MurphyA/hacker-news huggingface dataset:
by amichal | 2026-02-09 14:02:38+00:00
I would love to see alternatives of educational code that implements these things in a "compliant" way.

Security does not come from Compliance (sometimes they are at odds) but as someone who is not an academically trained security professional but who has read NIST* in detail, implements such code and has passed a number of code reviews from security professionals. And who has been asked to do things like STRIDE risk assessment on products I write code for I do appreciate the references and links along side actual code of any kind.

Now to be fair, I have not yet looked at any of the code here, it's commit history or its level of AI-induced fantasy confidence in the validity of the specific solutions. That could be good or bad but the intent of this is really on point for me.

Edit: I looked at some code:

This is missing a lot from NIST SP 800-63B

Looking at https://github.com/vhscom/private-landing/blob/main/packages...

- the db select runs before the password has so you can detect if the account exists with timing attacks
- there is no enforced minimum nor maximum length on the stored secret (e..g para 5.1.1.1 and 5.1.1.2 recommend length range of 8 to 64 unicode printable chars normalized to some form i forget)

- there is no enforced min max length on the account identifier (in this case email) and no normalization

At least not in the code i saw. so there is still a lot of basics/low hanging fruit from NIST recommendations at least you would find in any production grade auth framework missing
by jammaloo | 2026-02-09 14:03:02+00:00
That's an interesting one, because it's misused more often than not, to mean what you are suggesting.

It's actually meant to say if someone provides an exception, e.g. "No parking on Wednesdays", then that proves the existence of another rule, e.g. "Parking is allowed". Since an exception, without a rule, makes no sense.

But, in my experience, people do use it to mean "Oh, this one thing is wrong, but that proves everything else is right", which does not track.
by nis0s | 2026-02-09 14:03:15+00:00
Two points of clarification.

Societal collapse doesn’t necessarily mean all-out nuclear catastrophe, and can also mean transitioning from one set of norms or rules establishing the status quo to another. People shouldn’t labor under the false impression that they will have guaranteed success when such transitions happen. What are they modeling this on, exactly? Countries where mafias are de facto rulers, or there’s some level of dictatorship, are only held up due to external pressures put on by democratic world orders. As mentioned, guns and bombs can guarantee protection up to a point, and the rest of that necessary work is done by ideas and ideals.

Secondly, I am afraid a lot of the people who believe they’ll have some sort of success in scenarios with lesser law and order than they grew up with will find out it wasn’t their winning personalities which guaranteed them anything. There will always be someone more brutal ready to just take yours and dispose of you. To put it more plainly, if all they like is your money then you’re just standing in the way of that.
by mrb | 2026-02-09 14:03:15+00:00
Hi Tom it's Marc, I'm glad to see you finished your sightline project ! Any clue why you report the longest sightline as "530.8 km" when it seems to be actually 538.1 km? That's what my code calculated (https://news.ycombinator.com/item?id=45512970) that's what Dr. Ulrich Deuschle also calculates (https://www.udeuschle.de/panoramas/panqueryfull.aspx?mode=ne...) You, Deuschle, and I all use the same DEM data (https://www.viewfinderpanoramas.org/Coverage%20map%20viewfin...) and the same refraction coeff (0.13), and nearly the same camera height (1.5m for me, 2.0m for Deuschle, and 1.65m for you—and these differing heights make no difference given the coarse DEM resolution). Something must be slighly off in your computations? Or do you think both Deuschle and I are wrong?

Edit: to be clear the difference stems from our coordinates. Our starting points are:

41.059167,77.683333 (me)

41.0181,77.6708 (you)

And our end points are:

36.295364,78.755593 (me)

36.314,78.7654 (you)

Also I calculate the distance assuming the Earth is spherical (which gives 538 km) not the standard geodesic (which would give 537 km).

And in the DEM data I measure the distance from the center of a cell to another (not the edge), while measuring from edge to edge may explain a difference of at most 0.1 km as the DEM resolution is 3 arcseconds.

So clearly we disagree on the coordinates of the exact actual sightline as we have a 7 km difference :-)
by cucumber3732842 | 2026-02-09 14:03:46+00:00
> The real question is, can you learn to do it before you starve or freeze to death? Or perhaps poison yourself because you ate something you shouldn't or cooked it badly.

You can eat some real terrible stuff and like 99.999% of the time only get the shits, which isn't really a concern if you have good access to clean drinking water and can stay hydrated.

The overwhelming majority of people probably would figure it out even if they wind up eating a lot of questionable stuff in the first month and productivity in other areas would dedicate more resources to it.
by bdunks | 2026-02-09 14:04:17+00:00
> “I’m not going to install yet another chat app”

This is legitimate.

I have to use:

- iMessage & SMS for most US based family, casual friends and co workers.
- WhatsApp for European Family
- Signal for one group of friends
- Telegram for another group of friends

Every time I message someone I have to remember what app to use. It’s annoying. This in addition to random threads that pick up with the same people on instagram, discord, etc., which I try to redirect to our “standard” channel as aggressively as I can.
by rodeoclown | 2026-02-09 14:04:32+00:00
There are several ideas here about how to elegantly combine physical switches, knobs, and dials with digital displays that I quite appreciate in this design.

Some nice details:
- There's digital readouts around the binnacle gauges
- The physical needle on the speedo comes from the outside to leave the center available for the digital screen
- The drive selector has a small screen (light?) in the center as an indicator

The combination seems like it may create a quite polished feel if it's done well in motion.
by afandian | 2026-02-09 14:04:35+00:00
How are people sticking stuff to quartz? I know less than nothing, but the pieces of quartz you find in rock don't look like they'd take a solder bond.

I'd assumed that with piezo crystals etc there was a mechanical connection rather than an electrode bonded to the crystal?

But if you can add solder presumably there is some kind of molecular connection with the metal?
by christophilus | 2026-02-09 14:04:59+00:00
True, but reductio ad absurdum is a good way to make any argument look silly without actually considering nuance. Of course, there's some limit to what society will do to save an individual. If someone is lost at sea, we'll try to save them, but we won't spend $1T rerouting all of our available naval capabilities to do it. How much should we spend? The math isn't clear, and thus the economics aren't clear. But, where we should fall is somewhere on a gradient between "Every man for himself" and "Save every individual at all costs."

The question is, where do we fall on that gradient?
by andsoitis | 2026-02-09 14:05:03+00:00
> Makes the same mistake as all other prognostications: programming is not like chess. Chess is a finite & closed domain w/ finitely many rules. The same is not true for programming b/c the domain of programs is not finitely axiomatizable like chess.

I believe the author addresses it in the article:

> many domains are chess-like in their technical core but become poker-like in their operational context.

Also applicable to programming.

Programming has parts like chess that are bounded and what people assume to be actual work. However, what LLMs don't do well is understanding future requirements, stakeholder incenctives, etc.
by pumplekin | 2026-02-09 14:05:09+00:00
BFD or Ethernet-OAM is the standard here.

It can get a bit hardware dependant but getting <50ms failovers from software based BFD in BIRD or FRR is fairly easy, and I've tested down to < 1ms before with hardware based BFD echo. ~50ms is the point at which a user making a traditional VOIP call won't notice the path switch.

You can get NIC's for computers (like most Nvidia/Meallanox or higher end Broadcom/Intel NIC's that do hardware BFD, and its obviously included in higher end networking kit.

You then link the BGP routes to the health of the BFD session for which that path is the next hop, and you get super quick withdrawls.
by rcdemski | 2026-02-09 14:05:18+00:00
That's my challenge in Colorado.

I installed a modest solar system (5kwh) in 2024 and was incredibly happy with the results. On any given 24 hour period it'd offset 40% of my electricity consumption (EV, hot tub being the big loads).

Last year I installed a cold climate heat pump. I'm incredibly happy with the switch from gas as my primary heat source. The solar now only covers ~15-20% of my consumption in winter.

So my solution this year will be to add more solar.
In the two years since I installed mine prices have halved. I'm fortunate enough to be able to do a DIY install, properly permitted and inspected, for about $350/400w panel once you factor in inverters, mounts, etc.

It's an amazing time for affordable energy.
by nagarajsarath6 | 2026-02-09 14:05:19+00:00
The execution timeline you mentioned is the software-layer answer, but there is a physical-layer constraint that acts as the great equalizer here. Even with Google's advantage in custom accelerator hardware (TPUs), they are hitting the same 'Hardware Latency Gap' as every other hyperscaler.

While software cycles move at gigahertz, the power grid is on a mid-20th-century industrial clock. Specifically, lead times for the high-voltage transformers required to power these massive clusters have moved from 50 weeks to 120+ weeks.

You can optimize for 'agentic' tasks all day, but you cannot 'Agile' your way through the 120-week curing time of transformer oil or the global shortage of GOES (electrical steel). When the digital roadmap is decoupled from the physical map, even the best research and distribution advantages become stranded assets. I've been auditing these physical bottlenecks—the friction of atoms is now governing the speed of bits
by noirscape | 2026-02-09 14:05:45+00:00
I think a product focus does exist: Element seems to be a genuine attempt to fully assemble Matrix as one full project. The problem is that it feels like the Element devs are stuck wanting to have their cake and eat it too.

There's some design choices in Matrix that don't really "fit" with what modern messaging infrastructure looks like. (Which to summarize it pretty quickly is a Slack/Discord-esque model, where non-sysadmin users get to fully administer their own spaces, with an expectation for multiple different channels, control over user permissions and user access and so on and so forth.)

Some of these come from the fact that Matrix is pretty blatantly just designed as "what if IRC, but slightly more modern". It's main unit for non-sysadmin moderation is a single channel, with the expectation that one instance of Matrix will never have two channels named #general (as an example). Similarly, it's entirely possible to kick users from a channel... but then have that exact same channel continue independently on a different instance, but under a different label. This makes sense if you look at it as "supercharged IRC", but becomes a complete and utter mess when you factor in things like the encryption between two servers suddenly disagreeing with each other (leading to a bunch of old messages becoming unreadable), content moderation (barely an issue on IRC because message retention is expected to be almost entirely clientside) and so on and so forth.

Element/synapse's people do try to provide for these cases, but you're effectively stuck trying to prod at admin API endpoints, bots to synchronize moderation decisions and they have like 3 different "channel grouping" that's supposed to be their version of the Slack workspace/Discord guild model.

Honestly though, I'm pretty sure that once XMPP gets a proper multi-user multi-channel XEP going (there's one in draft right now which specifically tries to provide workspace-esque support; it's possible to do this already but it's a sysadmin XEP, the proposal aims to give this capability to regular users), it'll just end up blowing Matrix out of the water entirely for most usecases. Unlike Matrix, it's a far more mature protocol that's a lot easier to work with and actually has many different implementations that you can choose from.
by pul | 2026-02-09 14:06:01+00:00
Those are really useful suggestions, thanks!

> 1) Include a link to dnsviz.net to check on the DNSSEC status of domains.

I use DNSViz all the time. They've done a great job of displaying the entire trail and helping debug DNSSEC issues. But it's a bit too detailed for my liking. I'm thinking about how I would add this to Wirewiki. What to show and hide by default, how to format it, etc. Adding something similar is pretty high on my list for Wirewiki.

> 2) Shared fate [...]

I do already show ASNs for A/AAAA records, but adding those to NS and MX addresses as well would be useful. I'm a bit hesitant to add more data to the overview, but a separate page that shows an analysis of shared name server resources could be useful indeed. I've added it to the list.

> 3) displaying whether a domain exists on popular block lists would be awesome.

Absolutely. Already on the list :)

> You could spend the rest of your life building this and never actually completing it, be careful!

Haha, I've already spent 5 years, and I don't mind to keep going as long as it's interesting and sustainable!
by finnthehuman | 2026-02-09 14:06:09+00:00
Graybeards love to yap. Just talk to them or consume the wide amount of material already out there.

It takes curiosity on your part though. Handwaving about practical concerns taking priority is a path to never getting around to it. "Pragmatism" towards skills is how managers wind up with an overspecialized team and then tell themselves it was inevitable. The same can happen to you.
by ht_th | 2026-02-09 14:06:24+00:00
I'd not worry too much about picking a major yet. Or rather, students typically need a couple of years in undergrad to figure out what exactly it is that they want, what motivates them, where their interests lie, etc.

I've seen top-students who got fed up with the field, or with academics in general, and moved into industry after a bachelors. I've also seen average performing students discovering a love for research and going that route successfully. And anything in between.

Heck, even discovering that a field isn't for you and switching majors or dropping out for a bit is fine.

So, I recommend going someplace/some major you feel at home and then try as many different courses and activities until you discover what drives you. Then decide where to go next from there.
by kaicianflone | 2026-02-09 14:06:52+00:00
I think the core insight here is about incentives and friction, not crypto specifically.

I’m working on an open source CLI that experiments with this at a local, off-chain level. It lets maintainers introduce cost, review pressure, or reputation at submission time without tying anything to money or blockchains. The goal is to reduce low-quality contributions without financializing the workflow or creating new attack surfaces.
by 0xmattf | 2026-02-09 14:07:15+00:00
I've been working through the pwn.college curriculum, as well as building https://stoacentral.com. It's meant to be a place to chill, discuss philosophy (Stoicism), and improve yourself. I built it after becoming annoyed with Facebook groups, really.

If you're interested in Stoicism, feel free to join and start some discussions.
Show HN: A Satellite View for Python Code
by treeliker | 2026-02-09 14:07:16+00:00
Hi HN,

I built ast-visualizer.com because I wanted a way to visualize the architecture/structure of a Python repo before dived into the code.

Most tools tell you what the code does; I wanted to see how it's built.

The Problem: Onboarding onto a large codebase is a nightmare. LLMs help with single functions, but they struggle to show you the "God Objects," circular dependencies, or high-complexity hotspots across 50+ files.

What it does:

Dependency Graph: Visualizes imports and file complexity to find architectural bottlenecks.

Radial AST Heatmaps: Maps individual files and color-codes them by Cyclomatic Complexity (McCabe). If a node is red, the section of code is a refactoring candidate.

Complexity Dashboard: High-level metrics like nesting depth and maintainability scores as well as files recommended to be refactored.

Privacy & Security (The Big One): I know how sensitive source code is. We do not store your code. Files are processed in (RAM) on our servers and discarded immediately after the visualization is generated. No permanent storage, no databases of your source, and zero training on your data.

Early Adopter Offer: I’m looking for feedback from the community to improve the UI and parsing. I’ve opened an Early Adopter tier that enables all features (including repo-wide analysis) completely free in exchange for your honest feedback.

Let me know: What’s the one thing you wish you could "see" visually when you open a new repository for the first time?
by instalabsai | 2026-02-09 14:07:18+00:00
Sure, here are a few tips:

- Use a static website generator (I use Astro but there are others) where the agent can fully control every aspect of the website

- Use skills to enhance the prompting, like this frontend-design one but can also combine it with copy writing/seo skills etc

- Give the agent control access to the browser to give it visibility into the result in order to iteratively improve upon it

- The last thing is to just be very demanding and setting a high bar, so ask for animations and ask the agent over and over again “ok and now let’s improve what you just did”
by bingwu1995 | 2026-02-09 14:07:31+00:00
I've been testing it on a few specific workflows.

Found it actually performs well for data analysis and running automated checks (cron-style tasks). Because the reasoning layer seems reliable so far, I've hooked it up to a simulation account (paper trading) to backtest the execution in real-time.

It’s good enough to monitor the market, but I’m keeping it sandboxed until I see consistent behavior over a longer timeframe.

https://github.com/SYNR-AI/ClawStreet
by sungho_ | 2026-02-09 14:07:32+00:00
> This is still true - a compiler can never win this battle. All a human programmer has to do is take the output of the compiler and make a single optimisation, and he/she wins. This is the advantage that the human has - they can use any of a wide variety of tools at their disposal (including the compiler), whilst the compiler can only do what it was programmed. The best the compiler can hope for is a tie.

This is awkward
by pixl97 | 2026-02-09 14:07:34+00:00
Can you list a situation where this matters that you know this personally?

Maybe if you end up alone and lost in a huge forest or the Outback, but this is a highly unlikely scenario.

If society falls apart cooking isn’t something you need to be that worried about unless you survive the first few weeks. Getting people to work together with different skills is going to be far more beneficial.
by duxup | 2026-02-09 14:07:56+00:00
I feel like nobody has figured out yet how these screens and components in a modern car should fit together that don't look like little iPhones and iPads just mounted in a car.

There are some nice buttons here, and individual components (as photographed) look good on their own.

BUT altogether it still seems like disparate components who share design language, just slapped into a vehicle.
by gsf_emergency_6 | 2026-02-09 14:08:17+00:00
Paper
https://www.science.org/doi/10.1126/sciadv.adw9995

At a glance Fig 2 looks most interesting.. last panel compares "monolithic" US to Canada with their giant error bars..

(Canadians become more honest but less trustworthy??!! Need to look at supps to make sense of that ! Ought we move the kids to Canada?

https://aspredicted.org/ZR9_Z1Y )
by matthewdgreen | 2026-02-09 14:08:28+00:00
There’s a lot of concern on the Internet about objective scientific truths being censored. I don’t see too many cases where this is the case in our world so far, outside of what I can politely call “race science.” Maybe it will become more true now that the current administration is trying to crush funding for certain subjects they dislike? Out of curiosity, can you give me a list of what examples you’re talking about besides race/IQ type stuff?
by automatic6131 | 2026-02-09 14:08:35+00:00
That steering wheel looks absolutely awful. Like a budget car. And the UX is rubbish. The easiest to reach buttons are ones that are nearly never needed: drive mode (usually used 0-2 times per trip), wiper mode (but no single wipe?). The only frequently used ones are the indicators - which I don't love but I guess stalks are a bit meh aesthetically - and the speed cruise. But sensors? Suspension? Why are they there?

The clock looks like a dollar store alarm clock. The center console otherwise looks okay, environment management can be done easily, that's a good trend to continue.

The instrument cluster has no aura - completely anonymous, doesn't make me think "Ferrari" or "high performance, high technology".

Rounded square design language isn't fit for purpose in a ferrari, which is about aerodynamic shapes that reinforce that you're in a high-performance sports car.

Jony Ive is a garbage-tier car designer. He'd fit in better at Kia. Or Volvo.
by recursivedoubts | 2026-02-09 14:08:44+00:00
glad to see some physical buttons, but there aren't nearly enough of them and they aren't differentiated enough

the emergency lights button should be colored red and elevated because it needs to be interacted with in high-stress situations

temperature should be set with a slider rather than a toggle switch because then a given temperature selection becomes spatially consistent and selecting max-hot or max-cold is instant and obvious

and so on

all in all better than expected and shows that we are moving past the "everything is an ipad" phase of civilizational development
by treeliker | 2026-02-09 14:08:50+00:00
A few technical details for those interested in the behind the scenes:

Why AST? -> Simple regex or string parsing fails as soon as you hit complex decorators or nested classes. By using Python’s native AST module, we can get an objective map of the logic flow that doesn't care about formatting or comments.

The Visualization Challenge-> Rendering a dependency graph for a repo with hundreds of files can quickly turn into a laggy hairball. We spent a lot of time tweaking the D3.js force-directed graph parameters to ensure that nodes self-organize in a way that highlights clusters rather than just creating a mess.

Why Server-side? -> We chose server-side processing to handle larger repositories without crashing the user's browser (Numpy, FastAPI etc.), but we've architected it to be non permanent. The code lives in RAM just long enough to be parsed into a JSON structure for the frontend, then it's gone.

Next steps: -> I’m looking into adding Javascript, html and css support to make debugging the frontend much easier.
by bux93 | 2026-02-09 14:09:06+00:00
You could also present 4 hexadecimal digits in a rectangle to represent values from 0000-FFFF. Currently used to display unicode characters for which your font has no glyph (the kind of tofu known as hexagana - on the wikipedia page on .notdef firefox on windows displays one with a 6-digit hex number 􏿮 )