MurphyA/hacker-news huggingface dataset:
by amjadfatmi1 | 2026-01-23 16:57:32+00:00
Spot on, Yaron. Schematic validation (Protobuf) catches structural errors, but semantic aliasing (the 'rm -rf' vs 'rm -r -f' problem) is exactly why I developed the CAR (Canonical Action Representation) spec.

I actually published a 40-page paper (DOI: 10.5281/zenodo.18296731) that defines this exact 'Action Authorization Boundary.' It treats the LLM as an untrusted actor and enforces determinism at the execution gate.

Faramesh Core is the reference implementation of that paper. I’d love for you to check out the 'Execution Gate Flow' section. it would be a massive win to see a Faramesh-Cordum bridge that brings this level of semantic security to your orchestrator.

Code: https://github.com/faramesh/faramesh-core
by shikhar | 2026-01-23 16:57:56+00:00
> Can this be used as an embedded lib instead of a separate binary as an API?

Did not architect explicitly for that, but should be viable. You could use the `Backend` directly, is what the REST handlers call https://docs.rs/s2-lite/latest/s2_lite/backend/struct.Backen...

Happy to accept contributions that make this more ergonomic.

> And am I understanding correctly that if I pointed 2 running instances of s2-lite at the same place in s3 there would be problems since slatedb is single writer?

SL8 will fence the older writer, thanks to S3 conditional writes.
by GuB-42 | 2026-01-23 16:58:04+00:00
> BTW what makes you think writing their end in C would yield even higher performance?

C is not inherently faster, you are right about that.

But what I understand is that the library they use works with data structures that are designed to be used in a C-like language, and are presumably full of raw pointers. These are not ideal for working in Rust, instead, presumably, they wrote their own data model in Rust fashion, which means that now, they need to make a conversion, which is obviously slower than doing nothing.

They probably could have worked with the C structures directly, resulting in code that could be as fast as C, but that wouldn't make for great Rust code. In the end, they chose the compromise of speeding up conversion.

Also, the use of Protobuf may be a poor choice from a performance perspective, but it is a good choice for portability, it allows them to support plenty of languages for cheaper, and Rust was just one among others. The PgDog team gave Rust and their specific application special treatment.
by 9rx | 2026-01-23 16:58:07+00:00
I am curious about what kind of friction you encountered. Were you generating ad-hoc protobuf messages?

Assuming you were using Protobufs as they are usually used, meaning under generated code, I saw no difference between using it in Javascript and any other language in my experience.

There are a number of different generator implementations for Javascript/Typescript. Some of them have some peculiar design choices. Is that where you found issue? I would certainly agree with that, but others aren't so bad. That doesn't really have anything to do with the browser, though. You'd have the same problem using protobufs under Node.js.
by troupo | 2026-01-23 16:58:10+00:00
> It's something they should fix and if they did would you suddenly switch to Scaleway?

You know why I have this screenshot? Because I literally tried to switch to "great European alternative" that is "as slick as DO".

After a third or a fourth screen, most of which felt completely isolated and disconnected from any previous ones, I gave up on the screen that couldn't handle a standard European address.

This was literally the point that I gave up.

So I went ahead... and signed up with Hetzner.
by tsimionescu | 2026-01-23 16:58:32+00:00
First of all, the very fact that companies need to encourage it shows that it is not already a majority opinion in society, it is a majority opinion among company management, which is often extremely unethical.

Secondly, even if it is true that it is a majority opinion in society doesn't mean it's right. Society at large often misunderstands how technology works and what risks it brings and what are its inevitable downstream effects. It was a majority opinion in society for decades or centuries that smoking is neutral to your health - that doesn't mean they were right.
by thejoeflow | 2026-01-23 16:59:01+00:00
Isn't the search bad because they can't search email contents? As long as the term is somewhere in the metadata (title, sender email, sender name) it seems to work ok.

I agree though that the user experience isn't great because of this limitation. You kind of have to remember what the title of the email was for what you're looking for. Searching for "flight ticket" results in mixed success
by Luke7492 | 2026-01-23 16:59:04+00:00
How do you convince a small business or individual that $1k is a good price for their website? As someone that has learned web development as a hobby many years ago, I’ve helped build sites for several people through word of mouth but I can never seem to ask much for the work I’ve done for some reason. I work really fast, it’s easy, and even fun for me. This idea sounds great and I even have access to create unlimited sub-accounts on a CRM platform paid for by my real job. I can make full websites with storefronts, blogs, forms, galleries, email/sms flows, you name it. My issue is knowing how to convince others how valuable the work is. Any suggestions?
by latexr | 2026-01-23 16:59:05+00:00
> You misread. Betteridge's law says it can be "no"...

That doesn’t make sense. Of course Betteridge didn’t mean “it can be answered with “no”, but also “yes””. The point is that you can answer “no” instead of reading the article.

Either way, I was responding to ultropolis’ assertion—not Betteridge’s—by citing the studies which already suggest it to be false.
by DoughnutHole | 2026-01-23 16:59:11+00:00
Homer used to complain about the big things. He tried to kill himself in the third episode due to losing his job. The first 2 seasons are honestly comparatively depressing with some of the heavy topics they touch on.

The Simpsons just leant so far into 1-note characteristics that they became caricatures of themselves - and the term Flanderization was born.
by tracker1 | 2026-01-23 16:59:15+00:00
Serious question, why not just use websockets? AFAIK, it's effectively a TLS socket with a little bit of handshake overhead when starting.

I'm literally working on a web interface I want to use for classic BBS door play... currently working on a DOS era EGA interface, and intend to do similar for PETSCII/Comodore64/128 play as well. I've got a couple rendering bugs to explore for ansis submitted that messed up in the viewer test mode.

https://github.com/bbs-land/webterm-dos-ansi

It's been an opportunity to play with AI dev as well... spent as much time getting the scrollback working how I want as it took on the general rendering.
Show HN: Segre – Safe CLI to organize messy folders by type or date
by shubhampawade | 2026-01-23 16:59:18+00:00
I built segre because my own Downloads folder was a nightmare: endless mix of PDFs, images, installers, zips, code snippets, random screenshots—impossible to find anything. Manual sorting was tedious, so I created a simple, safe Node.js CLI that handles it automatically.

Key features:
- Organizes by file type (Images, Documents, Code, Videos, Archives, Installers, etc.) based on extensions
- Or by date (Year/Month folders)
- --dry-run to preview moves without changing anything
- --interactive to confirm each file
- undo command to revert the last run
- Custom categories via JSON config file
- Progress bars, verbose logging, safe handling (no overwrites by default)

Try it instantly with npx (no global install needed):
npx segre ./Downloads --dry-run

Or install globally: npm install -g segre
Then: segre ./path/to/folder

npm: https://www.npmjs.com/package/segre

Would love honest feedback: Does it catch the right categories for your files? Any edge cases or missing types? Bugs? Feature suggestions? Happy to answer questions or iterate based on what people say.

If you'd like to connect or chat more (about this or other projects), feel free to reach out on LinkedIn: https://www.linkedin.com/in/shubhampawade

Thanks for checking it out!
by avidiax | 2026-01-23 16:59:26+00:00
I haven't seen our roadmap accelerate because of AI. I'm sure, given time, having the P2s like documentation and prototyping in place will yield dividends. But I still can't imagine even doubling our rate of progress.

I am in an area that is bottlenecked on many things besides writing the code. Testing requires physical devices and realtime execution. So having the code 10x faster is little difference when the other processes take most of the time.
by goda90 | 2026-01-23 16:59:32+00:00
> In a perfect world, we could send all traffic completely unencrypted and never scan for a malicious payload, saving all that energy and hardware.

In a world with such social cohesion, we'd be defeated by an alien species being able to quickly interpret and exploit our technology like in the hit film Independence Day(note, we're the defeating alien species in this example). https://www.youtube.com/watch?v=9DIjBGierkA
by hannob | 2026-01-23 16:59:50+00:00
Okay, story time: back in 2018, the German government's foreign ministry was hacked.

At the time, a colleague of mine (we were both working for the German IT news magazine Golem) found a web page by a government-associated university that was offline with a message that it's been taken down due to a security issue.

Putting a few hints together, we figured out that Ilias was hosted therer, and that this was how the attack on the government initially started.

We weren't able to figure out which vulnerability was used, but had some ideas what it might've been. (Older versions had a default password for the admin account.)

One wonders: there's an Open Source software that's widely used by universities, even by government-associated universities. It's been the cause of a high-profile attack on a government before. One wonders why that doesn't trigger sufficient funding for regular, high-quality security audits of that software.

Article from 2018: https://www.golem.de/news/government-hack-hack-on-german-gov...
by throwup238 | 2026-01-23 16:59:55+00:00
> How do these industry figures claim they see no part of a 225K+ line of code and promise that it works?

They're going through a psychotic break and losing touch with reality. I have never seen a worse codebase than beads or gastown. It's a literal flaming pile of garbage disguised as a go CLI so no wonder the author doesn't want to look at the code. Their spleen would probably try to kill them to stop the suffering if they tried ala Vogon poetry.

(Yes, it's that bad)
by s_dev | 2026-01-23 17:00:12+00:00
It's a cool project but it is 'niche'.

I think the purpose of the site is more about the alternatives to 'large players', platforms and infrastructure companies. Still Constantin Graf should have clarified out of politeness but possibly he's busy or doesn't have time to respond to every email.

However I'd point out there is a market for European 'Product Hunt' that would include more of these smaller projects.
by IAmBroom | 2026-01-23 17:00:37+00:00
I have a hoarder friend, who is very cognizant that she suffers from a mental illness.

Her motif is a bit different: she has childhood trauma from her mother secretly throwing away her things, and assigns emotional value to anything that might be usable in the future (essentially safeguarding it against secret destruction by the mental image of her mother).

But likewise, her sense of value is all skewed.
by gloomyday | 2026-01-23 17:00:42+00:00
I've heard once that Americans distrust their government and trust their corporations, while Europeans distrust their corporations and trust their government. I honestly think that governments already has a huge role in shaping people's understanding of the world, and that's GREAT on good democratic countries.

What I find really weird is that I am stopping believing in the whole idea of free press, considering how the mainstream media is being bought by oligarchs around the globe. I think this is a good example of the erosion of trust in institutions in general. This won't end well.

Your idea of letting it be run by a non-profit makes me believe that you also don't trust institutions anymore.
Show HN: NetHackPlayer – Have Claude Play NetHack
by pj4533 | 2026-01-23 17:00:51+00:00
I was doing this in a regular Claude Code session for a while, but wanted an all-in-one UI for it. Claude Code controls NetHack via tmux.

I have a NetHack skill installed that I update after each session.

My Claude's top score is 3302 (dungeon level 11).

It is interesting cause it mostly has trouble with spatial reasoning, even though it knows most/all the details of the game.

This absolutely CHEWS up tokens...lol.
by uhuhuhuhuhuh | 2026-01-23 17:00:54+00:00
This is incorrect. There are no separate "private Claude Code endpoints."

I reverse engineered this over the past week. Both Claude Code and regular API users hit the same endpoint: https://api.anthropic.com/v1/messages

The only difference is the auth method - OAuth bearer token (sk-ant-oat01-...) vs API key (sk-ant-api03-...). The "blocking" is request body fingerprinting on the server side.

Here's what a working Claude Code request looks like:

{
"model": "claude-sonnet-4-20250514",
"max_tokens": 32000,
"stream": true,
"metadata": {
"user_id": "user_<sha256>_account_<uuid>_session_<uuid>"
},
"system": [
{"type": "text", "text": "You are a Claude agent, built on Anthropic's Claude Agent SDK."},
{"type": "text", "text": "<~12KB of instructions>"}
],
"tools": [
{"name": "Task", ...},
{"name": "Bash", ...},
// 17 tools total, PascalCase names
],
"messages": [...]
}

And here's what OpenCode sends (blocked):

{
"model": "claude-sonnet-4-20250514",
"max_tokens": 16000,
"temperature": 0, // Claude Code doesn't send this
"stream": true,
// no metadata.user_id - required
"system": [
{"type": "text", "text": "You are OpenCode, an interactive CLI..."}
],
"tools": [
{"name": "bash", ...}, // lowercase, wrong schema
{"name": "edit", ...},
// 11 tools total
],
"messages": [...]
}

The API validates at least 5 things: (1) system prompt must start with "You are a Claude agent, built on Anthropic's Claude Agent SDK." (2) tools must match Claude Code's exact 17 tool definitions with PascalCase names (3) headers must include anthropic-beta, x-app: cli, and claude-cli user-agent (4) metadata.user_id must be present in a specific format (5) temperature field must be absent.

Fail any of these:

400 | This credential is only authorized for use with Claude Code
and cannot be used for other API requests.

I confirmed this by writing a proxy that intercepts requests and transforms them. The approach: run legit Claude Code through mitmproxy once to capture its exact request format - the full system prompt, all 17 tool schemas, headers. Cache that. Then when a third-party client sends a request, swap their templates with Claude Code's cached ones, add the required headers/metadata, strip temperature. The OAuth token is already on disk at ~/.claude/.credentials.json (written by "claude login") - the proxy just reads it for each request.

Same endpoint, same request size, just different templates. Returns 200.

It's not endpoint separation, it's request body validation. The OAuth token is tied to an expected request format.
by MarkusWandel | 2026-01-23 17:01:04+00:00
I'm not sure I agree with all of that - that single-purpose tech is making a real comeback. But I do have one example in my daily life that supports this: A Garmin watch.

Unlike "full" smartwatches (arbitrarily defined as: You can browse the web on them in some fashion) Garmin devices are intentionally limited but in return, what they do works very well and seems fully debugged. I spent several years recording outdoor activities with the Strava app on my phone, and always there was about a 1% failure rate where for one reason or another, the GPS trace was interrupted or corrupted. With the Garmin watch this simply doesn't happen. If it's recording, the recording is good, period.

It is that, that has somehow been lost. That devices that just do one thing and do it well have been replaced by apps on a device that, in the modern software fashion, are "mostly" debugged, get constant updates that may or may not remove bugs (or features!) and usually don't add anything useful. One app got an update which, on my lower-end phone, changed it from crisply responsive to incredibly slow (5+ second response time to a tap). It worked fine before.
by mise_en_place | 2026-01-23 17:01:39+00:00
Read Spengler.

>Comradeship breeds races... Where a race-ideal exists, as it does, supremely, in the Early period of a culture... the yearning of a ruling class towards this ideal, its will to be just so and not otherwise, operates (quite independently of the choosing of wives) towards actualizing this idea and eventually achieves it.

In other words, it's not necessarily that a non-white culture can't independently form and sustain a liberal democracy. But they'd need their own historical events mirroring that of the Magna Carta, the Enlightenment, etc. The seed needs to exist from the very beginning. The Global South doesn't have such preconditions culturally; unless you count colonialism, but as we've seen, that's not enough to transmit the race-ideal permanently, mimetically speaking. So you'll get a cargo cult of liberalism at best, but you won't get liberalism as such.
by kieranmaine | 2026-01-23 17:01:45+00:00
On https://european-alternatives.eu/about the listing criteria state:

> The company is based in an EU, EEA, EFTA, or DCFTA member country or in the UK.

but

> For hosting providers: It is not allowed that a hosting provider is simply a sub-hosting provider of a company that is not based in an EU or EFTA member country.
Show HN: Malan Chat, a full immersion language learning app for 62 languages
by sam_osterfeld | 2026-01-23 17:01:53+00:00
With Malan Chat, you can learn over 60 languages through AI-powered conversations, grammar correction, and integrated FSRS flashcards. The chat allows users to practice speaking and listening, get instant corrections, and build your vocabulary with our intelligent language tutor. Users may import readings into the Reader, look up words and annotate the article, and discuss the reading with the chat. To practice longer form writing, you may go into the writing hub and see your text marked up with corrections.

I built Malan to make speaking practice feel like a real conversation instead of a clunky exercise. It’s a chat-first language coach that listens, responds, and nudges you toward more natural phrasing without breaking your flow, so the learning process stays light and fast, it feels more like texting than studying. It’s strongest for people who already know some of the language and want to go from 1 → 100. There isn’t a true 0 → 1 path yet (onboarding for complete beginners is coming), so right now it’s best for learners who can form basic sentences and want consistent practice with real feedback.

Coming soon: YouTube (and possibly Spotify) integration so you can get listening practice from real sources that you want to engage with. This is your journey, and you are a distinct individual with your own tastes. I want you to have fun while you're going through the arduous task of learning a new language! Also in the works are custom exercises based on your own needs.

I've still had very limited user feedback, so please tell me what you like or don't like about the platform and I will do my best to remedy it!
by ynx | 2026-01-23 17:02:05+00:00
> Docker’s journey reads like a startup trying to find product-market fit, except Docker already had product-market fit - they created the containerization standard that everyone uses. The problem is that Docker the technology became so successful that Docker the company struggled to monetize it. When your core product becomes commoditized and open source, you need to find new ways to add value.

I would argue the reverse: that Docker's value was itself the product-market fit. Docker the technology was commoditized and open-source almost from its genesis, because its technology had been built by Borg engineers at Google. It provided marginally more than ergonomics, but ergonomics was all it needed - the missing link between theory and practice.
by mikepurvis | 2026-01-23 17:02:37+00:00
My sense is that a lot of the container CI space just kind of assumes that every run starts from nothing or a generic upstream-supplied "stack:version" container and installs everything every time. And that's fine if your app is relatively small and the dependency footprint is, say, <1GB.

But if that's not the case (robotics, ML, gamedev, etc) or especially if you're dealing with a slow, non-parallel package manager like apt, that upfront dependency install starts to take up non-trivial time— particularly galling for a step that container tools are so well equipped to cache away.

I know depot helps a bunch with this by at least optimizing caching during build and ensuring the registry has high locality to the runner that will consume the image.
by csense | 2026-01-23 17:02:40+00:00
Your documentation needs improvement. It proudly mentions the alphabet soup of technologies you use, but it leaves me completely baffled about what s2 does, what problem s2 is trying to solve, or who the intended audience of s2 is.

So you frame the data into records, save the frame somehow (maybe with fsync if you're doing it locally, or maybe you outsource it to S3 or S3-compatible storage?), then ack and start sending it to clients. Therefore every frame that's acked or sent to clients has already been saved.

Personally I'd add an application level hash to protect the integrity of the records but that's just me.

At first glance I wondered if a hash chain or Merkle tree might be useful but I think it's overkill. What exactly is the trust model? I get the sense this is a traditional client-server protocol (i.e., not p2p). Does it stream the streams over HTTP / HTTPS, or some custom protocol? Are s2 clients expected to be end-user web browsers, other instances of s2 or something else?
by turtlebits | 2026-01-23 17:02:45+00:00
No one is promising anything. It's just a giant experiment and the author explicitly tells you not to use it. I appreciate those that try new things, even it it's possibly akin to throwing s** at a wall and seeing what sticks.

Maybe it changes how we code or maybe it doesn't. Vibe coding has definitely helped me write throwaway tools that were useful.
by archy_ | 2026-01-23 17:02:56+00:00
4b-model take. LLMs are far more intelligent than you give them credit for. Every new layer of abstraction allows us to develop software better and faster. People constantly ragged on OOP yet it is the foundation of modern computing. People while about "bloat" but continue to buy more RAM. Compilers are a black box and meaningfully inhibit your ability to write asm but these days nobody cares. I see LLMs as the next logical evolution in computing abstractions.
by spaceman_2020 | 2026-01-23 17:03:01+00:00
If you want to be completely watertight, you can absolutely run an on premises model. No data ever leaves your network, ever. Some pretty good models run on $5-10k hardware

Can’t do that with SaaS

Also, I’m baffled that on HN of all places, I have to actually defend the idea of rolling your own apps and protecting your data from cloud providers
by durch | 2026-01-23 17:03:19+00:00
Design indeed becomes the bottleneck, I think that this points to a step that is implied but still worth naming explicitly -> design isn't just planning upfront. It is a loop where you see output, see if it is directionally right, and refine.

While the agents can generate, they can't exercise that judgement, they can't see nuances and they can't really walk their actions back in a "that's not quite what I meant" sense.

Exercising judgement is where design actually happens, it is iterative, in response to something concrete. The bottleneck isn't just thinking ahead, it's the judgment call when you see the result, its the walking back, as well as thinking forward.