MurphyA/hacker-news huggingface dataset:
by easterncalculus | 2026-01-21 14:19:30+00:00
The reality is that most people's thoughts on bug bounties are from salacious headlines talking about those $1M vulnerabilities. In reality the average bug bounty submission is a machine translated report for a low severity issue in a web app that may or may not even exist (or be a vulnerability), sprayed at hundreds of companies (or the same company a hundred times) in the hopes of earning $500 to basically do currency manipulation.
by wolvoleo | 2026-01-21 14:19:31+00:00
I can say exactly that about Linux?

I use Linux as my daily driver (KDE, 200% scaling on a 24" 4K) and I really love its DPI scaling. With Plasma 5 I had a few little bugs involving DPI but they are solved with Plasma 6.

Same wuth all the apps I use (which admittedly are mostly Qt apps because I don't like Gnome/GTK so I avoid those as much as possible).
by embedding-shape | 2026-01-21 14:19:42+00:00
I mean if you now live in Spain, then you need to pay taxes in Spain, because that's where you live. This makes sense, does it not? Or is the expectation that you shouldn't pay taxes where you live, only where your company that you work for/in is based?

FWIW, I also live in Spain, and also pay "high taxes" as I'm in the highest income bracket, and it sucks to see large parts of your income and capital gains disappear. But then I've also experienced the health care here, and see everyone being taken care of, and I sleep well again :)
by goku12 | 2026-01-21 14:19:42+00:00
They either lack that foresight and are completely oblivious of that limitation (the Dunning-Kruger effect), or they're lying shamelessly to manipulate the market in the hopes cashing out in the end, sort of like a pump-and-dump scheme or a pyramid scheme. Based on many of their track records I wouldn't be too surprised if both effects are at play, reinforcing each other.
by jojomodding | 2026-01-21 14:19:43+00:00
Saying "I'm 5 feet 11 inches" requires about 3 digits, saying "I'm 180cm" also requires that many digits. It takes about as many syllables as well, because in practice you say "five-(feet)-e-leven" or "one-eighty" (Note that I don't know how to say US customary units out loud)
by whizzter | 2026-01-21 14:19:55+00:00
I think starting and investing per-se really isn't the major issue for some time (at least in Sweden and probably Denmark), we've gotten many small business friendly laws over the past 15-20 years.

At the same time there are many discrepancies that makes it hard for companies from one country to mesh with companies from another country.

Law tradition (Napoleonic, German or Nordic), tax rules (German rules were (are?) notorious for their complexity,etc. , then there's certain laws such as the Finnish money gathering law that can be a problem for very early stage development ( https://solhsa.com/wishlist.html ).

All the above creates friction, and if EU-inc would follow German rules, I'd rather just stay with a Swedish company because..

Luckily the EU has harmonized things so a startup in one country can mostly work within local rules as long as we make sure to distribute earnings from different countries correctly.

The trickier part is forming bonds, such as for investor and/or startup protection for across-border investments when one wants to grow, various scams over the years has played out differently in various countries so those kinds of laws could be quite an issue outside of the stock market.
by zelphirkalt | 2026-01-21 14:19:55+00:00
All this complication seems to stem from the simple fact, that the fences don't have a recognizably distinct start and end marker. It's all "`" or "~", instead of one symbol at the start and another, different symbol at the end. And then going into the different numbers of backticks or tildes. Why add such ambiguity, that will only make it harder to parse things correctly? This immediately raises the question: "What if I start a block with 4 backticks and end it with 5?"

All these complications would have been avoidable with a more thought through design/better choices of symbols. For example one could have used brackets:

[[[lang
code here
]]]

And if one wanted to nest it, it should automatically work:

[[[html
html code
[[[css
css code
]]]
[[[js
js code
]]]
html code
]]]

In case one wants to output literally "[[[" one could escape it using backslash, as usual in many languages.

In a parser that would be much simpler to parse. It is kind of like parsing S-expressions. There is no need for 4 backticks, 5, or any higher number. I don't want to sit there counting backticks in the document, to know what part of a nested code block some code belongs to. It's a silly design.
Ask HN: Why does SoC 2 feel so hard for early-stage startups?
by rftrtfx | 2026-01-21 14:20:13+00:00
Context: I’m working on a compliance preparation tool for early-stage startups, and I’ve spoken with many teams going through SOC 2. I’m posting here to sanity-check my understanding and learn what others found most painful before the audit.
Most teams don’t delay SOC 2 because they don’t care about security or because customers aren’t asking. They delay because it’s extremely unclear how to start.

You Google “SOC 2” and you’re immediately hit with:
- 100+ controls
- Type I vs Type II
- Trust Services Criteria
- Tooling vs auditors vs consultants
- The result is that many startups treat SOC 2 as a tooling problem.

They wait until a deal is blocked, then:
- Sign up for Vanta or Drata
- Hire a consultant
- Try to “speedrun” compliance

What actually hurts them isn’t missing controls — it’s missing readiness. No clear asset inventory, no ownership, no risk model, no vendor tracking, no idea what evidence even exists yet.

By the time tools or auditors enter the picture, everything is reactive and expensive.

For those of you who’ve been through SOC 2:
- What helped you most before the audit?
- What do you wish you had done 3–6 months earlier?
- Did you start with tools, docs, or internal processes first?

Genuinely curious how others approached this.
by Aurornis | 2026-01-21 14:21:07+00:00
> It's a hard path to walk and recruiting/interviewing is inherently sensitive it seems.

Hiring and interviewing is in a weird place right now. We’re coming off of a period where tech jobs were easy to get and companies were competing for candidates. A lot of candidates quickly got used to the idea of companies working hard to charm and almost beg them to join. When those candidates encounter what it’s like to apply for highly competitive companies who have 1000x more applicants than they’d ever consider, the resulting straightforwardness can be shocking.
by miki123211 | 2026-01-21 14:21:33+00:00
In Europe, there are two parallel realities which coexist, have some influence over one another, but are ultimately somewhat separate.

There's the real reality, and then there's the reality as it is perceived by the bureaucratic apparatus, the "upside down." It's important to realize that everything in the "upside down" must be consistent with the rest of that reality, but not necessarily with what actually happened in the real world. The closer your activities get to the government and government scrutiny, the more true that description is.

Did John have to go somewhere on Monday and finish his work on Saturday instead? He could have filed for time off and then gotten special permission to work on Saturday, but that's far too many forms with far too many signatures. It's just easier to pretend (on all documents, yes all of them, the "upside down" demands consistency) that he did in fact work on Monday and did not work on saturday. Americans call it fraud, Europeans call it Tuesday.
by seec | 2026-01-21 14:21:43+00:00
Germans have an insatiable need for control, dominance, and superiority. They are deeply corrupt, which is why they always manage to create massive instability in Europe.
Previously they waged wars with soldiers, but now they have switched to politics, regulation, and economic warfare.

As someone who took German in school, had multiple exchange partners, spent quite a bit of time in Germany, and hosted some for their teaching assistant jobs, I have progressively become uneasy about their behavior. I do not hate any individuals specifically, but their culture is extremely imposing.

The EU was supposed to bring countries together, but I think it did quite the contrary. You just cannot forcefully unify people who have radically different life philosophies. And no country wants to diminish its own culture to benefit another, rightfully.

The original project of free economic space was OK, but the massive bureaucracy that has been bolted on is really problematic.
by PaulHoule | 2026-01-21 14:21:46+00:00
I'll argue otherwise.

Almost the defining problem of modern institutions is sweeping problems under the rug, be it be climate change or (most important) Habermas's "Legitimation Crisis" [1] It's something I've been watching happen at my Uni ever since I've had anything to do with it. The spectacle of institutions failing to defend themselves [2] turns people against them.

Insofar as any external threat topples an institution or even threatens it seriously there was a failure of homeostasis and boundaries from the very building.

[1] https://en.wikipedia.org/wiki/Legitimation_Crisis_(book)

[2] ... the king is still on the throne, the pound is still worth a pound ...
by mewpmewp2 | 2026-01-21 14:22:07+00:00
So if my heart rate stays the same even though I feel anxious I am not anxious? I am thinking I am anxious and that I don't feel good, but I don't really notice any physical symptoms.

E.g. I am worried about upcoming deadlines, or whether I am going to make it, maybe it is not a direct fight or flight anxiety though, but what is it then, just stress?
by Traubenfuchs | 2026-01-21 14:22:09+00:00
They are missing an aspect of the human mind that the majority of humans have. It's defined as the "inability" to do something most humans can do. Research on cognitive performance shows it's most likely connected to worse memory. Some studies show reduced social skills. Then there are the deficits in autobiographical memory. It's progressive form is indicative of dementia.

How exactly is this anything but a pathology?
by swaits | 2026-01-21 14:22:13+00:00
You're confusing economic status with cultural ideology.

If pushing ESG mandates, DEI initiatives, 'Stakeholder Capitalism' (over shareholder primacy), and top-down climate interventions isn't the platform of the modern elite Left, what is? The fact that they are wealthy hypocrites doesn't make them right-wing.

But if you prefer the term 'Technocratic Globalists,' fine. The point stands: Carney played to that room rather than the reality of the Canadian economy.
by dangus | 2026-01-21 14:22:17+00:00
I don’t know if history is on repeat, but it rhymes.

Trump is a traitor to the United States. Society’s biggest failure was its inability to take off the sanewashing kid gloves and put him on trial for the big boy crimes he committed before it was too late.

He was caught on recorded phone calls committing election fraud.

He was caught stealing classified documents and refusing to give them back.

He was caught planning an insurrection and a coup. Even speaking of ending free elections should be illegal and shouldn’t be considered part of 1st amendment protected speech.

Republicans in congress have the power to end this today with articles of impeachment but are accomplices in the traitorous destruction of America.

He’s even a convicted felon and still got elected.

This version of democracy where corporations optimize the system for people voting against their own interests is not working. At this point it’s not even working for the corporations, who will find it much harder to make the green line go up without the stability of the past 70 years.

The only people left making a profit will be the mafia extraction economy Trump goons if we let this continue, just like the way it works in Russia.
by ost-ing | 2026-01-21 14:22:22+00:00
Germany never thought it would be in the current situation - decaying health care, pension system, cornerstone industry in decline, lack of digitalization, the list goes on. Massive reforms are needed, action is needed, but there is too much inertia in the system to change anything quickly.

Smaller countries like Estonia have the ability to be much more nimble.
by arseniibr | 2026-01-21 14:22:36+00:00
Hi HN,

I built a CLI tool called Veritensor for scunning AI models, because I found out that downloading model weights from 3rd party websites and loading them with torch.load() can lead to RCE. At the same time, simple regex scanners are easy to bypass.

To test my tool, I ran it against 2500 new and trending models on Hugging Face.

Here is what I found — 86 failed models:
Broken files — 16 models were actually Git LFS text pointers (several hundred bytes), not binaries. If you try to load them, your code crashes.
Hidden Licenses — 5 models. I found models with Non-Commercial licenses hidden inside the .safetensors headers, even if the repo looked open source.
Shadow Dependencies — 49 models. Many models tried to import libraries I didn't have (like ultralytics or deepspeed). My tool blocked them because I use a strict allowlist of libraries.
Suspicious Code — 11 files used STACK_GLOBAL to build function names dynamically. This is a common way how RCE malware hides, though in my case, it was mostly old numpy files.
Scan Errors — 5 models failed because of missing local dependencies (like h5py for old Keras files).

I was able to detect some threats because under the hood, Veritensor works differently from common regex scanners. Instead of searching for suspicious text, it simulates how Pickle loads data, which helps it find hidden payloads without running any code. It also checks that the model file is real by hashing it and comparing it with the version from Hugging Face, so fake or changed models can be detected. Veritensor also looks at model metadata in formats like Safetensors and GGUF to spot license restrictions. If everything looks safe, it can sign the container using Sigstore Cosign.

It supports PyTorch, Keras, and GGUF. Free to use — Apache 2.0.

Repo: https://github.com/ArseniiBrazhnyk/Veritensor
Data of the scan [CSV/JSON]: https://drive.google.com/drive/folders/1G-Bq063zk8szx9fAQ3NN...
PyPI: pip install veritensor

Let me know if you have any feedback, have you ever faced similar threats and whether this tool could be useful for you.
by bilekas | 2026-01-21 14:22:48+00:00
I'm not sure I completely agree, I don't think it's that black and white, it's a similar analogy to Guns and gun violence.

Without the prevalence of guns there is simply less gun violence, but you could argue that it's also a human problem.

Giving people who have no business using an LLM to submit slop bug bounties is a problem of the tools accessibility. But also a human problem of course.

Edit: I should mention, I don't have a solution to the problem although I do like the other posters suggestion of a "deposit" scheme to submit a bug. I think that would incentives higher quality submissions.
by levolvel | 2026-01-21 14:23:07+00:00
The trail provides! Its wild how much of the peace and calm I brought back from the trail into my regular life. I live in a major US city and traffic used to drive me insane. Now, I could care less. I just chill and roll with it. I'm more tolerant of people. I'm never in rush to get anything done or get anywhere quickly. I appreciate all that I have and all that I don't need. It really was just what I needed.

Like you said, definitely privileged to be able to do this, but I also found that a lot of people hiked both the PCT and AT on a shoestring budget and made things work. Maybe not stopping in every town or not going out to eat as often. If a person is dedicated and there to get the experience, money only made it easier, but the experiences were all very much the same I found.
by lightandlight | 2026-01-21 14:23:10+00:00
> do you think there's any appetite in people paying for this type of tool which lets you spin up infra on demand and gives you all the capabilities built so far?

(I'm not the author) The easiest way to charge for this kind of software is to make it SaaS, and I think that's pretty gross, especially for a CLI tool.

> I'm skeptical and I may just release it all as OSS

It doesn't have to be one or the other: you could sell the software under libre[1] terms, for example.

[1]: https://en.wikipedia.org/wiki/Free_software
Show HN: dol – Detect dark/light mode on the CLI
by netmute | 2026-01-21 14:23:22+00:00
Hi HN,

I built a small macOS/Linux CLI tool called dol (dark or light).

Why? Modern operating systems can automatically switch between dark and light mode. However, many CLI tools assume a fixed dark or light background unless told otherwise. This is an attempt to make that less painful.

The output is intentionally minimal; it just prints `dark` or `light`. This allows you to construct command lines with it.

Examples:

`fzf --color=$(dol)`

`difft --background $(dol) file1 file2`

This is the first release (0.1.1). Feedback is very welcome.

Repo: https://github.com/netmute/dol
by miroljub | 2026-01-21 14:23:34+00:00
Just because you accusse people to be "right wingers" because they don't want to fund bicycle lanes in foreign countries doesn't make them wrong.

If you want to fund bicycle lanes in foreign countries, go start a fund an fund them privately.

For the people that don't know the topic:

- yes, German taxpayers are indeed funding bicycle lanes in foreign countries

- it's not the only waste of money going to foreign countries

And additional questions:

- since when is it forbidden to complain against the waste of tax money?

- how does favouring tax cuts instead of tax money waste makes you a "right wing"?
by cstdsmrtcntrct | 2026-01-21 14:23:37+00:00
This is what smart contracts do.

A smart contract with a stablecoin (or a wrapped stabblecoin) would probably solve for this use case.

You want to avoid leaving a bank password in clear text for the process running in cron; so it would really be best for the bank to support Read-Only and Read-Write access tokens
by 6DM | 2026-01-21 14:23:46+00:00
I don't think AI is the cause, it's merely the mechanism that is speeding up what has already been happening.

Social media was already isolating people. It is being sped up by the use of AI bots (see dead internet theory). These bots are being used to create chaos in society for political purposes, but overall it's increasingly radicalizing people and as a result further isolating everyone.

AI isn't eroding college institutions, they were already becoming a money grab and a glorified jobs program. Interpersonal relationships (i.e. connections) are still present, I don't see how AI changes that in this scenario.

I am not a fan of how AI is shaping our society, but I don't place blame on it for these instances. It is in my opinion that AI is speeding up these aspects.

The article does highlight one thing that I do attribute to AI and that is the lack of critical thinking. People are thinking less with the use of AI. Instead of spending time evaluating, exploring and trying to think creatively. We are collectively offloading that to AI.
by capitainenemo | 2026-01-21 14:23:49+00:00
I suspect that applies specifically to their cloud rewrite which was apparently a bloat of JS libs and hundreds of requests even by Atlassian standards. The on-prem self-host Confluence I've used is still pretty snappy and pleasant to use and without throwing an absurd amount of resources at it. We do have quite a lot of actually-useful documentation in it.

That said, Atlassian is busy relentlessly raising the price for self-host to push people into their cloud roach motel, so we'll probably be on some alternative (either FOSS or commercial, but self-host) soon too.
by embedding-shape | 2026-01-21 14:24:32+00:00
It's basically a proof of "most basic effort" that you're serious. You could probably note down some stuff on a single A4 and get it approved, it doesn't have to be a 40 page dossier.

Kind of like fizzbuzz, just something really simple and most basic to get rid of the "easy scams" and so on.

Edit: So "easy scams" are probably the wrong word, I initially wrote "riffraff" because in my mothertoungue that isn't so... disparaging, but what I meant was that it's used as "bare minimum filter" basically.
by Imustaskforhelp | 2026-01-21 14:24:32+00:00
Yea probably doesn't make sense for just starting out.

I think this might be the only option available right? Do you know of any other option perhaps cheaper than this?

I think I can only promise at this point that if project becomes worth it ie. makes reasonably lot more than >1500 per year then the project might migrate to as such.

I was seeing an estimates of 300$-400$ on internet and I assumed that was expensive (here, the MSME's don't even require a company formation itself & you get benefits of payment dispute collection & investment from govts directly and lower rate loans and you can get it all online just using aadhaar card which everyone has)

LLC's are a bit of a mess with accounting (I actually wanted to be chartered accountant during my middle school so I saw they make a bank in fees comparatively too) but its still pretty reasonable.

Anyways, what would be the best bet, would this still be the best bet or is there anything which can allow for something say cheaper/easier? Would say having an European co-founder might help comparatively in the fees/other options?
by throwaw12 | 2026-01-21 14:24:54+00:00
> Civic institutions - the rule of law, universities, and a free press - are the
backbone of democratic life

It probably was in 1850-1950s, but not in the world I live today.

Press is not free - full of propaganda. I don't know any journalist today I can trust, I need to check their affiliations before reading the content, because they might be pushing the narrative of press owners or lobbies

Rule of law? don't make me laugh, this sounds so funny, look what happened in Venezuela, US couldn't take its oil, so it was heavily sanctioned for so many years, then it still couldn't resist the urge to steal it, and just took the head of the state.

Universities - do not want to say anything bad about universities, but recently they are also not good guys we can trust, remember Varsity Blues scandal? https://en.wikipedia.org/wiki/Varsity_Blues_scandal - is this the backbone of democratic life?
by jvanderbot | 2026-01-21 14:25:06+00:00
It's hard for me to argue with these few direct sentences.

They delegitimize knowledge, inhibit cognitive development, short circuit
decision-making processes, and isolate humans by displacing or degrading human connection.
The result is that deploying AI systems within institutions
immediately gives that institution a half-life.

... even if we don't have a ton of "historical" evidence for AI doing this, the initial statement rings true.

e.g., an LLM-equipped novice becomes just enough of an expert to tromp around knocking down chesterton's fences in an established system of any kind. "First principles" reasoning combined with a surface understanding of a system (stated vs actual purpose/methods), is particularly dangerous for deep understanding and collaboration. Everyone has an LLM on their shoulder now.

It's obviously not always true, but without discipline, what they state does seem inevitable.

The statement that AI is tearing down institutions might be right, but certainly institutions face a ton of threats.
by torginus | 2026-01-21 14:25:08+00:00
Is this a true problem in EU (or indeed anywhere)? I don't think starting a company is the bottleneck, it's mostly the inordinate amount of regulations one has to comply with, as well as the strenuous laws around letting workers go, while making people work as contractors being also frowned upon.

I'm not sure how any one these is going to change.