MurphyA/hacker-news huggingface dataset:
by woodruffw | 2026-01-23 15:47:47+00:00
Thanks for your detailed response.

I guess what I mean is that trust is a hard problem, and a lot of solutions to trust involve transmuting a presupposed trust problem into a different trust problem with a slightly different security model.

For example: with a centralized service, I assume that a given identity is integral so long as the service is secure. I don't need cryptographic identity for that centralized service, but that assumes I trust the service to be secure.

With a distributed service, I need some way to ensure the integrity of identities. One way to do that is to TOFU, i.e. take a claimant identity on face value on first observation and then trust it going forwards. This works well for schemes like SSH, but it doesn't work super well for distributed user networks (because users like to lose their keys, and there's a larger potential surface area for undetectable key substitution).

Another solution is a "web of trust" architecture, where you take an initial trusted core and transitively extend trust outwards. The problems with this are (1) that trust isn't actually transitive, and (2) it still presupposes a trusted core, which needs to be bootstrapped somehow.

A third solution is a traditional PKI, where you have one or more pre-established identity "authorities" that sign for end user identities. This is the solution that HTTPS picks, and is arguably the most empirically proven of the decentralized identity schemes. But it's only as decentralized as the authorities themselves are, and there's a meaningful argument to be had about that (particularly in schemes that are smaller than the Web PKI).

It sounds like Radicle is going with a mixture of (1) and (2), which is interesting and worth proving out. But my experience is that "someone's SSH key" is much less of a stable identity than we'd all like it to be, and schemes that involve delegating trust via unstable identities eventually run into architectural limitations that end users solve by just subverting the scheme itself (i.e. falling back to TOFU).

> That aside, how do you know which people to trust when you meet them? And how do you signal trust in those you've met? In Radicle holding stable cryptographic identities doesn't resolve the zero-to-some trust problem but it does resolve the some-to-more trust problem, I can continue trusting once I recognise and know an identity.

This is a good example both of how (1) social trust isn't easy to encode in cryptographic claims, and (2) how the transitivity of trust breaks down.

In the real world, I trust my barber to cut my hair and my dentist to look at my teeth. But I only trust them for their apposite roles, and my trust in my barber doesn't necessarily mean anything to my friend who doesn't like my haircut.
by prophesi | 2026-01-23 15:48:10+00:00
There may be a free CS course out there that teaches how to implement a simplified version of Google's PageRank. It's essentially just the recursive idea that a page is important if important pages link to it. The original paper for it is a good read, too. Curiously, it took me forever to find the unaltered version of the paper that includes Appendix A: Advertising
and Mixed Motives, explaining how any search engine with an ad-based business model will inherently be biased against the needs of their users[0]

[0] https://www.site.uottawa.ca/~stan/csi5389/readings/google.pd...
by tartoran | 2026-01-23 15:48:16+00:00
Spot on. I used to have back pain and all sorts of discomfort throughout body, neck shoulders, etc. until I figured out how to properly sit. Luckily I haven't had any issues lately, I'm in my mid 40s and have been in a much better shape than I was in my mid 20s. I don't use a stool necessarily but I try not to use the back support too much and for me the sitting area must be rigid, any cushion can mess up with my sitting position.
by naolbeyene | 2026-01-23 15:48:22+00:00
I built SudoAgent, a Python library that guards “dangerous” function calls at runtime.

It’s meant for agent/tool code (refunds, deletes, API writes, prod changes) where you want a gate outside the prompt.

How it works

Evaluate a policy on the call context (action + args/kwargs)

Optionally request human approval (terminal y/n in v0.1.1)

Write audit entries (JSONL by default) and correlate with request_id

Key semantics

Decision logging is fail-closed (if decision logging fails, the function does not execute)

Outcome logging is best-effort (logging failure won’t change the function return/exception)

Redacts secret key names + value patterns (JWT-like, sk-, PEM blocks)

It’s intentionally minimal and framework-agnostic: implement your own Policy, Approver,or AuditLogger (Slack/web UI/db) and inject them.
by derefr | 2026-01-23 15:48:36+00:00
The convenient thing in this case (verification of translation of academic papers from the speaker's native language to English) is that the authors of the paper likely already 1. can read English to some degree, and 2. are highly likely to be familiar specifically with the jargon terms of their field in both their own language and in English.

This is because, even in countries with a different primary spoken language, many academic subjects, especially at a graduate level (masters/PhD programs — i.e. when publishing starts to matter), are still taught at universities at least partly in English. The best textbooks are in English; all the seminal papers one might reference are in English; etc. For many programs, the ability to read English to some degree is a requirement for attendance.

And yet these same programs are also likely to provide lectures (and TA assistance) in the country's own native language, with the native-language versions of the jargon terms used. And any collaborative work is likely to also occur in the native language. So attendees of such programs end up exposed to both the native-language and English-language terms within their field.

This means that academics in these places often have very little trouble in verifying the fidelity of translation of the jargon in their papers. It's usually all the other stuff in the translation that they aren't sure is correct. But this can be cheaply verified by handing the paper to any fluently-multilingual non-academic and asking them to check the translation, with the instruction to just ignore the jargon terms because they were already verified.
by HelloNurse | 2026-01-23 15:49:38+00:00
If you think this discussion is antagonistic, you should see how antagonistic "entrepreneurs" and VCs become when they are in charge of open source projects. Risk aversion is good.

In this case, the familiar "rewrite it in Rust" MO has a special angle: the Turso feature list is such a terrifying collection of high-risk, low-performance, inferior, unlikely to be compatible, unproven and unnecessary departures from SQLite that a malicious embrace-and-extend business plan is a reasonable theory and reckless naivety is the best possible case.
Is there room left for the "Industrial" Systems Engineer in a post-cloud world?
by infraphysics | 2026-01-23 15:50:05+00:00
I'm an Industrial Engineer by training with a deep background in software, but I find myself increasingly disillusioned by the current cloud-native saturation. While the market is flooded with AWS/DevOps experts managing abstractions, I'm interested in the "ground truth": the physical and low-level reality of data centers, medical infrastructure, and defense systems.

I'm currently digging into OSTEP (Remzi) and DDIA (Kleppmann) to bridge my industrial roots with modern systems engineering. I want to focus on bare-metal deployments, L2/L3 networking, and Linux at a molecular level (Kernel hardening, LVM, performance tuning), specifically for environments where the cloud isn't an option (air-gapped, high-stakes, or edge-heavy).

I have a few questions for the HN community:

1. Is there a sustainable career path for engineers who prioritize the ATMOS layer (Physical/Kernel/Networking) over the Public Cloud? Do firms like Anduril, Palantir, or high-end industrial automation giants actually value the Physics + Software hybrid, or is it becoming too niche?

2. How much does a deep understanding of thermodynamics, power integrity, and signal physics matter compared to the ability to write low-level firmware or C/Rust? Where is the real bottleneck in modern hard-tech infrastructure?

3. For someone moving away from VMs and towards bare metal, what kind of scar tissue projects actually impress senior infrastructure leads? I'm currently building a resilient, air-gapped data pipeline on physical nodes (Intel NUCs) with manual kernel tuning and thermal monitoring in Rust. Is this the right direction?

4. If OSTEP and DDIA are my baseline, what are the TIER-2 materials or real-world challenges I should be tackling to prove I can manage high-stakes infrastructure in a hospital or a remote deployment? Kubernetes?

I'm looking for the hard advice, the stuff that doesn't make it into AWS certifications. What does it take to be the person they send when there is no internet, no cloud, and the hardware must not fail?
by rtkwe | 2026-01-23 15:50:13+00:00
Also a technique used all over the place for studying how molecules react to light. Probe it with as short of a laser pulse you can afford to buy and measure the light emitted by it some time later. My wife has been doing this basic technique for years studying things like molecules to generate fuels from sunlight. (Or was until solar energy funding as practically eliminated last year, now it's studying other things using similar techniques)
by ALittleLight | 2026-01-23 15:50:13+00:00
I agree with you that someone who is good with a screen reader can efficiently move through web interfaces. A good screen reader user is faster than the typical user.

However, not all blind people are good with screen readers. For them, an AI assistant would be useful. Even for good screen reader users an AI could be useful.

An example: Yesterday, I needed to buy new valve caps for my car's tires. The screen reader path would be something like walmart -> jump to search field, type "valve cap car tire" and submit -> jump to results section -> iterate through a few results to make sure I'm getting the right thing at a good price -> go to the result I want -> checkout flow. Alternatively, the AI flow would be telling my AI assistant that I need new car tire valve caps. The assistant could then simultaneously search many provider options, select one based on criteria it inferred, and order it by itself.

The AI path, in other words, gets a better result (looking through more providers means it's likelier to find a better path, faster delivery, whatever) and also, much easier and faster. Of course, not only for screen reader users, but also just everyone.
by rob74 | 2026-01-23 15:50:44+00:00
I'm not sure what the technology by which the data from the speed camera is downloaded has to do with identifying the driver?

The reason for this "ludicrous" procedure is that the police can identify the owner of the car (based on the license plate), but not the driver, so the owner has to say who was driving. And all of this has to be done in a way that will hold up in court, therefore snail mail. The same procedure exists in Germany (of course, the bureaucracy here has its ludicrous sides too) and I bet in other countries as well.
by outcoldman | 2026-01-23 15:50:55+00:00
The only big noticeable issue for me was building a large enterprise images (like Splunk). This issue was fixed [1]. Other than that I have not seen any issues with IO or performance. Running Splunk/OpenSearch/ElasticSearch, some performance tests, enterprise software written in Go (building for arm64/amd64). No issues at all.

1. https://github.com/apple/container/issues/68
Show HN: Dippy solves Claude permission fatigue and keeps the LLM on-track
by ldayton | 2026-01-23 15:51:12+00:00
Less permission fatigue, more momentum. Dippy knows what’s safe to run and keeps Claude on track when plans change.

https://github.com/ldayton/Dippy

Claude Code asks permission for every shell command. The problem isn't `ls`—it's that `ps aux | grep python | awk '{print $2}' | head -10` also needs approval. So does `git log --oneline -5 && git diff --stat`. You're constantly interrupted for commands that are obviously safe.

Dippy is a PreToolUse hook with a real bash parser. It decomposes pipelines, analyzes each command, and auto-approves when it understands the whole thing is read-only. I'm seeing much faster development—not smarter AI, just fewer interruptions.

What's original:

1. Actual bash parsing. Hand-written recursive descent parser (Parable), pure Python, no dependencies. Correctly handles pipelines, subshells, command substitution, here-docs, redirects. Understands `cd /tmp && rm -rf ` resolves paths relative to /tmp. 14,000+ tests.

2. Deep command analysis. Not just "is this git"—Dippy knows:
- `awk '{print $2}'` is safe, `awk '{print > "file"}'` writes files
- `sed -n 's/foo/bar/p'` is safe, `sed -i` modifies in place
- `curl -sS https://...` is safe, `curl ... > script.sh` isn't
- `find . -name ".txt"` is safe, `find . -exec rm {} \;` isn't
- 45+ CLI tools with subcommand-aware logic

3. Deny messages that steer Claude in the right direction. `deny python "Use uv run python"` blocks and tells the AI why. It self-corrects and continues—no wasted turn. This compounds across a session.

4. Highly configurable. A [configuration system](https://github.com/ldayton/Dippy/wiki/Configuration) with last-rule-wins semantics gives you fine-grain control over Dippy's steering and command approvals.

Philosophy: approve what we know is safe, ask about everything else. Not adversarial—just catches mistakes.
Show HN: GONK – an ultra-lightweight, edge-native API gateway written in Go
by justvugg | 2026-01-23 15:51:20+00:00
Hi HN,
I built GONK, a small API gateway written in Go, aimed at edge, IoT and constrained or offline environments where full-blown gateways feel like overkill.

Repo: https://github.com/JustVugg/gonk

What it does

GONK handles the common “front of service” concerns while staying simple and dependency-free:
• Routing and reverse proxying
• JWT-based auth with RBAC and scope validation
• mTLS with client cert authentication and flexible role mapping
• Load balancing (round-robin, weighted, least-connections, IP hash)
• Upstream health checks and automatic failover
• Single static binary, no external services required

There’s also a CLI to generate configs, JWTs and certificates so you don’t have to hand-edit YAML.

Why

Gateways like Kong, Traefik or NGINX are great, but they often assume:
• cloud-native environments
• control planes, databases, or external dependencies
• more resources than you realistically have on edge devices or air-gapped systems

GONK is designed for industrial setups, edge nodes, offline networks and small deployments where you just want something that works and is easy to reason about.

Getting started

git clone https://github.com/JustVugg/gonk
cd gonk
make build
./bin/gonk-cli init --template basic --output gonk.yaml
./bin/gonk -config gonk.yaml

Looking for feedback

I’d love input from folks working on:
• IoT / edge computing
• air-gapped or industrial systems
• embedded or low-resource deployments

Does this auth + gateway model feel practical in real setups?
What features would you expect next (or would not want)?
by pixl97 | 2026-01-23 15:52:03+00:00
>then I'm going to escalate to the national authority if they still refuse to act.

You are actually doing this wrong...

Report to the national authority first...

Then report to Google.

Fuck them, it is not in your interest to report to them first, make them react for their bullshit. Over here in the states this is how I ended up dealing with telecom in the ISP industry. "Hello, I have put in an FTC/FCC complaint on $issue, and would like to see about getting it resolved".

It didn't matter that's not the order you're supposed to go in, at the telecom side they send it off to a team that actually gets shit solved before it becomes a regulatory problem.
by WarmWash | 2026-01-23 15:52:09+00:00
Then the problem was solved 30 years ago, and you can continue to use it indefinitely.

No one will force a blind person to use a computer that converses in natural english. But even sighted people are likely to move away from dense visually heavy UIs towards natural conversational interface with digital systems. I suspect that given that comes to fruition (unlike us nerds, regular folks hate visual info dense clutter), young blind people won't even perceive much impediment in that area of life.

This isn't far off from CLI vs GUI debate, where CLIs are way faster and more efficient, but regular people overwhelmingly despise them and use GUIs. Ease over efficiency is the goal for them.
by EmptyCoffeeCup | 2026-01-23 15:52:10+00:00
Very happy - the £100 fine isn't the problem, it's the points/day-wasted-on-useless-course that is the real deterrent to speeding.

And before people say "think of the children" and "I learned something I should have already known on the course" - Speed limits are increasingly being changed for political reasons: Safety has nothing to do with it, therefore, these arguments no longer stand (my local authority is determined to make cars as slow as buses, and is more than happy to "set aside" any suggestions that they do not do this).
by igneo676 | 2026-01-23 15:52:17+00:00
What's actually going on here is the Unix Philosophy applied to more and more platforms.

Previously, if you wanted to rig up a screen recording app in a few minutes you'd use Linux and specifically one of the minimal desktop environments like i3 or sway. Then you'd wire up a few command line utilities (slurp, wf-recorder, etc) and get the exact experience you want. These small unix tools allowed the greater ecosystem to just cobble together what they wanted without too much hassle. I've done exactly this!

This is the exact mindset that keeps people away. They'd prefer to NOT maintain their own video recording software THANK YOU VERY MUCH. So you get people who go to Mac OS because there's always a slick solution for a couple bucks and you never have to be TOO fiddly.

This doesn't destroy the market for people in the latter camp, but it DOES open up the market for people in the former.
Show HN: VibeInbox – AI inbox triage for Gmail with safe defaults
by kyoungsookim | 2026-01-23 15:52:23+00:00
I built VibeInbox to organize Gmail by reading email content
(Gemini) instead of relying on sender-based heuristics. It
classifies emails into IMPORTANT/NORMAL/INFO/SPAM, applies
Gmail labels (AI/...), and can optionally archive promos or
move high-confidence spam (no delete actions). Runs locally;
you provide Gmail OAuth + Gemini API key.
Repo: https://github.com/kks0488/vibe-inbox
Would love feedback on classification quality, workflows
(scheduler/systemd/docker), and false positives/negatives.
by kwanbix | 2026-01-23 15:52:46+00:00
This was my first computer too! I loved it - that’s where I learned LOGO. In my home country, games (and basically everything) were incredibly expensive, but my father still bought it from a friend who was selling it to upgrade to a C64.

I remember playing Parsec, and Space Invaders. I am sure I had 2 or 4 more games. But don't remember which ones.
by dspillett | 2026-01-23 15:52:55+00:00
The asymmetry of 56k standards was 2:1, so if you got a 56k6 link (the best you could get in theory IIRC) your upload rate would be ~28k3. In my expereience the best you would get in real world use was ~48k (so 48kbpd down, 24kbps up), and 42k (so 21k up) was the most I could guarantee would be stable (baring in mind “unstable” meant the link might completely drop randomly, not that there would be a blip here-or-there and all would be well again PDQ afterwards) for a significant length of time.

To get 33k6 up (or even just 28k8 - some ISPs had banks of modems that supported one the 56k6 standards but would not support more than 28k8 symmetric) you needed to force your modem to connect using the older symmetric standards.
by t-3 | 2026-01-23 15:53:01+00:00
No, nationalism and patriotism started to be embarrassing to the educated classes in the US after the USSR collapsed. We had "won", and slavish obedience and loyalty are really not consistent with the values of liberalism and democracy, and empire is quite uncomfortable if you believe in human rights and self-determination, etc. Our society has been changing because it's running into the contradictions of a culture designed to foster the unity necessary to win wars and dominate the world and an idealism that says all humanity is equal and freedom and self-determination are inherently good.
by okanat | 2026-01-23 15:53:11+00:00
If you are building natively, yes. However the original comment is about Dev Containers which runs under WSL2.

If you open a native Windows folder in VSCode and activate the Dev Container, it will use the special drvfs mounts that communicate via Plan9 to host Windows OS to access native Windows files from the Docker distro. Since it is a network layer accross two kernels, it is slow as hell.
by zabzonk | 2026-01-23 15:53:18+00:00
> Most underlying technology is timeless (see TAOCP, SICP, CLRS, K&R, GoF, Dragon Book,

True enuf, but how often do you actually refer to the books underlying ideas? I've had (now gone, presumably) TAOCP on my bookshelves for years, but how often did I use it? Stuff on RNG a bit, I guess...
by lorenzleutgeb | 2026-01-23 15:53:28+00:00
Radicle is a free software project, not a company or commercial product. Many other open source projects are also not monetizable in the narrow sense, and still manage to attract enough contributors and funding to flourish. Sometimes these projects even get adopted so widespread that multiple companies build consortia/foundations to fund the development, even if there is no direct revenue stream from that.

As long as someone is willing to fund the development of Radicle, the developers just will have a stronger incentive to work on it. Without any more funding, of course it will join the (very large) club of less well funded free software projects.

If enough people join and contribute now, and then some companies make the switch, it might well be feasible to pay a small team to continue working on it, financed by donations.

Just don't think about it as a commercial product, only because someone decided to use their money towards its development. If you don't like that it's not a company, then that's okay. I am just trying to give another perspective.
by rvermeulen98 | 2026-01-23 15:53:40+00:00
Thanks a lot for your contribution, this is something I will look into in the upcoming days. I totally agree that CGO isn't ideal, I had to make the build/release process also a lot more complicated purely for that clipboard requirement (see GHAs and the different goreleaser files).

On the other hand, I also don't want whosthere to be depended on a fork that isn't maintained anymore. I will think about this trade-off, but I am also interested how others look at this problem.
by 9rx | 2026-01-23 15:54:10+00:00
> Yes, it can be done with JSON and OpenApi, yet it’s not mandatory.

It is not mandatory for Protobuf either. You can construct a protobuf message with an implied structure just as you can with JSON. It does not violate the spec.

Protobuf ultimately gets the nod because it has better tooling (which isn't to be taken as praise towards Protobuf's tooling, but OpenAPI is worse).
by jen20 | 2026-01-23 15:54:36+00:00
Automatic enforcement of dumb low level stuff is supposed to free up police time for the more serious things. Whether that happens or not is a political decision. I remember the time before red light cameras in London, and the time afterwards, and the situation was much improved after they showed up.

I agree the driving test is too easy (though several orders of magnitude more difficult than in the US states I've had to do one in), and there is too little enforcement of otherwise dangerous behaviour.