MurphyA/hacker-news huggingface dataset:
by aperture147 | 2025-12-04 10:15:25+00:00
Hey I think I've just found a new marketing stunt for a new vibe-coding platform:

"Worried your vibe-coded app is about to be broadcast on the internet’s biggest billboard? Chill. ACME AI now wraps it in “NSA-grade” security armor."

I've never thought that there will be multiple billion-dollar-AI-features that fixes all the monkey patching problems that no one saw them coming from the older billion-dollar-AI-features that fixes all the monkey patching problems that no one saw them coming from...
Show HN: I built a free security scanner for your domain
by 539hex | 2025-12-04 10:15:51+00:00
When I started freelancing, I was shocked how many small businesses had no idea their servers were exposed. Basic stuff, open database ports, expired SSL certs, missing security headers. The tools to find this existed, but they were either enterprise-priced or required security expertise to use.

I built Deft to make security scanning accessible. Point it at any domain, checks certificate, analyzes email security (SPF/DKIM/DMARC), and grades your security headers – all in about some seconds.

Features:

- Port scanning with service detection across main domain + top 10 subdomains

- Subdomain discovery via certificate transparency and passive recon

- Email security analysis with actionable grades (A-F)

- Security headers audit (CSP, HSTS, X-Frame-Options, etc.)

- Executive summary for non-technical stakeholders

- No signup required for the free scan

The free tier gives you a solid overview. Paid reports ($29) add full CVE vulnerability detection, complete subdomain scanning, and a detailed PDF report you can share with your team.

I've been using this to audit client sites before taking on projects. Found an exposed MongoDB on a $2M ARR SaaS last month – they had no idea.

Try it: https://deft.is

Happy to answer questions about the methodology or the security tools under the hood.
by klipitkas | 2025-12-04 10:15:53+00:00
Built another localhost tunneling tool because I kept forgetting my ngrok auth token.

What it does:

- Expose localhost to the internet (HTTP/TCP/WebSockets) - Zero signup – just works immediately - Free

Nothing groundbreaking, just scratching my own itch for a no-friction tunnel service. Written in Go.

Link: https://tunnl.gg

Happy to answer questions or hear how you'd improve it.
by zingar | 2025-12-04 10:16:28+00:00
My neighbour asked me the other day (well, more stated as a "point" that he thought was in his favour): "how could a billionaire make people believe something?" The topic was the influence of the various industrial complexes on politics (my view: total) and I was too shocked by his naivety to say: "easy: buy a newspaper". There is only one national newspaper here in the UK that is not controlled by one of four wealthy families, and it's the one newspaper whose headlines my neighbour routinely dismisses.

The thought of a reduction in the cost of that control does not fill me with confidence for humanity.
by mxfh | 2025-12-04 10:17:15+00:00
That process usually takes years.

Here the price hike was pretty instant as secondary effect of DDR5 evasion in two waves. I July and now in October.

There is usually no shortage of old working PC components as they also are avalable used and tested from people decommissioning and upgrading systems. These are not some rare parts in normal market situations.

I made a habit of maxing out motherboards a year or two before upgrading to an new platform. This was always dirt cheap until like 5 years ago.
by slop-cop | 2025-12-04 10:17:29+00:00
The guy who discovered the actual vulnerability says otherwise.

Delete this distraction to genuine blue teamers and stop shitting up the information landscape with this utter hogwash.

This is why infosec is dead.

https://react2shell.com/

https://github.com/ejpir/CVE-2025-55182-poc/issues/1#issueco...
by solaarphunk | 2025-12-04 10:18:34+00:00
Seattle is the type of economy that is heavily threatened by AI. Desk jobs that Claude basically already knows how to do, and just needs to be integrated into the existing systems to have impact.

Most people in Seattle "tech" are middle management with no discernible skills other than organizational deckchair arrangement. It is a place to optimize for work-life balance, and not take risk - this is why the region, despite its technology density, has such a disproportionately small startup scene.

AI IS a huge threat to a place like this and I am not optimistic about the ability for people to adapt.
by johnnyanmac | 2025-12-04 10:20:27+00:00
>Common folk decided to use ChatGPT because they think it is good.

That is not the only reason to use a tool you think is bad. "good enough" doesn't mean "good". If you think it's better to generate an essay due in an hour then rush something by hand, that doesn't mean it's "good". If I decide to make a toy app full of useless branches, no documentation, and tons of sleep calls, it doesn't mean the program is "good". It's just "good enough".

That's the core issue here. "good enough" varies on the context, and not too many people are using it like the sales pitch to boost the productivity of the already productive.
by cess11 | 2025-12-04 10:20:58+00:00
It's good at what it does. Starts quickly, doesn't get bogged down when dumping large amounts of text into it, got some nice themes.

I find it a bit messy to build but I'm not exactly a compile binaries kind of person anymore so it's probably a good sign that I still manage to figure it out. If stuff like Zig is your thing you'll probably enjoy this part.

My main terminal emulator is the bog slow but reliable Terminator, though in a while I'll probably flip the i3 commands and move over entirely to Ghostty.
by prmoustache | 2025-12-04 10:21:24+00:00
There are still physical stores in most cities so I guess they are still selling if they aren't out of business. They cater for a more enthusiast/gaming oriented population than in the past but still.

You have to take into account that same day delivery from amazon and the likes is only a real thing in the USA. Most other markets do not have the same service, even with accounts such as Amazon Prime. There is only one online store I know that is providing same day delivery in my area in Spain and it is a physical (and rather expensive) chain, El Corte Inglés.
by piva00 | 2025-12-04 10:21:31+00:00
I recommend reading "In the Swarm" by Byung-Chul Han, and also his "The Crisis of Narration"; in those he tries to tackle exactly these issues in contemporary society.

His "Psychopolitics" talks about the manipulation of masses for political purposes using the digital environment, when written the LLM hype wasn't ongoing yet but it can definitely apply to this technology as well.
Show HN: I built an app to validate ideas. The internet decides if it's shit
by danielkempe | 2025-12-04 10:21:57+00:00
I speak to so many people asking me about their ideas, and the majority of the time, they are just terrible.

I decided it was time to build a place that's so honest, it's brutal.

Submit your ideas, get roasted, save time...or validate it and ship ship ship.
by bravetraveler | 2025-12-04 10:23:57+00:00
Do I? Well, verification helps. I said 'prefer', nothing more/less.

If you must know, I don't trust this stuff. Not even on my main system/network; it's isolated in every way I can manage because trust is low. Not even for malice, necessarily. Just another manifestation of moving fast/breaking things.

To your point, I expect a certain amount of bias and XY problems from these things. Either from my input, the model provider, or the material they're ultimately regurgitating. Trust? Hah!
by fauigerzigerk | 2025-12-04 10:25:29+00:00
>"by using a single solution from a huge provider"

The parent didn't say that though and clearly didn't mean it.

Smaller SaaS providers have a problem right now. They can't keep up with the big players in terms of features, integrations and aggressive sales tactics. That's why concentration and centralisation is growing.

If a lot of specialised features can be replaced by general purpose AI tools, that could weaken the stranglehold that the biggest Saas players have, especially if those open weights models can be deployed by a large number of smaller service providers or even self hosted or operated locally.

That's the hypothesis I think. I'm not sure it will turn out that way though.

I'm not sure whether the current hyper-competitive situation where we have a lot of good enough open weights models from different sources will continue.

I'm not sure that AI models alone will ever be reliable enough to replace deterministic features.

I'm not sure whether AI doesn't create so many tricky security issues that once again only the biggest players can be trusted to manage them or provide sufficient legal liability protection.
by victorbuilds | 2025-12-04 10:25:58+00:00
The detail that -wavonly (falling back to the older WinMM API instead of DirectSound) actually gave the highest frame rate is a perfect example of a lesson that keeps reappearing in systems programming: "more direct" doesn't always mean faster when you're CPU-bound. DirectSound's lower latency came at the cost of more CPU cycles that could otherwise go to rendering.
by psviderski | 2025-12-04 10:26:04+00:00
I think there are two different cases here. Not sure which one you’re talking about.

1. External requests, e.g. from the internet via the reverse proxy (Caddy) running in the cluster.

The rollout works on the container, not the server level. Each container registers itself in Caddy so it knows which containers to forward and distribute requests to.

When doing a rollout, a new version of container is started first, registers in caddy, then the old one is removed. This is repeated for each service container. This way, at any time there are running containers that serve requests.

It doesn’t say any server that requests shouldn’t go there. It just updates upstreams in the caddy config to send requests to the containers that are up and healthy.

2. Service to service requests within the cluster. In this case, a service DNS name is resolved to a list of IP addresses (running containers). And the client decides which one to send a request to or whether to distribute requests among them.

When the service is updated, the client needs to resolve the name again to get the up-to-date list of IPs. Many http clients handle this automatically so using http://service-name as an endpoint typically just works. But zero downtime should still be handled by the client in this case.
by rsynnott | 2025-12-04 10:26:12+00:00
> Yeah, I see it as a radical anti-establisment resource.

Only if the 'establishment' involved is, well, reality.

> I would not call it a complete nonsence though, for me it's a place where you can "get" thinking of folks who are opposing "the System".

No, it's where you can get thinking from crazy people. Actual dissidents are elsewhere.
by canopi | 2025-12-04 10:26:14+00:00
Many thoughts:

- That wasn't in my bingo list. I guess it's acquisition time and all these AI companies need to spend the money somewhere.

- Congrats to the team. I was a big fan of their devrel work.

- Now both wandb and neptune AI have been acquired. I guess there is no independent MLOps solution left.

- Are they shutting down the product? Is this an acquihire? Does it mean OpenAI has not offices in Europe?
by sipofwater | 2025-12-04 10:26:31+00:00
* Here is the direct link to the November 25, 2017 comment by edent (Reddit): https://old.reddit.com/r/androidapps/comments/7edgah/app_or_... (old.reddit.com/r/androidapps/comments/7edgah/app_or_method_to_connect_to_nfs_shares/dqbbxfg/)

* Kodi, "Downloads for Android": https://kodi.tv/download/android/

* Source of the links: "Testing: Termux, proot-distro, Network File System (NFS)" at https://gist.github.com/NoteAfterNote/e1719f4029b91918d99621... (gist.github.com/NoteAfterNote/e1719f4029b91918d996216939d5bff2)
Show HN: Made HN, but for Music – Sonusly
by lorenzosch | 2025-12-04 10:26:48+00:00
I built Sonusly. Think Hacker News, but for music.

You search for a song, create a post with a title, and people can vote and discuss.

Here’s what you can do:

You can vote on posts you like by clicking ▲, with each vote costing 1 karma. Your karma starts at 100 and you earn 5 more each day you’re active if it’s below 100. You can save songs with the bookmark icon and save post discussions you care about for later. Click “listen” to hear a song in Spotify, use comments to discuss it with others, and click “share” to copy the post’s link/image.

Post example: https://www.sonusly.com/s/21B4gaTWnTkuSh77iWEXdS/p/dyi3czjdl...

First project I’ve ever shipped. I’d love feedback
by sateesh | 2025-12-04 10:28:49+00:00
I don't know of how digital IDs are used etc. in other countries and how ubiquitous there usage is. (One ID I'm aware of is social security numbers (SSN) is U.S, but that is considered as PII data and usually companies take steps to protect/mask them). But citing that this is how it is done elsewhere is just an appeal to tradition/common practice and not necessarily addresses the points I had made.
by zkmon | 2025-12-04 10:29:09+00:00
A proof (visual or otherwise) shows "how" some statement is true, as in how it is built by the preceding truths. But I always wanted to know "why" something is true. For example, a biological cell grows and division happens. I could find tons of literature which talks about "how" this happens, but not "why" this happens. What's the motivation or goal? And why that goal is pursued? What is the force behind seeking of that goal?
by johnnyanmac | 2025-12-04 10:29:27+00:00
You can argue they did, depending on what you value. If you loved valve as a premier developer discovering unique experiences and narratives, thars been gone for 14 years now. If you valued not having your software locked down to middlemen or preferred physical media, Valved killed those off in the PC market. If you are a dev and wanted to set your own prices, Valve is current under litigation for price parties.

Its not all sunshine and windows.

>Short of Gabe Newell not controlling it anymore, I

In the same way Bill Gates did not force you to use Internet Explorer, yes. Both are free applications with alternatives. Let's not forget our history.
by maratc | 2025-12-04 10:29:51+00:00
> For complex logic I don't rely on the CI system

I do that too, until my complex logic belongs to the CI system and nowhere else.

As an example:

It's 2 am now and Jenkins needs to run some (but not all) nightly tests[0]. To figure out which, let's bring the source code and analyse the configuration file, disregarding anything that doesn't need to run at this hour. Once we have the plan for which tests to run, let's figure out what we need to build[1]. Also, let's see what is the status of the pool running the tests[2] so we can decide on a tests parallelisation strategy for this run. When we have a plan, let's build and test, keeping an eye on the triggered tests. When all these have finished, analyse the failures[3], create tickets for the failures[4] and prepare a report to be sent.

I wouldn't be able to express all this in YAML.

[0] other "nightly tests" run at 1, 3, 4 etc.

[1] this is mapped in the configuration file too.

[2] this is internal to Jenkins

[3] same

[4] this involves finding the "responsible person," so a lot of API calls
Show HN: FirstDistro – I lost a $5k/mo customer overnight
by Jide_Lambo | 2025-12-04 10:30:08+00:00
I had a sweet deal $5k/mo customer. Their usage had been dropping for weeks, but I was busy building features to notice. Got the cancellation email on a Tuesday morning. That's a $60k/year in revenue I could have saved with a 10-minute phone call, if I'd known they were struggling. So I built https://firstdistro.com . It watches your customers' health (usage, engagement, activity) and alerts you when someone's at risk. One script tag. Health score in minutes. Alerts to Slack, email or Attio crm. Happy to answer questions about churn prediction, customer health scoring, or how we calculate signals. https://firstdistro.com
by johnnyanmac | 2025-12-04 10:33:33+00:00
Don't know who you're talking about. I took a scan and see this is my only reply to you anywhere in this chaiin. If everywre you go smells.....

Try to focus on the argument next time instead of the person. Especially if you're leaving so many replies you can't keep up with. "I'm sorry for you" isn't convincing anyone and only weakinig your point.
by StrLght | 2025-12-04 10:33:40+00:00
Yes, it is. It's so wild to see this.

For years people didn't care that much about specific terminal emulators or opinionated dotfiles. Now projects like Ghostty and Omarchy get tons of attention.

I get that it's probably not the projects themselves, but rather authors behind them. I'm also not saying that these projects are bad — they could be good. I don't use them, so I wouldn't know. It's just discouraging, seeing that other similar projects don't and probably won't get that traction.
by theothertimcook | 2025-12-04 10:34:13+00:00
There are ads on Reddit for a secure age verification system that uses your bank account to prove you're over 16.

The current trend with authoritarian moves in Australia, law changes targeted young people, whether to prevent them from committing crime or to protect them from it, then broadened out to the rest of the population.

E.g intoxicated teens stabbing each other has turned into compulsory wanding and searches by police in public.
by safety1st | 2025-12-04 10:34:19+00:00
There is a bit of a debate about what to call the American economic system these days, but I think we should all agree it's not a capitalist one. It's not one that Adam Smith would look at, approve, and say oh yeah baby that's exactly what I was writing about in Wealth of Nations.

It looks a lot closer to the economic policies of the most successful fascist regimes - the best term for modern American economics might be "democratic fascist." There is a facade of a market economy, but there's heavy intervention to privilege not just domestic businesses, but a specific set of big ones that have close ties to the ruling party. This is not much different from how Hitler and Mussolini approached economic policy. Basically have your system revolve around private ownership, pretend to have a market economy but actually make very centralized decisions and execute them through a small number of private oligarchs you're buddies with. The uniquely American flavor is that there are two parties which do this instead of one (but three would be unimaginable), and you can choose which pack of bandits you signal loyalty to without being executed.
by johnnyanmac | 2025-12-04 10:34:34+00:00
If you only focus on money and not the actual societal effects, it's very easy to divorce yourself from society. Thars prerty much what billionaires have been doing for decades now.

Data centre's and the stock market are not humans. They are powered by humans who's incentives do not align with the betterment of humanity. Be careful looking down the green abyss.
by JohnMakin | 2025-12-04 10:34:36+00:00
Why would you want to do that though?

On cloud, in my experience, you are mostly paying for compute with managed kubernetes instances. The overhead and price is almost never kubernetes itself, but the compute and storage you are provisioning, which, thanks to the control plane, you have complete control over. what am i missing?

I wouldn’t dare try to with a small shop try to self host a production kubernetes solution unless i was under duress. But I just dont see what the control plane has to do with it. It’s the feature that makes kubernetes worth it.
by arghwhat | 2025-12-04 10:35:06+00:00
(In the context of the discussion about these vehicles in the EU)

In the EU, neither would any American pickup truck: If registered as a normal class B vehicle, the total gross vehicle weight would be limited to 3500 kg (7700 lbs), and it would at most be permitted to tow 3500 kg (7700 lbs) with full independent trailer brakes, 750 kg (1650 lbs) without. You can add roughly 1000 kg if you tow a semitrailer, but getting the vehicle certified with a fifth wheel would probably be infeasible.

It doesn't make sense as a class C truck here (special driver's license, tachograph requirements for commercial use). It's way less nimble than our Scania/Volvo trucks (their turning radii are way tighter, and and have much smaller footprint for a given capacity), and is obviously a lot less capable than a vehicle that can be build from small utility up to the ~100k lbs range.

At the same time, if a farmer is outside the scope of a regular personal vehicle, they're most likely going to use their go-to tractor (e.g., Lamborghini, John Deere) which can haul anything anywhere, otherwise if they really need to haul they'll be reaching for a Scania/Volvo.

(It is common to register smaller, 7500 kg class C vehicles, but that's usually stuff like large Mercedes Sprinter vans, often built up as specialized service vehicles - think sewer inspection and repair.)

In the context of the US: It might seem like the best choice given the common options there, but I think the issue is with the options and perceived utility. It's the same with large trucks: The common ones in the EU are much more powerful, rated to haul more, are more comfortable, safer, have much smaller footprint for the given load and turns on a dime compared to US options.
by roncohen | 2025-12-04 10:35:59+00:00
As someone who myself worked on a hobby-level Rust based Kafka alternative that used Raft for metadata coordination for ~8 months: nice work!

Wasn't immediately clear to me if the data-plane level replication also happens through Raft or something home-rolled? Getting consistency and reliability right with something home-rolled is challenging.

Notes:

- Would love to see it in an S3-backed mode, either entirely diskless like WarpStream or as tiered storage.

- Love the simplified API. If possible, adding a Kafka compatible API interface is probably worth it to connect to the broader ecosystem.

Best of luck!
by rvz | 2025-12-04 10:37:10+00:00
"Perfect Go"

Rebuttal for startups: https://benxlabs.substack.com/p/clean-code-is-killing-startu...

Unless you want to release your product MVP or feature more than 6 months or a year late, you can indeed continue to write "perfect" code.

By the time it's perfect, you have not only released very late, but your competitors released and iterated faster, already cemented their products and took your customers faster than you.

After that, your startup would cease to exist.
by vintermann | 2025-12-04 10:37:14+00:00
People hate being manipulated. If you feel like you're being manipulated but you don't know by who or precisely what they want of you, then there's something of an instinct to get angry and lash out in unpredictable destructive ways. If nobody gets what they want, then at least the manipulators will regret messing with you.

This is why social control won't work for long, no matter if AI supercharges it. We're already seeing the blowback from decades of advertising and public opinion shaping.
by Andrew_nenakhov | 2025-12-04 10:37:36+00:00
You aren't from Russia, aren't you? Yes, anyone in Russia who still doesn't have VPN access IS a complete idiot. This is the reality on the ground that I observe every day. Nannies in kindergartens have them, teachers at school have them, salespersons in perfume store have them, all students have them, schoolchildren have them.

And it has nothing to do with the law — currently, using vpn isn't breaking any laws.