MurphyA/hacker-news huggingface dataset:
Show HN: Stackup – Configure your dev env for cross-platform
by araldhafeeri | 2025-12-24 12:52:43+00:00
The first thing a new developer needs to do when getting a new device is to configure their dev environment.

Stackup allows you to do that in a single command, given you write the configuration yaml once.

It's free open-source under the MIT license.

This is my first Go project (as an experienced developer).

Feel free to give me any feedback.
Show HN: Leash – Security guardrails for AI coding agents
by melihmucuk | 2025-12-24 12:52:46+00:00
AI coding agents like Claude Code can hallucinate dangerous commands. Wrong paths, wrong directories, and suddenly you're running "rm -rf ~/" instead of "rm -rf ./". I built Leash to catch these mistakes before they execute.

It's a simple hook that runs before each tool call. Blocks dangerous commands outside the working directory, protects sensitive files like .env and .git even inside the project, and stops destructive git operations like reset --hard or push --force.

Some things it handles that weren't obvious at first: agents doing "cd ~/Downloads && rm -rf folder" to escape the sandbox, compound patterns like "find -delete" or "xargs rm" targeting paths outside the project, and symlink-based escapes.

Works with Claude Code, OpenCode, Pi, and Factory Droid. Setup is just "npm install -g @melihmucuk/leash" followed by "leash --setup claude-code".

Not a full sandbox. If you need real isolation, use containers. This just catches the common hallucination patterns that cause accidental damage.

https://github.com/melihmucuk/leash
by jwr | 2025-12-24 12:53:24+00:00
Polish person here. Don't try to learn Polish. It's insanely difficult, the "rules" make no sense whatsoever, and almost anybody that you'll want to talk to will be able to communicate with you in English.

As for Russian, I also don't see any point in learning it. I was forcefully taught Russian in primary school back when Poland was under Russian yoke. The general idea here is that we'd like not to be in that situation ever again. Learning the language of a nation where a significant percentage of population supports war and killing is not something I'd consider.
by vfclists | 2025-12-24 12:53:44+00:00
You may have to wait indefinitely. The EU, Britain and Canada do the the same thing to their own citizens when it suits them.

Canada is memorable for freezing the bank accounts of truckers who objected to Covid vaccinations.

With Britain you can look up the case of Nigel Farage who got debanked.

In the case of the EU here are few interesting ones.

https://www.youtube.com/watch?v=PXq89FryYzo

https://www.youtube.com/watch?v=g-feCMFSpRw
by vdupras | 2025-12-24 12:53:59+00:00
Who's seeking power, the poor schmuck who misused their PDF tools?

It seems that my novel "razor" is misunderstood. The article attributes bad redacting to gross incompetence. But what if the person having done this bad redacting is instead doing sabotage with plausible deniability "lol, those damn PDF tools, you never know how they work"?

It makes this story more interesting, and it allows one to see an outline of the future film scripts that will be written about this period. The courageous saboteurs at the dawn of american fascism.
by modo_mario | 2025-12-24 12:54:22+00:00
Honestly I feel like people won't care and the sanctioning helps less and less if it doesn't do the opposite.

They feel like repeatedly the baby was thrown out with the bathwater wrt migration and the like despite popular opinion being very much against those.
Often getting no genuine choice of opposition that wasn't fringe right.

Now I know so many people who will in turn throw out the bathwater containing their national or supranational interests, rule of law (that limited their options), etc.
People who one will struggle to reach across the isle... and it was utterly predictable.
by AdrianB1 | 2025-12-24 12:54:45+00:00
Learn Cyrillic the fun way: go in vacation in Bulgaria, they have road signs in both Latin and Cyrillic. This is how I learned Cyrillic 20 years ago, driving a lot for business all over around Balkans. It was an easy curve, a few characters at a time, with a lot of repetitions and the scenery is nice.
by Telaneo | 2025-12-24 12:55:20+00:00
The only one of those that would potentially disappear would be the 100 GB patches and games. Tiktok and Facebooks still works with 360p video, so doomscrolling would likely continue. Same goes for clickbait. The slop is what's being doomscrolled though in many cases, and all the slop that isn't in video form barely takes any bandwidth to begin with. Spyware doesn't take up much bandwidth, neither when first downloaded, nor during usage.
by general1465 | 2025-12-24 12:55:37+00:00
> If they're saying this to undermine Europe, their track record suggests that it might strengthen Europe.

The main problem with US international politics is that they are looking on the problem through American lenses, i.e. why would Afghans refuse liberal values and either choose or tolerate theocracy? Does not make any sense from view of an average American.

Same like it makes no sense for average American why states in EU are banding together and slowly shedding its nationalistic values? What if same would be done by Latin America? Wow scary, need to throw a spanner into the things!
by xelxebar | 2025-12-24 12:56:35+00:00
> What do you mean Mandarin is simpler in this regard?

Just to add context to a sibling comment, Japan's first "writing system" was literally just Chinese.

I don't mean Chinese characters, I mean that if you wanted to write something down, you had to communicate in written Chinese. Over time this written Chinese accumulated more and more transformations bringing it in alignment with spoken Japanese until we get what we see today. However, this means that, to a first approximation, modern Japanese is some amalgamation of Old Chinese and Middle Japanese.

Actually, use of Chinese co-existed alongside the whole transformation process, so we actually see this funky mix of Early and Middle Japanese with Wu, Han, and Song Chinese. Character readings varied by region and time period, and so the the reading of a compound kanji term in Japanese mostly reflects the time period when that word was imported. This is why a single kanji ends up having multiple readings. Later, people began backporting individual characters onto native Japanese words, giving yet another reading.

The character 行 is a particularly illustrative example: 行脚 (an-gya), 行動 (kou-dou), 行事 (gyo-ji). The first reading "an" comes from 7th century Chinsese or so, "kou" comes a bit later from the Han dynasty, and "gyo" even later from Song. Then we have the backports: 行く末 (yu-ku-sue), 行く (i-ku), 行う (okona-u). The first "yu" reading is from Middle Japanese, "i" from Modern Japanese, and "okona" from I have no clue when. That's six different readings for 行 alone!

Oh, and then there are "poetic" readings that are specific to usage in people's names: 弘行 (hiro-yuki) etc. Granted, these are often quite evocative of the above readings or that of synonym characters.

The historical introduction process also explains why older readings tend to be more obscure, 1) they had less time to accumulate usage, and 2) they tend to be specific to Buddhist and administrative themes.

Note: The above is just what I've pieced together osmotically over the years, so I'm sure there are errors.
by Esophagus4 | 2025-12-24 12:58:31+00:00
But ise1 is down 4x more than use2 (AWS closely guards the numbers and won’t release them, but that is what I’ve seen from 3rd party analysis). Don’t you want your customers to say, “wow, half the internet was down today but XYZ service was up with no issues! I love them.”

I can’t tell if it’s you thinking this way, or if your company is setup to incentivize this. But either way, I think it’s suboptimal.

That’s not about “risk profile” of the business or making the right decision for the customer, that’s about risk profile of saving your own tail in the organizational gamesmanship sense. Which is a shame, tbh. For both the customer and for people making tech decisions.

I fully appreciate that some companies may encourage this behavior, and we all need a job so we have to work somewhere, but this type of thinking objectively leads to worse technology decisions and I hope I never have to work for a company that encourages this.
by zokrezyl | 2025-12-24 12:58:54+00:00
For my problem describe under the link above the suggestions above eliminate indeed the branches, but same time the extra instructions slow down the same as my initial branches. Meaning, detecting newlines would work almost 100% of memory throughput, but detecting first non-space reduces the speed to bit above 50% of bandwith

https://gist.github.com/zokrezyl/8574bf5d40a6efae28c9569a8d6...
by gaigalas | 2025-12-24 12:59:16+00:00
> Introduce new concepts that doesn't exist in the original stack

That is also true for "macro" frameworks.

> Wraps around the company/org-shared tech stack or framework

That is often also true for "macro" frameworks.

> Creators claim that the framework "magically" solves many problems, and push more people to use it

That is often also true for "macro" frameworks.

---

It is not clear from the reader's perspective what actually characterizes a "micro" framework. It's also not clear why the size is the issue here, when all complaints seems to be about design or quality.

Is googletest a micro or macro framework? Give us some clarifying examples. Actual things people can look for, not internal unknowable projects. There must be some exceptions too (silver bullet rules don't exist), mention them.

Also, rethink the title. Maybe "makeshift frameworks" is better terminology, as it more accurately reflects the problem that is described in the content.
by dotancohen | 2025-12-24 12:59:33+00:00
It's nice, but far from being the most legible font. I notice that the uppercase I is not shown in the example image - and that is one of the hardest letters to get right for a legible font.

Nitpicky, the 0 and O are difficult to distinguish. But for the application, this is not a problem. Other than entering (e.g. wifi) passwords, there are no places where one would be mistaken for the other in a passenger vehicle UI.
by barrkel | 2025-12-24 13:00:31+00:00
> real and only difference between a library and a framework, is whether it introduces new concepts

This isn't what is normally understood in software engineering by those terms.

A library is something you call.

A framework is some kind of application scaffolding that normally calls you.

You can use more than one library. You normally only have one framework in-process.

I found the blog post a little hard to parse. Is it an argument against wrapping frameworks, or wrapping libraries?

I agree that wrapping frameworks is fraught with danger. I can't quite agree for wrapping libraries. Wrapping libraries makes a lot of sense if you're only using a tiny fraction of the library functionality, the breadth of the wrapper's API is much smaller than the library's API, wrapping it enables you to substitute it (whether for a smaller / faster / whatever dependency in the future, or for testing, etc.)
by Telaneo | 2025-12-24 13:00:32+00:00
> Isn’t “paying for what you use” the ultimate expression of personal responsibility, though?

The value of bandwidth is negligible until you start to work with 100s of TBs. Bandwidth is basically free on a consumer scale. It's the infrastructure you're paying for, but once purchased, it has minimal upkeep compared to how much use you get out of it. It'd be one thing if bandwidth were subsidised; then we could raise pricing up to where you're actually paying for what you use. We're already at that point though. Raising pricing further, either directly or through rationing, is just rent-seeking.

Responsibility is not inherently good. Imposed responsibility for no good reason is in fact bad.
by rubslopes | 2025-12-24 13:00:45+00:00
> Having to debug code I didn’t write that’s an integral part of what I’m building is an annoying context switch for anything non-trivial.

That's the problem I've been facing. The AI does 90% of the work, but the 10% that I have to do myself is 20x harder because I don't have as much knowledge of the codebase as I would if I had written all of it by myself, like in the old days (2 years ago).
by narvidas | 2025-12-24 13:00:55+00:00
As a rule of thumb, "magic" is a code smell. Libraries should be preferred over frameworks whenever possible.

A toolbelt of small utility-like composables are often easier to maintain and reason about. This results in added explicitness (i.e. less magic, fewer surprises).

Personal experience shows that the immediate efficiency gains of a framework often get diminished in the face of all the hacks people introduce later, just to work around the remaining 10% of cases that the framework did not anticipate or traded-off against.

Please note this is a comment based on personal experience and professional preference.

BOCTAOE.
by saberience | 2025-12-24 13:01:12+00:00
Vim has a terrible user experience though. There's a reason everyone stopped using it as soon as they possibly could and moved to other text editors. Now the only vim users are the 60 year old+ greybeards who try to convince everyone they're such morons for not using it.

Stop trying to convince people to use vim, it sucks, it's got a terrible ux, it's not intuitive, it's overly complicated, hard to learn, arcane, and looks like ass.
by borroka | 2025-12-24 13:01:35+00:00
I wanted to appreciate Malick's films out of a sense of intellectual snobbery, but it was too difficult for me. And I think most people who love his films appreciate them in a snobbish way; they really try to convince themselves that it is great cinema.

The Thin Red Line had some good moments, but it clearly came together in the editing room--but in the end, it came together only somewhat and weakly. He had hours of scattered footage (famously, a couple of major characters/actors had 90% of their planned screening time reduced in the final release), and in the editing room, he was trying to make sense of it, but unsuccessfully. What somebody interpreted as genius, I saw as disorganization, poor planning, and imprecise editing.

Well, someone may say, when talking about The Thin Red Line, that's what war is: confusing, boring most of the time, very violent in bursts. But that is akin to saying that life is mostly about eating and using the bathroom and doing pedestrian stuff and cleaning counters. But most of us, and not because we are simpletons, don't go to movies to see actors doing chores.
It might be for others, but not for me.
by sebow | 2025-12-24 13:01:51+00:00
Everybody knows about Cambridge Analytica being used in the US/UK, but, for example, little to no one knows that Cambridge Analytica was also used by political parties within the EU (I won't give specific names [for now], but parties [from Italy, Malta, CZ, and Romania], members of the euro-parliamentary groups EPP/RE/SD, in the 2014-2016 period). Why did nothing happen back then? Those mentioned parties were usually pro-EU, so it's not really surprising no such "scandal" was being discovered until later on, when Cambridge Analytica was being used by the UK/US.

And the Cambridge Analytica "phenomenon" is not really something you can realistically prevent. I'm sure it happens now with some other better firm (Palantir probably), but this is really beside the point. The point is that normal citizens, like you and me, are effectively censored upon suspicion before any burden of proof is provided. Nothing says "protecting democracy" like deleting posts from social media and then finding out the context.

> Individual free speech is not - of course - ethically or politically identical to "free speech" produced by weaponised industrial content farms funded by corporations and foreign actors.

Sure, nobody likes bots/paid shills. But of course, in a normal society, you have to prove those posts are made by actual bots/content farms before taking any action. Otherwise it's just censorship. Election interference always happens, without exceptions, but degrees vary. This is not to say we shouldn't point out when it happens, but to not do censorship against our own citizens because "the models indicate a pattern akin to foreign entities." Patterns are not burdens of proof, and thus employing a "crowdfunded" fact-checking system like Community Notes or the one from YouTube is at least partly the actual solution instead of directly removing content. Under DSA, you can effectively remove content without providing burden of proof regarding the identity of the poster. Platforms must provide a "statement of reasons" (Article 17) to affected users for any removal, including appeal rights, but this does not impose pre-removal identity checks on posters.
by LeftHandPath | 2025-12-24 13:02:00+00:00
Moved to NYC. Have a good team at my new job. Satisfied with my income. Have enough free time. Made a lot of good friends really fast, and now I see a rotating cast of them 3-7 days a week. Happy with my apartment. Have an east facing window so I don't have to set an alarm to wake up in the morning, I wake with the sunrise. Getting plenty of exercise and walking a 8-12k steps a day.
by TeMPOraL | 2025-12-24 13:02:11+00:00
> Laws legitimise and stabilise those in power. If enough people stop believing in the law, it really threatens those in power.

Not quite that simple.

If enough people stop believing in the law, the society breaks apart, and you have people shooting each other in the streets trying to loot supermarkets and extend their lives for a week or two, before inevitably dying of starvation.

This is serious stuff. Society and civilization are purely abstract, intersubjective constructs. They exist only as long as enough people believe in them -- but then, it's still not that simple. Actually, they exist if enough people believe that enough other people believe in them.

Money, laws, employment, contracts, corporations, even marriages - are mutually recursive beliefs achieving stability as independent abstractions. But they're not independent - they're vulnerable to breaking if large group of people suddenly start to doubt in them.
by 6510 | 2025-12-24 13:02:27+00:00
Little computer people was awesome[0]. Upscale it to a full size microsoft office[3]. Give agents neck bearded avatars with green hair named after real employees except from legal, there everyone is a pirate. Make it so that one can zoom in on everything and follow the cringe worthy dialog in overloaded sprint-planners that some~how work out. Take style pointers from KRAZAM Microservices[12] and gar1t's "Nodejs is bad ass rockstar tech"[44]

[0] - https://www.youtube.com/watch?v=SkTgX1mGmDg

[3] - https://officesnapshots.com/2014/11/18/microsoft-redmond-bui...

[12] - https://www.youtube.com/watch?v=y8OnoxKotPQ

[44] - https://www.youtube.com/watch?v=bzkRVzciAZg
by Theaetetus | 2025-12-24 13:04:21+00:00
Some alternatives:

- Finger to the wind ("this feels like a big change").
- Domain-specific versioning scheme (so Ruff uses [this variant](https://docs.astral.sh/ruff/versioning/#version-changes) that seems reasonable to me; it's described as a SemVer variant, but the work to specify how various cases are handled seems very useful to me).
- As you say, time stamps. FWIW I don't like that very much, because time is often so weakly correlated with progress / "breakingness," but it has its proponents.
by TeMPOraL | 2025-12-24 13:04:56+00:00
FWIW, laws aren't merely abstract tools of oppression, they're what binds groups larger than ~100 people into societies. And the true fabric laws are made of, is one of mutually-recursive belief, everyone's expectation that everyone else expects they're subject to them. Threaten that belief, the system stops working. The system stops working, everyone starves, or worse.
by nzoschke | 2025-12-24 13:05:37+00:00
> we are now implementing fleet-wide updates

That ~1000 drivers on the road are all better trained on what to do in the next power outage is incredible.

There will always be unexpected events and mistakes made on the roads. Continual improvement that is locked in algorithmically across the entire fleet is way better than any individual driver's learning / training / behaviorior changes.
by CGamesPlay | 2025-12-24 13:05:54+00:00
> Everyone brings their own experiences to the table, and in 6 months of testing nobody has made assumptions you just did. < As an experiment, try disabling the app's mouse support and testing it.

> For instance, "toad run" takes a path to a directory and not a command (check the usage). < I stand corrected. I think I was confused because I read this comment <https://news.ycombinator.com/item?id=46370722> ("toad acp COMMAND") and substituted "toad run COMMAND". I saw in the usage that it mentions "PATH" without specifying what it is the path to, and does include a "--agent" flag but with no explanation about what it does. This level of documentation is far from what I would call good, but I'll give it to you that I could have figured that one out. ([append] `toad run` isn't even the right command and as near as I can tell --agent does nothing. But `toad acp` is what I actually wanted and finally I can actually test the app)

> But you've chosen to be combative < My post was snarky but my experience was honest. I don't think I'm being combative. I certainly don't intend to offend you as the creator of the tool, regardless of whether or not I think the tool is high-quality in its current state.

Merry Christmas, I will continue to watch this project. Maybe I will open a discussion in the Github if I end up successfully able to use it with my newfound understanding of the "acp" subcommand.
by Terretta | 2025-12-24 13:06:07+00:00
1. Worth proof-reading LLM copy. For instance:

- This says none of these attacks survive traditional sanitization.

You probably mean the opposite.

- You claim rebuilding from raw pixels, while calling steganography a threat.

Of course, steganography is in the raw pixel values you say you keep. And it's neither the same kind of threat (it is not a hostile input), nor does ‎“CDR” do anything about it.

. . .

2. If you want this to take off, move a click up the value chain. Enterprises that care, don't want your API because they won't hire anyone who can do anything with it.

Instead, and you can have this for free:

a) Implement a plugin for Outlook that sanitizes email image embed, and extensions for browsers. It should run locally. Ship that for free.

b) At enterprise licensing pricing, implement a proxy server plugin that works with the top enterprise proxies to sanitize images while passing them through, caching them for subsequent requests, etc., all the things that make this a single drop in control for the entire proxied enterprise footprint.

c) Get a patent for $10k - $15k, costs more to be hard to workaround.

d) Write your contract so hostile image data belongs to you, license that attack data to the big infosec detection firms, likely also putting you in play for acquisition.

. . .

3. This site and this post doesn't read like Show HN. It reads like one cool trick SEO sales copy. The same day old account doesn't help.

Reconsider if authenticity matters.
by oersted | 2025-12-24 13:06:22+00:00
Sure the gaming hardware landscape is likely to change, but it won’t be up to Nvidia’s decision. If it remains a viable business, it will thrive whether Nvidia is in it or not.

They’ve become a big name now with AI, but they were never the only game in town in their home markets. They had an edge on the high-end so their name had some prestige, but market share wise it was quite even. Even with AI, they have a temporary head start but I wouldn’t be surprised if they get crowded in the coming years, what they do is not magic.