MurphyA/hacker-news huggingface dataset:
Show HN: Getmaapp/signal-WASM v0.1.0 – Signal Protocol for the Web
by getmaapp | 2026-01-15 09:11:27+00:00
Hello HN,

I'm excited to announce the release of @getmaapp/signal-wasm v0.1.0, a Rust crate compiled to WebAssembly that exposes the Signal Protocol (Double Ratchet, X3DH) to Browser JavaScript and TypeScript environments for E2EE messaging.

Repository: https://github.com/getmaapp/signal-wasm
NPM: https://www.npmjs.com/package/@getmaapp/signal-wasm

Motivation
The landscape of web applications is evolving rapidly, and secure communication is becoming more critical than ever.
- Rise of Chat Features: More web apps are integrating chat directly into their products.
- AI Chatbots: The proliferation of AI agents necessitates secure, private channels for sensitive data.
- Security Threats: With the increase in hackers, fraud, and data breaches, reliance on cleartext or weak encryption is no longer sufficient.
- Vendor Lock-in: Existing E2EE solutions function as "black boxes" or proprietary SaaS offerings, locking developers into specific ecosystems.
- Open Source Foundation: The Signal Protocol is the gold standard for E2EE, but using it in a pure browser environment has historically been challenging due to WASM constraints (system time, randomness, etc.).
- This project aims to provide a long-term open-source tool that makes the Signal Protocol accessible to any web developer, without the lock-in.

Implementation Details
This library wraps the upstream libsignal Rust crates and solves several WASM-specific challenges:
- Randomness: Replaces OsRng (which panics in WASM) with getrandom using the Web Crypto API.
- Time: Handles SystemTime panics by bridging to js_sys::Date.
- Async/Await: Exposes a clean async API for JavaScript, handling the synchronous Rust core.

Caveats & Disclaimers
- I am not a Cryptographer: I am primarily a TypeScript/React full-stack developer (Effect-TS) with a background in Product Management. While this library binds the official Signal Rust crates, the bindings themselves have not been audited.
- AI-Assisted Development: This project was built with significant assistance from AI coding agents (Google Antigravity, Claude Opus 4.5, Gemini 3).
- Attribution: Huge credit belongs to the Signal Foundation and their engineering team for creating the cryptographic primitives and the libsignal Rust implementation that makes this possible. We are standing on the shoulders of giants.

Call to Action
- This is v0.1.0. It works, it passes tests, and we have a working React demo in the repo. However, to make this the standard for web-based E2EE, we need community eyes on it.
- Collaboration and contributions are highly welcome. Whether it's code review, improving the WASM bridge, or building cool demos, I'd love to see what you build.

About Me
I'm a TypeScript/React developer and Product Manager.

LinkedIn: https://www.linkedin.com/in/thecannabisapp/
Github: https://github.com/thecannabisapp
Email: jia@getma.app

Thanks!
by manuelmoreale | 2026-01-15 09:11:41+00:00
I'll join I saying I also daily Safari for generale usage (with only two extensions installed 1Blocker and Are.na) and I have basically zero issues.

I also do dev work in Firefox + Safari. I use Firefox mainly because I prefer their dev tools to do frontend work. Chrome I almost never use. This insistence that Safari is the new IE is honestly baffling. Yes Safari is not perfect and yes Apple is Apple. Still, Safari is far from being a train wreck.
by seec | 2026-01-15 09:12:11+00:00
I share your sentiment very strongly.

Apple's change for the sake of change is extremely annoying, especially since the changes have been regressions lately.
They always push their commercial interest at the cost of their users, refusing to maintain stuff properly to save money.

At some point I had to change a Mac because the GPU wasn't compatible with some apps after they pushed their Metal framework. But it was working just fine for me, and I didn't really need to change it at this moment; Apple just decided so.

And if you use their software on different hardware and make the mistake of upgrading just one, it is very likely that you will have to upgrade the other because the newer software version won't be compatible with the older hardware (had the problem with Notes/Reminders database needing an OS upgrade to be able to sync).

Microsoft is all over the place, but at least it is very likely that you can get away with changing your hardware only once every 10 years if you buy high-end stuff.
by like_any_other | 2026-01-15 09:12:12+00:00
> The organizations, which focus on child safety, women’s rights and privacy, expressed their concerns in letters on Wednesday to Apple CEO Tim Cook and Google CEO Sundar Pichai, claiming that Grok’s content violates the technology companies’ policies.

I find it repulsive that "company policies" should dictate what I'm allowed to install on my phone, and just as repulsive that these organizations try to subvert user choice, lobbying some random corporation to get it to extra-legally impose its will on people. If they had any integrity, they would be directing their persuasion at users themselves, instead of giving their blessing for corporations to act as morality police.

And of course, despite promptly fixing the issues, the call is not "we are grateful X decided to fix it, we'll keep a close eye on it so keep up the good work or else", but "ban them even though they did what we wanted". Because the issue was just a pretext.
by habeanf | 2026-01-15 09:12:16+00:00
Shameless plug:

At baseshift.com we're building a solution to this. We generate isolated clones of production databases and expose operational control of clones via MCP (start/stop/reset). This provides agent autonomy for development and analysis workloads without risking production.

We support PG, MySQL, MariaDB, and MongoDB (more coming). We're currently in private beta but we're happy to onboard fellow HNers!
by johnisgood | 2026-01-15 09:12:25+00:00
Hmm. "Fearless concurrency" and the flagship examples are... background threads for search and not freezing the UI?

That is GUI programming 101 from the Win32 era. Every Tcl/Tk app, every GTK app, every Qt app has been doing this for 25+ years.

If Rust's concurrency story were genuinely revolutionary, you would expect examples like:

- Lock-free data structures that are actually hard to get right

- Complex parallel algorithms with non-trivial synchronization

- Work-stealing schedulers with provable correctness

Instead we have "we run grep in a background thread"?
by BatteryMountain | 2026-01-15 09:12:35+00:00
Most households do not drive more than 100KM per day... yet people are obsessed with range.

My next EV will be a small BYD (dolphin or dolphin surf), these things can get between 200KM and 400KM per FULL charge, depending on your speed and settings. If you use the "slow" wall charger (that doesn't require installation or modifications to home circuits), not only will the batteries last longer, it will easily charge up your 100KM actual drive range in a couple of hours, typically overnight.

If you empty the battery each day and recharge it each night, that nets you 300KM per charge, or 2100KM per week. I don't know a single person or family that does 2100KM a week with their cars. So the whole range anxiety is rubbish. Just plug in every night and go to bed and tomorrow you have another 300km available.

Oh and then there are public fast chargers if you do get stuck. I live in Africa and this is solved problem.

Sorry for the rant..your comment about the expensive charger installations makes my blood boil as most people can just use the normal wall charger and charge overnight.
by oleggromov | 2026-01-15 09:13:38+00:00
https://gromov.com
It's a custom build dynamic website, which is a rarity this days, meant to have a commenting system and other 'advanced' features. However, as time went by I realised you need A LOT of traffic for people to engage with your stuff on your own platform. Now, I suspect, it's mostly endlessly parsed by bots - and this, quite frankly, made me abandon the idea of posting my thoughts to a 'broad' internet.
by jeroenhd | 2026-01-15 09:13:41+00:00
I find Safari's devtools to be quite annoying, but to each their own. Firefox' dev tools still hold the crown for me.

The lack of cross-platform support is also annoying to the point where I generally don't bother testing on Safari unless I'm absolutely forced to. Until Apple releases a Safari build for Windows and/or Linux, Safari users will just have to rely on Safari's compatibility with cross-platform browsers.

The open source version of WebKit works fine as a user, but behaves differently from any official Safari releases, so as a web developer it's not really usable as a testing tool.
by bflesch | 2026-01-15 09:14:16+00:00
Main purpose of this seems to offer a way for undoing "previously blocked location access" by the user.

> If a prompt appears unexpectedly, users may block it reflexively or accidentally, unaware that this decision creates a permanent block that is difficult to reverse. This context gap—rather than the feature itself—is a primary driver of high denial rates.

> If a user previously blocked location access when browsing a site (perhaps by accident or lack of context), clicking the element triggers a specialized recovery flow. This helps them re-enable location at the moment when they actually want to use location, without the friction of navigating deep into the browser's site settings.

Google sees "high denial rates" when they try ask users for their geolocation. This is a problem for Google's customers, the advertisers. So they introduce this <geolocation> HTML tag so that dark patterns can be employed to trick users into permanently sharing location even though they have blocked location sharing before.

If the Google engineers who are working on this feature would actually give a damn about users who decided to block geolocation access, this feature would be designed as a "temporary access to geolocation for duration of browser session".

So basically it is all about more tracking and less data privacy.

It's overdue that skilled engineers provide better solutions than this crap, but of course it's much easier to be apolitical and become a millionaire working for a bunch of tech bros who visited Epstein's island.
by kuatroka | 2026-01-15 09:14:40+00:00
I did have tried, but the ease of installing handy as just a macOS app is so much simpler than needing to constantly run in npm commands. I think at the time when I was checking it, which was a couple of months ago they did not have the parakeet model, which is a non-whisper model, so I had decided against it. If I remember correctly, the UI was also not the smoothest.

Handy’s ui is so clean and minimalistic that you always know what to do or where to go. Yes, it lacks in some advanced features, but honestly, I’ve been using it for two months now and I’ve never looked back or searched for any other STT app.
by Dylan16807 | 2026-01-15 09:14:56+00:00
I think any measurement of development velocity is shaky, especially when measured between two different workflows, and especially when measured by the person doing the development.

Such an estimate is far less reliable than your eyes are.

So if people want to do more and better studies, that sounds great. But I have a good supply of salt for self-estimates. I'm listening to your input, but it's much easier for your self-assessment to have issues than you're implying.
by mikkupikku | 2026-01-15 09:15:10+00:00
Nobody would accept the rule of law if we didn't all know the alternative was the local bullies with the most friends and guns declaring themselves warlords and selling your family into slavery.

An open source project without a CoC on the other hand is quite normal and harmless. Maybe some people sometimes get their feelings hurt, but CoCs obviously don't prevent that anyway. The whole thing is dumb.
by mustardo | 2026-01-15 09:15:33+00:00
For machine tools I just use an oil can with a finer than normal tapered tip, this will depress the ball bearing in zerk / grease nipple fittings no problems, this also works with the ball oilers typically found on lathes etc. You can cut a tiny slit in the end too if that helps get oil in https://www.wentztech.com/metalworking/projects/convert-a-ch...
by Nition | 2026-01-15 09:15:56+00:00
> From a spiritual perspective, there are only two career paths one can take: farmer or artisan. Anything else unavoidably involves doing evil or is essentially meaningless.

I thought this was a beautiful statement; something to really help us think about what we're trying to do here on Earth. But personally I would add Artist to this. Painter, sculptor, musician, writer, poet, and so on. We need those too.

Edit: As others have reminded me below, service work like doctor, firefighter, teacher must qualify as well.
by fauigerzigerk | 2026-01-15 09:16:42+00:00
I remember this argument being used against Postgres and for Oracle, against Linux and for Windows or AS/400, etc. And I think it makes sense for a certain type of organisation that has no ambition or need to build its own technology competence.

But for everyone else I think it's important to find the right balance in the right areas. A car mechanic is never in the business of building tools. But software engineers always are to some degree, because our tools are software as well.
by spapas82 | 2026-01-15 09:16:47+00:00
Is this actually a business that can make money? My family owns around 1000 olive oil trees in Greece that produce eatable olives and extra virgin olive oil.

The thing is that we always sell the product in intermediates that would pack it up and sell it in a much higher price. I don't know of any small producer that sells the product directly to the consumer. This seems like a very big investment and not really sustainable. Are there other people that are doing it?

Could my knowledge as a software engineer help that family business in any way to be more profitable ?
by dredmorbius | 2026-01-15 09:17:20+00:00
What strikes you as unreasonable?

What I'm suggesting for different service levels is simply to map a specified access / age-verification level to a specific network access point. This is better suited to IPv6 which has a much larger address space than IPv4, and often allocates a range of addresses rather than a single IP, though NAT or IP shenanigans might be possible for the latter as well.

The point is to put the heavy lifting of age validation at a level at which who is getting the service has already been vouched through service account provisioning.
by zapperdulchen | 2026-01-15 09:18:00+00:00
Sure, manually written API docs are a thing of the past. But this has been true even before the era of LLMs. But I'm not that sure that this argument stands for all kinds of software. Depending on the abstraction between your source code and the things your users want to achieve, the expert view of a technical communicator might be necessary in order to come up with instructions (how-to) that meet the needs of the person seeking help instead of just summarizing the software code in natural language.
by jiriknesl | 2026-01-15 09:18:10+00:00
I guess, these things are long somewhere in the mind, before people execute.

People change countries, partners, careers not because of one book. This is usually the last drop. They were long-term unhappy, yearning for something else.

And as this guy wrote, he was sick, he was burned out. I suppose, he wasn't able to limit his screen time, it was all or nothing. Sometimes, those big changes work better than incremental steps. 20 years ago, I went from a pack of cigarettes a day to zero. If I went to 19, then 18, then 17, I might still smoke to this day.
by blutack | 2026-01-15 09:18:17+00:00
Great project!

If you want a hardware upgrade it's actually reasonably inexpensive to build something direct drive (which is how the real sub-30kg ones work). This gives you many advantages over the plastic gear type including a much faster response time and more accurate positioning.

Look for "gimbal motors", basically a large skinny pancake brushless motor. Combine those with a storm32, simplebgc or odrive and a magnetic encoder. A 3D printer will help.

You can also have a look at low cost suppliers of cheap UAV stuff if you want something fully integrated for you. A basic Gremsy, Viewpro or Siyi isn't that much more than your Amazon thing. Various software bugs but they can be worked around. The DJI units can sometimes be had used and some of the protocols have been RE'd already.
by gulcin_xata | 2026-01-15 09:18:37+00:00
For many production setups, taking a database snapshot involves transferring significant amounts of data over the network. The standard way to do this efficiently is to process data in batches. Batching reduces per-request overhead and helps maximize throughput, but it also introduces an important tuning problem: choosing the right batch size.

A batch size that works well in a low latency environment can become a bottleneck when snapshots run across regions or under less predictable network conditions. Static batch size configuration assumes stable networks, which rarely reflects reality.

In this blog post we describe how we used automatic batch size tuning to optimize data throughput for Postgres snapshots, the constraints we worked under and how we validated that the approach actually improves performance in production-like environments for our open source pgstream tool.
by aebtebeten | 2026-01-15 09:18:39+00:00
I'd guess some of those countries rank highly because they're counting parents disappearing with non-sole-custody children as kidnappings?

I'll also note that while former Yugoslavs seemed to have no trouble playing "one less sentient one less vote" in their home countr{y,ies}, they also seem to have no trouble getting along with each other here. Set and Setting?
by Tade0 | 2026-01-15 09:19:18+00:00
I didn't read the article, but a quick Ctrl+F confirmed my suspicions.

I was raised Roman Catholic and to me it was always a head scratcher why would someone insist on a certain translation which is at least two languages away from the original.

It's a whole field of study and there's broad agreement that as language evolves translations need to be updated, otherwise you'd have to become an expert in that old language the work was written in on top of everything else.
by ivanr | 2026-01-15 09:19:24+00:00
I wrote about OpenSSL's performance regressions in the December issue of Feisty Duck's cryptography newsletter [1]. In addition to Alex's and Paul's talk on Python cryptography, at the recent OpenSSL conference there have been several other talks worth watching:

- William Bellingrath, from Juniper Networks, benchmarked versions from 1.1.1 to 3.4.x https://www.youtube.com/watch?v=b01y5FDx-ao

- Tomáš Mráz wrote about how to get better performance, which, in turn, explains why it's bad by default: https://www.youtube.com/watch?v=Cv-43gJJFIs

- Martin Schmatz from IBM presented about their _very detailed_ study of post-quantum cipher suite performance https://www.youtube.com/watch?v=69gUVhOEaVM

Note: be careful with these recorded talks as they have a piercing violin sound at the beginning that's much louder than the rest. I've had to resort to muting the first couple of seconds of every talk.

[1] https://www.feistyduck.com/newsletter/issue_132_openssl_perf...
by mentalgear | 2026-01-15 09:19:45+00:00
> All that remained was to decide what to do with my life. From a spiritual perspective, there are only two career paths one can take: farmer or artisan. Anything else unavoidably involves doing evil or is essentially meaningless.

Seems shocking at first, but the more you think about what our SWE works does, for whom, and who benefits the most of it ... IMO it makes sense.
by KronisLV | 2026-01-15 09:19:55+00:00
I think it's actually really cool to focus on efficiency over just raw performance! The page for the cards themselves goes into more detail and has a pretty nice graph: https://furiosa.ai/rngd

You can see them admit that RNGD will be slower than a setup with H100 SXM cards, but at the same time the tokens per second per watt is way better!

Actually, I wonder how different that is from Cerebras chips, since they're very much optimized for speed and one would think that'd also affect the efficiency a whole bunch: https://www.cerebras.ai/
by dwaite | 2026-01-15 09:19:56+00:00
For 1, I think we are getting farther away from this.

Siri's current architecture now provides context into the prompt, such as the app/window that has focus and the content loaded into it. In that sense, Siri is more like the MacOS menu bar than an app. A consolidated view of Siri history may look disjointed, in that there is a lot of context hidden if all it shows is a query like "when was this building built?".

Even more so, it might not provide the functionality desired if you go look at historic chats and ask "who was the architect?", unless all that context was actually captured. However, that context was never formatted in a way that was intended to be clearly displayed to the user. That in itself creates a lot of challenges around things like user consent since Siri can farm off queries to other (online) tools and world-knowledge AI services.

There is at least a UX paradigm for this - clipboard history. Coincidentally, Tahoe built clipboard history into Spotlight. But clipboard history lends itself to perhaps being more a complete and self contained snapshot. I'm not sure Siri is being built to work this way because of implicit context.

For 2, at a certain point this gets farmed off to other tools or other AI services. The Gemini agreement is for the foundational model, not large "world knowledge" models or backing databases. Today, Siri answers this question by providing bibliographical information inline from Wikipedia, using internal tools. The model itself just isn't able to answer the actual question (e.g. it will just say his birthday).

For 3, the model already has substantial personal context (as much as apps are willing to give it) and does have state in between requests. This is actually one of the issues with Siri today - that context changes the behavior of the command and control engine in interesting ways, phone to phone and sometimes moment to moment.

Unfortunately, I think stopping and asking for clarification is not something generative AI currently excels at.
by mikkupikku | 2026-01-15 09:20:57+00:00
That's why it was kicked into overdrive during/after Occupy Wall Street. The message of bankers screwing over everybody else in the country had clear broad appeal and people were paying attention and talking about the issue. Then, newspapers started reporting that the OWS protestors were using a "progressive stack" to silence white men and give all the talking time to the freak squad... I don't even know if that narrative had any truth or if the newspapers made it up whole cloth, but regardless it was something most American's certainly could never agree with, so OWS was overnight transformed into a social justice freak show in the eyes of the public and people stopped talking about bankers.
by lproven | 2026-01-15 09:21:59+00:00
The problem is this:

There was existing UI for this. It's called IBM CUA and it's been around for about 40 years now.

https://en.wikipedia.org/wiki/IBM_Common_User_Access

It worked in Windows 2 and 3 and everything since. It worked in DOS since about 1990. It worked in OS/2. It works in Xfce, and up to a point in LXDE, LXQt, GNOME 1/2, MATE, Cinnamon, EDE, XPde, and lots of other Linux and xBSD GUIs. A form of it works on MacOS.

But GNOME ripped the whole UI out and has re-invented a worse version of its own. (KDE has partially kept something like it but changed half the keystrokes, which is almost worse.)

If you're blind or have some disability that stops you using a mouse, say, this makes it a TONNE more work.

That was a bad idea.

I want the industry standard UI back.