MurphyA/hacker-news huggingface dataset:
OWASP PTK 9.6.0 - A Reporting and Correlation
by DenisPodgurskii | 2026-02-05 19:18:55+00:00
This version is all about turning scan output into something you can actually share, triage, and act on.

’ ..
• PDF and Markdown export
• Two report presets: Executive and Technical
• Summary section (high-level overview + key totals)
• Severity filters to triage findings faster
• Confidence scoring + correlated findings across DAST / IAST / SAST / SCA to surface higher-signal issues

’
• Safe-by-default redaction in exports (tokens, Authorization headers, cookies, storage values)
• Cleaner evidence: truncation + consistent formatting (monospace blocks where it helps)
• Executive reports now group/deduplicate noisy repeats (especially SCA/SAST-style output) to stay concise and decision-focused

Executive reports are now genuinely shareable: prioritised risks + correlated findings, with sensitive data removed by default.
Technical reports go deeper (per-engine detail + evidence) while still staying safe-by-default.

If you’re using PTK for real-world testing, this release should make reporting and handoff to dev/AppSec teams much smoother.
by Dylan16807 | 2026-02-05 19:19:18+00:00
Sure they do. People don't abandon products very fast when they turn worse. And the power of being the default option is massive.

And it's easy to imagine a situation where the other options are still mediocre most of the time, so switching has an advantage but it's not a big compelling thing you shout to the rooftops, so it doesn't get a big popularity wave.
by detourdog | 2026-02-05 19:19:30+00:00
Prior to the Mosaic I thought Gopher was superior to a text based WWW. Once ISDN became available I used an Ascend Pipeline 50 and that made IP addresses available across an entire network. The office I was working at also immediately adopted Mosaic/Netscape at that time. Getting PPP to work was definitely heavy lifting for me. Getting an IP address as an individual was difficult in the early days.
by agcat | 2026-02-05 19:19:36+00:00
I made my validation thesis and frameworks that i used to run discovery open - https://aishwarya-48913.medium.com/startup-pivots-how-we-ite...

And the process of defining ICP, finding them here - https://aishwarya-48913.medium.com/founder-led-sales-for-us-...
by WarmWash | 2026-02-05 19:19:54+00:00
These are intro prices.

This is all straight out of the playbook. Get everyone hooked on your product by being cheap and generous.

Raise the price to backpay what you gave away plus cover current expenses and profits.

In no way shape or form should people think these $20/mo plans are going to be the norm. From OpenAI's marketing plan, and a general 5-10 year ROI horizon for AI investment, we should expect AI use to cost $60-80/mo per user.
by nothrabannosir | 2026-02-05 19:20:01+00:00
I think it’s satire, not sarcasm. Mocking sycophant but ultimately hollow AIs, by imitating them. And, in the end, concurring with GP. Highlighting both the ways in which GP is correct, and filling in the gaps in implementation between the originally proposed dystopia, and the one we actively find ourselves marching towards.

Upvote from me :)
by adastra22 | 2026-02-05 19:20:17+00:00
It would still be a space junk problem. Space is big, but amazingly not that big. If you start ejecting little hot BBs at interplanetary speeds, you are creating broad swath of buckshot that will eventually impact something with the force of a missile. Put millions of these satellites into solar orbits (I’m ignoring the huge increase in launch cost this would require, and all the other issues like latency and comms), and you could very well make trips to other planets impossible.

It wouldn’t be Kessler syndrome as you would not have a chain reaction of collisions, but the end result would be the same.
by pembrook | 2026-02-05 19:20:26+00:00
Yea, if you have to waste an extra 15 minutes per day due to bad UX who cares, it’s much better that you get the self-satisfied feeling of sticking it to “the man” (American big tech).

I mean it only adds up to 90 days of your life wasted over a 30 year career. European peoples time has a lower salary value anyways. UX doesn’t even matter that much, the political meme of the day is much more important.
by ghurtado | 2026-02-05 19:20:40+00:00
Not to mention strict limits on advertising of these products, licensing required to sell them, and very highly taxed.

If that's not enough, in the US we created a federal level agency that oversees 3 things only. Two of those things are alcohol and tobacco. And the third thing isn't even regulated half as much as those two.

Why on earth anyone thinks these things are unregulated is beyond me.
by pronik | 2026-02-05 19:20:48+00:00
To the folks comparing this to GasTown: keep in mind that Steve Yegge explicitely pitched agent orchestrators to among others Anthropic months ago:

> I went to senior folks at companies like Temporal and Anthropic, telling them they should build an agent orchestrator, that Claude Code is just a building block, and it’s going to be all about AI workflows and “Kubernetes for agents”. I went up onstage at multiple events and described my vision for the orchestrator. I went everywhere, to everyone. (from "Welcome to Gas Town" https://steve-yegge.medium.com/welcome-to-gas-town-4f25ee16d...)

That Anthropic releases Agent Teams now (as rumored a couple of weeks back), after they've already adopted a tiny bit of beads in form of Tasks) means that either they've been building them already back when Steve pitched orchestrators or they've decided that he's been right and it's time to scale the agents. Or they've arrived at the same conclusions independently -- it won't matter in the larger scale of things. I think Steve greately appreciates it existing; if anything, this is a validation of his vision. We'll probably be herding polecats in a couple of months officially.
Show HN: Nudge – A type-safe prompt builder with CLI codegen for AI apps
by nicolodaddabbo | 2026-02-05 19:20:49+00:00
We’ve been experimenting with a more controllable way of prompting, which led us to build Nudge - a better way to write type-safe prompts for TypeScript AI applications.

Nudge lets you define prompts via a TypeScript builder API, then uses a CLI tool to generate the final system prompts. You describe intent structurally, not by tweaking wording, caps, or repetition. Instructions can be “nudged” with a numeric strength instead.

Prompts support:

- type-safe variables

- optional blocks toggled at runtime

- multiple variants for A/B testing

Because prompts are structured, parts are easy to reuse across agents. Prompts can also be tested and iteratively improved using an LLM based on failing test cases.

This is a project Joshua Knauber and I have been working on - would love feedback.
by krackers | 2026-02-05 19:20:57+00:00
>You can usually tell when the code isn't right because it doesn't work or doesn't pass a test

Tests (as usually written, in unit-test form) only tell you that it's not completely broken, they're not a good indicator of it working well otherwise "vibecoded slop" wouldn't be a thing. And the tests themselves are usually vibecoded too which doesn't help much in detecting issues off the happy path.

>you verify that your AI CEO is giving you the right information or planning its business strategy effectively

The same could be said for human CEOs. A lot of them don't really have good success rates either.
Show HN: Accept-md – One command to make Next.js sites LLM-scraping friendly
by hval | 2026-02-05 19:21:06+00:00
I recently saw a post from the Vercel CEO pointing out that LLMs understand websites much better when they can request:

`Accept: text/markdown`

Most websites today are built for humans. When AI agents try to consume them, they get complex HTML instead of clean, structured content.

So I built *accept-md* – a simple open-source package for Next.js that helps solve this.

Getting started is intentionally minimal:

```
npx accept-md init
```

After that, your existing Next.js routes can automatically respond with Markdown whenever an AI agent (or any client) requests it. No redesigns, no CMS changes, and no duplicate pages to maintain.

Right now the project is:

* Focused only on Next.js
* Middleware-based and lightweight
* Designed to work with existing apps
* A small step toward more AI-friendly websites

This is an early experiment, but I think the idea itself matters as AI agents become first-class consumers of the web.

I’ve open-sourced it and would love help with:

* Better markdown extraction
* Edge cases across Next.js setups
* Performance and caching
* Tests and examples
* Documentation
* Eventually adapters for other frameworks

Would love feedback from the HN community on the approach – and whether `Accept: text/markdown` feels like a pattern worth standardizing for the AI-native web.
by tracker1 | 2026-02-05 19:21:14+00:00
I tend to prefer to hand-roll schema migrations... but I use grate[1] for the most part. That said, I've created similar tooling for different scenarios.

1. https://grate-devs.github.io/grate/

Pretty easy to setup/use in a dev environment as well... see docker-compose.yaml and run/dbup script.

https://github.com/tracker1/FastEndpoints-SqlJobQueues
by Darshan009 | 2026-02-05 19:21:29+00:00
Hi, I may be a partial match.

4.5+ years building high throughput distributed backend systems using Kafka, microservices, Kubernetes, and AWS. I’ve focused on scalability, reliability, and performance under heavy load. While I don’t have direct InfiniBand/NVLink experience, I’m very interested in infra, cluster level systems, and networking adjacent work.
Happy to share details.
Email: darshan.v@protectmymails.com
by gignico | 2026-02-05 19:21:34+00:00
> To stress test it, I tasked 16 agents with writing a Rust-based C compiler, from scratch, capable of compiling the Linux kernel. Over nearly 2,000 Claude Code sessions and $20,000 in API costs, the agent team produced a 100,000-line compiler that can build Linux 6.9 on x86, ARM, and RISC-V.

If you don't care about code quality, maintainability, readability, conformance to the specification, and performance of the compiler and of the compiled code, please, give me your $20,000, I'll give you your C compiler written from scratch :)
by jumpocelot | 2026-02-05 19:21:36+00:00
Congratulations on the new release! I've seen some forum discussions on this in the past, and I'd imagine it's a frequently debated topic. However, I'd like to ask about the technical feasibility of implementing a feature similar to Ableton's 'Warp' within Ardour. I understand that Ardour and Ableton have fundamentally different architectures and that different DAWs can prioritize different workflows. Given the current state of the codebase and the development roadmap, I'm curious how realistic the implementation of BPM-synced time-stretching actually is or if it remains significantly outside the project's scope.
by MBCook | 2026-02-05 19:21:37+00:00
Right. I was thinking what I expect most people to do. Walk into Walmart or Best Buy and just grab whatever looks nice to them at the price point they’re willing to pay.

Chromebooks I forgot about. But every time I’ve seen them at a store they’re not mixed in with the “computers“, they’re “othered” into their own little section of the computer area. A bit like Macs in the late ‘90s or early 2000s.
by realityfactchex | 2026-02-05 19:22:26+00:00
First of all, I love LibreOffice very much as the last bastion of sanity in classic document suites, and I and love what Collabora is trying to do with the online piece. So, first, a million thanks. Truly.

Now, to put on the the "feedback is a gift" and "radical transparency" caps.

From the screenshot comparison in TFA: The new one looks all Microsoft-Ribbony. That's a huge step backward. The big strength of LibreOffice or Collabora Desktop Classic is that it has a sane UI/menubar visual paradigm. (Which MS obliterated eons ago.)

But let's talk about what matters: Collabora (the online document suite) is slow as heck.

It needs to be fast-updating for shared multi-user docs, like Google Docs/Sheets or Word/Excel 365.

That should be the top priority. Full stop.

LibreOffice works fine for desktop. But, for Collabora, the web experience needs to be fast. The lag in Collabora is simply unacceptable.

People expect online, and they expect collaborative, and they expect nearly instantaneous updates (at least not painful to type and wait for screen to update).

Talk about misplaced priorities. In my very humble opinion.
by iainctduncan | 2026-02-05 19:22:35+00:00
At the risk of sending you down a giant rabbit hole, the book Designing Sound is all about making programmatic sounds with Pure Data, and open source low-code programming environment available for all platforms. From what I've read, the book is considered a classic in the video game sound world. It's really good. Combine that with the Cipriani book on PD and learning Ardour would give you a very good learning path.
by kkfx | 2026-02-05 19:22:36+00:00
The real issue is that there is no easy-to-self-host complete enough solution. We do not have something go install-able, pio-able, without a gazillion of deps web-app who offer:

- a direct call UI

- a chat UI, with optional group chats

- a simple web site to be used as a wiki-like tool to share textual stuff + common media, storage internally managed

We have anything to do all of the above, but all very complex, spread across many different projects, fragile, hyper tedious to set up etc.
by socalgal2 | 2026-02-05 19:22:51+00:00
Where are the smoking guns? All I see is normal talk for how to get customers. A smoking gun would be "Teens love posts about X even though we know X is really bad for them. Let's promote lots of X". But I don't see any of that. I just see market research etc.

I could post every quote on the page and respond to it how it's not a smoking gun but not one of them seemed like a smoking gun to me. Anyone care to point to one that seems like a smoking gun to them?
by dmitrygr | 2026-02-05 19:23:04+00:00
> The generated code is not very efficient. Even with all optimizations enabled, it outputs less efficient code than GCC with all optimizations disabled.

Worse than "-O0" takes skill...

So then, it produced something much worse than tcc (which is better than gcc -O0), an equivalent of which one man can produce in under two weeks. So even all those tokens and dollars did not equal one man's week of work.

Except the one man might explain such arbitrary and shitty code as this:

https://github.com/anthropics/claudes-c-compiler/blob/main/s...

why x9? who knows?!

Oh god the more i look at this code the happier I get. I can already feel the contracts coming to fix LLM slop like this when any company who takes this seriously needs it maintained and cannot...
by mpolichette | 2026-02-05 19:23:12+00:00
I don't disagree, but I think there is the otherside of that same coin... What if we could do other stuff while remaining productive.

Rather than the example of missing first steps, what if we had, "Ok Claude, prepare a few slides for my presentation, I'm going to watch my childs mid-day recital..." maybe you get a success/failure ping and maybe even need to step out for part of the event, but in another world you couldn't have gone at all.
by mmooss | 2026-02-05 19:24:06+00:00
One major issue is system management:

Installing another app, such as Signal, on your personal computer is one thing. On 1,000 or 10,000 or 100,000 computers, installing it, configuring it, changing settings, updating it, backing it up, locking down settings from user changes (such as retention) - all that requires special tools to do it efficiently at scale. Without the management tools, no way that bit of IT can be used.

The most common tool by far is Microsoft's Active Directory and Group Policy, which has the best compatibility with Windows and with Microsoft applications, including Office. If AD/GP is already deployed, imagine the burden of deploying a second tool to your 1K/10K/100K computers, setting up the server, learning to use it ... you're not doing that for one application unless it's very valuable. The exception is a tool bundled with the application for its own management, but that's going to have to be efficient to deploy, learn, and use to be worthwhile.

Therefore, for many organizations, any application must be effectively managed by AD/GP, which requires the application's developer to create AD/GP management components.

Do Matrix, Signal, or any other application have system management tools?
Show HN: Guro – Python CLI system monitoring, benchmarking and telemetry tool
by akadhanu | 2026-02-05 19:24:12+00:00
I built Guro as a lightweight, cross-platform CLI tool for system monitoring and basic benchmarking in Python.

It focuses on a clean, script-friendly interface with real-time CPU, memory, thermal, and (where available) GPU metrics. Installation is via pip, and it runs on Linux, macOS, and Windows.

This started as a personal tool to better understand system behavior during development and testing. I’m sharing it openly and would appreciate feedback from folks who use similar tooling or care about observability from the terminal. And hit a star, if you found this useful
by simoncion | 2026-02-05 19:24:46+00:00
> ...any network hiccup or dropped connection will leave the filesystem in an unclean state.

Given that the docs claim that this is an implementation of an official NVMe thing, I'd be very surprised if it had absolutely no facility for recovering from intermittent network failure. "The network is unreliable" [0] is axiom #1 for anyone who's building something that needs to go over a network.

If what you report is true, then is the suckage because of SystemD's poor implementation, or because the thing it's implementing is totally defective?

[0] Yes, datacenter (and even home) networks can be very reliable. They cannot be 100% reliable and -in my professional experience- are substantially less than 100% reliable. "Your disks get turbofucked if the network ever so much as burps" is unacceptable for something you expect people to actually use for real.
by pdonis | 2026-02-05 19:25:37+00:00
> For purpose of taxes, that is still treated as a sale in the earlier year, right?

To the best of my knowledge, yes, the date of closing, which is the date on which the deed is executed, is the date of sale for tax purposes. Note, however, that at least in the US, the IRS doesn't check what you claim the date of sale is unless you are audited, and I never have been. What would happen in an audit under your hypothetical, I can't say.

> a closing at an attorney's office with delayed recording has the same ambiguity under both systems.

Yes, that's why I asked if such a closing is even allowed under a Torrens system--it seems like it would defeat a key purpose of the system, which is to make sure that the land registry's records always are the "single source of truth" for who owns what.
by AndrewKemendo | 2026-02-05 19:25:40+00:00
I feel bad for guys like Wyden.

The citizens of the U.S. are neither organized enough, sufficiently intelligent and motivated, to keep the various levels of government in check.

As we have seen with the Epstein stuff, even when the evidence is overwhelming and unambiguous there is massive amount of direct support and an accompanying vacuum of response

The only conclusion to be had is: Everyone is ok enough with the state of reality that they will not change it.

Everyone gets the governance they deserve
by tavavex | 2026-02-05 19:25:51+00:00
> Think of it like the early stages of internet copyright protections, the first step is just cross-referencing the design with a list of known banned designs. Just like an early Youtuber could have mirrored banned videos to bypass copyright detection, people will likely still be able to manipulate designs in certain ways to get past this sort of ban. That's ok. Regulation like this doesn't have to be 100% effective to still be worth doing. The goal here is to make it more difficult for some random person with no expertise to buy a 3d printer, download some files, and print a weapon.

Yes, I agree, and I understand that the law is narrow in this way. However, I still have worries that make the problem of matching STLs harder and less effective than the US dollar printing ban in ways that would force their hand to strengthen the legislation to make it not completely toothless. For one, STLs don't have consistent tells like money does - if you just match it by hash or something, even the most trivial modifications like an irrelevant metadata change or shifting the entire print to the side by 0.01 or something would be enough to thwart the detection. This would be far less effective than the money printer ban, and is so easy to execute that it would nearly nullify the value of this law, because it could be bypassed with a one-line instruction. Matching STLs by geometry within certain tolerances would be better, but still circumventable. This approach would give us the scenario you proposed, so I'm hoping it will go in this direction. However, now that the door to discussing 3D printing regulation is open, there's nothing stopping this law from being dialed up further, especially if they go with the first approach and find it completely ineffective.
by sjsjsbsh | 2026-02-05 19:25:53+00:00
> So, while this experiment excites me, it also leaves me feeling uneasy. Building this compiler has been some of the most fun I’ve had recently, but I did not expect this to be anywhere near possible so early in 2026

What? Didn’t cursed lang do something similar like 6 or 7 months ago? These bombastic marketing tactics are getting tired.