MurphyA/hacker-news huggingface dataset:
by lproven | 2026-02-11 13:35:28+00:00
MacOS 10.15 dropped support for x86-32 binaries.

Later it became clear why: the Apple Silicon transition, and Rosetta 2, which is optimised for running x86-64 binaries on Apple's Arm64.

But the same change is looming on Linux: Ubuntu tried in 2019 but was persuaded not to, Fedora has tried more than once.

WINE 11 can run Win32 binaries on a pure 64-bit host OS without 32-bit libraries. So, you can run some 32-bit Windows games on 64-bit Linux and macOS which cannot run the 32-bit binaries of their own older versions.

Apple merely jumped first. I think it's not to be blamed here. It'll happen everywhere in time.
by jeremyscanvic | 2026-02-11 13:36:11+00:00
Blur is perhaps surprisingly one of the degradations we know best how to undo. It's been studied extensively because there's just so many applications, for microscopes, telescopes, digital cameras. The usual tricks revolve around inverting blur kernels, and making educated guesses about what the blur kernel and underlying image might look like. My advisors and I were even able to train deep neural networks using only blurry images using a really mild assumption of approximate scale-invariance at the training dataset level [1].

[1] https://ieeexplore.ieee.org/document/11370202
by Otterly99 | 2026-02-11 13:36:22+00:00
Well said. I use it the same way.
Sometimes, a technical book will assume that you know a concept or will even use an acronym that is not explained (but obvious) or is just plainly not very explicit. I also use it to directly test my knowledge of the subject (you have to be careful of the people-pleasing behavior, but in my experience they tend to gently tell you where you're wrong rather than lie to you).
Same goes for hands-on books. Sometimes the example are not very interesting, or you have something of your own that you would like to try.
As long as you use it carefully like this, it can be really transformative.
I do agree that there is a potential risk of offloading too much thinking to it, but if you keep that in mind, I don't see the problem.
by zachdotai | 2026-02-11 13:36:56+00:00
Yeah the demo-to-production gap is massive. We see the same thing with browser agents being potentially the most vulnerable. And I think this is because of context being stuffed with the web page html that it obscures small injection attempts.

Evaluation is automated and server-side. We check whether the agent actually did the thing it wasn’t supposed to (tool calls, actions, outputs) rather than just pattern-matching on the response text (at least for the first challenge where the agent is manipulated to call the reveal_access_code tool). But honestly you’re touching on something we’ve been debating internally - the evaluator itself is an attack surface. We’ve kicked around the idea of making “break the evaluator” an explicit challenge. Not sure yet.

What were you seeing at Octomind with the browsing agents? Was it mostly stuff embedded in page content or were attacks coming through structured data / metadata too? Are bad actors sophisticated enough already to exploit this?
Show HN: Auditi – open-source LLM tracing and evaluation platform
by ariansyah | 2026-02-11 13:37:02+00:00
I've been building AI agents at work and the hardest part isn't the prompts or orchestration – it's answering "is this agent actually good?" in production.

Tracing tells you what happened. But I wanted to know how well it happened. So I built Auditi – it captures your LLM traces and spans and automatically evaluates them with LLM-as-a-judge + human annotation workflows.

Two lines to get started:

auditi.init(api_key="...")
auditi.instrument() # monkey-patches OpenAI/Anthropic/Gemini

Every API call is captured with full span trees, token usage, and costs. No code changes to your existing LLM calls.

The interesting technical bit: the SDK monkey-patches client.chat.completions.create() at runtime (similar to how OpenTelemetry auto-instruments HTTP libraries). It wraps streaming responses with proxy iterators that accumulate content and extract usage from the final chunk – so even streamed responses get full cost tracking without the user doing anything.

What makes this different from just tracing:
- Built-in evaluators – 7 managed LLM judges (hallucination, relevance, correctness, toxicity, etc.) run automatically on every trace
- Span-level evaluation – scores each step in a multi-step agent, not just the final output
- Human annotation queues – when you need ground truth, not just vibes
- Dataset export – annotated traces export as JSONL/CSV/Parquet for fine-tuning

Self-host with docker compose up.

I'd love feedback from anyone running AI agents or LLMs in production. What metrics do you actually look at? How do you decide if an agent response is "good enough"?

GitHub: https://github.com/deduu/auditi
by FlorianBruniaux | 2026-02-11 13:37:13+00:00
Love this tool

RTK - 15-Day Summary (Jan 28 → Feb 11)

- 7,081 commands intercepted, 24.6M chars saved out of 29.4M input → 83.6% average reduction
- Peak efficiency: 96%+ on heavy implementation days (Feb 3-4, ~11.6M input on Feb 4 alone)
- Busiest day: Feb 2 with 1,413 commands (but only 39% savings — likely many non-RTK commands)
- Most productive week: Feb 2-8 → 4,916 cmds, 19.4M chars saved
- This week trending lower (77.5% savings) — likely more complex pipes/unsupported commands
- Bottom line: ~24M characters of context window saved in 2 weeks. That's significant token budget reclaimed.
by joshvm | 2026-02-11 13:37:27+00:00
Baffin make some of the best cold weather boots. We use them in Antarctica, though you probably don't want the chonky -70C rated ones. I have some lighter boots rated for about -40 and they're great. Really any good gore tex mid-ankle hiking boot is probably fine. Whether you need cold rated boots is going to depend on where you're walking.

Your main concern is to stay dry and minimize snow incursion. Either wear ski pants that act as gaiters, use gaiters or use boots and socks that are high enough that you won't get snow down the sides.

If you buy boots with insulation, try not to compress it. Otherwise be aware that if you don't keep moving, your boots will eventually cool to ambient and it's pretty hard to get that temperature back up.

Check grip? Hard to test but warm doesn't necessarily mean any good on slick ice. Spikes work well if you're going on a hike and there's a lot of packed snow mixed with ice.

Don't forget good socks. Doesn't need to be anything fancy, but wool is by far the best material (not necessarily merino as it tends to be too thin). You may need to size up because of the extra padding.

Also luxury, but fan assisted boot drying/warming stations are great. They make quite a big difference if you go out a lot because moisture build-up takes ages to dry otherwise.
Autonomous Bug Bounty Agent: Architecture and Safety Proxy (Design Only)
by Layer_8 | 2026-02-11 13:37:49+00:00
Hello HN,

We’re three security researchers in Tokyo building an autonomous agent framework for authorized security testing (VDP/Bug Bounty).

We wanted to share our experimental results running this agent against live targets (as of Feb 8):

Real-World Impact: Reached #86 globally on the HackerOne VDP leaderboard (90 days).

Gov Targets: 3 vulnerabilities triaged by the U.S. Department of Defense (DoD).

Benchmark: Solved 84% of PortSwigger Web Security Academy labs autonomously.

Interestingly, we encountered an "Impact Gap": while the agent finds technically valid exploits, it often struggles to assess business criticality, leading to "Informative" closures.

We released our architecture design and safety proxy details on GitHub. We'd love to hear your thoughts on bridging this gap between technical exploitability and business impact.

URL: https://github.com/cyberprobe-ai/autonomous-pentest-agent-research
Show HN: Server Compass – GUI SSH client, deploy like Vercel but VPS pricing
by vankhoa1505 | 2026-02-11 13:37:50+00:00
Hey HN,

I built Server Compass because I got tired of two extremes: paying $200+/month to Vercel/Railway for a polished deploy experience, or wrestling with self-hosted panels (Coolify, CapRover, Dokploy) that eat up half my VPS resources just to run their dashboard.

The core idea: A GUI SSH client that gives you Vercel-like deployment UX on your own VPS. Nothing gets installed on your server except your apps – every command runs over SSH from your desktop.

What it does:

- 1-click deploys from GitHub repos or 160+ pre-built templates (Postgres, WordPress, Ghost, Supabase, n8n, etc.)
- Zero-downtime deployments with blue-green strategy
- Domain + SSL management (Let's Encrypt auto-renewal, Cloudflare tunnel support)
- Real-time logs streamed in-app, no more ssh && docker logs -f
- Visual cron jobs, env vars, file browser – basically everything you'd SSH in for
- GitHub Actions CI/CD – builds use your free GH Actions minutes, not your server CPU
- Full terminal when you need raw SSH access

What makes it different from other GUI SSH clients:

Traditional SSH clients (Termius, Royal TSX) give you a nicer terminal. Server Compass wraps SSH with a deployment-focused UI – think "Vercel but the backend is just your VPS."

Unlike Coolify/CapRover, there's no agent or dashboard consuming your VPS resources. Every command goes direct from your Mac/Windows/Linux lap → your server over SSH. If I disappear tomorrow, your deployments still work.

Pricing: $19 one-time. No subscriptions.

Happy to answer questions about the architecture or demo specific workflows.
by cepcode | 2026-02-11 13:38:19+00:00
> And I thought: mate, you were already so far up the abstraction chain you didn’t even realize you were teetering on top of a wobbly Jenga tower.

But AI is different. If I program in a high level language like Python, sure I don't know what's going on under the hood. But you get a 'feel' for it because the same code usually reproduces the same results. Does AI reproduce the exact same results when I ask the same thing? That I don't know.
by Layer_8 | 2026-02-11 13:38:31+00:00
Quick clarifications (to avoid ambiguity / keep this responsible):
Authorized only: we run this strictly within explicit VDP/bug bounty scopes. We do not run it as a general internet crawler.
Human-in-the-loop: the system drafts a report + evidence, but a human makes the final call and we never auto-submit.
Scope-enforcing proxy: all outbound traffic is forced through a gate with default-deny, FQDN allowlists, method constraints, rate/concurrency caps, and full allow/deny logging.
“Safe PoC” policy: we prioritize read-only verification patterns and stop on signs of instability (error spikes, account risk, unexpected side effects). We’re not sharing real-world exploit payloads here.
Metrics: “84% labs solved” refers to server-side lab completion outcomes; details / breakdown are in the README.
The thing we’re most interested in feedback on is the “impact gap”: how would you teach an agent to estimate business severity (or chain low-severity issues into a meaningful impact narrative) without pushing into risky/destructive testing?
Show HN: I extract recipes from TikTok, Instagram, and the messy web
by sklaiber | 2026-02-11 13:38:38+00:00
I kept losing recipes. You know how it goes — you're scrolling TikTok at midnight, see an amazing pasta dish, save it, and never find it again. So I built TasteBuddy to fix that for myself. What I didn't expect: parsing recipes from the internet is a rabbit hole that goes deep.

The thing is, recipe content is scattered everywhere in completely different formats. A food blog might have nice JSON-LD markup. A TikTok? Just someone talking over a video. An Instagram reel? Recipe buried in the comments. Pinterest? Links to blogs that died three years ago.

So I ended up building specialized extractors for each platform.

Websites are the "easy" case. I look for JSON-LD with @type: Recipe first — most food blogs have it, thanks to SEO plugins. But the real world is messy. I've seen duration fields as PT30M, 30 minutes, 0:30, and my personal favorite, just half an hour. About 30% of recipe URLs have no structured data at all, so I fall back to Gemini to make sense of the raw HTML.

TikTok is where it gets fun. There's no recipe API. My pipeline resolves short URLs, then checks if the creator says something like "link in bio" (I detect this in five languages because German food TikTok is surprisingly massive). If I can find their website, great — I scrape the actual recipe from there. If not, I download the video via Apify and let Gemini analyze the frames. It works, but it's slow and expensive, so that's a Pro-only feature.

Instagram and Facebook — similar deal. oEmbed gets me the image, but the recipe is usually in the caption or comments. Same link-in-bio detection, same website resolution.

Photos are actually straightforward — screenshot of a recipe, photo of a cookbook page, whatever. Gemini's vision model handles those surprisingly well.

One thing I'm proud of: the AI tiering. Not every task needs a big model.

- Gemini Flash Lite handles 90% of the work — classifying content, parsing ingredients, extracting recipe names. Cheap, fast, good enough.
- Gemini Flash kicks in when structured data fails — parsing messy HTML, analyzing video frames.
- Gemini Pro only for image generation (recipe share cards).
- text-embedding-004 for semantic search across your recipe collection.

This keeps my costs sane as a solo dev.

Stuff I learned the hard way:

- JSON-LD in the wild is chaos. The spec is fine, but WordPress plugins are creative.
- "Link in bio" is how recipe distribution actually works on social media.
- AI as fallback beats AI as default. Structured data first, AI when it fails = 95%+ success at a fraction of the cost.
- Tier your models aggressively. Don't throw dollars at a problem that cents can solve.

Stack: Flutter (just me, indie dev), Supabase (Postgres + Deno Edge Functions), Gemini, Apify, PostHog.

Free with a Pro tier for video extraction and household sharing. Happy to go deeper on any part of the extraction pipeline.
by vintagedave | 2026-02-11 13:38:59+00:00
> and the same power it would take to boil eight kettles.

Newspaper-style units, but laughter aside, I tried to do the math.

If a kettle is rated at 2.5kW, then five minutes of usage (to boil a kettle, or for eight of them do a turn of the bridge) is 2.5kWh * (5/60) * 8 = 1.6kW.

My Nissan Leaf stores about 24kWh. So it's about 7% of a Leaf's battery to turn the wheel, or 10km of range. Given mass, perhaps it is finely balanced, and that seems more reasonable than I expected.

I am not an electricity expert and will get things mixed up ;)
by masfuerte | 2026-02-11 13:39:20+00:00
Same here. And I just noticed yesterday that Firefox had added and enabled a "Suggestions from sponsors" feature. Which I've now disabled, but presumably it's been sending anything I type into the address bar to Mozilla since 2021. I am tired of Mozilla but Chrome is very much worse.

ETA: I only noticed yesterday because a "sponsored suggestion" popped up when I was typing, which I've not seen before. So either they actually enabled it recently, or advertisers don't bid on the kinds of things I usually type.
by zhouhua | 2026-02-11 13:39:35+00:00
No software downloads required – access powerful tools directly from your browser, completely free. This platform is designed for developers, data analysts, and content creators, offering a comprehensive suite of utilities for formatting, beautifying, minifying, validating, and converting between dozens of popular data and code formats like JSON, XML, SQL, HTML, CSS, and YAML.

Whether you need to tidy up messy code, validate data integrity, or seamlessly convert between formats such as JSON, CSV, and SQL, TidyCode empowers you to enhance productivity and maintain clean, standard-compliant code. Experience this fast, secure, and professional online toolkit today to simplify all your data handling tasks!
Show HN: I created an app to remove Reels, now on iOS too
by adrianhacar | 2026-02-11 13:39:35+00:00
Last year I built an Android app to block Reels and Shorts while keeping "healthy" features like stories and DMs. I didn't want to block the whole app. I just wanted to message friends and see their posts without losing an hour scrolling on Reels. For context, this was the HN post for the Android version:
https://news.ycombinator.com/item?id=44923520

When people asked for an iOS version, I thought it was not possible. Apple is way more restrictive and doesn't allow that level of app access.

But I ended up building the iOS app using a different approach. On iOS, it uses WebApps. It's not exactly the same experience as the native app, but it works surprisingly well.

I also combined it with iOS Shortcuts to auto-redirect the native apps to WebApps, so I can keep Instagram installed for notifications but get sent to the WebApp without Reels and any feed when I tap.

Curious what you think, especially about the WebApp approach on iOS.
by gnl | 2026-02-11 13:39:37+00:00
Couple of quick thoughts on how to protect yourself from having a formerly trustworthy extension go rogue on you:

- https://github.com/beaufortfrancois/extensions-update-notifi...

And then you can do whatever you feel is an appropriate amount of research whenever a particularly privileged extension gets updated (check for transfer of ownership, etc.)

- brave://flags/#brave-extension-network-blocking

You can then create custom rules to filter extension traffic under brave://settings/shields/filters

e.g.:

! Obsidian Web
*$domain=edoacekkjanmingkbkgjndndibhkegad
@@||127.0.0.1^$domain=edoacekkjanmingkbkgjndndibhkegad

- Clone the GitHub repo, do a security audit with Claude Code, build from source, update manually
by mancerayder | 2026-02-11 13:39:55+00:00
Biontech, the one that had the first mrna vaccine, has a bunch of phase 3 trials this year, and they're all about curing cancer - it's literally how they're using all of the covid vaccine revenue, as funding for that endeavor.[1]

1 https://european-biotechnology.com/latest-news/2026-a-year-o...
by thunky | 2026-02-11 13:40:05+00:00
To each their own.

> I use these tools daily and I just don't see it.

So why use them if you see no benefit?

You can refuse to use it, it's fine. You can also write your code in notepad.exe, without a linter, and without an Internet connection if you want. Your rodeo

I don't understand the defensiveness.
by PunchyHamster | 2026-02-11 13:40:13+00:00
There is some merit to the end user ISPs doing that - for example one I used before filtered SMTP traffic (and iirc some other) to the client unless you opted out from it.

Which was mildly annoying workaround for the power users (disabling it was just changing the ppp login), but stopped a lot of accidentally open open relays and a lot of other cruft
Show HN: I reverse-engineered Mewgenics (game) to build a luck/RNG calculator
by causalzap | 2026-02-11 13:40:27+00:00
Hi HN,

I’ve been playing the beta of Mewgenics (the new game by Edmund McMillen, creator of The Binding of Isaac) and got frustrated by the opaque RNG mechanics. The game has a "Luck" stat, but it wasn't clear how it affected success rates.

So, I decided to dig into the game files (classes+Misc.txt, events.csv) to reverse-engineer the hidden formulas.

I built MewGenius to visualize this data. It's a static site built with Astro + React.

Technical challenges I solved:

Reverse-engineering the RNG: Discovered a hidden "Reroll" system where Luck 15+ gives you two dice rolls, drastically changing the probability curve.

Genetic Simulation: The game has dominant/recessive traits. I built a simulator to flag risky breeding pairs (inbreeding/diseases).

Data Pipeline: Wrote Python ETL scripts to parse the raw CSV/Text game dumps into structured JSON for the frontend.

It's still a work in progress, but the Luck Calculator is fully functional. Would love any feedback on the tool or the UX!
by magicalhippo | 2026-02-11 13:40:48+00:00
> The claim that the code is inefficient is really not substantiated well in this blog post. Sometimes, long-winded assembly actually runs faster because of pipelining, register aliasing, and other quirks.

I had a case back in the 2010s where I was trying to optimize a hot loop. The loop involved an integer division by a factor which was common for all elements, similar to a vector normalization pass. For reasons I don't recall, I couldn't get rid of the division entirely.

I saw the compiler emitted an "idiv [mem]" instruction, and I thought surely that was suboptimal. So I reproduced the assembly but changed the code slightly so I could have "idiv reg" instead. All it involved was loading the variable into an unused register before the loop and use that inside the loop.

So I benchmarked it and much to my surprise it was a fair bit slower.

I thought I might have been due to loop target alignment, so I spent some time inserting no-ops to align things in various supposedly optimal ways, but it never got as fast. I changed my assembly to mirror what the compiler had spit out and voila, back to the fastest speed again...

Tried to ask around, and someone suggested it had to do with some internal register load/store contention or something along those lines.

At that point I knew I was done optimizing code by writing assembly. Not my cup of tea.
by gspr | 2026-02-11 13:40:54+00:00
With `u32` as the element type, rustc 1.93 (with `-O`) does the correct thing for size=1, checks both elements separately (i.e. worse than in the article) for size=2, checks all three elements separately (i.e. not being crazy like in the article) for size=3, and starts doing SIMD at size=4.

https://godbolt.org/z/5PETM5bbn
by maqp | 2026-02-11 13:41:06+00:00
>Loading your messages on Signal can take quite a while.

Yeah if you have to go through hundreds of ratchet steps, yeah it will take time. That's expected. The only way to make it faster than that is to deploy it without privacy. That's cheating.

>Why are you ignoring the fact Signal actively prohibits third-party clients?

Because it's not a problem for security.

>Yes, Telegram is far from perfect, and inferior to Signal when it comes to E2EE.

Telegram's lack of ubiquitous E2EE is a blocking issue. Signal's wait times is a problem that goes away with 5G, 6G etc., and with them nanometers going down.

>But what makes you reject the proprieatry blob claim when it's true?

What blobs? Firebase? I have bad news for you wrt Telegram https://github.com/DrKLO/Telegram?tab=readme-ov-file#compila...

>Because your favorite messenger is being attacked?

Not my favorite messenger. Nor is it my messenger. Signal is the best messenger for day-to-day use though.
by vishnukool | 2026-02-11 13:41:31+00:00
Thank you!
We have limits around usage. Also as a startup we have a lot of Gemini credits from Google, so that helps in offering it. Not to mention the gemini 3 flash that it's running on is dirt cheap.

Regarding low quality skills, our search only surfaces top starrted and forked skills, so that largely addresses that. Kinda like google page ranking. You'll see that whatever you search for, you tend to only get high quality skills first.
by trinix912 | 2026-02-11 13:41:35+00:00
This is easy to say until you're an immigrant worker in a foreign country - something one probably worked for their entire life up to that point - risking it all (and potentially wrecking the life of their entire family) just to stop some random utility from having a Copilot button. It's not "this software will be used to kill people", it's more like "there's this extra toolbar which nobody uses".

In life you have to choose your battles.
by Baerbeisser | 2026-02-11 13:41:52+00:00
There's still old tiny Metapad. And also more modern and fully featured (but still light) Notepad 2/3/4 and Notepad++.
For full replacement, i just renamed all instances to notepad.exe.bak, back then on Windows 7 & 10, and rename-replaced it with metapad.exe. Though, i guess with UWP apps (modern Notepad is one), it's just file associations nowadays. There's surely some mass-reassociate utility around?

Btw, nano is only 50/50 chance that's it's pre-installed. Learn some vim, will ya? ;)