MurphyA/hacker-news huggingface dataset:
Show HN: PySpector – a hybrid Python SAST with a Rust core, looking4contributors
by ParzivalHack | 2026-01-10 11:25:07+00:00
Hi HN,
My name is Tommy, and i’m the maintainer of PySpector, an open source static analysis security testing (SAST) hybrid framework for Python (now with around 19k PyPI downloads), that combines a Rust analysis core with a Python CLI.

I originally built PySpector because I kept running into two problems with existing Python security scanners:
- performance issues on larger codebases
- lack of deeper analysis (like inter-procedural taint tracking)

PySpector’s approach is:
- a Rust core for fast, parallel analysis (making PySpector 71% faster than Bandit and 16.6x faster than Semgrep)
- Python for orchestration and extensibility
- multi-layered detection using regex, AST analysis, and taint flow tracking
- static rules for LLM/AI model vulnerabilities
- TUI for triaging issues

The project is still in beta and actively evolving.
I would love some feedbacks, and i appreciate (a lot) contributions around:
- security rule design (especially AI Security ones)
- taint analysis
- improvements to the Rust core that enhance performances
- developer experience and documentation

If you work on static analysis, security tooling, AppSec or Rust/Python scripting in general, I’d really appreciate your thoughts (and help, if you're feeling generous xD)

Repo: https://github.com/ParzivalHack/PySpector
Website: https://parzivalhack.github.io/PySpector/
by throwawayqqq11 | 2026-01-10 11:26:08+00:00
What if that "anti american sentiment" is just a more sceptical mindset and there is actually alot to critize about trump/usa.

Want to play a game? I give you quotes/actions from trump and you have to reason why he still is eligible for office. Gosh, i'd wish this was a game show. The longer you make it, the more price money is to win. 'Grab'em by the facts!' and the top price is your very own 747 plane.
by hyperman1 | 2026-01-10 11:26:25+00:00
This is a great idea.

Where I live, a biking organisation gave out yearly awards for the golden and silver spokes for the best bike adaptions, and the rusted spoke for the most dangerous road setup for bikes. The government rarely collected their rusty award, but the local press loved it. If the government fixed the bad roads, the rusted spoke could be requested back to some smiling official, again for some press attention.

It worked. Fixing your worst road every year and reminding designers not to forget bikers had a remarkedly long term good influence.

Writing this, I wonder if iFixit is planning to take back awards if vendors do better.
by tomjen3 | 2026-01-10 11:26:28+00:00
It will certainly help - but its an extremely high bar. Almost all formal verification of software today is "does this pass the typechecker"?.

Now this captures some errors, but it doesn't really capture high level ones (is this program guaranteed to not deadlock is a hard one), and it doesn't capture the one that is important for business purposes (does this do what the customer wants). That requirement is more important than correctness (vitness all the software that is described as "crap", but is nonetheless widely used).

I don't think this is a required key to unlocking vibe coding. That seems to be easy: does this provide business value? And there the answer seems roughly to be "yes".
by bdauvergne | 2026-01-10 11:26:33+00:00
Seems people read the blog but not the code, I looked at the stated rewrite of Numpy in Rust:

> As an introductory project, I rewrote Numpy in Rust. It was great fun.

That's not a rewrite at all it's just a wrapping of an existing linear algebra Rust library (faer, blas, etc..) with a more Numpy like API. It seems to me that every AI project I look at is just a mashup/wrapper over existing things. Where are the real bootstrapped new things with AI ? Is there any big OSS project (Linux kernel, postgresql, Django, whatever) with serious bugfixes or new features implemented by AI that we could look at ?

Are so much people in programming implementing middleware / wrapping existing API all day that it gives them a feeling of liberation to be able to delegate those tasks ?
by sph | 2026-01-10 11:27:12+00:00
I've always thought the world needs a project to provide guerrilla internet connectivity to a large area using cheap, common hardware like a Raspberry Pi for situations like these which are increasingly common.

Basically a 12V battery-powered Wifi+3G(+Wimax maybe) antenna for clients and an outbound Ethernet port to plug to some illegal internet socket. Make it open-source, able to be built with a little ingenuity and low cost.
by abc123abc123 | 2026-01-10 11:28:32+00:00
WTF? How are you attacked by russian accounts? This childish notion of thinking that only "true" thoughts are allowed under free speech, and the rest must be eradicated needs to die.

If you don't like the risk of russian accounts, don't follow them, and follow accounts that you like. It's as easy as that.

You have news, government news sites, journalists, newspapers, it's never been easier to find sources to trust and compare them against each other.

Screaming murder because Sergei6778 says that Ukraine is evil is just stupid. Take responsibility for your own reading and mind, and stop using the law as a hamfisted tool to stop free speech. Take the bad with the good, or else there won't be any good left in the future.
by dxdm | 2026-01-10 11:28:44+00:00
In my experience, this is a time management problem. Meetings tend to fill the time available. Rarely are there meetings that have to last a full hour and could not have been over after 50 minutes.

Or what makes 60 minutes so magical that you can wrap up a meeting quickly once that marker approaches? People need to leave, that's why. If it had been clear from the start that people will leave after 50 minutes, you can wrap up by then, same way you wrap things up at 60.

There is a lot of slack in meetings. What you need is someone to manage the available time and move things along, make sure that there is room at the end to get to a conclusion. You will have these last 10 minutes after 40 minutes instead of 50 if you pay attention to time and keep things moving.

This can be done, even with time to spare for pleasantries. I know this because I've been in meetings and I have run meetings like this. It helps if you can start on time and don't have to wait for stragglers in the beginning who needed a break between their back-to-back meetings.
by cess11 | 2026-01-10 11:29:25+00:00
The zionist movement has never been peaceful, it has always aimed for violent expulsion of native populations from Palestine. One might argue that socialist or liberal zionism is not overtly jewish supremacist, but in practice they always were so I'd contest that. Unlike the irish they also did not have a reason to exterminate the palestinians specifically, whereas the irish have good reason to resist british influence.

So you agree that zionism is a movement mainly consisting of christians, you're just not aware that both christian and jewish zionists prefer to paint the movement as a jewish underdog and distract from things like the nukes and nuke carrying backers and the genocide and so on.
by teotexe | 2026-01-10 11:29:34+00:00
Hi HN,

I built Sappu (Simple As Possible Processing Unit) to teach myself low-level C programming and computer architecture simultaneously.

It’s a simulation of the SAP-1 architecture (popularized by Malvino and Ben Eater). Instead of emulating high-level behavior, I modeled the hardware explicitly. In fact, the entire CPU - registers, ALU, and Control Unit - is built on top of just these two C functions:

wire NOT(wire a){
return !a;
}

wire NAND(wire a, wire b){
return !(a && b);
}

From there, I built the derived gates (AND, OR, XOR), then flip-flops, then the bus interactions.

It includes a custom assembler and a CLI visualization to watch the control signals fire in real-time. The goal was to understand exactly how instructions physically move through a bus.

I’d love any feedback on the C implementation or the architecture logic!

Repo: https://github.com/teotexe/Sappu
by andyjohnson0 | 2026-01-10 11:30:31+00:00
I'm noticing quite of lot of posts to Ask/Show that are basically people using HN as a blogging platform. Sometimes they're tech-flavoured AI slop wrapped around a few links - persumaby an attempt at SEO. Other times they seem to be posted by users who may genuinely think that this is appropriate usage. Or they're cheap rants. Mostly they seem to be posted by new accounts. It's not clear to me that a captcha mechanism would help with this.
by watwut | 2026-01-10 11:31:20+00:00
https://www.cdc.gov/hepatitis-surveillance-2023/hepatitis-b/...

Whites had highest hepatitithis B rate 2013-2020 at which point blacks "won" again. Every since, it is blacks first, whites seconds, asians, hispanics, native americans third.

The assumption that whites have lower Hep B rates is wrong.
by impendia | 2026-01-10 11:31:33+00:00
> Are you an expert?

I can't speak for ndriscoll, but I am a university math professor with extensive experience teaching these sorts of topics, and I agree with their comment in full.

You are right that some (other) statements are harder to formalize than they look. The Four Color Theorem from graph theory is an example. Generally speaking, discrete math, inequalities, for all/there exists, etc. are all easy to formalize. Anything involving geometry or topology is liable to be harder. For example, the Jordan curve theorem states that "any plane simple closed curve divides the plane into two regions, the interior and the exterior". As anyone who has slogged through an intro topology book knows, statements like this take more work to make precise (and still more to prove).
by j-krieger | 2026-01-10 11:31:38+00:00
> I am hurt when I think I am hearing words from a fellow citizen that are their own opinion, when instead it is a foreign actor pushing a narrative for their state.

No you are not.

> I am all for free speech, but I am not for anonymous speech which is choking the internet

Then you are not for free speech. Have you ever considered from your point of view that anonymity is incredibly valuable to people who live under an oppressive regime, like Iran or Russia?

> I want to at least know that an account I am speaking to is a _person_ and not a robot, although Id probably want country of origin too.

I too, want many things. That does not give me the right to unveil people who wish to be anonymous. It's pretty wild that this is an opinion on hacker news, of all sites.
by jimnotgym | 2026-01-10 11:31:45+00:00
No, your tone is fine, and thanks for that. A whirling mind is not often productive but it can make great leaps forward. It can also be paranoid, dangerous and self-destructive.

I was trying to make the point that self- help easy fixes are not always successful. I spent decades actively learning to sleep. It works most of the time. It is good to learn. I use a mindfulness sleep meditation most nights. I also learnt from sleep hygiene that going to bed early is normally a big mistake for me, precluding much of the 'go to bed earlier, get up and exercise' advice.

I have also hit periods in my life where I simply couldn't mediate for weeks on end despite regular practice over a decade. I was mentally ill. No routine or hacks was going to get me to exercise. I needed therapy (EMDR) and rest, and when I got really self-destructive I needed sleep medication (useful only for a very short time). The 'hack' people just made me feel bad about myself for being unable to get a grip.

That is what I want people to see, exercise is only useful if you are well enough to do it. If you are not well enough to shave, then don't beat yourself up for not getting exercise. Put a pin in it, and do it later.

My latest illness was (psycho-somatically) interfering with my cortisol levels, and it made any exercise crippling. I couldn't recover. I didn't get the boost. I beat myself up about not being able, and it made me worse.

Exercise and therapy rather than exercise or therapy might be better advice.

Edit, typos
by disqard | 2026-01-10 11:32:41+00:00
I think you have a point.

I often think of Tony Hsieh (Zappos founder/CEO), who was a much more grounded and humble person before he became extremely wealthy. Perhaps he had the tendencies/propensities (that ended his life) dormant all along, and his wealth suddenly boosted those deadly habits.

He went from this:

https://youtu.be/jJ5k_Byd9Fs?si=XeYpu-rUNos_dwgI

...to this:

https://straightforwardinteractive.com/2020/12/08/tony-hsieh...
by nomilk | 2026-01-10 11:32:56+00:00
Word on the street is Starlink is operational in Iran [0]. Although the article claims it's being jammed in some neighbourhoods:

> Starlink was being jammed, Rashidi said, although the extent varied from one neighbourhood to another.

[0] https://x.com/WarMonitor3/status/2009729660792258805
by Joel_Mckay | 2026-01-10 11:33:07+00:00
These firms can do what they like if and only if they pay for every $7B reactor, the 30k year waste stewardship, and disconnect from community resources people paid for with taxes. However, currently the unethical burden cities with the endless bill for resources, contribute no actual value, and one may spot the data center waste heat signatures and industrial run-off from space.

Consider most "AI" firms lost on average $4.50 for every new user, rely on overt piracy, and delusional boards sand-bagging for time... these LLM businesses are simply unsustainable fictions.

Many problems don't have simple answers, but one may merely profit by their predictable nature. I would recommend volunteering with a local pet rescue society if you find yourself getting upset about trivia. Have a great day. =3

https://www.youtube.com/watch?v=JAcwtV_bFp4

https://www.youtube.com/watch?v=Xx4Tpsk_fnM

https://www.youtube.com/watch?v=t-8TDOFqkQA

https://www.youtube.com/watch?v=yftBiNu0ZNU

https://www.youtube.com/watch?v=vrTrOCQZoQE
by stared | 2026-01-10 11:33:45+00:00
You're mixing up phōnē (voice) and phonos (slaughter), but the truth about Persephone is actually more metal.

Her name predates the Persians, so the timeline doesn't fit. Instead, it comes from perthein (to destroy) + phonos, making her the "Bringer of Destruction". With a caveat that the etymology of her name is uncertain: https://en.wikipedia.org/wiki/Persephone#Name

I do like "Killer of Distance" for telephone, though. :)
by sph | 2026-01-10 11:33:47+00:00
I don't get this. AI coders keep saying they review all the code they push, and your suggestion is to use even harder languages the average vibe coder is unable to understand, all in name of "performance"? Faster code maybe, and exponentially increasing the tech debt and amount of bugs that slips through.

It wasn't even long ago that we thought developer experience and capacity for abstraction (which is easier to achieve in higher level languages) was paramount.
by jeswin | 2026-01-10 11:33:55+00:00
Actually TypeScript is an excellent language (in my view) for targeting native code. It reads cleaner than Java, C# and even golang in many cases - at least to me.

For example, JS/TS's file-path based imports are more intuitive; several languages do it via explicit namespaces when well-written code is already organized into directories. Of course, all of these design choices are subjective. In fact, disagreement with a few people in the C# user community is one of the reasons I started this project.

Another example - top level functions, being able to export them trivially etc.

> At what point do JavaScript developers need to realise that this is all convoluted, and begin to use languages better suited for the job.

I'd like to know what makes TS convoluted. Here's an example of multi-threading: https://github.com/tsoniclang/proof-is-in-the-pudding/blob/m...
by kouteiheika | 2026-01-10 11:34:49+00:00
> are often used to make fake news, slander people, or other illegal content.

That's not how these models are used in the the vast majority of cases.

This argument is like saying "kitchen knives are often used to kill people so we need to ban the sale of kitchen knives". Do some people use kitchen knives to kill? Sure. Does it mean they should be banned because of that?

> I agree research is exempt from copyright, but people cashing in on unpaid artists works for commercial purposes is a copyright violation predating the DMCA/RIAA. We must admit these models require piracy, and can never be seen as ethical. =3

So, may I ask - where exactly do you draw the line? For the sake of argument, let's imagine something like this:

1. I scrape the whole internet onto my disk.
2. I go through the text, and gather every word bigram, and build a frequency table.
3. I delete everything I scraped.
4. I use that frequency table (which, compared to the exabytes of the source text I used to build it, is a couple hundred megabytes at most) to build a text generator.
5. I profit from this text generator.

Would you consider this unethical too? Because this is essentially how LLMs work, just in a slightly fancier way. On what exact basis do you draw the line between "ethical" and "unethical" here?
by latexr | 2026-01-10 11:35:01+00:00
Markdown is limited because it covers what its creator (single), needed for his blog. That’s it. Markdown was birthed as a single Perl script (with bugs that are still present).

Tables don’t have to have headers in Markdown. It doesn’t even have tables to begin with! Not in the original specification which still exists. But there are certain flavours of Markdown which add support for tables, and those may or may not require headers. Each flavour implements features of Markdown as it see fit, and those may or not exist in other flavours or be implemented differently.
by nl | 2026-01-10 11:35:22+00:00
> are 99% of us building a pacemaker? no. but that doesn’t mean we can automatically make the leap to assuming a set of tools known for being non-deterministic are good enough for our use case.

This seems irrelevant?

Either way hopefully you test the pacemaker code comprehensively!

That's pretty much the best case for llm generated code: comprehensive tests of the desired behaviour.
by dxdm | 2026-01-10 11:35:24+00:00
Seen from within the meeting, it does not really matter if you start 5 minutes late or end 5 minutes early.

I think the point is to reduce meeting time from 60 minutes to 55 or even 50 and be firm about it. People need to expect to start and end on time; giving them a natural break between helps make this happen even for people whose job requires them to be in back-to-back meetings.

Personally, I think starting on the hour (or half-hour, etc) and ending "early" is better, because it tends to sync well with the calendars of external folks.

But in the end, moving start or end time is only part of the solution. This is a time-management problem, and in addition to constraining the available time, it also needs proper management of the available time within the meeting.
by SergeAx | 2026-01-10 11:37:22+00:00
This is a continuation of LaLiga vs Cloudflare in Spain. Spaniards are just blocking the whole CF IP ranges during the broadcast of important sports games, shutting down half the internet altogether. Italians are trying another way.

I can't ad hoc the best solution for all, but asking for help from Elon Musk and JD Vance, two prominent borderline fascist figures of our time, is disturbing.
by Ikatza | 2026-01-10 11:37:26+00:00
Freedom of speech is binary, there aren't any acceptable degrees of it: either you have it, or you don't.

If there is disinformation, the solution is to counter it with actual information, to give the people better tools to identify it (like X's community notes), and to educate the general population so they will have better critical thinking.

Restricting freedom of speech is never a solution. How long until dissenting opinions are censored because somebody labels them "disinformation"? Who watches the watchmen? etc.

I'd rather live in a society with full freedom of speech and disinformation from State actors than have only 100% accurately vetted news.
by tsimionescu | 2026-01-10 11:37:31+00:00
> Paying a junior employee $100k? "We can't do that, the agency director has worked here for 40 years, and he doesn't make that much."

I can assure you that junior software engineers in Italy or anywhere else in the EU make nowhere near that amount of money. In fact, few of even the most senior software engineers make that amount of money anywhere in the EU (in Switzerland or the UK they might see such salaries, at the higher tiers).
by fc417fc802 | 2026-01-10 11:37:54+00:00
Well, yeah, I suppose that on occasion a view expressed by an American could happen to overlap with the propaganda of any given geopolitical adversary. Similar to the principle of a broken clock being right twice a day.

I have to say though, reflexively responding in that manner gives the impression of being quite radicalized. I don't think that's the level of discourse expected on HN.
by sph | 2026-01-10 11:37:59+00:00
> I will never as long as I live understand the argument that AI development is more fun

AI is more fun for programmers that should've gone into management instead, and prefer having to explain things in painstaking detail in text, rather than use code. In other words, AI is for people that don't like programming that much.

Why would you even automate the most fun part of this job? As a freelance consultant, I'd rather have a machine to automate the whole boring business side so I could just sit in front of my computer and write stuff with my own hands.
by torginus | 2026-01-10 11:38:22+00:00
I used to work on custom embedded UIs that supported fractional scaling. This shit is hard.

You have to understand there's enormous effort that needs to go into this to make things look good. It's absolutely no surprise to me that Jobs era Apple used to stick to integer scaling ratios with relatively low-res phones while the competition battled with paper specs.

The trick to make things look good is to be mindful of the pixel grid, (and the subpixel layout). You have to choose font spacing and fonts so that major font features line up with the pixel grid. You sometimes have to slide a letter a bit to the left or right, which might result in inconsistent spacing, you might even want to have multiple versions of characters to hide these issues.

This applies to borders as well (both spacing and thickness).

Sometimes you can't make it look good no matter what you try - and the designer has to change it.

While flexbox and other super-duper layout algorithms might be very clever, if you use them, there's no way to line things up perfectly, and if you expect to, you might be in a world of hurt.

Adding PPI is a poor way to fix this. Even if you 2x the resolution, going from 1080p, to 4K, these issues still persist, and you quickly run out of hardware beyond that.

There's no wonder why modern 'flat' UIs usually have 1-2 pixel-ish gradients on edges of features, or use smooth transitions, it's a cop out - but that's the only thing that works with flexible layout, different pixel densities. But subtly, you notice things looking a bit blurry, just as if the images were low-res, even though the pixel density is insane.

ClearType is brilliant, but it only works with a certain set of assumptions, like a bit of light bleed (which exists on LCD but not on OLED afaik), and needs to know the subpixel layout, and can result in absolutely gorgeous looking fonts with relatively low res displays.

There's a reason why Windows 95-era UIs have a cult following - it's insane how sharp they looked even on hardware that on paper is much worse than modern stuff.