MurphyA/hacker-news huggingface dataset:
by severino | 2026-02-17 14:45:06+00:00
> And in practise that means a banking app, because most people do not want a separate token they have to buy and can lose.

It can be SMS. As said in another comment, the main banks in Spain offer this authentication method while being PSD2 compliant. Some also offer a card with coordinates. So it's not mandatory in any way to use a banking app.
by chneu | 2026-02-17 14:45:28+00:00
There's a joke in the race world that White Americans have no culture so they have to steal other people's culture.

This is relatively true and largely because the US has little history compared to other nations. That's part of why so many facets of American society and history are nonsense myths, such as the American West myth. So much of US culture and history is made up ego stuff.
by saidinesh5 | 2026-02-17 14:46:03+00:00
See if there is an OTA package available for your speaker that you can extract and figure out what goes where.

Then figure out what SoC your smart speaker is running.

A lot of soc vendors just provide SDKs for IoT applications. Maybe you'll find something like that you can flash.

Also if there's a separate SPI flash chip, you can simply dump it and study the firmware.
by kibwen | 2026-02-17 14:46:09+00:00
I still wonder if it wouldn't have been better to let each digit be represented by its exact value, and then use the high end of the scale rather than the low end for the control characters. I suppose by 1970 they were already dealing with the legacy of backwards-compatibility, and people were already accustomed to 0x0 meaning something akin to null?
by palata | 2026-02-17 14:46:25+00:00
Feels like you don't know what "the sandbox" is. It's not "their" sandbox, it's from AOSP.

When you run an app on Android, it runs in a sandbox. Meaning that your social media app cannot access the files of your banking app by default. They are "sandboxed".

On a normal Android, the Play Services are installed as a system app. It is privileged app that has "system" access. A system app is not sandboxed.

GrapheneOS allows you to install the Play Services and the Play Store as "sandboxed" apps in that they run unprivileged, just like WhatsApp or TikTok or your banking app.

So running the proprietary Google apps in the sandbox is obviously more private than running them as system apps, wouldn't you say?
by NoGravitas | 2026-02-17 14:46:32+00:00
I think it's less mind-reading than looking for a sociological explanation.

That said, I think a big underlying cause is that Business Idiots [1] are, in fact, idiots. Even so, it's worth looking for a sociological explanation of why Being An Idiot doesn't hurt Business Idiots like it would hurt the rest of us.

[1]: https://www.wheresyoured.at/the-era-of-the-business-idiot/
Anam Cara-3: Why we think AI needs a face
by grayne | 2026-02-17 14:46:44+00:00
Hey HN, we're Ben and Caoimhe, cofounders of Anam. We built a service for interactive avatars and just shipped our latest model, cara-3. Try it at anam.ai, no sign-up required, or build with it at lab.anam.ai or anam.ai/cookbook.

Some context on why we're working on this: faces carry emotional signal that text and voice don't. Almost half the human brain is devoted to visual processing, and it's one of the first
things we learn as babies. It's also a more accessible medium. Anam started, in part, from Ben watching his gran struggle with her iPad and thinking there should be a face she could just talk to.

cara-3 uses a two-stage pipeline: a diffusion transformer converts audio to motion embeddings (head position, eye gaze, lip shape, expression), then a rendering model applies those to a reference image to produce video frames. Separating motion from rendering means we can animate any face without retraining. The two models run in sequence within ~70ms time-to-first-frame on an H200, so we can run many concurrent avatar sessions on a single GPU.

The core of audio-to-motion is flow matching, but we found off-the-shelf formulations weren't stable enough for this task, so we developed a novel variant. We also built our own training data pipeline (and recently open-sourced the backbone: Metaxy) because existing frameworks made it hard to iterate without rerunning expensive steps.

We commissioned an independent blind evaluation comparing interactive avatars from Anam with HeyGen, Tavus and D-ID. Hundreds of participants played 20 Questions with the different offerings and cara-3 scored highest on every metric (p < 0.001), 24% above the closest competitor on average. What surprised us most: responsiveness correlated with overall experience (Spearman 0.697) far more than visual quality (0.473). In interactive settings, how fast you respond matters more than how good you look.

Ask us anything!
by 0xInfoSec | 2026-02-17 14:46:47+00:00
Learn all about web application security in one platform. - Hands on challenges - Over 15 free labs - Over 50 labs of realistic world attacks, based mainly on hackerone reports or bug bounty reports - New labs every week - Detailed explanations (non AI) - Progress tracking

I strongly suggest giving at least the free challenges a shot, this might end up being your next career :)
Show HN: Stellar – CLI Theme Manager and Web Hub for Starship Prompts
by a3chron | 2026-02-17 14:46:49+00:00
I built this because discovering good Starship themes usually meant digging through random dotfiles repos on GitHub.
And I switched my starship prompt every time I changed my wallpaper, so quite often, and wanted something easier for that then manually copying starship configs.

Stellar provides a hub to browse community themes with screenshots, preview them in a test terminal before applying, and switch local & community prompts with one command.

Tech: Go CLI (single binary) + Next.js hub + Supabase. Themes stored locally with starship.toml symlinked to them.

Just launched v1.0.0. Happy to answer questions, and I'd love some feedback :)
Also, feel free to upload your own starship prompt :)
by NoLinkToMe | 2026-02-17 14:46:53+00:00
Will pay because these societies can afford it. If they had 10k they're not spending 200k, period.

That's the whole point in these affordability discussions.

Take homes, We often speak of homes being so expensive, $1m average in Silicon Valley or whatever. That's not because it's unaffordable, but precisely because for the people who bought these homes, they were able to afford $1m or whatever the number is. If people there could only afford $500k, they'd be 500k.

If it's 200k it's because that's what we can and believe should spend. And that's completely different from the past, when we could spend less, and decided we should spend less. My grandparents generation for example who had 5-10 kids certainly wasn't spending 1-2m on their children.

Fact is that median income has gone way up, while children per person went way down. We thus have more to spend per child, we can afford MORE, to spend more. And the fact that we do (evidenced by the 200k per child figure), is not evidence of unaffordability, to the contrary!
by reliabilityguy | 2026-02-17 14:46:56+00:00
> War starts with neighboring countries, partly to disrupt the ethnic cleansing campaign against a mostly defenseless population

Did you made this all up?

There is zero evidence that the war started because the Jews were ethnically cleansing “defenseless population”. It is enough to go to the library and read newspapers from the time where Arabs openly stated that they do no accept Jewish state for the sake of it being Jewish.
by deaux | 2026-02-17 14:47:21+00:00
If you have for example a monorepo, then you'll probably want a super lean top-level one - could be <15 lines - and then one per app. In those, only stuff that applies to the app as a whole. Then feature-specific context can be put at the level of the feature - hopefully your codebase is structured by domain rather than layer! The feature-level ones too, IMO, should usually be <15 lines. I just checked one of ours, it's 80 (GPT-5) tokens. It's basically answering potential "is this intentional?" questions - things that an LLM (or fresh human) can't possibly know the answer to because they're product decisions that aren't expressed in code. Tribal knowledge that would be in a doc somewhere. For 99% of decisions it's not needed, but there's that 1% where we've made a choice that goes against the cookie-cutter grain. If we don't put that in an AGENTS file, then every single time it's relevant there's a good chance it will make a wrong assumption. Or sometimes, a certain mechanic is inferable from the code, but it would take 10 different file reads to figure out something that is core to how the feature works, and takes 2 sentences to explain. Then it just saves a whole lot of time.

It does depend on the domain. If you're developing the logic for a game, you'll need more of them and they'll be longer.

Another advantage of this split is that because they're pulled into context at just the right time, the attention layer generally does a better job of putting sufficient importance on it during that part of the task, compared to if it were in the project-level AGENTS file that was loaded at the very top of the conversation.
by microtonal | 2026-02-17 14:47:59+00:00
I agree that the locking down is truly stupid.

I don't agree that it is stupid. Both banking on a Windows PC or on an unlocked + rooted phone is potentially catastrophic. Windows because of the prevalence of malware, unlocked phones with custom AOSP forks because people download 'ROMs' (as they call them) from the most shady sites.

Once 10,000s of Euros are siphoned from a bank account, it's usually the bank that has to deal with the mess. Especially if they cannot prove the transactions were done in on an insecure platform.

Phones are generally safer (though there is a huge variance between the safety of different Android phones) because they use verified boot and strong application sandboxing.

I think it is possible to believe the following two things a the same time:

- Banking apps should only run on locked phones with secure boot.

- Banking apps should not be limited to the Apple/Google duopoly.

The solution is that there is some validation of alternative OS vendors, e.g. in the form of an audit, and that banks are required to approve apps on their platforms after the audit. This would be fairly straightforward tech-wise, because e.g. GrapheneOS supports remote attestation, but banking apps need to add/allow the hashes of the official boot keys: https://grapheneos.org/articles/attestation-compatibility-gu...
by gf000 | 2026-02-17 14:48:09+00:00
> but obviously Google still gets to see everything you do in their apps

Well, the actually scary part of google services is that they have this quasi-elevated access in your phone where it can do a lot of stuff ordinary android services just can't do. E.g. google maps' location sharing works this way (but don't quote me on that).

GrapheneOS managed to "put it back into the bottle", and it runs as a regular android service anyone could write, with the same rules applying. So you have much more control on what you allow it, and this will also limit what data apps relying on google services can leak about you.
by dangus | 2026-02-17 14:48:20+00:00
The article directly answers your questions, specifically in the “what is GrapheneOS?” section.

For the end user, breaking free from Google means exiting from Google’s services surveillance system wherever possible. It doesn’t mean complete elimination of the use of source code written by Google employees.

GrapheneOS is really the most private option of all viable daily drivable smartphone operating systems available, because your only other options generally involve Apple and Google services dependency.

You can use GrapheneOS and never send any user information to Google, that’s how you “break free.”
by cpburns2009 | 2026-02-17 14:48:24+00:00
I realize that the GP is trolling, but he accidentally has a good point. It is useful to know what censorship goes into a model. Apparently Copilot censors words related to gender and refuses to autocomplete them. That'd be frustrating to work with. A Chinese model censoring terms for events they want to memory hole would have zero impact on anything I would ever work on.
by Uehreka | 2026-02-17 14:48:37+00:00
Speaking as a fellow job-displacement-worrier, I don’t think people have answers. But contrary to what a lot of people say, there is a ton of utility in pointing out a problem without having a solution. In this case, I think a lot of people who might have good ideas are currently under the mistaken impression that this isn’t a problem.

To the extent that I’ve heard people propose solutions, many of them have pretty big flaws:

- Retraining - AI will likely swoop in quickly and automate many of the brand new jobs it creates. Also retraining has a bit of a messy history, it was pretty ineffective at stopping the bleeding when large numbers of manufacturing jobs were offshored/automated in the past.

- “Make work” programs - I think these are pretty silly on the face of it, although something like this might be mecessary in the really short term if there’s very sudden massive job loss and we haven’t figured out a solution.

- Universal Basic Income - Probably the best system I’ve heard anyone propose. However there are 3 huge issues: 1 - politically this is a huge no-go at the moment (after watching the massive Covid stimulus happen in 2020 I have a sliver of hope, but not much). 2 - Even a pretty good UBI probably wouldn’t be enough to cushion the landing for people who make a lot right now and have made financial decisions (number of kids, purchasing a house, etc) on the basis of their current salary. 3 - Even if this happens in America (presumably redistributing the wealth accruing to American AI companies) it would leave non-Americans out in the cold, and we currently have no globally powerful institution with the trust and capability to manage a worldwide UBI.
by isodev | 2026-02-17 14:48:39+00:00
I share the sentiment of the post. The best I can describe it is that I’m tech-savvy enough to know that “AI” is just not capable of what people want it to do and yet I apparently lack the “broligarch” gene required for me to ignore the technical reality in favour of seeking ways to exploit people who don’t know better (a-la OpenClaw guy).
by acnops | 2026-02-17 14:48:41+00:00
Charts were vibe-coded in a not-yet-shareable way. It's pure SVG. I asked it to take inspiration from https://www.star-history.com/.

These days I guess we don't want a library? I can create an MIT-licensed repo with some charts you can point your AI agent to, if it helps?

The font is Gaegu.
by cauenapier | 2026-02-17 14:49:35+00:00
“The internet is dead” feels emotionally true if you only look at algorithmic feeds full of AI sludge and engagement bait. But I think that’s mistaking the loudest layer of the web for the whole thing.

The internet isn’t dead, the human parts just aren’t concentrated on a few megaplatforms anymore. They’re scattered across personal blogs, niche communities, indie sites, and small networks that don’t optimize for infinite scale. The web feels worse because the default surfaces are worse, not because humans left.

Calling it dead risks turning a discoverability problem into a nihilistic one. The interesting work is figuring out how to surface and grow the human corners, not declaring the whole system a loss.

I wrote a short piece expanding on this idea: https://cauenapier.com/blog/the-internet-is-not-quite-dead/
by reliabilityguy | 2026-02-17 14:49:41+00:00
> No, the British backed the Jordanians, not the Palestinians.

What is the difference between Jordanians and Palestinians given that the line that separates them is drown by the Brits?

> So there was no ethnic cleansing at all? I suppose 700k or so Palestinians just oopsied their way out of their homes and villages.

So they all left because Israel kicked them all out? What about the interviews and news articles from the time where Arabs themselves said that Jordan Army asked them to leave for the duration of the fights?

And you are the one talking about narratives?
by pjmlp | 2026-02-17 14:49:46+00:00
It kind of depends on where in the globe one is, many countries see programmers as a white collar job that happens to be better paid than a plain secretary, a mere transition phase into management, that is the success story for most families, the programmer turned boss.

So those of us that fight against becoming managers, it was for love of programming and the related technical details, as it usually comes with a payment and career ceiling.

And being unemployed beyond 50 years old in many countries that see being a programmer as yet another office job, means too old for employment, and too young for retirement.
by Tharre | 2026-02-17 14:50:22+00:00
The question is what generated that TOTP code. The banks must ensure that they "are independent, in that the breach of one does not compromise the reliability of the others," as article 4(30) states. That text is vague as hell, but published opinion of the European Banking Authority on the matter[0] is:

"a device could be used as evidence of possession, provided that there is a ‘reliable means to confirm possession through the generation or receipt of a dynamic validation element on the device’"

So in essence the TOTP has to be bound to the device in a way that prevents users from just extracting the secret and putting in in their password manager. Hypothetically that would still allow Yubikeys and other security keys that provide attestation from the factory, but in practise banks probably don't want to deal with the support headache and just provide their own, like the TAN generator mentioned by other commentors.

Two other highlights from the interpretation of the EBA:

"App installed on the device" -> not compliant

"In the case of an SMS, and as highlighted in Q&A 4039, the possession element
‘would not be the SMS itself, but rather, typically, the SIM-card associated with the respective
mobile number’."

"SIM-card associated with the mobile number" - is that even technically possible? Do mobile carriers provide a API for banks to verify that a number still corresponds to the same SIM card? If so I've never heard of it.

[0] https://web.archive.org/web/20191207213213/https://eba.europ...
by deaux | 2026-02-17 14:50:41+00:00
Thank you for turning up here and replying!

> The LLM-generated prompts follow the coding agent recommendations. We also show an ablation over different prompt types, and none have consistently better performance.

I think the coding agent recommended LLM-generated AGENTS.md files are almost without exception really bad. Because the AGENTS.md, to perform well, needs to point out the _non_-obvious. Every single LLM-generated AGENTS.md I've seen - including by certain vendors who at one point in time out-of-the-box included automatic AGENTS.md generation - wrote about the obvious things! The literal opposite of what you want. Indeed a complete and utter waste of tokens that does nothing but induce context rot.

I believe this is because creating a good one consumes a massive amount of resources and some engineering for any non-trivial codebase. You'd need multiple full-context iterations, and a large number of thinking tokens.

On top of that, and I've said this elsewhere, most of the best stuff to put in AGENTS.md is things that can't be inferred from the repo. Things like "Is this intentional?", "Why is this the case?" and so on. Obviously, the LLM nor a new-to-the-project human could know this or add them to the file. And the gains from this are also hard to capture by your performance metric, because they're not really about the solving of issues, they're often about direction, or about the how rather than the what.

As for the extra tokens, the right AGENTS.md can save lots of tokens, but it requires thinking hard about them. Which system/business logic would take the agent 5 different file reads to properly understand, but can we summarize in 3 sentences?
by Sharlin | 2026-02-17 14:50:44+00:00
Square brackets are often used in contexts where the function is "higher-order" in some sense, with the type of the parameter itself being a function, distribution, or a similar object with richer structure. I think in this case C[S] is particularly supposed to evoke the expected-value notation E[X], because that's what C[S] essentially is – it gives the expected value of S if you interpret S as a random variable with that distribution.
Show HN: Quick Issues: A Fast Mobile Issue Capture for GitHub, GitLab, and Gitea
by balthasarS | 2026-02-17 14:50:48+00:00
I got frustrated with how GitHub and GitLab's mobile apps handle issue creation. You need to be online, the flow is slow, and if you're on a self-hosted instance you're out of luck entirely.

So I built Quick Issues. It's a lightweight Swift app with an offline buffer -- you capture the issue, it syncs when you have connectivity. Supports GitHub, GitLab, and Gitea/Forgejo (including self-hosted and local with PAT).

A few technical notes for anyone interested: This was my first time using GRDB with SQLite instead of default Swift data structures, and the performance difference was significant. Setting up proper OAuth2 flows and GitHub/GitLab apps was more of an adventure than expected, but it's solid now.

Free for a single account/instance, paid tier if you juggle multiple providers.

My background is in GTD and data analytics, not traditional software engineering, so I'm genuinely curious: how does issue capture fit into your development workflow? Do you batch-create issues, capture them the moment they come up, use templates all the time or treat issues more as documentation only?
by retio_pagemap | 2026-02-17 14:51:14+00:00
I built PageMap because I got frustrated with existing MCP browsing tools.

Playwright MCP dumps the entire accessibility tree per page, which is 50-540K tokens. After 2-3 page navigations your context window is gone. Firecrawl and Jina Reader are better on token count but they convert to markdown, so you can read but not interact. No clicking, no typing, no form filling.

PageMap takes a different approach. It runs a 5-stage HTML pruning pipeline and a 3-tier interactive element detector (ARIA roles, implicit HTML roles, CDP event listeners). The output is a structured map with numbered refs that an agent can act on.

I ran a benchmark across 66 tasks on 9 e-commerce sites. PageMap got 95.2% task success at $0.58 total. Firecrawl got 60.9% at $2.66. Jina Reader got 61.2% at $1.54. The gap mostly comes from PageMap being the only one that supports interaction and from the pruning keeping relevant content while cutting noise.

It works as an MCP server with three tools. get_page_map navigates to a URL and returns the compressed map. execute_action clicks, types, or selects by ref number. get_page_state is a lightweight status check.

pip install retio-pagemap
playwright install chromium

Add to .mcp.json and it works with Claude Code, Cursor, or any MCP client.

Python, Playwright, lxml. MIT licensed.
by halflife | 2026-02-17 14:51:16+00:00
Jews in Israel had rockets fired on them mainly from border town. And now the Israeli government finally put a stop to it, and no rockets are being fired on them.

https://amp.dw.com/en/berlins-young-jews-reveal-complex-expe...

> In December, for example, major security measures were implemented at the public candle-lighting ceremony for the Hanukkah holiday, held at Berlin's landmark Brandenburg Gate, while just a few years ago, passersby could watch the celebration up close.

> "In the past, I sometimes wore a Star of David necklace. At the moment, I don't," Sofer says. "Right now, anywhere in Berlin, you'd have to be crazy to wear one," in her view.

Yeah, sounds safe.
Love the jewsplaining of telling me where I should feel safer.