MurphyA/hacker-news huggingface dataset:
by cakehonolulu | 2026-01-20 14:28:45+00:00
Hi! Sorry, this is an issue on my side; I forgot to update the documentation's example with the latest changes.

You basically have the kernel eventfd notify you about any access triggered (Based on your configuration), so from userspace, you have the eventfd and then you mmap the shared lock-less ring buffer that actually contains the events PCIem notifies (So you don't end up busy polling).

You basically mmap a struct pciem_shared_ring where you'll have your usual head/tail pointers.

From then on, on your main, you'd have a select() or a poll() for the eventfd; when PCIem notifies the userspace you'd check head != tail (Which means there are events to process) and you can basically do:

struct pciem_event *event = &event_ring->events[head];
atomic_thread_fence(memory_order_acquire);
if (event->type == PCIEM_EVENT_MMIO_WRITE) handle_mmio_read(...);

And that's it, don't forget to update the head pointer!

I'll go and update the docs now. Hopefully this clears stuff up!
by hombre_fatal | 2026-01-20 14:28:46+00:00
We're already at a point where I think a PR should start with an LLM prompt that fully specs out the change/feature.

And then we can look at multiple LLM-generated implementations to inform how the prompt might need to be updated further until it's a one-shot.

Now you have perfect intention behind code, and you can refine the intention if it's wrong.
Ask HN: Would you trust a new browser security extension in 2025?
by linklock | 2026-01-20 14:29:09+00:00
I'm considering building a privacy-first browser security extension
and want to validate the idea with HN's community before committing
months to it.

The hypothesis: Current browser security is fragmented. You need
multiple extensions (uBlock, Privacy Badger, HTTPS Everywhere) plus
something for phishing protection. Most all-in-one options are bloated
(Norton, Avira) or have privacy concerns.

What I'm considering:
- Zero data collection (no accounts, no telemetry)
- Open-source (MIT license)
- Phishing detection (local + Safe Browsing API)
- HTTPS enforcement
- Cookie auto-delete
- Pop-up blocking

Questions for HN:

1. Is there actually a gap here? Or is the current extension ecosystem
already perfect?

2. What would make you trust a NEW security extension in 2025? Open
source alone doesn't seem sufficient - there are sketchy OS
extensions too.

3. Would you ever pay for browser security ($3-5/month)? Or should
everything be donation-supported?

4. Is Manifest V3's limitations (30k rules, webRequest restrictions)
a dealbreaker even for security-focused extensions?

I put together a survey to gather structured feedback: https://forms.gle/CrxiWDFM23wvHT7g9

But honestly more interested in the discussion here. Talk me out of
this if it's a bad idea.
by prodigycorp | 2026-01-20 14:29:17+00:00
Supabase virtually encouraged it last year haha. I tried using it once and noped out after using it for an hour, when claude tried to do a bunch of migrations on prod instead of dev.

https://web.archive.org/web/20250622161053/https://supabase....

Now, there are some actual warnings. https://supabase.com/docs/guides/getting-started/mcp#securit...
by screye | 2026-01-20 14:29:25+00:00
It's been a bizarre watch. The automotive industry (and nations that rely on it) has sabotaged itself for a good decade. Unsurprisingly, China has caught up. Classic case of 'we've tried nothing and we're all out of ideas'.

Unions sabotaged automation efforts and limited hours worked. Quarterly financial pressures kept research investments to a minimum. Nations refused to scale up nuclear, and cost of electricity kept rising. The one well-run EV company (Tesla) decided to destroy its brand value overnight. Toyota went on a pig-headed hydrogen tangent and Honda still hasn't tried to make an EV. Korea has done surprisingly well. But, they're the exception that proves the rule.

China's rise as a manufacturing superpower was inevitable. But its rise as an automotive superpower involved major capitulation by the primary competition.
by SleepySteve_sk | 2026-01-20 14:29:44+00:00
I think of them as "Accountability" markets. Someone who can influence the outcome is encouraged to make a public bet on their success, and define what the success criteria is. The bet is then a means to hold them publicly accountable for doing what they said they would do. The market then becomes a voting machine for the public to decide if they think the person will succeed or not.
by FourSigma | 2026-01-20 14:30:50+00:00
I've been exploring this space. There are some use cases where I'd love to run an isolated Claude agent asynchronously. I think running Docker in rootless mode might solve some of the OP's concerns—I believe Podman does this implicitly. Also, there are tools like Kaniko that does not need Docker to create container images. You can also try changing the underlying container runtime to something like gVisor if you want more security.

Does anybody have experience using microVMs (Firecracker, Kata Containers, etc.) for this use case? Would love to hear your thoughts.
by mghackerlady | 2026-01-20 14:31:21+00:00
Yeah. I'm actually planning on making a qwidgets based CUA desktop for BSD (and /Linux too I suppose). Despite not hating GNOME and being able to defend it we need a good unixy (IE, do one thing and do it well) desktop that doesn't try to do everything or pull in that many dependencies (it won't be based on KDEs libraries for example)
by AdmiralAsshat | 2026-01-20 14:31:25+00:00
Meh. I installed Octopi, but it's like death by a thousand cuts. The dock looks like hot garbage when you flip to landscape mode--it ends up taking up like 60% of the screen. I don't know why it doesn't just switch to vertical mode the way Nova did.

Lack of being able to name the folders is also an annoyance, as is the way the folder icons pop out to the side from the dock rather than up-and-over.
by rpsw | 2026-01-20 14:31:54+00:00
The original paper would be: https://onlinelibrary.wiley.com/doi/10.1111/add.16648

The part the article OP linked to would be based off the line:

To put these percentage changes in terms of interest to policy makers, a 10% decrease in gambling expenditure in NSW would result in 4579 fewer ASS offences; 2867 fewer BESD offences; 1380 fewer BESND offences; 1398 fewer MVT offences; 2361 fewer SFMV offences; and 3793 fewer FRD offences 2 each year
by strogonoff | 2026-01-20 14:32:13+00:00
Many sports gamblers (horse racing, etc.) will say it’s about skill. They believe they shift the risk in their favor because they have the data and because they bet strategically so as to win over long term. (They can spend a while detailing it for you if you are willing to listen.)

Prediction markets in general can make anyone feel like it’s about data and skills. If they lose, then they didn’t have the good enough information, so clearly they should improve their skill, right?

From my understanding, purely natural events aside, the probability of you betting against the “house” will always approach 1. If the platform is centralised, they have a strong incentive to influence the stakes, or (this has been documented) straight up limit your ability to bet if you are winning “too much”—enough to cost them real money. If the platform is open and decentralised, “house” is another player with much more capital and personal influence in the matter than you (for example, some president can bet that he would invade a country—and then invade it; some footballer can bet that he wouldn’t score N times—then score N-1 and fake an injury at the most favourable time; of course, they would use intermediaries, and only the careless ones will get burnt).
by cd_mkdir | 2026-01-20 14:32:14+00:00
If you’ve ever had to prove which dollars in a drained bank account belong to you vs. a spouse, you’ve run into the Lowest Intermediate Balance Rule (LIBR). It’s a 50-year-old legal precedent (See v. See, 1966) that is a nightmare to calculate manually.

I’m a dev who got frustrated seeing forensic accountants charge $500/hr to do this in spreadsheets. So I built Exit Protocol to automate the forensic tracing and "impeachment" of financial lies.
Show HN: Run4ever – a browser-based long-term running progression game
by marcosme | 2026-01-20 14:32:30+00:00
Hi HN,
I’m a solo developer from Portugal. Over the past months I’ve been building Run4ever, a browser-based long-term progression game centered around running distance, XP growth, and global leaderboards.
The game is intentionally lightweight and text-first. Players start runs, accumulate distance over time, gain XP, unlock new run types, and compete with others worldwide. There’s no heavy graphics — the focus is on persistent progression and competition.
I recently opened a public beta. In the past weeks it grew to 114 players from 35 countries, which has been extremely helpful for finding real-world bugs and balancing progression.
The beta is currently planned to run until 500 runners or June 6, whichever comes first, before moving to a final release.
Game: https://run4ever.win
Rules / mechanics overview: https://run4ever.win/rules
I’d love feedback — especially on onboarding clarity, progression pacing, and anything that feels confusing or unnecessary.
Happy to answer any questions.
Marcos
by damnitbuilds | 2026-01-20 14:33:01+00:00
I have felt this for a long time.

Back in the email days, I used to try and get people to nest their email replies. But that was too much work or too complicated for most people.

Slack was awful for being single-threaded. Is it still ?!

X.com seems to be multi threaded but it is hard to see the threads. I find it unusable for discussions, and only use it as a read-only newsfeed.
It would be vastly improved if one could easily follow discussion threads, as per your idea.
by pdimitar | 2026-01-20 14:33:13+00:00
Like with everything, none of the both extremes are good.

What helps me in situations where people talk about it for the umpteenth time is trying to drill down and find the root cause with carefully worded questions. I think I might be ready to become a therapist, lol. Though my fuse is quite short due to my own stress so I don't put myself in the "I am your emotional trash bin" kind of situations.

So to me even the situations you describe can be made use of. Think of it as a long-running background task with many steps; after each retry you get a new exception stack trace. F.ex. during conversation #7 you might understand one or two causes of the problem but at conversation #12 you might already have a nice root cause and you can then try to gently nudge the person towards addressing that.

Of course you are not mandated to. It's all about what you need in this current phase of life as well; you don't have to be people's therapist. It's just what I find super interesting the last year or so -- root-cause analysis of human problems.

But when I understand that somebody just wants to whine and be a constant victim, I mentally check out. Not worth the joules that my brain would spend on that person.
Show HN: APIsec MCP Audit – Audit what your AI agents can access
by rajaramr7 | 2026-01-20 14:33:23+00:00
Hi HN — I built APIsec MCP Audit, an open source tool to audit Model Context Protocol (MCP) configurations used by AI agents.

Developers are connecting Claude, Cursor, and other assistants to APIs, databases, and internal systems via MCP. These configs grant agents real permissions, often without security oversight.

MCP Audit scans MCP configs and surfaces:

- Exposed credentials (keys, tokens, database URLs)
- What APIs or tools an agent can call
- High-risk capabilities (shell access, filesystem access, unverified sources)

It can also export results as a CycloneDX AI-BOM for governance and compliance.

Two ways to try it:

- CLI: pip install mcp-audit
- Web demo: https://apisec-inc.github.io/mcp-audit/

Repo: https://github.com/apisec-inc/mcp-audit

We're a security company (APIsec) and built this after repeatedly finding secrets and over-permissioned agent configs during assessments. Would appreciate feedback — especially on risk scoring heuristics and what additional signals would be useful.
by showsover | 2026-01-20 14:33:42+00:00
Seeing things being broken but not being fixed is a real source of frustration.
The tricky thing in my experience has been figuring out which are issues that nobody bothered to fix and which are issues that seem simple but require huge changes to fix.

The day-to-day gets so much better when you can do a few of these fixes every so often, after a few months it really adds up when you compare to how things used to be.
by edude03 | 2026-01-20 14:34:35+00:00
I have the same experience despite using claude every day. As an funny anecdote:

Someone I know wrote the code and the unit tests for a new feature with an agent. The code was subtly wrong, fine, it happens, but worse the 30 or so tests they added added 10 minutes to the test run time and they all essentially amounted to `expect(true).to.be(true)` because the LLM had worked around the code not working in the tests
by ori_b | 2026-01-20 14:34:39+00:00
Hypothetical example because I haven't dug through the bug tracker to find specific bugs. But it would not be discovered by a scrub because the hashes are valid. Scrubs check hashes, not structure. It would be discovered by a fsck because the structure is invalid. Fscks check structure, not hashes.

They are two different tools, with two different uses.
by jebarker | 2026-01-20 14:34:42+00:00
I get stuck on asking “why am I solving this problem” too much. I am surrounded by technical problems that it would give a dopamine hit to solve and I’d feel the pleasure of helping my fellow man, but 99% of them feel like they shouldn’t even exist and solving them doesn’t really lead to any meaningful progress beyond providing me job security and money. (How) do people deal with this?
by Aurornis | 2026-01-20 14:34:46+00:00
> Emotions and feelings are always "valid", in the sense that they are a natural consequence of events and prior conditioning.

If “validating” someone’s emotions comes down to simply saying that, yes, I agree you felt that way, then I suppose that’s true.

But when people talk about validating other people’s emotions it implies that they’re saying the emotional response was valid for the circumstances.

I have someone in my extended family who has a strong tendency to catastrophize and assume the worst. When she was in a relationship with someone who constantly validated her emotions and reactions it was disastrous. It took someone more level headed to start telling her when her reactions were not valid to certain situations to begin stabilizing the behavior.

There’s a hand wavey, feel good idea where we’re supposed to believe everyone’s lived experience and emotions are valid, but some people have problems with incorrect emotional reactions. Validating these can become reinforcing for that behavior.

I’m not saying we should start doubting every emotional reaction or white knighting everything, but it’s unhealthy to take a stance that validating other people’s emotions is de facto good.
by pdimitar | 2026-01-20 14:36:02+00:00
Well if none of the measures you already tried to stop that did not work, then maybe one thing that can help you is asking yourself whether you are not feeling drained after interacting with those people?

I, like yourself, cannot override my engineering mindset. I ALWAYS WANT TO HELP. But at one point I reframed it as an energy budget problem and how efficiently are my time and energy spent... and then it clicked.
by footy | 2026-01-20 14:36:18+00:00
This is what my differential equations exams were like almost 20 years ago. Honestly, as a student I considered them brutal (10 questions, no partial credit available at all) even though I'd always been good at math. I scraped by but I think something like 30% of students had to retake the class.

Now that I haven't been a student in a long time and (maybe crucially?) that I am friends with professors and in a relationship with one, I get it. I don't think it would be appropriate for a higher level course, but for a weed-out class where there's one Prof and maybe 2 TAs for every 80-100 students it makes sense.
by randerson | 2026-01-20 14:36:41+00:00
You can have plenty of fun without putting other drivers in danger. I used to drive a NA Miata that took 9 seconds to get to 60 mph and it was the most fun car I've ever owned. But I'm a slow-car-fast person.

Most people can safely wring out their cars in 1st and 2nd on a highway on-ramp, or from a traffic light on an empty 55 mph country road. I own a fun weekend car that I take out at dawn on a Saturday to carve up a mountain pass - which is fun even at the speed limit. In a lightweight sports car with excellent brakes, I am safer than all the trucks I see on these roads.
by JKCalhoun | 2026-01-20 14:36:51+00:00
"…time, there was a 36 percent chance that the president would annex Greenland. “Whoa, way up there!” Enten yells, slapping his hands together. “My goodness gracious!” The ticker at the bottom of the screen speeds through other odds: Will Gavin Newsom win the next presidential election…"

Like reading some kind of Twilight Zone episode script [1] starring William Shatner…

[1] https://youtu.be/405IKLIMvJo
by 0rzech | 2026-01-20 14:36:54+00:00
Despite Międzyzdroje (zachodniopomorskie, Poland) lying directly at the seaside, the air in winter is so bad it literally irritates the throat and can even make you nauseous, and only directly on the beach can you still breathe fresh air.

The common argument is that people use bad furnaces or burn bad fuel or trash out of poverty, but far too often the actual cause is mentality and not financial issues.

Smog kills around 40,000 Polish people each year. [1] It was reported in 2025 to be 20 times more than in car accidents. [2]

On the bright side, industrial art fans can make their breathing mask-wearing dreams a reality without even pretending.

[1] https://pulsmedycyny.pl/medycyna/choroby-ukladu-oddechowego/...

[2] https://www.infor.pl/prawo/nowosci-prawne/6826105,umiera-od-...
by win311fwg | 2026-01-20 14:38:34+00:00
> In general there’s no way to keep everything in your head

I imagine everyone's capacity is different, but you wouldn't want anyone with a low capacity on your team, so that's moot. Frankly, there is no need to go beyond what you can keep in your head, unless your personal capacity is naturally limited I guess, because as soon as you progress in some way the world has changed and you have to reevaluate everything anyway, so there was no reason to worry about the stuff you can't focus on to begin with.
by sinuhe69 | 2026-01-20 14:38:56+00:00
What a wonderful teacher! I wish all teachers were like him.

Regarding the collaboration before the exam, it's really strange. In our generation, asking or exchanging questions was perfectly normal. I got an almost perfect score in physics thanks to that. I guess the elegant solution was still in me, but I might not have been able to come up with it in such a stressful situation. 'Almost' because the professor deducted one point from my score for being absent too often :)

However, oral exams in Europe are quite different from those at US universities. In an oral exam, the professor can interact with the student to see if they truly understand the subject, regardless of the written text. Allowing a chatbot during a written exam today would be defying the very purpose of the exam.
Show HN: Osprey API Tester – VS Code API Testing from NestJS Controllers/DTOs
by jeremi-24 | 2026-01-20 14:39:03+00:00
Osprey API Tester – API testing inside VS Code for NestJS projects.

It reads NestJS controllers and DTO classes to:

list available routes

parse route params, query params, and headers

generate request URLs from decorators

generate JSON bodies from DTOs

allow sending requests directly from VS Code

No runtime dependency on the server.
Uses TypeScript AST (ts-morph).
Limitations: NestJS + TypeScript only.
by goku12 | 2026-01-20 14:39:25+00:00
> I am a pretty big RISC-V booster but RISC-V is going to cost way more for a while. It is simple economics of scale.

Yes. That's exactly my concern too. That can be expected to last until RISC-V application processors are a few magnitudes of order more popular. But it isn't as improbable as it sounds. Just a matter of time.

> But somebody designed the RISC-V chip and board you are buying and they will want to get paid.

Yes, that will be the licensing cost of the proprietary IP, excluding the hardware costs.

> RISC-V is inevitable. And the competition that will bring will pay dividends to all of us.

I hope so too. I'm just saying that it's too early to celebrate right now. It will probably take another half a decade as you mentioned.
by lucideer | 2026-01-20 14:39:50+00:00
As a Fairphone owner, I use them for one reason I rarely see mentioned.

I think they're very imperfect phones for a lot of reasons: they're bad value on a pure hardware specs to retail price comparison, their security update support isn't where it could be & the repairability - while best on the market - still has gaps.

However, the rarely mentioned story is their supply chain advocacy initiatives. Not only do they try to source as much of the hardware ethically as they can, their work has also had a broad knock-on effect on the entire industry. Their living wage advocacy for the assembly factories they use has resulted in wage improvements within those supplier companies for employees working on non-FP hardware as well. Their work in Congo with the Fair Cobalt Alliance is a big part of the reason that other companies like Apple are even able to source "certificate recycled" cobalt for their batteries (albeit those certifications are misleading due to the mass balance system, they're still a lot better than nothing).
by kxbnb | 2026-01-20 14:40:00+00:00
The multiplexing over a single port is a nice touch - solves the random port allocation pain point that makes localtunnel tricky to deploy in restrictive environments.

Curious about the WebSocket overhead in practice. Have you measured latency compared to SSH-based tunnels like bore or rathole? The TypeScript/node.js stack makes it easy to embed, which is appealing for dev tooling integrations.

The fact that you built this for MCP Inspector work is interesting - I've been working on MCP tooling myself and the local dev workflow definitely needs better tunneling options. Nice to see more infrastructure pieces for that ecosystem.
by hydrogen7800 | 2026-01-20 14:40:20+00:00
>could this be a difference in male/female brains ?

Maybe socially, but I'm not sure about naturally. It took me a long time to get where the GP is, realizing that some just like to he heard rather than offered solutions. Now I notice that my family are "fixers" and any problem or difficulty is countered with "did you do this" or "you should have done that" or "why don't you.." I now realize I don't like being second guessed in a moment like that, in contrast to the gender stereotype.