MurphyA/hacker-news huggingface dataset:
by dadrian | 2025-12-11 18:28:50+00:00
Network DLP is also not bulletproof so I'm not sure what the argument is there. These things are all best effort.

> if you have DLP at work, open the integrated browser in VS Code and notice how you can send protected test strings without anything chirping you.

I recognize it's not instrumented, but how are protected strings getting there in the first place?
Show HN: Free Security audit that checks what other tools miss
by renbuilds | 2025-12-11 18:29:01+00:00
Built this after almost shipping Stripe key in a production bundle.

It runs 6 checks in a few seconds:

- SSL Certificate - validity, expiration, protocol - DNS Health - SPF, DKIM, DMARC (email spoofing protection) - Security Headers - CSP, HSTS, X-Frame-Options - Blacklist Status - spam/malware list checks - Secret Scanner - finds leaked API keys in public JS bundles (AWS, Stripe, Firebase, etc.) - Ghost API Hunter - exposed Swagger docs, GraphQL endpoints, debug routes

Everything gets A+ to F grades with plain English explanations.

The last two are the differentiators, most SSL checkers exist, but few tools passively scan your frontend for shipped secrets or forgotten /api endpoints.

Looking for feedback on false positive rates and what other checks would be useful.
by fouronnes3 | 2025-12-11 18:29:01+00:00
I want to read a short scify story set in 2150 about how, mysteriously, no one has been able to train a better LLM for 125 years. The binary weights are studied with unbelievably advanced quantum computers but no one can really train a new AI from scratch. This starts cults, wars and legends and ultimately (by the third book) leads to the main protagonist learning to code by hand, something that no human left alive still knows how to do. Could this be the secret to making a new AI from scratch, more than a century later?
by hinkley | 2025-12-11 18:29:06+00:00
FOSS is a bit like blogging in that a lot of it seems to be motivated by a desire to win an argument you lost once already.

I’m a maintainer on one library in small part because of an argument I had with a maintainer of a similar library years ago. And nearly a maintainer on another one. I voted with my feet and made improvements to DX an/or performance because I can’t pull down a wrongheaded project but I can pull up a better one.

(Incidentally I looked at his issue log the other day and it’s 95% an enumeration of the feature list of the one I’m helping out on. Ha!)
by Nevermark | 2025-12-11 18:29:14+00:00
That is a good point. Is the image highly sexual? Are their children in the image?

Not a perfect CP detection system (might detect kids playing in a room with a rated R movie playing on a TV in the background), but it would be a good first attempt filter.

Of course, if you upload a lot of files to Google Drive and run a sanity check like this on the files, it is too late to save you from Google.

Avoiding putting anything with any risk potential on Google Drive seems like an important precaution regarding the growing tyranny of automated and irreversible judge & juries.
Show HN: CyberCage – Security platform for AI tools and MCP servers
by ziyasal | 2025-12-11 18:29:15+00:00
We've been building with AI tools and noticed there wasn't a good way to manage MCP servers across a team or see what's actually flowing to LLM providers. Who's running what? Which tools are approved? What data is going where or whats shared on AI websites?

So we built CyberCage (<https://cybercage.io>).

What it does:

MCP Management — Auto or manual discovery of MCP servers, with approval workflows. Manage allowed MCP servers org-wide (down to individual tools). Secure MCP catalog (integrates with GitHub's MCP Catalog).

Operations — Manage allowed AI applications org-wide. Full audit logs (Splunk integration available). Notifications via Slack, Teams, Webex, webhooks.

Works with:

AI IDEs: Claude Code, Cursor, VS Code, Windsurf, Antigravity. Low-code platforms: n8n (native integration).

In private beta:

On-device network agent for configured AI domains. Content inspection for PII and sensitive data. Packet metadata anomaly analysis.

Coming soon:

BYOLLM (bring your own models for inspection). Browser extensions.

See it in action: <https://youtu.be/Zy7XhkQkUlk>

We built this for visibility and control over AI tooling without slowing teams down.

P.S. We're planning to open source CyberSmol v1.0 — a small model fine-tuned for AI threat detection — once it's ready.

Happy to answer questions ♥
by Sanzig | 2025-12-11 18:29:30+00:00
Well, sure, they won't be thermally random, but they will be significantly perturbed from their nominal orbits, particularly at the lower orbital altitudes.

Solar flares cause atmospheric upwelling, so drag dramatically increases during a major solar flare. And the scenario envisioned in the paper is basically a Carrington-level event, so this effect would be extreme.
by tehwebguy | 2025-12-11 18:29:51+00:00
> Mickey Mouse Clubhouse's lazy CG animation and unimaginative storytelling

Yes, this show is absolute dogshit, pure slop and yet it ended in 2016. The dialog is completely braindead, episodes barely make sense.

The ancient Mickey Mouse cartoons are so good! Just a few I loved which are still very funny and I bet a few people remember:

- 1940: Mr. Mouse Takes a Trip ("Tickets please!")

- 1959: Donald in Mathmagic Land
by rcarmo | 2025-12-11 18:29:59+00:00
As a bilingual/trilingual user (I have English, Portuguese, Italian, Spanish, French and Chinese keyboards enabled, and use the first three on a daily basis), I have had surprisingly few issues with either swiping or pecking at the keyboard, perhaps because I automatically switch to pecking the instant I spot swiping going down the “wrong” decision tree.

But I also think having this many keyboards enabled makes iOS basically throw up its tiny virtual hands in frustration and nullifies most fancy predictions.

(This was mostly swiped in on an iPhone 15 Pro running iOS 26 with very minor hiccups)
by torginus | 2025-12-11 18:29:59+00:00
Isn't Disney on of the oldest tech companies of all time?

The engineering that goes into their parks is insane, and they have been consistently pushing live experiences. The logistics that goes on in the background to let as many people as possible have a good experience is also insane.

And that's just Disneyland. There's a guy on youtube who makes fascinating hour-long documentaries about every aspect of Disneyland.
by barbazoo | 2025-12-11 18:30:26+00:00
> I can sort of respect that the dependency list is pretty small, but at the cost of very unmaintainable 20k+ lines of utilities. I guess it really wanted to avoid supply-chain attacks.

> Some of them are really unnecessary and could be replaced with off the shelf solution

Lots of people would regard this as a good thing. Surely the LLM can't guess which kind you are.
by mothballed | 2025-12-11 18:30:53+00:00
I've repeated it several times in this thread, but it absolutely helped those in the Warsaw Ghetto Uprising gain hours to days, and a couple women who had their lives spared because the Nazi or Nazi-allied officers decided at least a couple of jews (see woman on right here for example[]) were humans with bravery rather than just more carbon for the incinerator.

Although I'll grant you, that took place in Poland, but it happened largely due to the German government.

[] https://1943.pl/en/wp-content/uploads/sites/2/2020/05/Kobiet...
by ranger_danger | 2025-12-11 18:30:59+00:00
Hey thanks. Actually I do something similar already using the "task-spooler" package on Debian.

$ tsp yt-dlp <some URL>

# returns immediately, runs tasks in its own shell in the background one at a time (or can be parallel if you tell it to)

# can check status/stdout any time with tsp -t (including older/other queued commands)

# just queue a new command to run after the last one at any time

$ tsp ffmpeg -i <file that will be downloaded by yt-dlp> <other params>

etc.
by pkulak | 2025-12-11 18:31:43+00:00
This is why I love how Rust approached this; almost by accident to make borrow checking work. Every reference is either mutable or not, and (with safe code), you can't use an immutable reference to get a mutable reference anywhere down the chain. So you can slowly construct a map through a mutable reference, but then return it out of a function as immutable, and that's the end of it. It's no longer ever mutable, and no key or value is either. There's no need to make a whole new object called FrozenHashMap, and then FrozenList, and FrozenSet, etc. You don't need a StringBuilder because String is mutable, unless you don't want it to be. It's all just part of the language.

Kotlin _kinda_ does this as well, but if you have a reference to an immutable map in Kotlin, you are still free to mutate the values (and even keys!) as much as you like.
by cons0le | 2025-12-11 18:32:04+00:00
Watches are a horrible example. The rich buy them because they're a status symbol. Rich people aren't going to start retaining teams of software experts just for status.

"Mechanical watches" also aren't exploding at all. When people cite this, they're citing the overall watch market growing, because the market for million dollar watches is being driven by a very small group of collectors. Its also not sustainable, and will die down in ~10-20 years when these old guys finish dying. The average not rich person could not give less of a damn about mechanical watches. There's no great comeback on the horizon
by kasool | 2025-12-11 18:32:26+00:00
Hathaway honestly blew me away the first time I saw it. One of the few movies I've watched 3-4 times now. It's exactly like you say, you can really _feel_ the weight and scale of mobile suits. It's honestly a fantastic start to this new era of UC.

Also lol @ kshatriya being called bell pepper. It's probably my favorite non-gundam mobile suit. I wish they'd make an MG kit for it despite how massive it is.
by Xiol | 2025-12-11 18:32:49+00:00
Exactly the same here. I've considered switching from Android multiple times and the two things that always stop me are notifications and the keyboard.

No long-press punctuation, no switch.

I also can't trust Apple to let 3rd party keyboards work smoothly everywhere, so that's not really an option I'm willing to take the risk on.

Doesn't solve the notifications either.
by dennis-tra | 2025-12-11 18:33:28+00:00
Had the same issue that the blue dot won’t disappear. I was able to clear the dot with:

gh api notifications -X PUT -F last_read_at=2025-10-06T00:00:00Z

Just change the date to today. I also got that line from a gh issue somewhere - maybe it was the same issue that you’re referring to.
by ignoramous | 2025-12-11 18:33:36+00:00
> Go ahead and bomb Dresden again out of nowhere, because the nation-state is genocide!

This is the 2nd time "[bomb] Dresden" at me in this thread. Interesting.

> by Mamdani's logic here we're fully justified ...

Well, if you're curious about where his "logic" (his political hypothesis) leads, Mamdani wrote an entire book on it (which is in fact the subject of the interview): https://en.wikipedia.org/wiki/Neither_Settler_nor_Native

(from the book's Introduction):

... Nuremberg effectively depoliticized Nazism, saddling responsibility for Nazi violence with particular men and ignoring the fact that these men were engaged in the project of political modernity on behalf of a constituency: the nation, the volk. The Allies who prosecuted individual Nazis at Nuremberg were invested in ignoring Nazism's political roots ... After the war, the Allies engaged in many atrocities similar to those the Germans had ... Germans were loaded onto the same cattle cars the Nazis used to transport Jews to concentration, labor, and death camps ... Some half a million Germans died amid the ethnic cleansing. ... If Nazism had been understood not as a crime but as a political project of the nation-state, there may yet have been a place for Jews in Europe, in denationalized states committed to the equal protection of every citizen. However, because the response to Nazism took the nation-state for granted, the solution for the Jews turned out to be the nation-state, again. ... South Africans didn't give up their cultural identities and reject diversity. They rejected the politicization of diversity. Decolonizing the political through the recognition of a shared survivor identity does not require that we all pretend we are the same; far from it. It requires that we stop accepting that our differences should define who benefits from the state and who is marginalized by it.
by dspillett | 2025-12-11 18:33:46+00:00
> The response.getheader method in urllib has been deprecated since 2023 … When the method was eventually removed, lots of code broke.

Two years doesn't seem long to me for a widely used project, unless you have an LTS version that people needing more stability can use, or you are upfront that your API support is two years or less. Of course API support of less than two years is fine, especially for a project that people aren't paying for, but personally I would be quite explicit from the outset (in fact I am with some bits I have out there: “this is a personal project and may change or vanish on a whim, use it in any workflow you depend on being stable at your own risk”). Or am I expecting a bit much there?

If using semver or similar you are fine to break the API at a major release point, that is what a major release means, though it would be preferable for you to not immediately stop all support for the previous major version.

> What if we intentionally made deprecated functions return the wrong result … sometimes?

Hell no. A complete break is far preferable. Making your entire API essentially a collection of undefined (or vaguely undefined) behaviours is basically evil. You effectively render all other projects that have yours as a dependency, also just collections of vaguely defined behaviours. If your API isn't set in stone, say so then people have nothing to complain about unless they specifically ask you to keep something stable (and by “ask you to keep something stable” I mean “offer to pay for your support in that matter”).

> Users that are very sensitive to the correctness of the results…

That is: any user with any sense.

> might want to swap the wrong result for an artificial delay instead.

That is definitely more palatable. A very short delay to start with, getting longer until final deprecation. How short/long is going to be very dependent on use case and might be very difficult to judge: the shortest needs to be long enough to be noticeable to someone paying attention and testing between updating dependencies and releasing, but short enough that it doesn't completely break anything if someone updates and releases quickly, perhaps to bring in a bugfix that has begun to affect their project.

This is still evil, IMO, but a much lesser evil. I'd still prefer the complete break, but then again I'm the sort of person who would pay attention to deprecation notices, so unless you are a hidden nested dependency I'd not be affected.
by pookha | 2025-12-11 18:34:27+00:00
This has nothing to do with protecting kids...This is the classic "OH WONT SOMEONE PLEASE THINK OF THE CHILDREN!!" meme that governments fall back on to terrorize and coerce the herd. There's an obvious push by neo-liberals to implement a digital application (ID) that they can use to "authorize". What the UK and Australia and the US homeland security really want is the ability to see a troublemaker and to toggle a switch on their digital certificate\token to dissociate them from the internet. No doubt they've got legions of Keycloak systems stood up and ready.
by lo_zamoyski | 2025-12-11 18:34:42+00:00
I think you're taking things to an extreme.

Let's make some distinctions first.

On the one hand, you have violence and pornography, and also other crude content. There is nothing good about exposing children to these. It does not contribute to their growth or to their maturity as human beings and it is ridiculous to think it could. On the contrary, this content will cause psychological harm, causing distortions in their emotions, in their habituated appetites, in their self-understanding, and their understanding of normal relations. When deviance like that is tolerated, it shifts the Overton window. Children observe this tolerance and roll it into their sense of normality. Individuals suffer. The quality of society degrades substantially.

On the other hand, we have political agitation. This one is more difficult to define and handle, especially in a liberal democratic society. There are examples of obvious political agitation, of course, but children should generally not be exposed to political agitation at all, except as a subject matter at an age appropriate level and in an appropriate pedagogic setting. Children don't have the intellectual or emotional maturity to examine such material in the wild on their own where they would be at the mercy of unscrupulous adult manipulators who couldn't care less about the well-being of children. (Ask yourself what kind of person would want to involve children in their political agitation to begin with.)

So, there's a big difference between common sense things like these and coddling children. We want to prepare children for life, not teach them adaptation to depravity. You throw them into the filth of social and psychological pathology. Neither violence nor pornography should be normalized even in the adult world - it is harmful to the adults who consume it as well - so the idea that we should prepare children for life in some violent and twisted pornland is preposterous. Nobody has to put up with that garbage, and the law should be making sure they don't.
by jamesgill | 2025-12-11 18:34:50+00:00
I agree with the title, but disagree with this:

"When programming becomes repetitive, the odds of you creating something that makes people go “wow” are reduced quite a bit. It isn’t a rule, of course. You need to be inspired to make inspiring software."

The purpose of software for other people is not to make them go 'wow'; it's to help them with their jobs to be done. That's it. The software is always in service to the job the user wants to get done. Can that make them go 'wow'? Sure, but you can't..aim for 'wow'. That's the wrong goal.

As far as 'inspiration' goes, I'm with Stephen King: "Amateurs sit and wait for inspiration, the rest of us just get up and go to work."

For those that might disagree (hey, it's HN), I would ask: how do you know when 'wow' occurs? Here's a clue: 'wow' can only happen when something else occurs first. That 'something else' is described above.
by ProjectRecon | 2025-12-11 18:35:18+00:00
Hi HN,

I’ve been digging into the security landscape for autonomous agents (LangGraph, CrewAI, AutoGen) and realized the tooling is scattered everywhere.

I built this repo to organize the ecosystem into a proper security lifecycle, rather than just a dump of links.

It covers: - Agent Firewalls & Runtime Protection (e.g., AgentGateway, PhantomWall) - Red Teaming Tools (e.g., PyRIT, Garak) - Sandboxing (e.g., SandboxAI, OpenHands) - Static Analysis & Guardrails

I’m looking for more open-source tools to add. If you’re building something in this space or know a tool I missed, please let me know or open a PR!

Repo: https://github.com/ProjectRecon/awesome-ai-agent-security
by toastal | 2025-12-11 18:35:28+00:00
Building your software usually involves getting dependencies, & those dependencies are, hopefully, in more than one location—which includes a cronjob to a bare repo, or Alice’s fork on another repo that at least has the latest tags. It should be trivial to point to these as mirrors for the cases where any forge/repository, even the ones held by megacorporations, inevitably go down. Even Nixpkgs itself, while not maintaining their own official mirrors, are mirrored by TUNA. Backups are an important strategy, & the source code should also be a part of that.
by 9rx | 2025-12-11 18:35:29+00:00
> Unfortunately, also in academia you cannot just do what interests you, unless you got unlimited funding somehow.

Okay, but you cannot be both in academia and accepting someone else's funding to work on their problems at the same time. Once you accept the latter, you've moved into industry.

That's not to say academia becomes off-limits. You can also spend time out of your day working on your own pursuits — you get 24 hours to divide as you please. But when your time is focused on someone else's interests, you are not in academia. You are in industry.
by shadowgovt | 2025-12-11 18:35:42+00:00
Because the tool can generate output faster than human employees alone can (and they control the "legitimate" gate by which other people can use those characters in the tool).

The consequence being that for everyone complaining that AI is disrupting artists right now: these will, in hindsight, be the halcyon years. Even if we assume the copyright arguments hold water in court and AIs trained on other people's copyrighted material are ruled poison-fruit machines, the end result isn't the end of synthesizing-AIs... It's synthesizing-AIs only being owned by people with a big enough data portfolio to train them. Techno-anarchy replaced with techno-corporatocracy, and the smaller-volume artists still lose on being unable to out-produce their competition in an art market.
by CerryuDu | 2025-12-11 18:36:19+00:00
I'm finding myself in a weird position now, because I disagree with a whole lot of things in the blog post (well, the parts I was willing to read anyways), but calling that variable static for the sake of persistence was correct.

The fact that you are questioning the use of the term shows that you are not familiar with the ISO C standard. What the author alludes to is static storage duration. And whether or not you use the "static" keyword in that declaration (also definition), the storage duration of the object remains "static". People mostly call those things "global variables", but the proper standardese is "static storage duration". In that sense, the author was right to use "static" for the lifetime of the object.

EDIT: if you drop "static" from that declaration, what changes is the linkage of the identifier (from internal to external).
by Sir_Twist | 2025-12-11 18:36:19+00:00
Not an expert in LLM benchmarks, but I generally I think of benchmarks as being good particularly for measuring usefulness for certain usecases. Even if measuring LLMs is not as straightforward as, say, read/write speeds when comparing different SSDs, if a certain model's responses are consistently measured as being higher quality / more useful, surely that means something, right?
by JanSt | 2025-12-11 18:36:24+00:00
The benchmarks are very impressive. Codex and Opus 4.5 are really good coders already and they keep getting better.

No wall yet and I think we might have crossed the threshold of models being as good or better than most engineers already.

GDPval will be an interesting benchmark and I'll happily use the new model to test spreadsheet (and other office work) capabilities. If they can going like this just a little bit further, much of the office workers will stop being useful.... I don't know yet how to feel about this.

Great for humanity probably but but for the individuals?
by marifjeren | 2025-12-11 18:36:40+00:00
There is actually a good reason not mentioned, not to name tools by their purpose:

- the purpose will change

Your "silicon-valley-bank-integrator" tool will eventually need to be updated to do something else.

Or your "login-page-config-service" tool may eventually do more than just logins.

Using gibberish or mythological names gives a nice memorable name that doesn't lead (or mislead) you to believe it does a particular thing which may or may not be correct anymore.
by breakingcups | 2025-12-11 18:37:34+00:00
Is it me, or did it still get at least three placements of components (RAM and PCIe slots, plus it's DisplayPort and not HDMI) in the motherboard image[0] completely wrong? Why would they use that as a promotional image?

0: https://images.ctfassets.net/kftzwdyauwt9/6lyujQxhZDnOMruN3f...