MurphyA/hacker-news huggingface dataset:
by D-Machine | 2026-01-15 07:19:09+00:00
Sifting, IMO from experience, does not solve the mass-to-volume ratio problem enough compared to just going by mass.

As a quick sanity test, if it did, serious baking resources would just always specify to use sifted flour (as this is easier and requires less equipment than a scale), but since they don't (e.g. Modernist Bread/Pizza, if you really demand a citation), you can infer that sifting is not effective in making reproducible results. Also, note e.g. chemistry is not done using sifted volumes (peruse quickly the amount of articles trying to assess the bulk vs "tapped density" of various powders: https://scholar.google.ca/scholar?hl=en&as_sdt=0%2C5&q=%22ta...). This should cause some skepticism about claims that sifting your flour is going to make baking results particularly consistent.

Sifting definitely helps remove variance (especially if you always buy the same flour and use the same sifting method into the same bowl, and then put un-needed sifted powder back into the jar), but IMO is far inferior to just weighing.

You're still right everyone overthinks home baking. Precision only matters if you are aiming for perfection, and even a horribly misspecified recipe made at home, but consumed fresh, is still generally going to be good, and definitely better than anything you buy at a supermarket. (And this is precisely why using a slide rule for precision is massively missing the point). As you said, there are many indicators that are more important to pay attention to.
by internetter | 2026-01-15 07:19:42+00:00
Perhaps, and yet I've referenced this article numerous times over the years. The most important property of an archive is that it saves an authentic copy of the source material—that is to say, the archive must be trusted. If archive.today is indeed a legitimate archival source first and foremost as it purports to be, the user has a reasonable interest in investigating the people behind it so that they can come to an informed conclusion about if they can trust the archive or not.
MailPilot - Email for AI Agents
by keepamovin | 2026-01-15 07:20:02+00:00
Greetings and salutations, People Of Hacker News! I built this to get outside, and away from my desk, but still have the agents work.

Watching agents iterate on long tasks is a waste of time, but they eventually stall if you aren't there to guide them. I didn't want another app or dashboard to check; I just wanted the work to find me when it actually needed input.

The solution was simple: Email.

MailPilot snapshots the agent's state when it pauses and emails it to me. I can reply from my phone—while out for a walk or lunch—and the response pipes directly back to the agent.

The accidental killer feature: You can CC your team. If you forward the thread to a coworker, their reply goes straight to the agent context too. It turns a local session into an async multiplayer thread.

Works out of the box with Claude, Codex, Gemini, Copilot, and OpenCode. Happy to answer questions!

https://mailpilot.chat
by schvenk | 2026-01-15 07:20:23+00:00
Online privacy is on a lot of minds these days. But what’s actually worth worrying about? And how can we help non-technical folks navigate these questions?

Let's start with personal communication. Because...well...it's personal. And every time you text someone, you’re giving the contents of your message—every word—to multiple internet companies, unknown other parties, and potentially the governments of one or more countries.
by grebc | 2026-01-15 07:20:34+00:00
I agree with the premise that academia at the expense of personal relationships and health is not the way to raise kids or encourage curiousness/a want to learn.

Where I disagree is that LLM’s are some sort of cheat mode for learning. Half the kids are illiterate and it’s getting worse. We’re supposed to believe that kids that can’t read can comprehend what a LLM spits out?
by wolvoleo | 2026-01-15 07:21:28+00:00
It is the problem, if you see platforms that are not driving engagement (like here) they are faring much better.

And no I really don't want it. Give parents the tools to manage better and make sure the worst toxic traits of social media are banned (the EU could do this under the DSA/DMA) and there is no need to ban it for all minors then.
Show HN: Matriq – Search inside video files using natural language
by Daviduche03 | 2026-01-15 07:21:38+00:00
Hello HN,
I’m David. I built Matriq because I was frustrated with the "Post-Production Scrub."

I had hours of B-roll and long-form content, but finding a specific 5-second clip (e.g., "a red car passing by" or "a specific quote about React state") meant manually watching the footage at 2x speed.

What I built: Matriq indexes video content visually and aurally. It uses multimodal embeddings to understand scene context, action, and dialogue.

The Use Case:

While it works for general editing, I’ve found the best use case is Content Repurposing. Creators with 100+ hours of archives can now instantly find "viral hooks" or specific topics to turn into Shorts/Reels without re-watching old footage.

It’s in beta. I’d love you to try breaking it or give feedback on the retrieval accuracy.

Link: https://matriq.video
by kortilla | 2026-01-15 07:23:11+00:00
The thing you’re missing is that it isn’t a $200 difference. Auto loans above $1k/mo are becoming common now vs the $400 for something “affordable”. Since people don’t have large down payments, the monthly rate scales beyond linearly to offset default risk with the loan upside down.

You’re also presenting a false scenario of “screwed either way”. One decision is getting a car that doesn’t leave you with $10k+ negative equity in a year because you did $1000 down on a $85k truck financed over 10 years with an 8% rate. That’s a decade long financial albatross that will cost you $150k by the time it’s done.

The alternative is you put $1k down on a $30k vehicle over 4 years with the same monthly payment and never end up with negative equity.

The gulfs here are enormous and the “screwed either way” altitude is pure defeatist financial ignorance.
Show HN: I built a satellite forensic engine to detect fraud in Carbon Markets
by kccanarch | 2026-01-15 07:23:18+00:00
I got tired of reading PDF reports for Carbon Offsets that claimed to be "Protected Forests" but looked suspicious on Google Maps.

So I built Silent Earth—a standalone forensic engine (Python/React) to audit them mathematically.

The Stack:
* Ingestion: Scrapes Verra/Gold Standard registries for project coordinates.
* Telemetry: Queries the Sentinel-2 Satellite Constellation (via Microsoft Planetary Computer).
* Analysis: Calculates NDVI (Biomass Density) and performs spectral analysis on the claimed area.
* AXIOM Kernel: Cross-references industrial "shutdown" claims against Tropospheric NO2 levels (Sentinel-5P).

The Result: I routinely find "Verified" assets with an NDVI < 0.2 (Bare Soil).

The tool is currently local-only for privacy, but I'm moving the data stream to Snowflake.

Happy to answer questions about the geospatial stack (Rasterio/Shapely) or the satellite APIs.
by vlovich123 | 2026-01-15 07:24:21+00:00
I’m not sure about the other UB opportunities, but in idiomatic rust code this just doesn’t come up.

In C, you frequently write for loops with signed integer counters for the compiler to realize the loop must hit the condition. In Rust you write for..each loops or invoke heavily inlined functional operators. It ends up all lowering to the same assembly. C++ is the worst here because size_t is everywhere in the standard library so you usually end up using size_t for the loop counter, negating the ability for the compiler to exploit UB.
by IndrekR | 2026-01-15 07:24:56+00:00
I am using Leo Bodnar’s fast pulse generator (SMA) in my lectures to teach transmission lines. With sufficient length (I use ~1m) it works quite well to demo with a low cost scope. I originally bought it for TDR with 40GSPS/15GHz scope, which works very well with few orders of magnitude smaller lengths. Old on has upper length limit with 10MHz fixed frequency. There is a new one available with external sync and variable frequency, but I have not bought/tested it.
by lotsofpulp | 2026-01-15 07:25:26+00:00
Nothing, but if market value of the land is going up, then that means the price for government services is going up (e.g. government employees need to be paid more, land acquisition or rent costs more, materials cost more, etc). Hence taxes collected have to go up.

This could all simply be due to a devaluation of the currency, rather than due to increased desirability or productivity.
by rly0nheart | 2026-01-15 07:25:32+00:00
I appreciate the passport analogy, but I think the comparison to North Korean developers is misplaced.
My work is entirely public and verifiable. I have years of commit history on GitHub. Ben Boyter, who shared this post, has worked with me directly. The people I've worked with can vouch for me without any problems at all.

The "provenance" exists. Companies just don't look at it because they filter on credentials first.
As for working locally, there are very few tech opportunities in Zambia that pay a living wage. That's part of why remote work seemed like the solution, but it requires getting past the same filters

I understand the concern about verification. I just wish the bar for verification was "look at their public work" rather than "do they have a degree from a recognisd institution."

Also, you didn't have to make it sound like I'm/might be a security risk. That kind of sentiment isn't helpful when the evidence to verify me is already public.
by c7b | 2026-01-15 07:25:50+00:00
One thing that kind of baffles me about the popularity of tools like Claude Code is that their main target group seems to be developers (TUI interfaces, semi-structured instruction files,... not the kind of stuff I'd get my parents to use). So people who would be quite capable of building a simple agentic loop themselves [0]. It won't be quite as powerful as the commercial tools, but given that you deeply know how it works you can also tailor it to your specific problems much better. And sandbox it better (it baffles me that the tools' proposed solution to avoid wiping the entire disk is relying on user confirmation [1]).

It's like customizing your text editor or desktop environment. You can do it all yourself, you can get ideas and snippets from other people's setups. But fully relying on proprietary SaaS tools - that we know will have to get more expensive eventually - for some of your core productivity workflows seems unwise to me.

[0] https://news.ycombinator.com/item?id=46545620

[1] https://www.theregister.com/2025/12/01/google_antigravity_wi...
by bob1029 | 2026-01-15 07:26:47+00:00
Tool calling + recursion seems to be the answer. Two tools are for manipulating the logical call stack - call/return. The trick is to not permit use of any meaningful tools at the root of recursion, but to always make their descriptions available. For instance, the root can't QueryWidgets or ExecuteShell, but any descendant of it can.

These constraints result in token-hungry activity being confined to child scopes that are fully isolated from their parents. The only way to communicate between stack frames is by way of the arguments to call() and return(). Theoretically, recursive dispatch gives us exponential scaling of effective context size as we descend into the call graph. It also helps to isolate bad trips and potentially learn from them.
by seec | 2026-01-15 07:26:59+00:00
Potatoes have low caloric density (80 kcal/100 g), so the ideal would be to dry them and store them in a sustainable form like ready-to-use mash.

At 2000 kcal/day average caloric expenditure, you could feed 1.6 million people for a day. Or 3.2 if it was only half the diet.
That's a lot of food indeed!

The problem is most of the volume/weight is water; that's not very convenient. In comparison, an equivalent volume of cereals would feed 7 million people and are much easier to store long term, they are very efficient !
by fathermarz | 2026-01-15 07:27:01+00:00
I have a hard time with this one. Technical people understand a skill and uploading a skill. If a non-technical person learns about skills it is likely through a trusted person who is teaching them about them and will tell them how to make their own skills.

As far as I know, repositories for skills are found in technical corners of the internet.

I could understand a potential phish as a way to make this happen, but the crossover between embrace AI person and falls for “download this file” phishes is pretty narrow IMO.
by vlovich123 | 2026-01-15 07:27:45+00:00
If programs were primarily unsafe rust, no one would use the language. Unsafe rust is strictly more difficult to write than C in certain constructs because the complex invariants the rust language requires remain in unsafe, there’s just no compiler proof checking them being upheld.

Is argue that he’s right that generally it’s referring to safe subset and in practice people relax the conversation with a little unsafe being more ok. But as Steve points out it really depends on the definitions you choose.
by ElFitz | 2026-01-15 07:27:50+00:00
> Nothing they create make any goddamn sense,

I wouldn’t be that dismissive. Some have managed to make impressive things with them (although nothing close to an actual movie, even a short).

https://www.youtube.com/watch?v=ET7Y1nNMXmA

A bit older: https://www.youtube.com/watch?v=8OOpYvxKhtY

Compared to two years ago: https://www.youtube.com/watch?v=LHeCTfQOQcs
by ajxs | 2026-01-15 07:28:21+00:00
What is this measure defending against (other than getting a job)? The recruiter can still extract the information in your signed PDF, and send their own marked-up version to the client in whatever format they like. Their request for a Word document is just to make that process easier. Many large companies even mandate that recruitment agencies strip all personally-identifiable information out of candidates' resumes[1], to eliminate the possibility of bias.

1: I wish they didn't, because my Github is way more interesting than my professional experience.
by superhuang | 2026-01-15 07:29:27+00:00
This is such a great point. Security does become the bottleneck once you move past simple queries.
We haven't implemented safety categorization yet, but I'd love to explore it. Ideally, would you prefer to see flags like 'Filesystem: Read-Only' or 'Network: Blocked' directly on the skill card?
Thanks for the feedback!
by self_awareness | 2026-01-15 07:30:36+00:00
> I don't think Gleam has a problem if Kenneth Copeland is using their software, either.

I wouldn't be so sure. In leftist projects, there are countless of examples why someone is not welcome based on their personal beliefs, and because of this I'm cautiously suspicious about Gleam.

If I'm wrong then the Internet is a better place than I think it is, which would be a good thing. If I'm right, then at least I'll dodge another bullet. Either way I win I guess.
by ropable | 2026-01-15 07:30:45+00:00
I continue to be broadly in favour of this idea. I agree that there's some wiggle room around the specific age (15 vs 16), but for a population-level change you just need to pick an arbitrary value, implement, and re-assess later. I also acknowledge that 1) online age-gate mechanisms tend to suck, 2) the evidence of harm is weak, and 3) it really should be up to parents to manage at the individual level. But ultimately, I feel that a restriction like this would be a net positive for the mental health of the vast majority of young teens.

Make the change, assess the effects, adjust/repeal as needed (just like everything else). It seems like the kind of change that's well-suited to undoing later, in case of unintended consequences. It's not like we're going to be permanently stunting the growth of an entire cohort or something.
by rswail | 2026-01-15 07:31:12+00:00
In the article it says that Cowork is running in a VM that has limited network availability, but the Anthropic endpoint is required. What they don't do is check that the API call you make is using the same API key as the one you created the Cowork session with.

So the prompt injection adds a "skill" that uses curl to send the file to the attacker via their API key and the file upload function.
by watwut | 2026-01-15 07:32:04+00:00
Bullshit. There were no democrat extremists. Insteat, democrats run as centrist and anodyne position as possible. And you still lie about it as it they run some kind of extreme position.

Trump won, because people like you will call his opposition extreme no matter what it does. And people like you will just try to push Trumps opposition into adopting his ideology, step by step.
by rly0nheart | 2026-01-15 07:32:36+00:00
You're right that I'm looking for remote positions from Zambia, and that distance adds complexity. But I don't think the issue is legal liability or risk of fraud.
I worked remotely for Bellingcat for 8 months. They're an internationally recognised investigative journalism organisation. If they could verify me and manage the "legal liability," I don't see why tech companies can't.
The risk assesment you're describing assumes that being from Africa without a degree makes someone inherently risky. But I have verifiable work history, public code, and people who can vouch for me. That should count as verification.
I understand market realities. I'm not expecting to walk into a senior role at a FAANG company. But entry or mid-level positions shouldn't require "rockstar credentials" just because of geography. That's not about risk managment, it's about gatekeeping.
The advice to "be in the same region/country" isn't practical when there are very few tech opportunities locally that pay a living wage. Remote work was supposed to democratise access to these jobs. If it only works for people in certain countries, that's a problem worth pointing out.
by Wilder7977 | 2026-01-15 07:33:08+00:00
Not really, that's the point. Reusable workflow, in a tightly controlled repos avoid exactly what you are saying and they are a fairly standard practice (if anything, also to avoid having 200 versions of CI instructions).
You can also verify attestations provenance by enforcing attestation performed via that particular, approved workflow, which is not security theater, it's actual real controls.
by sandra_vu | 2026-01-15 07:34:18+00:00
Hi HN,

We’re building DataRiver, a tool that converts PDF bank statements into structured, Excel-ready data (transactions, balances, dates), with a strong emphasis on privacy.

Unlike generic PDF extractors, DataRiver runs on a privately developed AI model trained specifically on bank statement layouts. Uploaded files are processed by our own model and are not sent to third-party LLM APIs, nor reused for training.

This approach came from working with sensitive financial data where accuracy and data isolation matter more than general-purpose flexibility. Many real-world statements include inconsistent tables, wrapped descriptions, or mixed formats that break rule-based tools.

Key points:

Private, domain-specific model for financial statements

High accuracy on messy, multi-column PDFs

No reuse of customer data for training

Files processed transiently and not stored long-term

DataRiver is used by accountants, auditors, and founders who need clean data without risking data exposure.

We’d appreciate feedback from anyone dealing with financial PDFs, especially on edge cases, privacy expectations, or compliance requirements.

Link: https://www.datariver.co

Happy to answer questions.
by keybored | 2026-01-15 07:35:32+00:00
> Because the internet was invented in America so it's the only country where a country suffix was never used from the start of its popularity.

I expect some countries like the UK and Australia to use something like `co.uk`. I expect many countries to use their own top-level domain. I do not assume that some `.com` website is American.

Is “the only” based on experience? How many websites from how many countries have you come across?

> I'm not saying this is good or bad or justified or not, just saying what the conventions are.

Do people associate `.com` with “company”? Or just “regular website”? Are people even stopped from making a `.com` if they don’t have a “company”?

https://www.paiste.com/

Is this Swiss business allowed to use `.com` because they have offices in the US of A?
Cyber+ – A versatile programming language for cybersecurity and automation
by Czax225 | 2026-01-15 07:36:08+00:00
Hi HN,

I’m excited to share *Cyber+*, a new programming language I created for cybersecurity,
automation, and practical scripting tasks.

*Key Features:*
- Easy to use CLI: `./cyberplus --version` and `./cyberplus run FILENAME.cbp`
- Built-in commands for hashing, phone info lookup, and more:
- Compute("Hello Cyber+");
- Hash_Compute("password", "MD5");
- Phone_Info("+911234567890");
- Fully open-source and lightweight

*Get started:*
GitHub repo: https://github.com/TanmayCzax/CyberPlus-1.0
Go to the official website of CyberPlus 1.0 -- https://cyberplus1.pages.dev/

*Why it’s different:*
- Combines cybersecurity-focused commands with general scripting
- Single executable CLI, no heavy setup
- Easy for beginners and useful for advanced users

I’d love to hear feedback from the HN community, especially on CLI design,
built-in commands, and potential use cases.

Thank you!
– Tanmay
by koverstreet | 2026-01-15 07:36:11+00:00
More fun, you mean.

Couple years ago I was driving through Arizona during a massive blizzard. Everyone's doing 15, and I'm doing 50 - taking things slow and careful because of the traffic.

I had people in vests standing out in the road waving at me trying to get me to slow down! And I'm going "What in the hell are you doing out in the road!? Don't you know this is a blizzard!"

I grew up in Alaska, we laugh at the snow :)
by ZeroConcerns | 2026-01-15 07:36:42+00:00
Not really -- any secrets stored using this method should also live in a password manager somewhere. It's about providing more-secure programmatic access to secrets.

Basically, it rebuilds Windows DPAPI from first principles, which is fine (I've done it many times myself!), and something non-Windows platforms sorely need. It changes the impact of malware from "they dumped all our secrets from prod to their C2" to "they got some encrypted values, and now someone will need to figure out our methodology and underlying keys", which is a meaningfully higher bar.
by Wilder7977 | 2026-01-15 07:38:23+00:00
See my other comment.

> when the implementation of these actions at some level live in the repo anyway

This is the false assumption. You can standardize that not to happen, and you can verify at runtime that's not the case.
You can control admission of container images for example, restricting those that were built by your workflow X (the approved, central, controlled, standard one) and reject anything else. You do this via build provenance attestation.

With makefile I don't know how you can achieve standard and centrally manageable (and verifiable) instructions (which are part of SLSA).
by rly0nheart | 2026-01-15 07:39:18+00:00
I relate to the burnout. Some days the rejection emails make me wonder if it's worth it.
But I still love building things. I just wish the industry valued that more than credentials.

Hope you find what works for you, whatever that ends up being.

All of a sudden, becoming a goose farmer is starting to sound pretty appealing to me :D
by mastermedo | 2026-01-15 07:39:54+00:00
What my pattern-matching eyes immediately spotted is that the hn username that posted this is rabinovich. The linked article speaks about Masha Rabinovich. Maybe a coincidence.

> in a 2012 F-Secure forum post, a “masharabinovich” complains about “my website http://archive.is/&#8221; being blacklisted. They pop up on Wikipedia as well getting told off for adding too many links to archive.is, including a mention that they’re using the Czech ISP fiber.cz