MurphyA/hacker-news huggingface dataset:
by reactordev | 2026-02-21 08:30:04+00:00
I’m one of the few I guess that have implemented OAuth at scale and enjoy it more than other forms of auth. Remember Windows Login Auth? Or each system having to be sync’ed to some sort of schedule so that passwords were the same? Yeah, no, that sucks.

OAuth is just a process framework for doing authentication and authorization such that a system doesn’t need to create those mechanisms themselves but can ask a server for it. More recently, in the form of a JWT token with those permissions encoded within.

It all boils down to how long your login token (some hash), or in the case of OAuth, your refresh token, can request an access token (timeboxed access to the system). “Tokens” in this case are just cryptographic signatures or hmac hashes of something. Preferably with a nonce or client_id as a salt.

Traditional login with username and password gives you a cookie (or session, or both) that you use to identify that login, same thing for refresh tokens. Only, refresh tokens are authentication, you need access so you request an access token from a resource server or api, now you have your time boxed access token that allows you to “Authentication: Bearer <token>” at your resource.

From a server perspective, your resource server could have just proxied the username and password auth to get the refresh token or (what I like to do) check the signature of the refresh token to verify that it came from me. If it did, I trust it, so long as the user isn’t in the ban table. If it’s good and they aren’t banned, issue them a time boxed access token for 24h.

If you fail to grasp the JWT aspect, I suggest you learn more about RSA/PKI/SHA and HMAC encryption libraries in your programming language of choice. Knowing how to bcrypt is one thing, knowing how to encrypt/sign/verify/decrypt is The Way.

(Sorry to the grey beards in the back and they know this already and probably wrote that RFC).
by Alive-in-2025 | 2026-02-21 08:30:45+00:00
A few ways I've heard about - DuckDuckGo.com has a system that generates a random email address on their domain where you can request "a new email address" whenever you need one; you request a new alias and they create a permanent mapping to your real address from that new address. Then mail sent to say Foo-Bar-Hotdog@duck.com goes to you, duck remembers the mapping that this goes to your address. You can reply back and duck handles the anon mapping.

Or you can have a catchall email address on your own domain, where anything sent to any alias on your domain gets forwarded to your own address. Then hamburger@myDomain.com and mcdonalds@myDomain.com goes to your real private address. you don't have to set it up. Anytime you join a new service, say reddit, you tell them your address is "reddit@myDomain.com".

All of these have a level of pain associated with them. And they aren't that private. The government could no doubt get a court order to pierce the obscured email addresses.

There's proton email and many others. All of these are too painful for most people.

I have wondered if people who want to be really secret set up a chain of these anon mail forwarding systems.
by aimoae | 2026-02-21 08:32:01+00:00
I built this because I kept ignoring gentle break reminders.

Now when the timer ends, a budgie named Diwa screams.
It's annoying and it works.

Also alerts you when you have too many tabs open. The bird panics.

Vanilla JS, Manifest V3, no tracking, no account.

tiredbudgie.com
by Kalpaka | 2026-02-21 08:34:00+00:00
The 'constitutively empty' framing is interesting but might move too fast. Lacan's own move was to show that the subject doesn't pre-exist the Symbolic and then enter it — it's produced as an effect of the signifying chain. So calling the LLM 'empty' because it lacks interiority prior to language is importing exactly the humanist subject Lacan was trying to dissolve.

The more compelling question for me is temporal. A stateless oracle that resets after every session is one thing. But what about a system that accumulates relational history — that is structurally altered by its encounters over time, not in a mystical sense, but in the sense that its community's co-evolving use of it carries something like memory? The Lacanian subject isn't a given; it emerges through the loop of desire and the Other's gaze across time.

The question isn't whether LLMs have souls. It's whether the loop that produces identity can only run in carbon.
by wedog6 | 2026-02-21 08:35:39+00:00
One of the creepiest aspects of this is that the 'thirsty content' is mainly mainly AI-generated pictures by spammers who know what they are doing, but also includes 'correlated' posts by normal users.

Eg you have a 15-year-old daughter and post a picture of her smiling in school uniform on Instagram because it's her birthday or something. The algorithm takes that post and shows it to randomly selected men who often interact with pictures of attractive female teenagers, even though none of your other posts get shared like this outside of your connections.
by bell-cot | 2026-02-21 08:36:04+00:00
Aren't the differences between "satnav sent him the wrong way on the motorway", "directions he'd memorize from his cousin's hand-written wedding invitation sent him the wrong way...", and "he just drove in his lane - didn't brake or swerve or anything - as the wrong-way car plowed into him at 250km/h" merely matters of perspective?

That said, I think there's another effect here. If a person feels unfamiliar with a situation, and a confident-sounding human voice - which the person knows is an expert - tells that person to do something, then there's a very strong human cognitive bias toward just doing as the "expert" says. 99.9% of the time, disobeying will end badly. And just how lucky are you feeling - about being able to outsmart the expert, on the spot, in a situation you are not familiar with - and that ending well?
by 0xDEAFBEAD | 2026-02-21 08:36:54+00:00
Karl Popper would like a word

"In fact, [proportional representation] robs him of personal responsibility; it makes of him a voting machine rather than a thinking and feeling person. In my view, this is by itself a sufficient argument against proportional representation. For what we need in politics are individuals who can judge on their own and who are prepared to carry personal responsibility."

https://www.economist.com/democracy-in-america/2016/01/31/fr...
by jascha_eng | 2026-02-21 08:36:58+00:00
I've rarely seen the first description of it where people actually commit directly to main. Except in very early stage projects. But it does always feel the fastest if you only review code "on-demand" in PRs/MRs instead of enforcing it for every change.

I think in a team with good ownership, enforcing formal reviews slows down a lot. But of course in a larger code base where no single engineer can understand all the effects a change might have, having a bit of knowledge sharing and 4 eyes enforced is often the better approach than yolo-ing it.

Then again I did build an SQL review tool for database access because I felt like "yolo-ing" production access was also not the way it should be. It's an interesting slider between full autonomy and strict review processes where each team needs to find their sweet spot: https://github.com/kviklet/kviklet/
by simoncion | 2026-02-21 08:37:17+00:00
> So what does it matter?

Yeah. There's a type of person who's obsessed with "cleanliness". For such a person, the goal is to have exactly one protocol on The Internet.

Such a person would lose their goddamn minds if they had to actually work as a WAN administrator or datacenter operator.

One of IPv6's purposes is to reduce pressure on the IPv4 address space. I don't expect IPv4 to get deactivated within the lifetime of any current HN reader; there's really no point in doing so. I expect the future for noncommercial sites to be "globally-routable IPv6 service, and IPv4 service by way of a CGN", which is how things are set up today in some parts of the world.

IPv6 will be the default, with v4 as a fallback for folks need to talk with others who can't be bothered to update their software or kit.
by logicprog | 2026-02-21 08:37:31+00:00
Why the fuck do people get off on accusing something they don't like of only being liked by men to prove it's bad and the people who like it are bad

Also, people have been publishing "not ready for primetime" experiments and ideas for people to try on their own machines as open source for decades. Every open source project is not required to be "professional" or "secure", and those who publish them shouldn't be required to do some kind of fucking "impact research" to make sure its "responsible" to release, and never were; those are requirements for major, already mature open source infrastructure projects, and it doesn't make sense to project them onto everything that has its code available for download or modification. That's not how most OSS projects that are now mature started (Linux started as a transparently hobby project! It was insecure, and is still in many ways!) and it's not true of the overwhelming majority even of useful and interesting OSS projects, and if we started requiring it, it would both utterly stifle all freedom, creativity, and diversity to the ecosystem and turn OSS into an EU-like regulatory museum, it would also raise the barrier to just releasing code into the open for people to use and contribute to.

Wasn't this the exact sort of thought process that went into that EU security regulation for OSS projects that we were all worried would kill OSS before they added an exemption??

And no, an interesting and fun experimental open source program shouldn't need to be plastered with explicit warnings like the California cancer labels just to be put out in the open. Stop infantilizing people. The post literally infantilizes those on the receiving end of OSS, saying handing unprofessional OSS to people is like "handing chainsaws to kids", and I think, alongside the outright sexism, that's the biggest indicator of the mindset of the kind of person who'd write this.
by jvuygbbkuurx | 2026-02-21 08:39:37+00:00
Terrible explanation what Oauth is. But the insight at the end of the article is great. UX should always be the driving factor.

I've seen so many integrations use Oauth where it wasn't a good fit or where the spec was not followed. It always results in an abomination and insecure mess.

Maybe it's a know the rules before you can break them thing, but I've found designing custom auth integrations from UX first perspective result in amazing features. It's rare that both parties are willing to put the effort in it though. Usually people try to shoehorn the usecase into an existing oauth platform.

The main selling point of Oauth is to scale auth and authz to thousands of clients and use cases.
by zenincognito | 2026-02-21 08:39:52+00:00
We have contacted Meta support dozens of times over the past 30 days. Each representative confirmed that account creation and monitoring are now handled almost entirely by AI. Despite successfully completing required face verifications, our accounts continue to be flagged and banned by automated parameters. There is currently no path for manual intervention; even internal support tickets are failing to reach human reviewers with the authority to resolve these systemic blocks.

>Oh nvm. They're full-time clickbaiters... what else did I expect.

There is nothing clickbait about this article. I fail to understand why take such a hostile approach to something on the internet where you completely miss the point under contention - auto account bans via AI
by db48x | 2026-02-21 08:40:09+00:00
I don’t think that they should try to look for an alternative to Dragon. SpaceX knocked it out of the park, and spending money on an alternative just to have an alternative isn’t necessary. The main innovation, if you want to call it that, of the Commercial Crew program was that it didn’t allow “cost–plus” contracts. That’s the part to keep.
by dyauspitr | 2026-02-21 08:40:33+00:00
Well once they’ve replaced both white and blue collar work there’s a couple of ways things can go.

1) We still retain a functional democracy and vote for UBI for ourselves.

2) Society fractionates into castes so the capital owners can maintain hierarchical control.

3) There’s the ruling class and the rest of us living hand to mouth and kept in line by an unassailable robot army forever.

4) If we manage to actually create ASI, there’s a chance we might get to an actual utopia with essentially limitless resources.
by lloeki | 2026-02-21 08:43:08+00:00
> Is half a lot?

> No. Human light perception works on a log scale, allowing us to maintain useful vision over 6 orders of magnitude of luminance, from the sun at noon to moonless nights, whereas halving is .3 orders of magnitude. In relative terms, halving light is a tiny blip of the dynamic range of vision.

Kind of missing the point that:

a) a display emits spectacularly less light than the sun, even on very overcast days

b) said "blue light" reduction is presumably intended to happen at night where 1) any comparison with the ability to maintain unsaturated vision in plain sun on a clear day is largely irrelevant and 2) backlight itself is typically lower than in daylight (not for OLED which does PWM)

So given that the amount of artificial light to not screw up with sleep is about equal to "none at all" I'll take a cut in half of what essentially constitutes a flashlight aimed straight at my retinas any day.

> Here are four things that can help. [...] Use dark mode [...] found reductions in luminance ranging from 92% to 98%! That’s huge.

From my anecdotal experience dark mode and other low contrast themes are mostly used by people who set their brightness too high, and conversely people switching to dark mode immediately crank brightness up.

Countless discussions I had:

"my battery holds poorly"

"using dark mode?"

"yes"

"try light mode"

"but my eyes!"

"turn brightness down"

"done. wow I just reclaimed 1-2h of battery"
by arjie | 2026-02-21 08:45:12+00:00
The openclaw rough architecture isn’t bad but I enjoyed building my own version. I chose rustlang and it works like I want. I made it a separate email address etc. and Apple ID. The biggest annoyance is that I can’t share Google contacts. But otherwise it’s great. I’m trying to find a way to give it a browser and a credit card (limited spend of course) in a way I can trust.

It’s lots of fun.
by emilburzo | 2026-02-21 08:45:19+00:00
I've been happily using oauth2-proxy[1] with nginx as an extra layer of authentication to prevent situations where e.g. home-assistant had an unauthenticated RCE.

It's pretty neat since you can have one oauth instances for all virtual hosts, e.g.:

server {
[...]

location /oauth2/ {
proxy_pass http://127.0.0.1:8469;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri;
}

location / {
auth_request /oauth2/auth;
error_page 401 = /oauth2/sign_in;

[...]
}
}

[1] https://github.com/oauth2-proxy/oauth2-proxy
by gethly | 2026-02-21 08:45:29+00:00
On desktop, unknown OS cannot be anything else but Linux, so that's 20% altogether(16%+4%). But that does not matter. The shift has started last year when W10 support ended and due to how bad W11 is and it is just getting stronger and stronger. Watch increase in YT videos about moving from Windows to Linux, or social networks in general. You cannot miss it. I've been on windows since 95, before that DOS. So that is three decades of being a loyal customer, so to speak. Even though I tried Linux in the past, Windows just works so I had no reason to switch.

With W11, that is not the case. Therefore, it becomes inevitable. Worth mentioning is that companies, governments and whole countries are ditching Microsoft altogether - for various reasons(some are geopolitical, due to sanctions and tariffs, others are technical).

Lenovo, Dell and HP are slowly ditching W11 as well in favour of linux. If you look up definitions of malware and spyware, windows 11 falls into both of them. It's that bad. So again, I'm not a linux fanboy by any stretch of imagination, but the writing is not just on the wall, we've passed the point of no return. Or rather, Microsoft has.

Now that linux supports 95% of games, there is little holding people back as gaming was always the biggest hurdle when it came to linux. And Adobe, too, is no longer what keeps people stuck on Windows - either because they ditched it due to their horrible pricing practices, or because there are now solid alternatives.

Of course many people will switch to mac as well. But windows in general, i think, is done. It had a good run for few decades, but they dropped the ball so hard that there is no going back or fixing it with w12.
by DiogenesKynikos | 2026-02-21 08:47:49+00:00
You could make a rational argument for short-term protectionism if the US government were simultaneously pushing the domestic auto industry to modernize, but the government is doing the exact opposite: it opposes electric vehicles.

The large American manufacturers are able to keep on selling technologically outdated, overpriced vehicles in the US, because they have a captive market.

When the Chinese imposed protectionist measures in the auto industry, they were aimed at allowing Chinese domestic manufacturers time to catch up technologically, and they were scaled back as that happened. Any international car manufacturer can now set up shop in China and compete directly with the local brands on an even footing. But the US has imposed drastic protectionist measures with no end-game (worse than that: US policy is backwards-looking and intended to maintain an old technology). It's just a permanent state of affairs.
by debugnik | 2026-02-21 08:49:00+00:00
Whom's messenger? You didn't point us to anyone else.

I just don't see how sampling tokens constrained to a grammar can be worse than rejection-sampling whole answers against the same grammar. The latter needs to follow the same constraints naturally to not get rejected, and both can iterate in natural language before starting their structured answer.

Under a fair comparison with a non-shitty harness, I'd expect the former to provide answers at least just as good while being more efficient. Possibly better if top-whatever selection happened after the grammar constraint.
by disillusioned | 2026-02-21 08:49:06+00:00
To the extent that there's some sort of clinical statistically significant lift over, say, however you might control for a placebo here, who knows? To the extent that it's working for you in a meaningful way, placebo or not... does it even matter? If they're working for you, they're tautologically not a scam, except insofar as you find yourself missing out on benefits promised that aren't being realized, or you feel that the price you've paid is disproportionate to the benefit because some much cheaper option exists in some sense.

Put another way, placebo or not, if there's an effect, and it's a positive one for you, it really doesn't matter. It's working.
by fweimer | 2026-02-21 08:50:23+00:00
There is the VEX justification Vulnerable_code_not_in_execute_path. But it's an application-level assertion. I don't think there's a standardized mechanism that can describe this at the component level, from which the application-level assertion could be synthesized. Standardized vulnerability metadata is per component, not per component-to-component relationship. So it's just easier to fix vulnerability.

But I don't quite understand what Dependabot is doing for Go specifically. The vulnerability goes away without source code changes if the dependency is updated from version 1.1.0 to 1.1.1. So anyone building the software (producing an application binary) could just do that, and the intermediate packages would not have to change at all. But it doesn't seem like the standard Go toolchain automates this.
by rdmuser | 2026-02-21 08:50:25+00:00
Personally I find that I prefer badly written english or auto-translated stuff written in languages foreign to me over ai generated or even just ai polished works I've seen. There is just so much more character, depth and variance there vs ultra ai generic or slop text.

That being said this project seems focused on content farms not people who just need a little help writing so this whole conversation is a bit of a side tangent.
by hunter2_ | 2026-02-21 08:51:46+00:00
I think it's reasonable for Google to control what happens in their version of Android (which can be installed by default) but it's not reasonable for Google to lock the bootloader (preventing installation of a non-Google OS).

Perhaps this is why Google hardware doesn't have locked bootloaders; Samsung et al can get away with locked bootloaders since it's not Google forcing the consumer in that case.

Whether the bootloader is or isn't locked should be very conspicuous before purchase, for consumer protection.
by intended | 2026-02-21 08:52:04+00:00
In which case the country with the least laws decides how everyone else functions.

Remember we started are working from here

> If you want to make gambling illegal, then make gambling illegal and then enforce that law. You don't need to resort to indirect measures that go beyond the law (e.g. by preventing me from merely viewing the odds on a gambling website).

From your argument the only option is to not make anything illegal that is legal in the nation of minimum laws.

Are you arguing that nations - voters - should have no say in what laws they want to live under ?

Do note that I am all for less government control. But our current regulatory and rights landscape is not resolving the questions our voters and infrastructure is throwing up.

Eventually, everything runs on some infrastructure. Control will be forced.

If we want to prevent it, we need to have answers to the issues being thrown up by users.
Show HN: AI Council v2 – multi-model deliberation, now with 35 personas
by prijak | 2026-02-21 08:52:05+00:00
I posted this yesterday and kept building. Original post got some good feedback about wanting more domain-specific personas beyond the generic analyst/contrarian archetypes.
So I added them.
35 personas now, organized into actual professional structures:

Law Firm — Litigator + Corporate Counsel + Compliance Officer + Junior Associate, synthesized by a Senior Partner
Hospital Team — GP + Specialist + Pharmacist + Medical Ethicist, synthesized by Chief of Medicine
Editorial Team — Reporter + Editor + Legal Reviewer + SEO lead, synthesized by Editor-in-Chief
Corporate — CFO + CTO + CMO + Legal, synthesized by CEO
Startup — Founder + Engineer + Designer + Growth Lead, synthesized by Investor
Consulting — Strategy + Operations + Finance + Risk, synthesized by Senior Partner

Each persona has a role-specific system prompt tuned to how that function actually thinks — the CFO talks in EBITDA and burn rate, the Junior Associate flags the clause the partners missed.
Also shipped in v2:

Temperature slider per run (Precise → Balanced → Creative)
Follow-up questions — council carries the full prior verdict as context
Abort mid-run with partial result preservation
Export MD / PDF
Import/export council config as JSON
Webhook after every completed session (works with Zapier, n8n, Make)

Still zero backend. Still runs entirely in the browser. API keys never leave your machine.

GitHub: https://github.com/prijak/Ai-council

Livelink: https://council.gameinghub.com/

Genuinely curious: has anyone found multi-model deliberation actually useful for a specific domain, or does it mostly just produce longer wrong answers?
by gapan | 2026-02-21 08:52:10+00:00
> When watching this I'm shocked how bad the UX Was these days. The scrollbar left, the triple steped menu...

Perhaps the only thing "bad" about it is that you're simply not used to it. I can certainly think of someone used to that UI thinking the same thing about today's interfaces, with disappearing scrollbars, flat design and confusing icons.