MurphyA/hacker-news huggingface dataset:
by lern_too_spel | 2026-02-21 04:44:51+00:00
The API is implemented in 36.1, but the previously proposed notarization requirement is not enforced in any production build, so this error is never thrown. Even if they implement the scare text, this API will still be needed.

If they implement what they said they would implement after the uproar, users will be better off. Previously, if a company wanted to distribute their app on their website, any user who installed it would have to dismiss scare text. Now, they have a way to distribute apps on their website without the scare text, and people who want to distribute apps without any tracking can still do that with the scare text.
by foxglacier | 2026-02-21 04:45:14+00:00
I mostly use Facebook by clicking on email notifications which are always real posts or comments by my real life friends. Some of them are a bit political but I just ignore those.

I just tried scrolling down the homepage and mine doesn't have any extreme political crap. However, it does have local political crap about the popular local issues (mostly bike lanes). Most of it is just harmless stuff like dashcam videos of bad local drivers, historic photos of my city, local issues like city infrastructure problems, curiosities like rare animals or space photos, and ads - tons and tons of ads.

I think it probably depends what you've engaged with indeed.
by KPGv2 | 2026-02-21 04:46:22+00:00
That's a hack. What you should do is a .gitignore with * and then a whitelist of paths like src/**/*.

If you rely on `add -f` you will forget to commit something important.

For example, for a tree sitter grammar I developed a couple years ago, here is my .gitignore:

```

# Ignore everything

*

# Top-level whitelist

CHANGELOG.md

# Allow git to see inside subdirectories

!*/

# Whitelist the grammar and tests

!/grammar/*.js

!/test/corpus/*.txt

# Whitelist any grammar and tests in subdirectories

!/grammar/**/*.js

!/test/corpus/**/*.txt

```*
Show HN: AI Code Review Agent – Automated PR Reviews with Google ADK and Gemini
by tme15b014 | 2026-02-21 04:46:23+00:00
Production-ready AI agent that reviews GitHub pull requests using Google's ADK
and Gemini 2.5 Flash. Analyzes code for security, performance, and correctness issues.
Deploys to Cloud Run, posts structured feedback as PR comments.
Show HN: Filepack: a fast SHASUM/SFV/PGP alternative using BLAKE3
by rodarmor | 2026-02-21 04:46:26+00:00
I've been working on filepack, a command-line tool for file verification on and off for a while, and it's finally in a state where it's ready for feedback, review, and initial testing.

GitHub repo here: https://github.com/casey/filepack/

It uses a JSON manifest named `filepack.json` containing BLAKE3 file hashes and file lengths.

To create a manifest in the current directory:

filepack create

To verify a manifest in the current directory:

filepack verify

Manifests can be signed:

# generate keypair
filepack keygen

# print public key
filepack key

# create and sign manifest
filepack create --sign

And checked to have a signature from a particular public key:

filepack verify --key <PUBLIC_KEY>

Signatures are made over the root of a merkle tree built from the contents of the manifest.

The root hash of this merkle tree is called a "package fingerprint", and provides a globally-unique identifier for a package.

The package fingerprint can be printed:

filepack fingerprint

And a package can be verified to have a particular fingerprint:

filepack verify --fingerprint <FINGERPRINT>

Additionally, and I think possibly most interestingly, a format for machine-readable metadata is defined, allowing packages to be self-describing, making collections of packages indexable and browsable with a better user interface than the folder-of-files ux possible otherwise.

Any feedback, issues, feature request, and design critique is most welcome! I tried to include a lot of details in the readme, so definitely check it out.
Show HN: WP2TXT – Wikipedia dump text extractor with category/section filtering
by yohasebe | 2026-02-21 04:46:34+00:00
WP2TXT is a command-line tool that extracts plain text from Wikipedia dump files. I originally built it in 2006 for corpus linguistics research and have maintained it since. The latest version (2.1) was largely rewritten with features for selective extraction:

- Auto-download dumps by language code (350+ languages)
- Extract specific articles by title without downloading the full dump
- Extract articles from a Wikipedia category with subcategory recursion
- Extract specific sections by name with alias matching (e.g., "Plot" also matches "Synopsis")
- Template expansion (dates, coordinates, unit conversions → readable text)
- Content type markers ([MATH], [TABLE], etc.) instead of silent removal
- Category metadata preserved in output
- JSON/JSONL output
- Parallel processing (English Wikipedia 24 GB dump: ~2 hours on Apple M4)
- Written in Ruby.
by UqWBcuFx6NV4r | 2026-02-21 04:47:36+00:00
I love the arguments where you tell me what I “must admit”.
I simply don’t, therefore your entire point is meaningless.
I’m sorry that something so inconsequential irked you so much. Maybe you need to read a book about git if this stumped you bad enough to want to voice your upset about it years later?

I’d consider yourself lucky that everything else is going so well that this is what’s occupying you.
by Ygg2 | 2026-02-21 04:50:08+00:00
> No? They caught it!

No? Who else has 2-3 years worth of time to become a contributior and maintainer for obscure OSS util?

> Exactly. Not sure how you think this makes the point different. Everything in Debian is volunteer, the fact that people do other stuff is a bonus.

What you mean exactly? This isn't curation working as intended. This is some random dev discovering it by chance. While it snuck past maintainers and curator of both Debian and Red Hat.

> Everything in Debian is volunteer, the fact that people do other stuff is a bonus. Point is the debian community is immunized against malicious software because everyone is working on validation downstream of the authors.

You can do same in NPM and Cargo.
Release a v1.x.y-rc0, give everyone a trial run, see if anyone complains. If they do, it's downstream validation working as intended.

Then yank RC version and publish a non-RC version. No one is preventing anyone from making their release candidate version.
Show HN: Mukoko weather – AI-powered weather intelligence built for Zimbabwe
by bryanfawcett | 2026-02-21 04:51:00+00:00
Zimbabwe has 90+ towns and cities, a population of 15+ million, significant agricultural and mining sectors — and almost no weather infrastructure built specifically for it. Global apps cover Harare and Bulawayo at best, and the AI summaries they generate read like they were written for someone in London.
I built mukoko weather to fix this. A few things that shaped the approach:
Weather as a public good. The platform is free, no ads, no paywalls. If a smallholder farmer in Chinhoyi needs frost risk data to protect their crops tonight, that can’t be behind a subscription.
Hyperlocal context matters more than raw data. Zimbabwe has distinct agricultural seasons — Zhizha (rainy), Chirimo (spring), Masika (early rains), Munakamwe (winter). Elevation varies dramatically: the Highveld sits above 1,200m, the Zambezi Valley below 500m. The AI assistant, Shamwari Weather, is prompted with this geographic and seasonal context so its advice is actually meaningful to the user.
Constrained environments are the primary target, not an edge case. Mobile-first, bandwidth-efficient, PWA-installable. The majority of users are on Android, often on 3G or spotty LTE. That’s not a future concern — it’s the baseline.
Technical decisions:
∙ Next.js 15 App Router on Cloudflare Pages + Workers
∙ AI summaries via Anthropic Claude SDK, server-side only, cached at the edge with KV and immutable TTL tiers (AI-generated weather advice shouldn’t change retroactively)
∙ Open-Meteo for forecast data (free, high-quality global model coverage)
∙ 90+ Zimbabwe locations validated against geographic bounds with elevation data for frost modelling
The broader vision is weather as infrastructure within a larger Africa super app (Mukoko Africa), with Zimbabwe as the proof of concept before expanding to other developing country markets using the same locally-grounded approach.
Would love feedback on the approach, especially from anyone who’s built for similar markets — low-bandwidth, mobile-dominant, regions underserved by global platforms.
by fallenranger | 2026-02-21 04:53:58+00:00
I built this because every company I've worked at ends up rebuilding the same webhook infrastructure from scratch. Retry logic, signature verification, delivery logs, failure alerts — it's always the same code, and it's never prioritized until something breaks in production.
WebhookStream handles the full lifecycle:

Receive inbound webhooks and relay them to multiple destinations simultaneously with configurable retries and timeouts
Verify signatures from Stripe, GitHub, Shopify, and other providers automatically
Send outbound webhooks with a visual builder — set the URL, method, headers, payload, then fire and inspect the response
Set up smart alerts with AND/OR logic — get notified via email, Slack, or webhook when specific conditions match
Full REST API with scoped tokens for managing endpoints and reading logs programmatically
Endpoint subscriptions so developers can subscribe via API and receive forwarded webhooks without touching the UI
Team collaboration with role-based access, IP allowlisting, and SSO/SCIM on Enterprise

Free tier available, no credit card required.
I'd love feedback — especially on what's missing or what would make you switch from your current webhook setup. Happy to answer any questions about the product or technical decisions.
by globalnode | 2026-02-21 04:54:08+00:00
flock safety were in one of y combinators incubator programs but to be fair, saying you want to make a camera company to improve public safety but then being used in a dystopian way... well it should have been foreseeable shouldn't it? Im conflicted in this, I love camera tech and its probably not going away any time soon, but wonder how it could be used responsibly for public safety only.
by woodruffw | 2026-02-21 04:55:22+00:00
Sure, but I think the useful question is whether it’s good enough for the median Python codebase. I see the story as similar to that of static typing in Python; Python’s actual types are dynamic and impossible to represent statically with perfect fidelity, but empirically static typing for Python has been very successful. This is because the actual exercised space is much smaller than the set of all valid Python programs.
by colordrops | 2026-02-21 04:56:55+00:00
Well fuck those venues. It's a small percentage. I've never run into one and I live in LA, a city with hundreds if not thousands of venues.

So you only get 98% of the world instead of 100%. That 98% is far more than the the 100% of 10 years ago. Everyone wants perfection when they've already got abundance.
by thephyber | 2026-02-21 04:57:47+00:00
> But it would be good for more people to learn about this so they don't get angry when they see their male-identified partners/friends feeds.

You seem to be assuming that none of them fall for the thirst traps. The reason thirst traps exist is because they work a good percentage of the time.

And despite your confident statement that “it doesn’t bother me anymore”, you only become “banner blind” to some content. The more authentic the content appears or the closer the topic is to something you are interested in, the more likely you are to engage with it.

I try to avoid BookFace with a passion, but I struggle with these issues on YouTube. My solution is to never browse YouTube while logged in, always use Incognito Mode, depend on browser bookmarks (instead of like/subscribe), and to close the browser as soon as I realize The Algo is pushing content I don’t care for.
by iamflimflam1 | 2026-02-21 04:58:37+00:00
> We show that exposure to algorithmically curated content led users to follow conservative activist accounts. In contrast, when the algorithmic feed was switched off, users continued to follow the accounts they had engaged with previously. This indicates that exposure to feed algorithms has a lasting impact on users’ feeds and their political attitudes.

Once you’ve been radicalised it’s very hard to go back to normal.
by drum55 | 2026-02-21 04:58:45+00:00
I occasionally saw a readme with a couple of Emoji in it, but the behavior where every title, every bullet point, every sentence ends with one or more of them is utterly obnoxious. There's something about the sources that chatGPT uses which causes it just sprinkle Emoji absolutely everywhere, it's one of the most obvious tell tales that it came from chatGPT with a prompt.
by awedisee | 2026-02-21 04:58:47+00:00
Okay? I suppose your next soapbox lecture will be on combustible engines and how "noxious, noisy, unreliable, and elephantine" and how they vibrate so much they can "loosen ones dentures"?

You know these can be SELF-HOSTED, using LOCAL MODELS like Ollama? Or maybe your just like putting your two cents in without actually doing your own research.

Thanks bud!
Show HN: Skill Check CLI for your skill.md
by thedaviddias | 2026-02-21 05:01:40+00:00
I've accumulated a ton of useful skills (skill.md) for my AI agents and to use on .cursor, .claude., .codex.

But I needed a tool to ensure they would respect some basic rules to avoid security issues and burning too quickly my tokens.

Now, with npx skill-check, I can quickly inspect any online skills or my own and fix any issue automatically.
by defrost | 2026-02-21 05:02:16+00:00
The US ship building industry is barely kicking along .. by intent, for whatever reason the US is not competing for the 90% of global commercial ship building demand currently met by China, Korea, and Japan.

This does not mean there is zero hope of scaling up should wartime demand come into existence.

Although U.S. shipbuilding is greatly diminished today, it is not the national security concern many would lead us to believe. America’s rapid expansion of ship production during World War II serves as a reminder of what allowed America to increase its ship production historically. Orders surged from the US government and other allied nations for commercial ships. Companies converted capital and entered the ship building business to meet the orders; Henry Kaiser built a shipyard in Richmond and got it operational in 78 days.

~ Is the U.S. Shipbuilding Capacity in Crisis? - Today’s Low Industrial Output May Not Signal Strategic Weakness https://www.theunseenandtheunsaid.com/p/is-the-us-shipbuildi...

Currently the demand for US military shipping is low, some suggest a change in organisational structure and siloing might be a path forward: The Next Great Era in U.S. Shipbuilding https://www.usni.org/magazines/proceedings/2025/february/nex...
Show HN: Stop Pasting Credentials in Slack
by ankurbhugra | 2026-02-21 05:02:27+00:00
I built VaultLink to solve a recurring problem: how do you securely share an API key or password with someone when you don’t use the same password manager (or don’t use one at all)?

VaultLink encrypts secrets client-side using the Web Crypto API (AES-256-GCM). The encryption key is delivered via a URL fragment (#key=...), which is never sent to the server. The server stores only ciphertext, IV, and salt. Decryption happens entirely in the browser.

Access requires email OTP, and view limits are enforced atomically at the database level to prevent race conditions.

It’s not trying to replace password managers or prevent a recipient from copying a secret. The goal is to reduce accidental exposure and long-lived credential leaks in chat.
by drum55 | 2026-02-21 05:02:52+00:00
https://raw.githubusercontent.com/psyb0t/piraterf/88c5fc416d...

That's because it's in the .gitignore.

It's just very obviously made with claude, from the style, to the commits of tens of thousands of lines of code a day, to the parts where Claude commits something sensible and the author goes back to add in curse words. Nobody has ever developed software in the same way that claude tends to, where suddenly a whole readme appears in a commit fully formatted and filled with emojis.
by cryptonector | 2026-02-21 05:02:59+00:00
Hey TFA, other people have gone to prison for finding monotonic user/account IDs and _testing_ their hunch to see if it's true. See, doing that puts you at great risk of violating the CFAA. Basically, the moment you knew they were allocating account IDs monotonically and with a default password was the moment you had a vulnerability that you could report without fear of prosecution, but the moment you tested that vulnerability is the moment you may have broken the law.

Writing about it is essentially confessing. You need a lawyer, and a good one. And you need to read about these things.
by zdc1 | 2026-02-21 05:03:41+00:00
I recall studies showing that reading in poor lighting conditions is a cause of myopia in children. So I'm questioning whether we want to be reducing luminance on our devices at all.

I like my (warm-coloured) lights and screens set to max brightness. I find it's easier to read and lets me work with more distance from the screen.

But what about easier sleep? Could we exercise more? Leave screens out of the bedroom? I have no idea.
by somenameforme | 2026-02-21 05:03:50+00:00
Your source does not seem aware of the history of tax brackets. In Truman's era the top rate started at $100k income and was 90%. Even at $60k it was 80%. Those are figures from 1953, when Truman left office. [1]

This wasn't that big of a deal for the average person at a time when the median salary was somewhere around $3k, but for a person with significant overhead and large, but not enormous, income -- in other words, exactly like Truman -- it was devastating.

[1] - https://taxfoundation.org/data/all/federal/historical-income...
by spankalee | 2026-02-21 05:03:51+00:00
I still don't know what you're arguing.

Is it that Lit gives you a different way of authoring web components than the raw APIs? Yes, that's entirely the point. It's a library that gives you better ergonomics.

Is it that from the outside the components aren't "Lit", but consumed as standard web components? Again, yes, that's entirely the point.
by disillusioned | 2026-02-21 05:04:00+00:00
Just click search on Instagram and BAM, thirst trap central. Don't have to have ever interacted with ANY of them, liked any of them, or follow anything CLOSE to that content, it's coming for you if you're a male between the ages of 18-99 that, presumably, the algo thinks is straight-leaning.

My _feed_ on Instagram is a bit more curated and sticks closer to that curation: weird music stuff, weird instrument stuff, and because I show my daughter a lot of it, Broadway musical stuff/BTS content/other actually interesting/cool stuff. So generally speaking my IG feed is curated and good. My FB feed is still trash; it feels like it casts a much wider net, but I've also been proactively following accounts that interest me on IG and don't do that much at all on FB (except some stand up comedians, since the format is actually really good for casual bite-sized scrolling).

But IG search... woooooo boy, it's _wild_. I have to hide my phone away from my daughter when I'm trying to pull up a specific account because the search interface is completely bikini-clad crazy thirst content. And again, I've literally never engaged or interacted or even really _lingered_ on any of those posts. It just goes for it.
by dividefuel | 2026-02-21 05:04:29+00:00
I agree with this a lot. In the late 2000s, which for me was when I was about 20, posts were very throwaway and low effort -- in a good way! You never really knew what you'd see when you logged in. Photos of stupid things or silly status updates, etc.

Over the next five years though, content gradually shifted to mainly image crafting. Over-processed photos, highlight reel curated trip photos, major life updates, etc. It felt like the bar was higher on what people would share, but unfortunately that removed a lot of the things that made FB fun in the first place.

I don't know whether it was a more universal shift or whether it had more to do with the age of my peers.
by adgjlsfhk1 | 2026-02-21 05:05:31+00:00
I don't know whether there was an opus that ran into trouble or if they just looked at the model they had and decided that they could charge more than originally intended.
sonet 4.6 presumably is either a version of sonet 4.5 with optimizations for cost instead of perf (or a haiku that also got upscaled).
Anthropic is preparing for IPO this year, so it's not exactly a stretch to suggest that they might be trying to decrease their losses and increase inference margin.
by autoexec | 2026-02-21 05:07:24+00:00
They're a good example of why we shouldn't have that. It wasn't DEI that made them crap it was letting people buy their way in and shifting the focus from education to networking for nepo-babies. George W. Bush is a prime example of a massively uneducated idiot who had no problems getting accepted to and graduating from Ivy Leagues.
by thephyber | 2026-02-21 05:08:16+00:00
You didn’t try hard to repro it.

Facebook uses your likes / groups / searches to customize your feed. If are active and don’t delete your old content, you have already trained FB to avoid the thirst traps for your account.

The article author said he was off-site site for 8 years, so FB was offering him random high engagement content to stuff his feed so he didn’t reach the end.
by why-el | 2026-02-21 05:08:18+00:00
For Oauth I'd like to borrow what I would describe humbly as a better analogy, and it comes from Douglas Crockford, and so adapting it from him commenting on Monads in Functional Programming, it goes something like this:

"OAuth is a simple idea, but with a curse: once you understand it, you lose the ability to explain it."
by troupo | 2026-02-21 05:08:20+00:00
Unfortunately, as most of them left Twitter they also temoved all their accounts, so you can only see responses from framework authors like Rich Harris.

But here's a very on-brand toot from Alex Russel: https://toot.cafe/@slightlyoff/113222280712758802

This is the article he's reacting to: https://dev.to/ryansolid/web-components-are-not-the-future-4...

---

Or here's Lou Verou (a TAG member) calling it hate (this is the mildest reaction, btw): https://x.com/LeaVerou/status/1840134654852247765 and uncritically reposting a bullshit article calling it excellent https://x.com/LeaVerou/status/1839736908370587947 (see reaction by Vue author: https://x.com/youyuxi/status/1839833110164504691 and https://x.com/youyuxi/status/1839834941884121363)

Note that Lea Verou also says that people decided to fix some things around web components after her post in 2020: https://lea.verou.me/blog/2024/wcs-vs-frameworks/

Here's Rich Harris (author of Svelte) in 2019: https://x.com/Rich_Harris/status/1198332398561353728

Here's the 2022 Web Components Group report: https://w3c.github.io/webcomponents-cg/2022.html. Notice similarities?

Literally everything web framework authors have been saying for ever has been completely ignored in favor if the in-group/tribe.

Literally nothing has changed. Nothing at all.
by ssivark | 2026-02-21 05:08:22+00:00
> speculative decoding for bread and butter frontier models. The thing that I’m really very skeptical of is the 2 month turnaround. To get leading edge geometry turned around on arbitrary 2 month schedules is .. ambitious

Can we use older (previous generation, smaller) models as a speculative decoder for the current model? I don't know whether the randomness in training (weight init, data ordering, etc) will affect this kind of use. To the extent that these models are learning the "true underlying token distribution" this should be possible, in principle. If that's the case, speculative decoding is an elegant vector to introduce this kind of tech, and the turnaround time is even less of a problem.