MurphyA/hacker-news huggingface dataset:
by akshat666 | 2026-02-03 16:07:35+00:00
I’ve been working on an open-source project called Ephemeral-First Security (EFSF). The core idea is to treat expiration as a first-class security primitive rather than relying only on long-lived secrets + revocation.

The project provides small SDKs (TypeScript, Python, Java) for building systems where identities, credentials, sessions, and access artifacts are time-bound by default and automatically invalidated.

This grew out of building a privacy-focused ephemeral browsing system, where we found that deletion + forced teardown often reduced risk more effectively than encryption alone in certain threat models.

Current features focus on:
-Explicit TTL semantics for security artifacts
-Deterministic expiration and teardown hooks
-Language-agnostic design (same model across TS / Python / JVM)
-Alignment with common threat-modeling practices (short blast radius, no silent persistence)

Repos / packages:
GitHub: https://github.com/akshat666/ephemeral-first-security-framew...
npm: https://www.npmjs.com/package/@efsf/typescript
PyPI: https://pypi.org/project/efsf/

This is early but stable. I’d really appreciate feedback on:
-Whether “ephemeral-first” is a useful abstraction in real systems
-Where this breaks down in practice
-What you’d want to see to adopt something like this

Happy to answer questions or discuss trade-offs.
by palata | 2026-02-03 16:08:02+00:00
I absolutely love Gentoo, and I actually wonder why I haven't moved there earlier (probably I was scared, and the availability of binary packages gave me a reason to try).

I really didn't want to mean that systemd/flatpak are impacting Gentoo and that I am considering moving away.

My hope is that some distros like Gentoo will keep the "old" spirit of Linux forever, while others try to please those who want Windows-but-without-ads.
by dcrazy | 2026-02-03 16:08:04+00:00
Is your reaction based on reading the linked case? Because it seems pretty sensible to me. Philpot licensed the photo to AXS under traditional terms, and also posted it to Wikimedia with a CC-BY license. IJR put a copy of the photo in their listicle, did not follow either license, and then tried to claim fair use. It’s clearly not fair use. The whole reason you put photos in an article is to make people want to read the article—this hasn’t changed since the early days of newspaper photography. And the whole reason for publishing the article is commercial: to sell ads against it.
by maxglute | 2026-02-03 16:08:05+00:00
> 1989, and the tension of “moral debt” is ever present, evidenced by its persistent censoring.

IMO mistake to frame censorship as a debt, when it's domestic investment in stability, just like policing or infra, or epidemiologic pathogen control. You don't stop investing in essential nation building. Simply part of domestic infosphere management against unwanted influence, which essentially all countries have recognized PRC is prescient. As for 6/4 specifically, future gens will look back and realize 3-4 digit deaths less than rounding error in terms of Chinese history, having 1000s yrs of events/context sharpens evaluation. Like how Mao 70% good, 30% bad evaluation will turn to 90% good, 10% bad, because what's a few 10s of millions starved to death when his engineering projects and industrialization efforts actually ended 1000s of years of reoccurring famine / Malthusian traps. It will be recognize as "price of future", i.e. retrospectives tend to evaluate empires less on carnage (which is assumed) but on the frameworks they leave behind.

>“The West” is more than just America.

The west is generally built on the same template as America, extractive exploitation of not only itself but others, aka, built off surplus blood and treasure from colonialism, except society indoctrinated to believe such is natural order and just. Generations pass, surplus snowballs to buy more rights and freedom and enable more introspection, where colonialism can be acknowledged as stain, but on the margins. West rarely acknowledge that often the fine line between able to experiment vs subsist is funded by foreign extractive surplus. Skewing global balance sheet of energy and resources enable building and experimenting and bribing peripheries, liberalism = luxury experiments derivative product of colonial surplus. We see how fast it erodes when physical resources contracts.

Regardless, when looting from another, the geopolitical balance sheet no longer remains domestic, like America, it starts geopolitical debts that likely can't be default without eventual consequence. Mistreated countries have long memories, and being mistreated, humiliated if you will (and we're not talking bout only PRC), those memories do not tend to soften with time, and can really only repaid in catharsis. AKA there maybe a day when global south develops/catches up and coerce the west pay their debts. It could be 100s of years from now or current events could hint interregnum where power shifts and debts are soon collected.
by Based-A | 2026-02-03 16:08:25+00:00
Well I can't speak to the notion of corrupt politicians, but it's worth noting that if it's in the interests of the landowners, then they'd likely fight to keep anything that they feel would keep their value high. And especially if they started developing/investing in their land to maximize the potential return of the land. Anecdotally, I've seen individual homeowners stir up enough support in my major Canadian city to stop city councils from starting somewhat major development projects, so I don't think that it'd be as inevitable as you're making it out to be.

It's also a mistake to say that a lot of land gets evaluated in isolation, because that's not even true with a the current property tax. You absolutely factor in the surrounding community and external factors when valuing a piece of land. Land in a downtown area is going to be inherently worth more than land on the periphery of a city due to the activity and potential of the land to generate economic activity.

To your point though, would you say that an apartment building next to a park (or even within several blocks of a park) is worth more than an apartment building with no park in proximity? I think most people would as well, therefore the apartment building with the park in proximity would have a higher value (which would extend to all land in proximity of the park), and thus the local government would be able to collect a higher tax dollar amount because of the park being there. Whereas maybe they could get a similar total amount by building another building, but why would a local government purposefully lower the amount of tax they'd collect on each plot of land? It's in the interest of the local government to maximize the value of the land within their jurisdiction to collect the highest amount of tax possible. Just like it's in the landowners interest to develop and invest in their land to get the highest return on their investment possible.

Re: homelessness, it would seem to me like a large group of people without housing would benefit from a system that incentivizes building more housing. Which LVT does. It would also encourage public spaces to be as ammenible as possible, so that the park is as appealing as possible in order to maximize the value for surrounding lots of land. At this point though we're talking second or even third order effects of LVT, which like you mentioned aren't super clear or even assured because LVT mostly remains in the theoretical. But if we have a sound theory, at this point why not try it and see what happens? Our current systems are very clearly failing us, so if we have ideas with sound reasoning, can things really get so much worse than they already are?
by xqli | 2026-02-03 16:08:32+00:00
Hi HN, I built Sbox because I needed a way to run untrusted / agent-generated code
without adding policy logic, scoring, or heuristics.

Sbox is intentionally "zero intelligence":
- no code analysis
- no allow/deny rules
- no LLM involvement

It only provides strong isolation primitives, and assumes all code is hostile.

I’m using it as a building block for long-running agents and automation systems.
Would love feedback from people who’ve built sandboxes or secure runtimes.
Show HN: Aifeed – A real-time feed for AI links
by ksl_dev | 2026-02-03 16:08:32+00:00
Hi HN!

I built aifeed as a simple, real-time feed for AI-related links.
It's meant for following new tools, articles and projects as they appear.

You can also save interesting links to your favorites so they don't get lost.
Submissions are community-driven, with light moderation and a small fee to reduce spam.

Happy to hear any feedback.
by philistine | 2026-02-03 16:08:37+00:00
The whole argument hinges on one word in your post: arbitrary.

I parse my own HTML I produce directly in a context where I fully control the output. It works fine, but parsing other people’s HTML is a lesson in humility. I’ve also done that, but I did it as a one time thing. I parsed a specific point in time, refusing to change that at any point.
by ruairidhwm | 2026-02-03 16:08:50+00:00
Hi HN,

I built WinLog because I kept seeing good engineers undersell themselves during reviews and promotions. Not because they weren’t doing great work, but because they simply forgot what they’d shipped over time.

WinLog helps you capture your "wins" as you go:

- You can log wins manually in a few seconds, or

- Passively capture candidates from Slack channels you choose (nothing is stored without approval)

Each win is rewritten into a concise, professional bullet you can use for:

- Performance reviews

- 1:1 prep

- Promotion packets

- Brag docs / weekly updates

It’s early, but I’ve been using it as my own tool and found it to be very helpful!

Would love feedback, especially from people who’ve struggled with review season or managing reports.

Link: https://winlog.dev
by roryirvine | 2026-02-03 16:08:50+00:00
Yeah, people forget the degree to which sysvinit was hated at the time - "why are you forcing me to deal with an impenetrable forest of symlinks rather than simply hand-edit a couple of basic rc scripts?!?".

If the intention is to create a system that users can reason about, then sysvinit offers the worst of all possible worlds.
by Imustaskforhelp | 2026-02-03 16:08:57+00:00
Can I get to whitelist my account too. Using the quote again but:

"I may have vibe coded 300 lines of code (this project) but I can bet on my life that all the words (200_000+ for me) are written by myself literally behind a keyboard (Hi! :D)"

To be honest, another minor thing but when I made this. I had added a cat video & I am only human after all song.

Now this post has 183 comments right now. I am still waiting for someone to tell me if they found the cat video funny and what was the funniest point within the video :D

Going to eat dinner while I watch I am only human after all because the song is really great. I suggest real people if they ever get accused of being AI to simply paste the music video link of "I am only human after all, don't put the blame on me"

(On a more serious note: I have been called AI for some reason, I usually flip out really hard because I have written the words myself and now you call me AI? That flips me off because I am really open about when I use AI and when I don't (which I never use AI in hackernews posts. Literally written by me) So it pisses me off so much when people call (atleast mine) comments AI.
Maybe its the distrust with the community regarding there being AI posts, I get that but it still pisses me off because I genuinely don't know how to respond to someone peacefully if someone calls me AI because I feel as if they might still call me AI if I talk too peacefully (Like I usually try to))
Show HN: C discrete event SIM w stackful coroutines runs 45x faster than SimPy
by ambonvik | 2026-02-03 16:09:07+00:00
Hi all,

I have built Cimba, a multithreaded discrete event simulation library in C.

Cimba uses POSIX pthread multithreading for parallel execution of multiple simulation trials, while the coroutines provide concurrency inside each simulated trial universe. The simulated processes are based on asymmetric stackful coroutines with the context switching hand-coded in assembly.

The stackful coroutines make it natural to express agentic behavior by conceptually placing oneself "inside" that process and describing what it does. A process can run in an infinite loop or just as a one-shot customer passing through the system, yielding and resuming execution from any level of its call stack, acting both as an active agent and a passive object as needed. This is inspired by my own experience programming in Simula67, many moons ago, where I found the coroutines more important than the deservedly famous object-orientation.

Cimba turned out to run really fast. In a simple benchmark, 100 trials of an M/M/1 queue run for one million time units each, it ran 45 times faster than an equivalent model built in SimPy + Python multiprocessing. The running time was reduced by 97.8 % vs the SimPy model. Cimba even processed more simulated events per second on a single CPU core than SimPy could do on all 64 cores.

The speed is not only due to the efficient coroutines. Other parts are also designed for speed, such as a hash-heap event queue (binary heap plus Fibonacci hash map), fast random number generators and distributions, memory pools for frequently used object types, and so on.

The initial implementation supports the AMD64/x86-64 architecture for Linux and Windows. I plan to target Apple Silicon next, then probably ARM.

I believe this may interest the HN community. I would appreciate your views on both the API and the code. Any thoughts on future target architectures to consider?

Docs: https://cimba.readthedocs.io/en/latest/

Repo: https://github.com/ambonvik/cimba
by order-matters | 2026-02-03 16:09:19+00:00
thankfully it is much more of a daily cycle than a true addiction. if you spike dopamine in the first hour of being awake, you effectively addict yourself for the day. whether you follow through on that addiction or not is less relevant, it kind of shapes your baseline. So you might just have a harder day than usual because it was a dopamine deprived day and instead of having a low baseline you primed your brain for a very stimulating day by having a high-dopamine activity in the morning.
by jeroenhd | 2026-02-03 16:09:32+00:00
Awful reporting. Vague workarounds for an issue "reported by Google Project Zero" without links to said report, but with links to Forbes (who interviewed one of WhatsApp's competitors about WhatsApp's security while their own app doesn't even do proper E2EE). Was there a human involved in publishing this page? If so, was leaving out the link to Project Zero intentional?

Anyway, according to Google Project Zero, the issue has been fixed with a comprehensive fix: https://project-zero.issues.chromium.org/issues/442425914

You can always enable lockdown mode and disable downloading media to protect against undetected vulnerabilities of course, but the bug has been fixed and you just need to update for the problem to go away.
by c22 | 2026-02-03 16:09:51+00:00
My grandfather was a computational meteorologist for the US Air Force who passed when I was a kid. I inherited both his slide rule and his laptop (a 486dx with a math coprocessor!) It felt cool being the only kid at the school with a laptop, but the slide rule languished in a box under my bed until I got it out and figured out how to work it in college. I wish I'd figured it out sooner because it gave a more visceral understanding of the mathematical relationships that I'd been lacking before. Granted, the slide rule has sat mostly idle since then, but it was definitely worth it. I'd encourage you to give it a go.
by BoxOfRain | 2026-02-03 16:10:22+00:00
> Genuine use cases for multiuser desktop Linux are exceedingly rare. (Are university computer labs with desktop computers still a thing? Or is it just Wi-Fi and BYOD now?)

When I was a student in 2015, we had several computer labs. One was called the Delphinium because it was populated with Dell machines running Linux, and another was called the Orchard because it was full of iMacs. There was a lab of Windows machines too which didn't have a memorable name.
by kurthr | 2026-02-03 16:10:24+00:00
So how is this slash command limit enforced?
Is it part of the Claude API/PostTraining etc?
It seems like a useful tool if it is!

I'd like a user writeable, LLM readable, LLM non-writable character/sequence.
That would make it a lot easier to know at a glance that a command/file/directory/username/password wasn't going to end up in context and being used by a rogue agent.

It wouldn't be fool proof, since it could probably find some other tool out there to generate it (eg write-me some unicode python), but it's something I haven't heard of that sounds useful. If it could be made fool/tool proof (fools and tools are so resourceful) that would be even better.
by chrisjj | 2026-02-03 16:10:56+00:00
> The point of banning real CSAM is to stop the production of it, because the production is inherently harmful. The production of AI or human generated CSAM-like images does not inherently require the harm of children, so it's fundamentally a different consideration.

Quite.

> That's why some countries, notably Japan, allow the production of hand-drawn material that in the US would be considered CSAM.

Really? By what US definition of CSAM?

https://rainn.org/get-the-facts-about-csam-child-sexual-abus...

"Child sexual abuse material (CSAM) is not “child pornography.” It’s evidence of child sexual abuse—and it’s a crime to create, distribute, or possess. "
by nerdjon | 2026-02-03 16:11:03+00:00
There has to be some sort of automation making these issues, to many of them are identical but posted by different people.

Also love how many have the “I searched for issues” checked which is clearly a lie.

Does Claude code make issue reports automatically? (And then how exactly would it be doing that if Anthropic was down when the use of LLM in the report is obvious )
by kstrauser | 2026-02-03 16:11:30+00:00
For context, this is the Lars Ingebrigtsen who wrote the manual for Gnus[0], a common Emacs package for reading email and Usenet. It’s clever, funny, and wildly informative. Lars has probably forgotten more about email parsing than 99% of us here will ever have learned.

The manual itself says[1]:

> Often when I read the manual, I think that we should take a collection up to have Lars psycho-analysed.

0: https://www.gnu.org/software/emacs/manual/html_mono/gnus.htm...

1: https://www.gnus.org/manual.html
by Daegalus | 2026-02-03 16:11:43+00:00
I have been using them for over a year. THey have the same flow as Cloudflare, point domain to thier CDN, set CDN Pull Zone to target your server. I havent had to do anything.

They even support websockets.

Why they cant do is the TUnnel stuff, or at least fake it. I have ipv6 servers, and I can't have the IPv4 Bunny traffic go to the ipv6 only sources.
by zamadatix | 2026-02-03 16:12:00+00:00
The usual impetus is that the official status pages habitually under report and sharing the status page showing the best information gives a basis to form a place to have discussion about where/how/why it was down. Unfortunately, many seem to take the other interpretation instead and said discussion often ends up being low quality in a self fulfilling loop of reasons.

The second note probably deserves to be a separate comment.
by thehamkercat | 2026-02-03 16:12:14+00:00
Everybody who uses anything knows that it's down

So what value does it add saying "X is down" anywhere?

It's just for discussion, you can't just ignore it and not talk about it with anyone if a particular service is down and posts like this are pretty common on hn and i haven't seen anyone complaining, it's you're being overly critical, yes
by optymizer | 2026-02-03 16:12:18+00:00
Fellow D fan - high five! This is seriously impressive for a 17 year old!

I'll note a few things:

1. 'fast' without benchmarks is just marketing speak. I keep seing "fast", "super fast" on the GitHub page but nothing to substantiate the claims. How fast is it compared to using D, or even C?

2. 'Download glang' link is broken

3. Why would I use G and not D directly? D generates small binaries as well.

4. What does the 'std' library include? You're mentioning 'println' and 'newline', while people expect data structures and components they can reuse. Is the D standard library accessible?

5. I couldn't find a documentation page easily, but I see you plan on overhauling the documentation

6. Including a package manager is awesome.

7. Do you have any interop with C, D or Java?

A few observations related to naming:

8. G Language is already used by a few pieces of software, though nothing too widely known (https://en.wikipedia.org/wiki/G_programming_language).

9. If I thought my language is worthy of a single letter name, I'd swing for the fences and name the compiler executable 'g', not 'glang'. You're already using the .g file extension for G Lang source code, so might as well go big with the command too.

10. Speaking of glang, it's super close to golang by Google

11. Your Fuchsia shell's name conflicts with the Fuchsia OS (fuchsia.dev) by Google

I'm not a big fan of the syntax, but I wish you good luck. I hope to keep hearing about your language in the future.
by Phonely | 2026-02-03 16:12:33+00:00
Phonely | Senior Backend Engineer (Python) | San Francisco (Onsite) | Full-time

We’re building the future of voice AI for businesses, with a platform designed to make real-time agents easy to build, tune, and operate.

We’re looking for a senior backend engineer to work on core systems that drive live voice conversations in production. This is a hands-on role with a lot of ownership and a lot of Python.

What you’ll do

• Build Python-based state systems for real-time voice AI conversations

• Integrate multiple LLM providers (prompting, routing, tool calling, fallbacks)

• Write high-performance async Python (FastAPI, asyncio)

• Design and test resilient agent logic and microservices

• Operate and improve production systems with strong observability

What we’re looking for
• 5+ years of Python experience, including async web services

• Experience with FastAPI, testing, and CI/CD

• Strong system design and security fundamentals

• Familiarity with LLMs, cloud infrastructure, AWS, and Kubernetes

Stack

Python, FastAPI, async microservices, AWS/GCP, Kubernetes, Redis, Firebase, Supabase, Datadog, SIP/voice APIs

Why Phonely

Small, intense team of builders. High ownership, fast pace, real impact. In-office 5 days/week in SF. Company-paid meals, great culture and periodic international work trips.

https://www.ycombinator.com/companies/phonely/jobs/gp1xSAu-s...
by BadBadJellyBean | 2026-02-03 16:12:39+00:00
I think you got it backwards. Systemd is a standardization that is appealing to developers. They want to adopt it because it makes their life easier. It is just nice to know that all the tools you need for a system are there and work together. Pluggability is hard to maintain and is only done if there is no standardization.

I somehow don't think your gripe is with systemd but with developers who prefer the easy route. To be honest though you get something for free. If you want it differently then you have to do it yourself.
by gus_massa | 2026-02-03 16:12:51+00:00
> I told him it was all AI and gave him all the warnings that it’s a POC and needs testing blah blah.

A long time ago, I read that for POC it was a good idea to use crappy icons and images. Otherwise the client think it's already done because the buttons and icons are in the screen. How hard could it be to implement the backend?

Does the new feature need a "undo" button? Is it implemented?

Credit card? Deduplication if the user hits the button twice?
by nither | 2026-02-03 16:12:57+00:00
Hi HN, solo builder here.

Floyd is an open-source booking kernel for AI agents: TTL holds -> confirm, explicit 409 conflicts, and idempotency keys to prevent double-bookings under concurrency.

Docs: https://docs.floyd.run

Repo (Apache 2.0): https://github.com/floyd-run/engine

Early dev preview, would love feedback on API semantics + edge cases.