MurphyA/hacker-news huggingface dataset:
by zerogru0x00 | 2026-02-11 01:15:14+00:00
*Built a Python Dependency Audit Tool Because Vulnerability Lists Weren’t Enough*
(A companion for compliance, not just another scanner)

Most vulnerability tools stop at giving you a list of CVEs. That’s useful, but it’s not enough if you need to *prove* your compliance, pass a security audit, or keep verifiable records for regulations like EO 14028 or NIST SSDF.

That’s why I built *AuditDeps* — a CLI tool that scans Python dependencies (`requirements.txt`, `pyproject.toml`) using OSV.dev and generates *evidence-ready, repeatable audit reports* in HTML and JSON.

*What makes it different*
- It produces self-contained, review-friendly HTML reports with scan metadata (time, scope, data source).
- JSON output fits into automated pipelines and evidence archives.
- Focused on *audit trails*, not just detection.

*Example*
```bash
auditdeps scan requirements.txt --report html
# Opens scan-report.html with dependency tree, vulnerabilities, and full context
```

*Who it’s for*
- Teams undergoing formal security/compliance reviews
- Open-source maintainers who need to document dependency hygiene
- Anyone tired of manually reformatting scanner output into audit artifacts

*Tool & repo*
- GitHub: https://github.com/0x5A65726F677275/AuditDeps
- Install: `pip install auditdeps` (after cloning)
- MIT licensed, Python-based

*Discussion points*
- How are you handling dependency audit trails in your projects?
- Are there other “evidence-ready” tools you’ve used for compliance?
- Would a similar approach be useful for other ecosystems (Node.js, Rust, etc.)?

This is a “Show HN” style post focused on solving the audit/evidence gap rather than just finding vulnerabilities. It’s built for developers who need to show — not just know — their dependency security.
RAG and Data Boundaries in Multi-Tenant Systems
by arthit-pkg | 2026-02-11 01:15:51+00:00
RAG works well in simple setups, but is it matter once you run in multi-tenant systems.

Many implementations retrieve broadly and rely on filtering later. From a security perspective, that can be uncomfortable. Once data is touched during retrieval, it’s hard to say the system never accessed something it shouldn’t have.

In practice, organizations often have layered access: parent-level policies, branch-level rules, roles, and documents that are only valid for certain periods. If that structure isn’t modeled explicitly, enforcing boundaries becomes inconsistent.

My approach that helped was treating access rules as a gate before retrieval. Only documents that already meet tenant scope, role visibility, and policy constraints are eligible for similarity search.

This reduces the risk of accidental exposure and avoids relying on prompts or model behavior as a security control.

The model becomes a consumer of already-approved context, rather than part of the enforcement path.

It’s less about stronger AI and more about clearer boundaries in the data model.

Interested in how others think about this trade-off in production.

— Arty
by gnarlouse | 2026-02-11 01:15:54+00:00
I just realized the inverse of Pascal’s wager applies to negative AI hype.

- If you believe it and it’s wrong, you lose.

- If you believe it and it’s right, you spent your final days in a panic.

- If you don’t believe it and it’s right, you spent your final days in blissful ignorance.

- If you don’t believe it and it’s wrong, you can go on living.
by fc417fc802 | 2026-02-11 01:15:57+00:00
Instead of continuing to parade your ignorance go read a whitepaper detailing the EUV process before telling me that it isn't akin to magic. Any other critical industry would have multiple competing techniques and implementors. There's even still more than one company operating cutting edge fabs despite the number dwindling as the processes got smaller.

An economic superpower identified cutting edge lithography in general as a national priority, allocated the resources, and after something like two decades of intensive research is _still_ trailing by many years. I can't immediately think of any other commercialized technology with a similar difficulty level.

As for REE, political willingness is entirely orthogonal from physical capability. A bunch of hot air on the evening news is irrelevant. If the politicians don't allocate the funds then they clearly don't see it as a top priority. If there were a pressing need then it would get done.

Where we really see the political dysfunction is the lack of planning for the future. By the time it's an urgent need there won't be enough time left for the buildout. But that's unrelated to the topic at hand.
by jameskilton | 2026-02-11 01:16:38+00:00
API documentation / types / signature is just one of the four types of documentation[1] that every service and library should ship. The other three are for telling people the things that code cannot tell you. The OP is arguing that the only "docs" you need are "how do I call this", not "what does this do", or "what do I do with the results", among plenty of others.

So no, what the author should be writing is "Ship Types and Docs".

[1] https://diataxis.fr/
by skysanctuary | 2026-02-11 01:18:55+00:00
It's a bad title.

I think he meant Christopher didn't read any of the original code himself. The AI certainly ingested it.

Though, there is this part:

"Ehrlich wrote a bridge that could call the original C code, then ran property-based tests asserting his TypeScript port performed identically."

So, he must have had some kind of awareness of how the code worked.
by adrianwaj | 2026-02-11 01:19:27+00:00
Good idea. I like the idea of:

- having a handheld that moves away from Android, but can also be used as a phone on-demand. That is, being able to turn off the telco signal. https://news.ycombinator.com/item?id=46700907

- having a handheld that can be used as a barcode scanner. https://news.ycombinator.com/item?id=46879780

- having a crypto wallet with a "kill switch" in the event of coercive standover. Could also have a surveillance switch as well. eg see Mockingjay in this thread.

"for the geeks, by the geeks and of the geeks"

Really it should/could be for the plebs and anyone with a half a brain.
by otterley | 2026-02-11 01:19:48+00:00
There are many reasons why people didn't vote, and it's not all because they sat out the election. Minors can't vote. Felons can't vote. Non-citizens can't vote. Those three groups of people comprise a substantial proportion of the total population. About half the country wasn't registered to vote. (Source: https://www.census.gov/newsroom/press-releases/2025/2024-pre...)

If GP had written "22% of the eligible voting population" or "22% of registered voters" hadn't voted for Trump, those would be more meaningful facts.
by unsnap_biceps | 2026-02-11 01:20:09+00:00
There's a difference in expectation between the reactions of a person that has under 10 seconds to react and a truck driver that had minutes of time to plan, including bypassing an emergency ramp designed specifically for runaway trucks.

After passing the Genesee exit, Aguilera Mederos's truck began to smoke as he passed a runaway truck ramp, without taking it, and instead drifted into the left lane nearly clipping a white Chevy Silverado, and passed the next exit as well. For the next few minutes, Aguilera Mederos reached speeds upwards of 100 miles per hour (161 km/h)[6] and passed the next four exits.

https://en.wikipedia.org/wiki/2019_Lakewood_semi-truck_crash
by six7vault | 2026-02-11 01:20:29+00:00
Hey HN,
I’m a solo full‑stack dev in Canada and I’ve been shipping a small suite of tools under the Six7Vault umbrella. I now have 4 working apps (Stripe wiring is the last bit I’m finishing), and I’d love feedback from this crowd on what’s worth doubling down on.
Here’s what I’ve built:
1. MindSync – a mental health–focused app that helps people reflect, track mood, and get structured prompts instead of just dumping everything into a generic notes app. The goal is to make day‑to‑day self‑reflection actually usable, not something you only touch when things are on fire.
2. The Roundtable – a multi‑AI collaboration space where different models “sit at the table”, you can compare answers, and iterate with them together. It’s aimed at people who already live in ChatGPT/Claude/etc but want a more structured way to work with multiple models at once instead of tab‑hopping.
3. Halo Gate – a scam‑detection tool designed to be dead simple for elderly and non‑tech‑savvy people. The idea is: paste an email, text, link, or “weird thing someone sent me,” and get a clear, non‑jargony answer about whether it’s likely a scam plus what to do next.
4. Prism – think TweetHunter.io but simplified and cheaper. It helps you grow and manage an X (Twitter) account without being a growth hacker: idea capture, content suggestions, scheduling, and some light analytics, aimed at solo builders and creators.
All four are full‑stack web apps (React/Next.js + Python/FastAPI/Postgres), deployed with real auth, persistence, and (soon) live Stripe keys. These are not just landing pages; they’re usable today, but I know the UX, onboarding, and positioning can be better.
Why I’m posting here
I know many of you have shipped products, killed a bunch more, and have opinions on where effort actually pays off. I’d really appreciate blunt feedback on:
• Which of these 4 (if any) is most worth focusing on first?
• Is keeping them under one “Six7Vault” umbrella dumb vs spinning them into separate brands?
• What would you need to see on the landing pages / onboarding to trust and try them?
• For MindSync and Halo Gate in particular: any red flags around positioning, claims, or ethics that I should be careful about
Happy to answer anything about the stack, what I’ve learned trying to build 4 things at once, pricing, or go‑to‑market. Blunt feedback is very welcome — including “kill X and focus on Y.”
Thanks for reading.
by mananaysiempre | 2026-02-11 01:20:37+00:00
> IMHO we need a good telnet replacement that sends signed data. Most people interpret signatures as allowed under FCC rules, just not encryption.

I know from bitter experience that IPsec is a “now you have two problems” kind of solution, but the Authentication Header is a thing and is supported by most (all?) implementations. Ham radio operators probably don’t have much use for the actual features of telnet compared to plain netcat, do they? (It’s mostly terminal feature negotiation and such.)
by ArkHost | 2026-02-11 01:21:07+00:00
Hi HN. I built this because I wanted UpNote's clean UI but with local .md files and no cloud dependency. Couldn't find it, so I built it.
Stack: Rust backend (Tauri 2.0, Tantivy for search), SvelteKit + TipTap frontend. Notes are plain markdown files on your filesystem - sync with whatever you already use.
AGPL-3.0, source on Codeberg: https://codeberg.org/ArkHost/HelixNotes
Happy to answer questions about the stack or design decisions.
by Moomoomoo309 | 2026-02-11 01:21:08+00:00
Time is a factor here. You need to launch each of these into space. Now, in the time it took to send those satellites up into space, how many datacenters and how many solar panels and how many GPUs could you have set up and built and had operational? If latency isn't a factor, why bother building them in the US? Build them in Iceland where they have cheap geothermal! The amount of rockets you'd need to launch to fit the same number of GPUs as a datacenter is definitely quite a few. SpaceX has done 165 flights in 2025. How many datacenters or solar farms or battery plants can you build in the time it'd take to launch 1 datacenter worth of satellites?

I'm entirely ignoring the problem of cooling in space (which is a huge problem!), and of how much it'd cost to launch the satellites.
by PaulHoule | 2026-02-11 01:21:50+00:00
Also those old open hearth furnaces are long gone, see

https://www.youtube.com/watch?v=BHnJp0oyOxs

There are people making top quality steel in the US today by modern methods but it wasn't like the new replaced the old, the old mostly disappeared and we got a little bit of the new.
by taysco | 2026-02-11 01:21:58+00:00
Microsoft went crazy with Windows 95 marketing and release.

They also spent 3m (reported between 8m-15m at the time though -- which was massive for its day) on licensing Stones' Start Me Up.And they actually sent some shitty live version which would have avoided paying their old bassist. Jerks.

The hype was real though. I can still remember installing the floppy version on one of my first PCs. The first start up was like Star Trek level awe. It was so radically different and cool. Imho, Windows 95 is probably one of, if not, the most important software release of all time. Shaped how PC technology was used for the next 4 decades and still going strong.

I miss the 90s where every next iteration or release of hardware/software was generally a huge improvement. Like going from a 120mb hard drive to 1.6gb disk. Or getting your first CD-ROM after only having floppies, or CD-Writer (parents bought a 1x SCSI CDR the first year consumer ones came out -- made lots of coasters). Dial up to cable internet. The feeling of experiencing those new technologies was unmatched. It created such a since of awe, inspiration and wild imagination of possibilities. I don't get that feeling much these days.
by hedora | 2026-02-11 01:22:48+00:00
For the bit less technical:

Assuming aggressive but non-breaking quantization, for LLMs, you need ~ 1 byte per parameter to run. I’ll optimistically assume diffusion models are at least as fast/quantizable (has anyone here tried?)

So, a 20b parameter model fits in 20GB of ram. At those sizes, iGPUs are fine, so we’re talking a sub-$500 box.

You can push things up to 128GB of unified ram for about $2200 with an AMD SoC.

If you think that’s expensive, don’t even think about buying GPUs or getting more than 128GB on an iGPU (apple makes one if money is no object)
by gruez | 2026-02-11 01:22:58+00:00
> If there are clues that something is bad I just get the f&$k away from it until a few hundreds years of testing have concluded which I see as common sense.

That's all fine. You might have a different risk profile. You might think the scientists have been captured by industry or whatever. You can even say "[x] is harmful". Where you get into trouble is when you go around claiming "medical consensus" or whatever, when such consensus clearly doesn't exist.
by 20k | 2026-02-11 01:23:22+00:00
The magic here with the word-ese is that a floating point expression may be contracted. In C, you write things like:

float a = /*expression*/

float b = /*expression*/

float c = a * b;

Contraction can only happen within the expressions on the right hand side, not mutually between a and b. This makes inlining, and even variable substitution not legally permitted by the C spec to be equivalent to the actually written out inlined version. Ie you can't transform:

float a = v1 * v2;

float b = v3 * v4;

float c = a + b;

Into

float c = (v1 * v2) + (v3 * v4);

As they aren't semantically equivalent, and compilers do follow these rules. The same applies for inline functions. Its one of the reasons why macros can sometimes perform better than force-inline functions

In practice, the big 3 compilers all perform floating point contraction according to the spec, and this is a major issue if you want to get good gpgpu performance because this extends to OpenCL and C-style languages in general (like CUDA)
by StilesCrisis | 2026-02-11 01:23:23+00:00
To be clear, I have no beef with Google the company and wouldn't mind working there again if it weren't in the ads division. After two years I transferred to the Chrome org and greatly enjoyed the work there. I was proud to develop something that is used the world over, it's open source, and I got to optimize tight code and tune for performance. (Yes, Chrome is fast, I don't understand the haters!) If I had just quit Google immediately, this wouldn't have happened and I would've missed out on a great experience.
by resters | 2026-02-11 01:24:54+00:00
I think the moat depends on how long it takes for an agent to ingest the entire commit history and product documentation into context on the fly. At the rate models are improving, seeing the reasoning chain of an outdated model that led to a commit that warrants post-hoc review (likely becuase of a bug) would mainly be useful for root cause analysis more than for insight into what to do next... but chances are the newer model would have been able to infer it from local context anyway.

It also creates a challenge with respect with the embedding model chosen and how future proof it turns out to be.
by reliabilityguy | 2026-02-11 01:27:06+00:00
> "anyone who looks like they may speak Spanish even if no crime has been committed,"

There are two parts to it in my view.

First, sure, I understand where you are coming from. At the same time I find this argument a bit problematic because if the numbers on border crossings from South America are true, and majority of those that crossed through are from South and Central America, who do you think ICE is going to look for? Tall, blond, white people from Norway (and I am not saying that there are no people who are out of status from Norway)?

Second, while Trump and co claimed that they will go after "only after criminals", and ICE arrests a bunch of people who may be not criminals in the hardcore sense of killers, etc., but they do arrest a significant amount of those as well. I do not understand this -- if the person crossed the border, are they supposed to get a pass just because? Why?
by loeg | 2026-02-11 01:27:14+00:00
That's their cut in the US, the market with the highest total interchange fees. In other markets with lower total fees, it's hard to imagine Visa/MC's cut being higher. They do a pretty useful service for a pretty reasonable fee.

Patio11 doesn't name names or give precise figures, but: https://www.bitsaboutmoney.com/archive/how-credit-cards-make...
by alsetmusic | 2026-02-11 01:27:16+00:00
Really cool to see this come back after the first pass. I always wonder if an interesting project will be seen again after someone asks for feedback. I'm really happy that you're back to show progress on this and will give it a test run tomorrow to maximize the seven day demo.

I chose this particular point to comment to further encourage a screenshot gallery and to mention that Help is a section I'm unlikely to open unless I'm learning about an API. Just wanted to share why I wouldn't have found that screenshot without you pointing to it.

Congrats again. Looks great!
by SchemaLoad | 2026-02-11 01:27:21+00:00
I had a look at that gist, and the majority of it is a result of the responsibility of wayland being smaller. xorg was dumping ground for a lot of functionality it shouldn't have been responsible for, so the majority of those Xs on the list are things that very much do work on a Linux system on wayland, just in theory you could build a wayland spec compliant DE which doesn't have them, but if you just install Gnome/KDE, it will all work.

For all the noise about the "unix philosophy" and systemd being too all encompassing, Wayland went the other way and people still aren't happy.
by abcde666777 | 2026-02-11 01:27:35+00:00
To be honest I find myself in disagreement with this attitude despite being a semi old-school programmer myself (I cut my teeth on C/C++/assembly in the early 00s). I think the author is caught up in the artist's dilemma - that being, they want to take part in the craft for the joy of it rather than for the results it produces.

Harsh take: nobody's stopping you from doing that. You can dust off an old computer right now and write software for it. All of that joy still exists. It's just that nobody's going to pay you for it and it's no longer mainstream relevant - the world's moved on from those times, in many cases for good reasons.

So I think what the person really wants is to have their cake and eat it too. They want to be mainstream relevant and employable... whilst having fun.

That's a luxury. More specifically it's a first world luxury. Most people don't get to have that. True, many programmers did get to have it for a time - but that doesn't mean we're entitled to it forever - not unless it's somehow directly tied to producing valuable results.

But you know it's strange to me that programmers lose sight of this. I became a programmer because I saw Wolfenstein 3D on a 386, and was inspired by there being a "world in the box". I wanted to make worlds too. That's an important distinction: I didn't become a programmer because I wanted to write code, I became a programmer because I wanted to create worlds. The programming is a means to an end, it's not the end unto itself - at least I never looked at it that way. And that's in spite of the fact that I genuinely enjoy programming in and of itself. But I still value the outcome more.

And in fact I actually went through a related transition some years ago on a personal level, when I shifted from always trying to write game engines from the ground up to being willing to use engines like Unity or Unreal. It felt like a betrayal - I no longer had a deep understanding of every layer, I could no longer bespoke craft everything to my personal whims. But you know what? It was absolutely the right choice because it put me on track to actually finishing the games I was working on, which was the entire point of the exercise in the first place.

So I don't bemoan or regret it for a second.

Anyway hope that didn't sound too blunt - it's just my way of speaking - I can sympathize with the author but I just think it's on the self-indulgent side.
by fennec-posix | 2026-02-11 01:27:35+00:00
Not the parent poster, but I also still use telnet. For me it's "Ancient", I have a few retired SPARC and PA-RISC boxes that run their period appropriate OSes as a hobby. Telnet/rlogin is the more reliable method to get into them remotely (just over the LAN).

They're on a LAN behind a NAT Router/Firewall, and I don't always keep them powered up (I'm not that insane) so I really don't have a concern for them.

Some of the more modern/high-performance examples I have run NetBSD with modern sshd and modern ciphers, but you can tell it's a bit of a workout for them.
by 0xbadcafebee | 2026-02-11 01:27:37+00:00
Telnet is used in legacy, IoT, embedded, and low-level industrial hardware. It's also intentionally enabled on devices where automation was written for telnet and it wasn't easy to switch to ssh.

If you investigate most commercial uses of ssh, the security is disabled or ignored. Nobody verifies host keys, and with automation where hosts cycle, you basically have to disable verification as there's no easy way around the host keys constantly changing. Without host key verification, there's kinda no point to the rest.

Even assuming the host keys were verified, the popular ssh conventions are to use either long-lived static keys (and almost nobody puts a password on theirs), or a password. Very few people use SSH with 2FA, and almost no-one uses ephemeral keys (OIDC) or certificates (which many people screw up).

So in terms of how people actually use it, SSH is one of the least secure transport methods. You'd be much more secure by using telnet over an HTTPS websocket with OAuth for login.
by gruez | 2026-02-11 01:27:47+00:00
That just shifts the problem around. Where's your evidence that there's a "Scientific consensus"? So far as I can tell there's only two studies, a in-vitro one (ie. the OP) and a cohort study from 2023. If an in-vitro study and a cohort study are all you need to claim it's "quite well studied" and that there's a "consensus", I think your bar is awfully low. On the second page of HN there's a story where some is commenting that mRNA vaccines cause heart issues, citing one study, and I'm sure that the vaccines quacks have more studies than just that one.

https://news.ycombinator.com/item?id=46969206