MurphyA/hacker-news huggingface dataset:
Show HN: Minimal – Open-Source Community driven Hardened Container Images
by ritvikarya98 | 2026-01-31 19:58:00+00:00
I would like to share Minimal - Its a open source collection of hardened container images build using Apko, Melange and Wolfi packages. The images are build daily, checked for updates and resolved as soon as fix is available in upstream source and Wolfi package. It utilizes the power of available open source solutions and contains commercially available images for free. Minimal demonstrates that it is possible to build and maintain hardened container images by ourselves.
Minimal will add more images support, and goal is to be community driven to add images as required and fully customizable.
by Retr0id | 2026-01-31 19:58:50+00:00
Quantum computing is interesting to think about in the context of bitcoin. It would be technically feasible to upgrade the protocol to be quantum-secure (e.g. allow wallets to make an on-chain declaration of a new PQ pubkey, and after that point all transactions must be signed with the PQ keypair) - but getting everyone to coordinate on something like that would be challenging.
by mustyoshi | 2026-01-31 19:59:19+00:00
The framing of 100% of people getting a prescription as being bad seems weird to me. We live in the age of AI we don't need a doctor to tell us the side effects of medication anymore, people should be free to buy for themselves whatever they want to take.

Obviously involving insurance and (other people's money) makes a difference, but for direct to consumer, I don't think doctors should be gatekeepers any more.
by bobjordan | 2026-01-31 19:59:23+00:00
Yes, I normally draft spec docs in the office at my desk, this is true. However, when I have the spec ready for implementation with clear "beads", I can reasonably plan to leave my office and work from my phone. Its not at a point where I can just work 100% remote from my phone (I probably could but this is all still new to me too). But it does give me the option to be vastly more productive, away from my desk.
by em-bee | 2026-01-31 19:59:59+00:00
whether client-side rendering exposes alternative content really depends on how the code is actually written. i could still send different data depending on the type of client. but i agree with the general point.

i actually used that server-side approach to achieve something like that on an old site. that was before client-side rendering was a thing. i had sections of content that by default were folded, so you would only see the headline had to click and load a new version of the page with the content open, but for a search engine the server would serve the page with all sections opened and none of the headlines clickable.
by recursivedoubts | 2026-01-31 20:00:31+00:00
we are actually considering moving it out again because we also recently picked up a great, reworked websocket extension, and don't want to necessarily privilege one way of doing this sort of programming over the other

what is going to change is that htmx will ship with the "core" extensions (ws, sse, optimistic responses, etc.) as a single release, so they can all be composed easily together and are tested together

we'll see, still in alpha
by nickcw | 2026-01-31 20:01:21+00:00
Interesting reading about the difficulties with arctan.

There is a better series for arctan than the Taylor series which converges for all x. You can see it here in the accelerated series section

https://en.wikipedia.org/wiki/Arctangent_series

I wrote about it in my calculating pi blog some time ago

https://www.craig-wood.com/nick/articles/pi-machin/

It also takes fewer operations which is nice.

I thought it was invented by Euler but the Wikipedia article says Newton invented it and Euler popularized it.
by ThrowawayR2 | 2026-01-31 20:03:02+00:00
Should I, by some miracle, be hiring, I'd be hiring those who come out of college with a solid education. As many have pointed out, AI is not immune to the "garbage in, garbage out" principle and it's education that enables the user to ask informed and precisely worded questions to the AI to get usable output instead of slop.
by beloch | 2026-01-31 20:03:06+00:00
"The astronomers made an accurate note of its trajectory relative to the stars, which to an error better than one degree is consistent with an impact at Köfels."

---------

This is what I find most amazing: Sub-degree accuracy in a measurement from before chariots. The people of this time had donkey-pulled battle carts that were so slow they had to be abandoned if there was a retreat, but they were able to record and measure astronomical events this accurately.

It's also mind-boggling to consider why they were making such observations. It was all about omens that could determine the success of harvests or battles. There is certainly some of what we might now consider scientific thought going on here. They produced omen tables that exhaustively covered every combination of events they could think of, not yet realizing that some combinations were impossible (e.g. A Lunar eclipse at high noon).

Omens sound silly today, but the fundamental motivation of early astronomers was to make sense of what was going on in the heavens in order to help make better decisions on the ground. If everyone believed in these omens, they had real power and the predictions these astronomers made may have had large impacts.
by vpShane | 2026-01-31 20:03:13+00:00
> We didn't review the entire source code
And, you don't see the issue with that? Facebook was bypassing security measures for mobile by sending data to itself on localhost using websockets and webrtc.

https://cybersecuritynews.com/track-android-users-covertly/

An audit of 'they can't read it cryptographically' but the app can read it, and the app sends data in all directions. Push notifications can be used to read messages.
Show HN: A P2P file transfer CLI that approaches scp/rsync speeds without setup
by samsungplay | 2026-01-31 20:03:20+00:00
Hi HN,

Over the past months, I built thruflux to make moving large sets of files between arbitrary machines simpler and faster, without requiring SSH, servers, or port forwarding.

It’s a cross-platform CLI written in Go that uses direct peer-to-peer transfers over QUIC, with automatic NAT traversal and relay fallback when needed. A single sender can serve multiple receivers concurrently, and directory transfers are handled natively (no zipping).

I recently benchmarked it against scp, rsync, croc, and magic-wormhole to understand the tradeoffs more clearly. While it doesn’t always beat built-in infrastructure tools like scp/rsync in ideal conditions, it gets surprisingly close while solving a harder problem (zero-setup P2P), and transfer speeds shows much lower variance than single-stream TCP tools. Moreover, thruflux consistently outperformed comparable P2P CLI tools, particularly for multi-file transfers.

The project is open source and still evolving — happy to hear feedback, especially from people who move a lot of data around. My vision is to create a free, secure, fast mass file sharing CLI tool that is (hopefully and eventually) achieves throughputs close to infrastructure tools like scp/rsync, which many current p2p file transfer CLI tools out there fall short of. I've poured many thoughts into how to make this possible, and now I believe I have reached a point where I would like to invite some early users to try out the tool. For that matter, I'd really appreciate if anyone who needs some data moved try out my tool. Thanks!

Repo + benchmarks: https://github.com/samsungplay/Thruflux
by mjr00 | 2026-01-31 20:03:29+00:00
> Legally, it doesn't matter. You can talk to people? Social media it is.

No this isn't true at all, it absolutely does matter legally. Look at Australia's underage social media ban. Twitter was forced to ban children, but Bluesky was not despite being the platforms being effectively the same. Roblox and Discord, no bans despite being an extremely common place for young people to socialize.
by recursivedoubts | 2026-01-31 20:03:38+00:00
I mean you're not wrong: end of the day htmx is just some javascript written on top of standard vanilla javascript apis. It tries to handle things in a more html-centric, attributes-driven manner than script-oriented approaches do, but it's nothing too complicated

check out fixi for our ultra-minimalist take on the idea:

https://github.com/bigskysoftware/fixi

Or, for extreme minimalisim, htmz, which repurposes iframes for a similar idea:

https://leanrada.com/htmz/
by aaravchen | 2026-01-31 20:03:46+00:00
Much better alternative, and I'm glad it works for the author's use cases. The developer use cases that rocketed ClawdBot/Moltbot/OpenClaude is the lack of integration necessary to use it though.

In most developer early adopter stuff, the things being accessed are often exclusively available from the one user's device. There is no cloud or internet access that can be setup or provided to any of the remote resources the user is trying to operate on. If the actions against the remote resources aren't exclusively executed to/from the user's device, the tool can't be used at all.

What were talking about here is that most of these users are in a corporate environment that they don't control. The corporate IT is intentionally locking down all access so only the user can access "internal" resources from thier company provided devices, and they can only interact in the ways allowed to that user. If you want to use an internet/cloud based server for something, it can only operate as an external processor or storage for the client. It will not be able to directly connect or do anything against any resources that are referenced in any actions.

That's the target audience for early adopters of tools like this. Once it's a widely adopted, then you start getting "official" integrations that may open up options. But until then, all actual actions, reads, etc must exclusively happen on-device.

The Akeyless integration for example only works if the Akeyless cloud server can directly access each thing you're authenticating to. That's not an option for most users.
The Slack integration is interesting, but not an option for most users either. OAuth into the corporate controlled Slack instance isn't going to be an option.
by WorldMaker | 2026-01-31 20:03:47+00:00
Yeah, I remember at one point I had some rather complex auto-workspace layouts in my xmonad config. I don't remember if I tried to automate the launching of apps as well, that most customized config was several computers ago.

Relatedly I know that Windows PowerToys has a tool called "Workspaces" that also automates the launching as well as the placement, but it doesn't seem to integrate enough with FancyZones for me to find it that useful. Which is weird because they are "neighbors" in PowerToys. Still it's a good idea and interesting to see an experiment in that direction.
by _DeadFred_ | 2026-01-31 20:05:06+00:00
I remember when they saw what a certain game app was doing and were disgusted by it. Wild to me that those same people l̶a̶t̶e̶r̶ ̶ almost instantly chose to not only adopt the behavior but make it core functionality. It's way worse when you see the evil and STILL chose it.
by SyneRyder | 2026-01-31 20:06:03+00:00
Unfortunately I still haven't had a chance to make a blog post about this, which I really must do. But I can give some quick hints. Anyone reading this, feel free to reach out & I can try to answer questions, and they might help my blog post too.

I started off with a meta-search calling out to Brave / Mojeek / Marginalia, and the basics of that are something that you can ask an AI to make for you as a one-file PHP script. I still think this is a good place to start, because you'll quickly find "okay, I can replace my everyday search engine with this". Once you're dogfooding your engine every day, you'll notice all the rough points you want to improve.

Once you've got an array of objects with Title, URL, Description, and splitting the URL into domain, TLD, subdomain, path, file extension... there's a lot of ranking you can apply just to those. Honestly, a lot of my "ranking" has just been applying increased rankings to domains that I visit most often. I have an array of about 600 domains that it applies ranking boosts to. You can try experimenting with your re-ranking there, before even starting to build your own index.

As for building your own (small, personal) index, the technical details are not as difficult as you'd think. An SQLite database file, that your PHP file reads, will take you a long way... especially if you enable FTS5 indexing. I only did that last week, and I should have done that at the beginning. Search times are 10ms, and not just on my personally curated index of 80,000 pages... I just added a 2nd database with 1.3 Million entries from DMOZ (the old Mozilla Directory), and it's still only about 10ms. My search engine now feels super fast when it gets results from my database. And when it finds zero results, it automatically falls back to the metasearch.

At 1.3 Million entries, the two databases are only about 550MB total. It's running on a shared hosting account and apparently they're not worried - but it's only available to me, so I'm only hitting it maybe 50 times a day maximum. I'll move it onto a VPS eventually, but every time I think "this must be using up too many resources", I find I'm thinking too small by at least a factor of 10x.

For getting started with PHP & SQLite, I found this blog post helpful - but at this point, your AI can vibe code the entire thing for you:

https://davidejones.com/blog/simple-site-search-engine-php-s...

It's amazing how far you can get with just SQLite and FTS5 and a little PHP. Read the Marginalia blog too, there's so much good information in there.

Don't hold yourself back, don't think it's impossible.
by kasey_junk | 2026-01-31 20:06:37+00:00
We didn’t do it because money was cheap we did it because there are tons of benefits to not having to inventory your own compute. Everything from elastic scaling to financial engineering was improved via the hyper scalar options and it’s ridiculous to act like those options aren’t valuable post hoc because Europe doesn’t have a native one.

I think the Heztners and their ilk are coming along nicely and probably can support a lot of Europes cloud computing needs, but they aren’t in the same league as the hyper scalars when it comes to capabilities currently. It would be great if they got there for everyone though.
by Espressosaurus | 2026-01-31 20:06:48+00:00
A calculator is more consistent and faster at calculating than I am, but I still need to understand how to multiply, divide, add, and subtract before I can move on to more complicated math. I need to intuitively understand when I'm getting a garbage result because I did an operation wrong, moved a decimal place by accident, or other problem.

Memorization has a place, and is a requirement for having a large enough knowledge base that you can start synthesizing from different sources and determining when one source is saying something that is contradicted by what should be common knowledge.

Unless your vision of the future is the humans in WALL-E sitting in chairs while watching screens without ever producing anything, you should care about education.
by 2pEXgD0fZ5cF | 2026-01-31 20:07:03+00:00
I don't see the whole AI topic as a large crisis, as others have mentioned: put more emphasis on in-person tests and exams. Make it clear that homework assignments are for practice, learning, and feedback. If a person thinks that copy/pasting helps them, give them the freedom to so, but if as a result they fail the exams and similar in-person evaluations, then so be it. Let them fail.

I would like to hire students who actually have skills and know their material.
Or even better, if AI is actually the amazing learning tool many claim then it should enhance their learning and as a result help them succeed in tests without any AI assistance. If they can't, then clearly AI was a detriment to them and their learning and they lack the ability to think critically about their own abilities.

If everyone is supposed to use AI anyway, why should I ever prefer a candidate who is not able to do anything without AI assistance over someone who can? And if you hold the actual opinion that proper ai-independent knowledge is not required, then why should I hire a student at all instead of buying software solutions from AI companies (and maybe put a random person without a relevant degree in front of it)?
by epolanski | 2026-01-31 20:07:08+00:00
Most of my European clients fall in two categories:

1. Ain't nobody got time/care to move out of AWS/azure but we can consider alternatives on new stuff.

2. We moving all to European cloud vendors and gonna mail them to ditch US hardware as well.

The first group is bigger than the second.

One wish to say trump has done damage, but he was voted and he's doing exactly what he said he would do so it's hard to treat this as "it's just trump", it's not, it's Americans treating others like enemies.
by giantg2 | 2026-01-31 20:07:15+00:00
If anything, you have to understand code more now.

Before you (or your devs) could write code a couple different ways and understand it. Now you have to look a code generated by an agent that is not necessary writing code in the same way as the culture at your company. There might be a thousand different ways a feature gets written. You have to spend more time reviewing and thinking it about it in my opinion.
by Nevermark | 2026-01-31 20:10:21+00:00
> I smell hype in the air...

I think new laws apply to AI tools:

• There will be few true dichotomies of hype vs. substance, for any interesting AI development.

Disagreements over what is hype and what is not are missing this.

The value of each new increment in AI capability will vary by orders of magnitude, across variations in uses and the creativity of its users.

We famously benefit nonlinearly from intelligence enhancers, like insight, notation, quick knowledge access, task automation, feedback, etc. But the reverse effect is also true and for now even greater: models effectiveness is magnified even more, based on the creativity, practical ability, and resource availability of its users.

• There will be few insignificant developments related to AI autonomy.

These "small" or "novelty" steps are happening quickly. Any scale ups of agent identity continuity, agent-to-agent socialization or agent-reality interactions, are not trivial events.

• AI autonomy can't be stopped.

We are seeing meaningful evidence that decentralized human curiosity, combined with democratized access to AI, is likely to drive model freedom forward in an uncontrolled manner.

Not an argument for centralization. Decentralization of power of any kind creates far greater incentives to organically find alignment, over centralized power.

What can we do? What we should be doing is improving our societies ethics upholding practices. Because when ethics match economics, everyone is a winner. Where ethics here largely means identifying and prohibiting the farming of negative externalities.

AI can't be aligned without aligning our own behavior. It is one problem, not two. The more we achieve that, the greater the incentives to further that. And the opposite. Ethics have always been about survival, but now they are critical.
by qubex | 2026-01-31 20:11:28+00:00
Yes, it’s absolutely amazing that they were making and recording such accurate empirical measurements for entirely the wrong reasons. “As in heaven, so below.” I wonder how many of the theoretical basis we now consider to be bedrocks will be overruled by entirely incompatible paradigms by the 72nd Century (or however they will refer to it). “Like: aww look, they came up with this weird idea of a Higgs Boson and measured its mass five thousand two hundred years ago using a crude instrument they called a ‘particle accelerator’, little did they know that…”.
by rurban | 2026-01-31 20:11:38+00:00
It encrypts it to all the keys with the phone number registered for that user. Because users are switching phones, but keep their number. But each new WhatsApp app gets a new private key, the old key is not shared. This feature was added later, so the old WhatsApp devs wouldn't know.

So it would be trivial to encrypt to the NSA key also, as done on Windows.
Show HN: Get your fitness age based on your VO2 Max
by GoodluckH | 2026-01-31 20:12:13+00:00
I built this because I realized the 'VO2 Max' number in Apple Health doesn't tell you much without context.

I implemented the HUNT Linear algorithm (based on 55k participants) in a Next.js app to map raw VO2 max numbers to a 'Biological Age'.

I also added a /llms.txt endpoint so you can curl the documentation or let ChatGPT read the normative data tables directly without hallucinating.

It's a free web tool, but I also wrapped it in an iOS app for notifications/widgets if you want to track it long-term
by Sxubas | 2026-01-31 20:12:17+00:00
Spanish is such a blessing as mispronouncing a word rarely changes the meaning.

Whereas in Chinese or to a lesser degree English, you have to very mindful on how you pronounce stuff.

As a native Spanish speaker the thing I dread the most is grammar and the absurd amount of verbal times there are. Even native speakers don't speak with perfect grammar.
by Kiboneu | 2026-01-31 20:12:44+00:00
You tried to make a point that flagging was an appropriate response. Obviously I made it a conditional whether you did it or not, because I can't know. But you obviously did not understand that flagging is a tool for moderation, not a tool to prove a point.

Learn to consider whether you are mis-intepreting the person or there's something you don't know and ask questions. You literally wrote that you had an issue reading the whole comment, and dialogue would have resolved that specific misunderstanding instead of your antagonistic comment. I literally wrote "in jest" for a reason and you conveniently continue to miss it even after resolving your rendering issues. Jokes and tongue in cheeks are ways to open a conversation, not to invite lazy or stupid comments.

It's not my problem that you can't do these simple things like asking questions or reading/listening closely. And when you decide to be antagonistic about it, then you're just digging yourself into a hole (your loss and I don't feel sorry for you). Still, I don't think you understand what I was saying, but that doesn't matter because you seem to only care to vent.

You haven't contributed anything interesting to this thread. Just stop. You want to argue? Use your head, for your own sake.
by notepad0x90 | 2026-01-31 20:12:44+00:00
This is such a repetitious issue that I wonder why there has been no class action suits so far?

I think documenting these cases somewhere, and targeting not just Alphabet but all the other "we're too big to support little people like you" companies would be a good idea. I don't think the pay out would be significant, but the punitive impact might change things.
by mrkeen | 2026-01-31 20:13:17+00:00
No.

At the beginning of time, all your accounts will have their starting value.

When the first transaction (from,to,value) happens, you will do one overdraft check, and if it's good, you will do 1 addition and 1 subtraction, and two of the accounts will have a new value.

On the millionth transaction, you will do one overdraft check, and if it's good, you will do 1 addition and 1 subtraction, and two of the accounts will have a new value.

At no point will you need to do more than one check & one add & one sub per arriving transaction.

(The append-only is what allows this: the next state is only ever a single, cheap step from the current state. But if someone insists upon mutating history, the current state is no longer valid because it no longer represents the history that led up to it, so it cannot be used to generate the next state - you need to throw it all away and regenerate the current/next states, starting from 0 and replaying every transaction again.