MurphyA/hacker-news huggingface dataset:
by youncj | 2026-01-23 16:34:03+00:00
I built Wiz because I was tired of context-switching between
remembering tool syntax and actually doing security work.

## Background

I've been doing security assessments for a while, and the workflow is always:
1. Remember the right tool for the job
2. Look up the flags (again)
3. Run the command
4. Parse the output manually
5. Copy findings to a spreadsheet
6. Repeat 100 times
7. Manually write the report

## What Wiz Does

Wiz lets you describe what you want in natural language:

"check if this Apache server is vulnerable to path traversal"

And it:
1. Selects the right tools (nuclei with CVE-2021-41773 templates)
2. Runs them with correct parameters
3. Parses the output into structured findings
4. Classifies by severity (Critical/High/Medium/Low)
5. Stores with evidence for the report
6. Generates professional reports when you're done

## Technical Details

Built on OpenCode (https://github.com/sst/opencode), which provides:
- Superior agent architecture vs generic LLM CLIs
- Extensible tool framework with typed I/O
- Multi-LLM support (Claude, GPT-4, Gemini, local models)

Wiz adds a security layer:
- 30+ tool integrations with output parsers
- Findings database with OWASP/CVE categorization
- Governance engine (scope enforcement, audit trails)
- Report generation (HTML, PDF, Markdown)

## What It's NOT

- Not a replacement for knowing what you're doing
- Not for unauthorized testing
- Not a magic "hack anything" button

It's an assistant that handles the tedious parts so you can focus on analysis.

## Stack

- TypeScript/Bun
- Runs on Kali, Parrot, any Linux, macOS, Windows
- Requires API key (Claude recommended, GPT-4 works too)

## Links

- GitHub: https://github.com/code3hr/opencode
- Downloads: https://github.com/code3hr/opencode/releases/latest

Open source, MIT licensed. Feedback welcome!
```

---

## Quick Demo Script (for Video/GIF)

```
# Terminal recording script

$ ./cyxwiz

> scan 10.0.0.5 for vulnerabilities

[Wiz runs nmap, detects Apache 2.4.41]
[Wiz runs nikto, finds misconfigurations]
[Wiz runs nuclei, matches CVE-2021-41773]

Found 1 critical, 2 high, 3 medium findings.

> show critical findings

CRITICAL: CVE-2021-41773 - Apache Path Traversal
- Target: 10.0.0.5:80
- Impact: Remote Code Execution
- Evidence: [response data]
- Remediation: Upgrade to Apache 2.4.51+

> generate report

Report generated: assessment-2024-01-15.html
```
by sublinear | 2026-01-23 16:34:04+00:00
Yes, LLMs have been a very expensive philosophy lesson for many investors. Ancient epistemology debates are now front and center for everyone to see. So-called "formal epistemology" is just empiricism in disguise attempting to borrow the credibility of rationalism and failing miserably.

LLMs are Bayesian inference and come with all its baggage. We definitely know brains are way better than that, even of other animals or insects.

Ultimately, there's no point in getting a chatbot to say deceptively expert-like words that are guaranteed by design to be lower quality than the books or blogs it learned from. LLMs are at best a search tool for those sources, and investor attitude now reflects that sanity with their confidence shifting back over to Google's offerings. Agentic AI is also pretty weak since agents are as functionally limited as any traditionally written computer program, but lacking the most crucial property of repeatability.

I find it shocking how many people didn't see this whole thing as a grift from day one. What else was SV going to do during the post-covid economic slump?
by grugdev42 | 2026-01-23 16:34:13+00:00
You might laugh, but selling cheap marketing websites is an easy $10,000.

Selling ten $1,000 websites to small businesses is easy. It isn't fun or exciting, but it works.

It's 50% sales, 30% chasing people, and 20% building.

Find small local businesses with bad websites, or better yet no website. They honestly do exist.

Resist the urge to make your own anything. Just use Squarespace or Wix!

You don't need to hide SS or Wix from the client. Tell them you just charge for your time to set it all up. If they complain then move onto the next customer, they would likely be a pain anyway.

People will say "small marketing websites are dead with SS or Wix about", but it's not true. Most small businesses just don't want to learn how!

If you cold call all week I bet you can have a couple of deals done by Friday! Good luck.
by yesturi | 2026-01-23 16:34:20+00:00
That is ridiculously fantastic idea!

Shame I used to have an SCSI scanner but I already disassembled it for parts.

One can write a simple bootloader, which reads bytes printed on a paper sheet to memory then boots it. Something like: black (0), white (1) or long rectangle (1), short rectangle (0). Wonder about the storage capacity of the A4 paper.
by Yizahi | 2026-01-23 16:34:25+00:00
You are forgetting about legislative branch too. Congress fist voluntarily "gifted" their right to the executive branch, in the form of the eCaNoMic ImErGenCy. And then Congress passed a measure which blocked every single member of Congress from legally questioning that "gift", in the form of legislation that whole year 2025 is one single calendar day, and thus a legal requirement of waiting 10 (or 15?) days before protest couldn't pass. Essentially Congress blatantly broke Constitution twice. At minimum.
by yakz | 2026-01-23 16:34:26+00:00
The answer is not in the article. The question is: why isn't there a registration process for the person that leased the car? How are rented or company cars even relevant, since that's a different company between Tesla and the driver that would have the information about the driver? It seems like a weird quirk that there's not a registration process closer that leads somewhere closer to the actual driver. Is it a privacy issue? Is it just because enforcement is easier against a larger company?
by oeken | 2026-01-23 16:34:33+00:00
Creator of Needle here. We made a free, public search tool that lets you explore everything discussed in r/Rag in 2025.

Think of it like Reddit r/Rag Wrapped 2025.

But not pre-generated. Can answer anything about what happened in RAG in 2025.

Use it to:

- Find for RAG advice
- Learn from the community
- Deep research on RAG
- Spot trends
by Spooky23 | 2026-01-23 16:34:51+00:00
Your words bro. 10x isn’t linear.

The cost iceberg with this stuff isn’t electricity, it’s the capital.

Other than Google and Facebook, the big hype players can’t produce the growth required to support the valuations. That’s why the OpenAI people started fishing for .gov backstops.

The play is get the government to pay and switch out whatever Nvidia stuff they have now with something more efficient in a few years.
by N3802E | 2026-01-23 16:35:18+00:00
This looks great! I've been searching for something like this for ever.

Some feedback of what I found on my network, as compared to some other scanners I've used.

I've never seen anything that can beat Advanced IP Scanner at finding hostnames. I've never even found a way to get arp or nmap to get close to Advanced IP Scanner; I've tried dozens of suggested commands of each, all with no luck. Here's the results of my scans:

Alive hosts: 309

Unkown: 201

With hostnames: 80

https://www.advanced-ip-scanner.com/

####################################

I also tried a program called Angry IP Scanner:

Hosts scanned: 510

Hosts alive: 315

With hostnames: 75

https://angryip.org/

####################################

whosthere

Devices: 318

With hostnames: 54
by neom | 2026-01-23 16:35:36+00:00
I think what happened to docker is a bit unfortunate. March 2013 — Docker goes public/open source at PyCon Nov 2013 — Jerry Chen pursues Docker, leads to Greylock Series B - Jan 2014 — Greylock Series B closes ($15M) - June 2014 — Kubernetes announced - July 2015 — Kubernetes 1.0 released.

Jerry is a good friend of mine and I think a great VC, he comes from the VMware world and was part of building the VMware enterprise strategy. When all the container stuff was all going down, I was trying to understand how digialocean needed to play in the container space - so I spent a lot of time talking to people and trying to understand it (decided we basically...shouldn't, although looked at buying Hashi) - but it was clear at the time the docker team went with Jerry because they saw themselves either displacing VMware or doing a VMware style play - either way, we all watched them start the process of moving to a real enterprise footing out of just a pure play devtool in 2014, it might have worked too (although frankly their GTM motions were very very strange), but Kubernetes..yah. You might recall Flo was on the scene too selling his ideas at Mesosphere, and the wonderful Alex Polvi with CoreOS. It was certainly an interesting time, I think about that period often and that it is a bit of a shame what happened to docker. I like Solomon a lot and think he's a genuinely genius dude.
by jodrellblank | 2026-01-23 16:35:59+00:00
Thirty years ago there was The Thin Blue Line, a sitcom set in a police station in the UK, starring Rowan Atkinson (Mr Bean, Blackadder) and written by Ben Elton (writer on Mr Bean and Blackadder). I suspect it wouldn’t stand up to much rewatching today, but it was a thing.

https://en.wikipedia.org/wiki/The_Thin_Blue_Line_(British_TV...
by tariqshams | 2026-01-23 16:36:11+00:00
I think whenever a new technology comes out, there will always be some new jobs to:

- build (LLM research engineers)

- integrate into existing systems (LLMOPS and AI engineers)

But I think besides those obvious ones, there will be lots of new combinations of LLMs and other technology that we won’t be able to predict, but in hindsight seem like it was destined to happen.
by SirensOfTitan | 2026-01-23 16:36:18+00:00
We need to define terms precisely first and the industry seems allergic to that, likely because precise terms would undermine hype marketing necessary for companies like Anthropic to justify their valuations.

We need clear definitions and clear ways of evaluating toward those definitions, as human evaluation of LLM is rife with projection.

Generally speaking, scaling is clearly not going to get LLMs there, and a lot of the gains over the past year or so have been either related to reasoning or domain-specific training and application.

I do think world models are the future and we’ll likely see some initial traction toward that end this year. Frontier AI labs will have to prove they can run sustainable businesses in pursuit of the next stage though, so I’d anticipate at least one major lab goes defunct or gets acquired. It may very well be that the labs that brush up against AGI according to conventional definitions are still nascent stage. And there’s a distinct possibility of another AI winter if none of the current labs can prove sustainable businesses on the back of LLMs.

I think a lot of the west is undergoing the early stages of a Kuhnian paradigm shift in many ways, so I’ve found it difficult to take the signaling from the macro environment and put it to work in my decision making.
by eudamoniac | 2026-01-23 16:36:30+00:00
Sad but true. White (western European) culture built these institutions and nonwhite cultures will have a hard time upholding them in their current form, if they even wanted to.

I don't think this is related to what's currently happening with Trump, however. That's a separate thing, more of a populist backlash by whites for various reasons.
by Uehreka | 2026-01-23 16:36:42+00:00
> (e.g. implement a well documented wire protocol with several reference implementations on a microcontroller)

I have had an AI assistant reverse engineer a complex TCP protocol (3-simultaneous connections each with a different purpose, all binary stuff) from a bunch of PCAPs and then build a working Python server to speak that protocol to a 20-year-old Windows XP client. Granted, it took two tries: Claude Opus 4.1 (this was late September) was almost up to the task, but kept making small mistakes in its implementation that were getting annoying. So I started fresh with Codex CLI and GPT-5.1-Codex had a working version in a couple hours. Model and tool quality can have a huge impact on this stuff.
by fc417fc802 | 2026-01-23 16:37:05+00:00
I guess I can see where others are coming from (the LLM is different than a literal rubber duck) but I feel like the "can't reply" part was never more than an incidental consequence. To me the "why" of it was always that I need to solve my problem and I don't want to disturb my colleagues (or am unable to contact anyone in the first place for some reason).

So where others see "rubber ducking" as explaining to an object that is incapable of response, I've always seen it as explaining something without turning to others who are steeped in the problem. For example I would consider explaining something to a nontechnical friend to qualify as rubber ducking. The "WTF" interjections definitely make it more effective (the rubber duck consistently fails to notify me if I leave out key details).
by lcnPylGDnU4H9OF | 2026-01-23 16:37:05+00:00
> It was massively selfish and incompetent for them not to make major policy pivots with the goal of just annihilating Trump and his movement. Instead they just treated it as a regular election, where the goal was to eek out a victory for their partisans.

It sounds a lot like you actually agree; those are all reasons why every Democrat constituent should be livid with the party "establishment". Instead, any time this point is brought up, people respond instantly with the "it's not a 'both sides' issue" thought-terminating cliché. In this case, one person says, "Okay, but obviously the other people shot themselves in the foot" and the response is "I disagree, here's how they shot themselves in the foot".
by embedding-shape | 2026-01-23 16:37:06+00:00
And to be frank, why would they? Who would stop them? Would take a massive case for them to be compelled to be stopped, and no one seems to care about attribution anymore, or licensing at all in most cases. Companies using torrents to download copyrighted material, stuff individuals gone to prison for before, and they hardly even get a slap on the wrist.
Show HN: Manim Skills – Claude Code skill for creating 3b1B style animations
by Adithya-Kolavi | 2026-01-23 16:37:10+00:00
I built this to solve a problem I kept running into: every time I asked Claude Code or Cursor to help with Manim animations, it mixed up APIs between Manim Community Edition and ManimGL (3Blue1Brown’s version), or used deprecated patterns.

This repository packages battle tested best practices and working code examples as “skills” that AI agents can automatically load when you are working with Manim.

Install:
npx skills add adithya-s-k/manim_skill

What’s inside:
- Separate skills for Manim Community Edition and ManimGL (they are incompatible frameworks)
- Working code examples for scenes, animations, 3D, camera control, and LaTeX
- Common patterns and pitfalls to avoid

It uses the open skills.sh standard, so it works across Claude Code, Cursor, and other AI coding tools.

Happy to answer questions about the implementation or Manim in general.
by toyg | 2026-01-23 16:37:24+00:00
> Sept 11 paved the way for FISA orders and NSA overreach

It's not even that. We euros were more than willing to look the other way (see the umpteen attempts to reconcile our privacy-friendly legislation with the free-for-all of American services, ongoing for decades) in the name of convenience and fundamentally shared values. The turning point was really in 2024/2025, when those shared values were summarily swept away on the other side of the Atlantic.

Besides, the "global alternatives not subjected to power-hungry overlords" are actually very much subjected to the worst of humanity, and wide open to exploitation from such overlords.
by alephnerd | 2026-01-23 16:37:41+00:00
> I'm open to correction on this. Maybe I'm just not understanding the situation

It's much more gray simply because there are multiple agencies per department that can interpret and conduct intelligence operations.

The current administration also decided to adopt the private sector practice of letting "middle managers" conduct and implement what they want on their own and only disturb "upper management" if there are irreconcilable differences.

This is why policies change on a dime in the current administration.
by bluGill | 2026-01-23 16:37:58+00:00
Not that you are wrong, but in the real world this is not significant for most uses. If it is significant you are doing too much IPC. Or maybe using protobuf where you should be making a direct function call. Fix the architecture either way. (similar to how I can make bubble sort faster with careful machine code optimization, but it is hard to make modern tim sort slower in the real world no matter how bad the implementation is)
by empath75 | 2026-01-23 16:39:06+00:00
In particular, the complaint that 'most villages didn't grow into towns' is a pretty terrible one from a game design point of view, because you could say "Most X don't Y" about almost every game, because players want to do the _exceptional_, not the _every day_.

Also there is the question of _who you are_ in a city builder, because he seems to be assuming that the player is playing as an average villager, and not the people who actually make planning decisions (monasteries and lords, etc).

Most of these games are sort of explicitly designed to be power fantasies on some level. I am sure you could make a truly great game that is sort of down in the muck, a villager eye view, or whatever, but it might not be as popular or fun.
by shykes | 2026-01-23 16:39:13+00:00
Yes :)

We heard the feedback that we should pick a lane between CI and AI agents. We're refocusing on CI.

We're making Dagger faster, simpler to adopt.

We're also building a complete CI stack that is native to Dagger. The end-to-end integration allows us to do very magical things that traditional CI products cannot match.

We're looking for beta testers! Email me at solomon@dagger.io
by s_dev | 2026-01-23 16:39:14+00:00
I'm sure there are much bigger and more worthwhile criticisms to be had than this.

It's something they should fix and if they did would you suddenly switch to Scaleway? I think you would consider other factors first.

A good critique for example is OVH lost a lot of customer data due to a fire. Where was the redundancy? That would make me think twice before switching to OVH.
by kkukshtel | 2026-01-23 16:39:18+00:00
This is one thing I find funny about all the discussion around AI watermarking. Yes for absolutely nefarious bad actors it is incredibly important, but what seems clear is that the majority of AI users do absolutely nothing to conceal obvious tells of AI generation. Turns out people are shameless!

Two immediate ones I can think of:

- The yellow hue/sepia tone of any image coming out of ChatGPT

- People responding to text by starting with "Good Question!" or inserting hard-to-memorize-or-type unicode symbols like → into text where they obviously wouldn't have used that and have no history of using it.
by Selkirk | 2026-01-23 16:39:24+00:00
Sounds like "Old Masters and Young Geniuses"

https://press.princeton.edu/books/paperback/9780691133805/ol...

That book used artwork valuation as a performance measure and analyzed it over top artist's lifetimes finding two patterns. The "Young Genius" where an artist has a vision and realizes some innovation and their most valuable works center around that with value tapering off over their life. Picasso. (Who had two peaks but still fit the pattern.) Contrast to the "Old Master." This is someone who keeps refining their craft and their most valuable works and innovations are their late life works. Cézanne.
by Yizahi | 2026-01-23 16:39:32+00:00
An anecdote - it is maybe lesser known fact in the west, but Putin deems himself a very law abiding person, and he proudly repeats this many times over his 26 year reign. The only tiny problem is that he himself first changes those laws as he sees fit. And then he can play pretend to be law abiding.

I think you get the hint. In despotias laws mean nothing really. USA is not there yet, but the process is very gradual, glacial even. But irreversible.
by wdfx | 2026-01-23 16:40:00+00:00
and that's fine in some sense if you're honest about what you're doing.

I have at least one guitar that I rarely play but I keep because I consider it a work of art and a collectible. But, I have others which are workhorses and I play daily.

It gets awkward when collecting is presented as a way to be a better musician, which is clearly false.
by thatguy0900 | 2026-01-23 16:40:00+00:00
I think the opposite as you. These global companies often act as a nation with laws unto themselves. Most of them don't actually have real support that can do anything unless you make a lucky Twitter post or something. Having a local company that is realistically beholden to local laws and local politicians that you can actually potentially go and talk to if needed is a major feature.
by embedding-shape | 2026-01-23 16:40:18+00:00
Looks really interesting, no doubt. But I also see that you can change the sound by just placing objects on top of the resonators, so I'm guessing if I was jamming with that, I'd try placing my hand, foot, head and a bunch of other stuff on top of the resonators. Probably find some neat sounds.

Then next week I'm gonna have zero ideas about how to recreate it again :P Already suffering with this with the modular synth, and those are just cables in specific holes.
by abronan | 2026-01-23 16:40:21+00:00
> but swarm was never intended to be a kubernetes contender.

Your comment is accurate for the original Swarm project, but a bit misleading regarding Swarm mode (released later on and integrated into docker).

I have worked on the original Swarm project and Swarmkit (on the distributed store/raft backend), and the latter was intended to compete with Kubernetes.

It was certainly an ambitious and borderline delusional strategy (considering the competition), but the goal was to offer a streamlined and integrated experience so that users wouldn't move away from Docker and use Swarm mode instead of Kubernetes (with a simple API, secured by default, just docker to install, no etcd or external key value metadata store required).

You can only go so far with a team of 10 people versus the hundreds scattered across Google/RedHat/IBM/Amazon, etc. There were so many evangelists and tech influencers/speakers rooting for Kubernetes already, reversing that trend was extremely difficult, even after initiating sort of a revolution in how developers deployed their apps with docker. The narrative that cluster orchestration was Google's territory (since they designed Borg that was used at a massive scale) was too entrenched to be challenged.

Swarm failed for many reasons (it was released too soon with a buggy experience and at an incomplete state, lacking a lot of the features k8s had, but also too late in terms of timing with k8s adoption). However, the goal for "Docker Swarm mode" was to compete with Kubernetes.
by yaront111 | 2026-01-23 16:40:48+00:00
That’s a sharp observation.
You’re partially right CAP (our protocol) handles the structural canonicalization. We use strict Protobuf/Schematic definitions, so if an agent sends a messy JSON that doesn't fit the schema, it’s rejected at the gateway. We don't deal with 'raw text' tool calls in the backend.
But you are touching on the semantic aliasing problem (e.g. rm -rf vs rm -r -f), which is a layer deeper.
Right now, we rely on the specific Worker to normalize those arguments before they hit the policy check, but having a universal 'Canonical Action Representation' upstream would be cleaner.
If you can turn 'messy intent' into a 'deterministic hash' before it hits the Cordum Scheduler, that would be a killer combo. Do you have a repo/docs for CAR yet?