, for the sake of actual democracy.
by packetlost | 2025-12-23 16:00:35+00:00
As someone who up until recently would have agreed with you, both of these are fundamentally familiarity issues. Nix's error messages really aren't that bad, but chances are there's exactly one line out of 200 that tells you what's wrong. Learning to read stack traces for a new language is part of learning that language.

I've not had issues with Nix APIs, at least not Nixpkgs or the language builtins. When something does break for me, it's usually some random JavaScript package that had some external dependency change. Nixpkgs is pretty well organized and I find navigating it not that hard once you read the packaging guidelines. find / fzf / ripgep / etc. are all great at this, as file and folder names are critical to the organization of nixpkgs.

The big turning point for me was trying to build and package a non-trivial application and build a NixOS module for it.
Show HN: Openinary – Self-hosted image processing like Cloudinary
by fheysen | 2025-12-23 16:01:27+00:00
Hi HN!

I built Openinary because Cloudinary and Uploadcare lock your images and charge per request.

Openinary lets you self-host a full image pipeline: transform, optimize, and cache images on your infra; S3, Cloudflare R2, or any S3-compatible storage.

It’s the only self-hosted Cloudinary-like tool handling both transformations and delivery with a simple URL API (/t/w_800,h_800,f_avif/sample.jpg).

Built with Node.js, Docker-ready.

GitHub: https://github.com/openinary/openinary

Feedback welcome; especially from Cloudinary users wanting the same UX but on their own infra!
by unethical_ban | 2025-12-23 16:02:50+00:00
Thanks for posting.

For those not familiar: there were five screenings in the prior week that journalists attended to discuss it. She was aware of those and did not attend.

When she did look at it, her feedback was minor, and they made adjustments.

Then she killed it a day after her delayed feedback, on the weekend it was to air.

That context, combined with the response above, is telling.

She is at absolute best, entirely unfit and amateur for this role combined with dangerous arrogance.

More likely, she is the malevolent puppet of a billionaire ally of the current corrupt administration.
by PhotonHunter | 2025-12-23 16:03:40+00:00
I read SubiculumCode's post in the same context as bane's, speaking to the current environment.

You're saying that a group having to spend all of its time fundraising has always been true in your lifetime and you link it to your time as a grad student decades ago and earlier when you were an undergrad. Do I have that right? The dominance of fundraising might have been true for your specific experience and viewpoint, but I don't understand your basis for claiming it was universal: it certainly wasn't my experience (R1 engineering, not software) nor my colleagues around that time.

Complaints about fundraising and administrivia have always been plentiful but actual time spent on teaching and service and research were dominant, with the expected proportions of the three legged stool varying based on role and institution. What SubiculumCode and bane and myself are reacting to now is the dramatic shift in how dominant (because funding has been pulled, funding allocation methods have suddenly shifted) and unproductive (fewer summary statements, less or no feedback from SROs and POs, eliminated opportunities for resubmissions) that work has become. The closest I can remember to the current was around the aftermath of the 2008 recession and 2013 government shutdown and that pales in comparison to the disruption of now.

edit: best study I could casually find is Anderson and Slade (https://link.springer.com/article/10.1007/s11162-015-9376-9) from 2016 that estimates grant writing at about 10% effort.
by mikkupikku | 2025-12-23 16:04:40+00:00
If you ever decide to visit America and learn what it's like firsthand, I encourage you to try this. Just make sure you know a good orthodontist first, and probably a good therapist too, because you're going to get thrown to the ground, handcuffed and sent to jail. There is no world in which trying to bribe your way out of an American traffic ticket makes more sense than just taking and paying the ticket. Even trying this is genuinely one of the stupidest things you could ever do.
Show HN: VeriMed – open-source medical license verification
by dhrey112 | 2025-12-23 16:05:04+00:00
Hi HN,

I built VeriMed while working on an AI-powered telemedicine platform. I quickly realised that verifying whether a healthcare provider is legitimately licensed is surprisingly hard.

Every country has a different registry, a different API format (REST, SOAP, FHIR), and different access requirements. I couldn't find a unified solution, so I built one.

VeriMed:
- Connects to 5 national medical registries:
- USA (NPI)
- France (RPPS)
- UAE (DHA)
- Netherlands (BIG)
- Israel (MOH)
- Falls back to AI document verification when registries aren't available
- Uses fuzzy name matching to handle variations (e.g., "Greg" vs "Gregory")
- Production-ready with Docker, Kubernetes manifests, and health checks
- MIT licensed, free to self-host
- Enterprise extension available:
- SSO (SAML 2.0 & OIDC)
- RBAC (Admin, Reviewer, Viewer)
- Audit Dashboard & CSV Export
- Bulk CSV Import Wrapper

Tech stack: NestJS, TypeORM, OpenAI (optional), Fuse.js

GitHub: https://github.com/daretechie/verimed

I'd love feedback on the architecture or suggestions for additional country adapters to prioritise.
by Spivak | 2025-12-23 16:05:31+00:00
At this time I'm not really sure if anyone can really say there's a 'point' to passkeys anymore. They just are exportable now, both Google's and Apple's implementation are synced instead of device-bound putting them at the level of Bitwarden / KeepassXC. Backups and multi-device have become a critical feature for users which breaks attestation so it's really just those weirdos with Yubikeys.

I think we're verrry slowly inching toward shedding all the security nerd self-indulgences and getting to what I think is the eventual endgame which PassKeys are just keys and ultimately a fairly user friendly way of getting people to use a password manager without it feeling like one. All the other features seem like noise.
by fooblaster | 2025-12-23 16:05:44+00:00
I am so confused by metas ecosystem. Perhaps others have the same issues. I have mountains of torchscript code. It worked fine for me - had no issues making the python compatible. Torchscript is now deprecated, and the ostensible replacement is torch.export and either: AOTInductor or executorch. torch.export is so limited - no control flow at runtime at all, less support of python than torchscript. It is far more work to hoist all the control flow out of the model than it ever was to make the model torchscript compatible. Feel like meta has moved on, but I'm still stuck in the past here.
by notKilgoreTrout | 2025-12-23 16:05:52+00:00
Pretty funny stuff. The democrats want to be angry about any job loss and the Republicans especially love the negative externality businesses so no one wants to consider the weight of the good in ruining Jim Beam?

I personally think Trump has a lot more in common with Maduro than he would like to advertise. He was essentially from the social left but realized the right is more gullible.
by silisili | 2025-12-23 16:06:32+00:00
> I'm assuming here that you mean that Nagle's algorithm is on by default, i.e TCP_NODELAY is off by default.

Correct, I wrote that backwards, good callout.

RE: fingerprinting, I'd concede the point in a sufficiently lazy implementation. I'd fully expect the application layer to handle this, especially in cases where this matters.