MurphyA/hacker-news huggingface dataset:
by Chris_Newton | 2026-02-21 07:46:50+00:00
Dependabot has some value IME, but all naïve tools that only check software and version numbers against a vulnerability database tend to be noisy if they don’t then do something else to determine whether your code is actually exposed to a matching vulnerability.

One security checking tool that has genuinely impressed me recently is CodeQL. If you’re using GitHub, you can run this as part of GitHub Advanced Security.

Unlike those naïve tools, CodeQL seems to perform a real tracing analysis through the code, so its report doesn’t just say you have user-provided data being used dangerously, it shows you a complete, step-by-step path through the code that connects the input to the dangerous usage. This provides useful, actionable information to assess and fix real vulnerabilities, and it is inherently resistant to false positives.

Presumably there is still a possibility of false negatives with this approach, particularly with more dynamic languages like Python where you could surely write code that is obfuscated enough to avoid detection by the tracing analysis. However, most of us don’t intentionally do that, and it’s still useful to find the rest of the issues even if the results aren’t perfect and 100% complete.
by Broken_Hippo | 2026-02-21 07:48:03+00:00
Indiana has sometimes required that for decades, though I think they finally adjusted the law a little after online purchases became popular.

Indiana charges sales tax like a lot of states, but only on things sold in the state or from a company located in the state. If you ordered something from California or overseas, no sales tax was charged. The law required you to track these purchases and report it on your tax return so you can pay the required sales tax.

That said, enforcement wasn't good and I don't know a single person that actually did so. A common tax fraud for the average person, I guess.

And honestly, I think any emergency federal law would be similar: It wouldn't be for refunds for the masses, but for surveillance and extortion.
by microtonal | 2026-02-21 07:49:19+00:00
The /e/OS installer is terrible though and often fails, even on their officially supported phones (like Fairphone). The standard recommendation in their forums is nah, just install /e/OS through the command-line.

Also, /e/OS has pretty bad security practices (shipping very old kernels, very old vendor firmware, and missing most AOSP security patches).

Also, be careful to follow the instructions really carefully. For some devices it's really easy to get the phone in a boot loop, where the only resort is to get your vendor to repair it. E.g. Fairphone 6 has downgrade protection and will become a brick if you relocked the phone when the old system's Android SPL is newer than the new system's.
by shevy-java | 2026-02-21 07:49:35+00:00
> They were basically all thirst traps of young women, mostly AI-generated, with generic captions.

I never seriously used Facebook; only once when a reallife buddy wanted means to communicate and I did not have a smartphone. But it was already really awful back then.

Now that AI spams down and eliminates real human beings, I guess many of these anti-social websites will die. Or at the least be in serious decline from where they can not easily escape anymore. Because which real human being wants all that AI slop?
by jmholla | 2026-02-21 07:49:44+00:00
A lot of the comments in here seem to be focused on mobile devices, but this law applies to basically every general computing device.

Here are the definitions from the bill in a more reasonable order than they are presented there:

> "DEVICE" MEANS ANY GENERAL-PURPOSE COMPUTING DEVICE THAT CAN ACCESS A COVERED APPLICATION STORE OR DOWNLOAD AN APPLICATION.

> "COVERED APPLICATION STORE" MEANS A PUBLICLY AVAILABLE INTERNET WEBSITE, SOFTWARE APPLICATION, ONLINE SERVICE, OR PLATFORM THAT DISTRIBUTES AND FACILITATES THE DOWNLOAD OF APPLICATIONS FROM THIRD-PARTY DEVELOPERS TO USERS OF DEVICES.

> "APPLICATION" MEANS A SOFTWARE APPLICATION THAT MAY BE RUN OR DIRECTED BY A USER ON A DEVICE.

> "DEVELOPER" MEANS A PERSON THAT WRITES, CREATES, MAINTAINS, OR CONTROLS AN APPLICATION.

The law applies to Operating System providers that runs on such a device:

> "OPERATING SYSTEM PROVIDER" MEANS A PERSON THAT DEVELOPS, LICENSES, OR CONTROLS THE OPERATING SYSTEM SOFTWARE ON A DEVICE.

Basically every Linux distro falls under this. Never mind the fact that OS providers don't really have control over where you run their code. If my device doesn't have a network card, does that mean my OS can skip this?

This also is not privacy preserving. It does require the device only report what age bracket a user belongs too, but on a long enough time frame, anyone currently under that age of 18 has their age accurately disclosed, often down to their birthday.

Worse, all applications MUST query this information every time it is run, regardless of whether or not age is at play. Every time you run grep, grep needs to know how old you are:

> A DEVELOPER SHALL REQUEST AN AGE SIGNAL WITH RESPECT TO A PARTICULAR USER FROM AN OPERATING SYSTEM PROVIDER OR A COVERED APPLICATION STORE WHEN THE DEVELOPER'S APPLICATION IS DOWNLOADED AND LAUNCHED.

Now, oddly, user is defined to be minors:

> "USER" MEANS A MINOR WHO IS THE PRIMARY USER OF A DEVICE.

But, the way the law is written, the implementation necessarily applies to everyone.
by unmarkdown | 2026-02-21 07:50:50+00:00
Respect for building the client from scratch. The "I wanted to understand every component" reasoning resonates. I took a similar approach with a conversion pipeline I built using remark/rehype directly rather than wrapping an existing markdown-to-HTML library. You end up understanding every edge case which matters when you need to handle things like nested tables or math rendering.

3.5 years solo is serious commitment. What was the hardest part ... the real-time sync or getting the editor to feel right?
by JasonADrury | 2026-02-21 07:51:16+00:00
The funniest thing is how many people actually buy this stuff. High-end streetwear communities are constantly spammed by fools seriously asking if the item they bought from depop at below 10% resale prices is authentic.

Clowns will buy extremely niche streetwear items like these https://www.depop.com/products/maxisepic-blue-jeans-with-mul... knowing very well that the real ones are reselling for upwards of $30k and then waste the time of people online asking them to "legit check" their garbage.
by shevy-java | 2026-02-21 07:51:37+00:00
Right. But who fits into that niche? I in general prefer privacy so I don't share fotos of whenever I take a du.. I mean do something semi-interesting to a grand selection of three or four other people out there (or more; but these are already reallife associations). Remote "relationships" rarely work in my experience, excluding a few that are important. But I don't see how that is any business of CIAbook to keep track of.
by zmmmmm | 2026-02-21 07:51:41+00:00
Well, that's why I say "being treated"

I'm not aware of many bluetooth headphones that blink an obvious light just because they are recording. You can get a pair of sunglassses with a microphone and record with it and it does nothing to alert anybody.

Whether it's actually legal or not, as you say, varies - but it's clear where device manufactures think the line lies in terms of what tech they implement.
by metavolvelabs | 2026-02-21 07:52:14+00:00
They crushed it with Gemini 3.1... especially when in Thinking Mode with Deep Think initiated. If you are working towards something with code, research etc. and hit a snag, run it by Gemini with these settings. Here's another KILLER trick: In Gemini Thinking mode select Nano Banana and have it put together a comprehensive slide with paragraph length text portions. It'll nail it.
by hilti | 2026-02-21 07:52:41+00:00
I started experimenting with custom HTML elements for my dashboard project THINK (live at https://think.iotdata.systems) and I’ve been really surprised by how much functionality you can get with just vanilla web components. The source is on my GitHub, and I’ve been documenting my other projects and work at https://marchildmann.com if anyone’s curious what else I’m building.
by larusso | 2026-02-21 07:53:21+00:00
On top you have news outlets and educated people not being clear what they are. See from the article:

He has long argued tariffs boost American manufacturing - but many in the business community, as well as Trump's political adversaries, say the costs are passed on to consumers

It’s reported as if someone still needs to figure out who pays the tariffs in the end. I’m aware that tariffs are a lever to potential move buying behavior and give incentives to move production locally. But in this instance and how it’s/ was implemented it’s clear who is the paying for it.
by bdelmas | 2026-02-21 07:55:39+00:00
I am not sure what you are not understanding since you know there are 3 branches.

The judicial has no say on this. The judicial branch is more and more pushing political agenda when it’s not their role. Tariffs were always part of the executive branch, it’s by itself an executive action in the spirit of the law. Still if the US decides that it should not be part of the executive branch anymore, it is not to the judicial branch to decide! But it is up to the legislative branch.

This is what I am saying. Plus the fact that the US is stripping more and more power from a branch called the "executive branch" making it less and less what it is supposed to be.
by conductr | 2026-02-21 07:55:41+00:00
I’m a cynical person but this is a reach. There’s a huge gap between what this is and how I interpret “mandatory”. There’s nothing even punitive being discussed. They’re free to meet their public interest obligations the normal way as well and not participate in this. They could also participate in this in a rebellious way if they so pleased. “While we don’t agree with the FCC…. We do think this is an important milestone in our nation worth celebrating… not because the FCC told us to but because…” it’s not dictating anything particular in how the programming celebrates American just asking that they lean into it in some special way they deem appropriate.

> Broadcasters can voluntarily choose to indicate their commitment to the
Pledge America Campaign and highlight their ongoing and relevant programming to their viewing and listening audiences.
by odie5533 | 2026-02-21 07:56:10+00:00
Iceland is one of the most peaceful countries in the world (murder rate 0.54), 36 incarcerations per 100k, police don't carry guns, and it's not known for its widespread mass surveillance system.

Portugal is one of the most peaceful in the world (murder rate 0.7), 118 incarcerations per 100k, and doesn't have license plate readers or mass surveillance.

USA murder rate is 6.3, 541 incarcerations per 100k, extremely high recidivism, and an amazing array of surveillance systems.

Portugal decriminalized all drugs in 2001. Guess they should have bought Flock cameras instead?
by microtonal | 2026-02-21 07:56:12+00:00
It is not 'largely the same as OTA' on phones with downgrade protection. Once you lock the device again, it's game over because the bootloader refuses to boot an older version of the OS, and you cannot unlock the phone anymore. Happens all the time in the /e/OS and Fairphone forums.

It really depends on the device. E.g. Pixel is quite hard to brick. Though they do sometimes increment the anti-rollback version:

https://developers.google.com/android/images

In that case you have to be careful to not flash an older version to both slots and lock the bootloader, which is possible, because many non-Google/GrapheneOS images are often behind on security updates.
by TacticalCoder | 2026-02-21 07:56:40+00:00
And these same publication have zero concerns for actual victims of illegals and are never reporting on the actual criminals arrested by ICE. Criminals typically wanted for rape and/or assault and sometimes murder too.

There's an ICE page where they published 40 000 names / pictures / and for each person the crimes committed: that's more than 5% of the 600 000 arrested and deported already on that website.

Here's what democrats keep ignoring and why Trump got elected:

"42 percent of immigrants arrested by ICE under CAP from local incarceration have a criminal conviction."

Criminals that dems would have happily released on US soil after their, typically light, sentences would have expired.

But we'll get instead the cherry-picked old lady whose husband overstayed his VISA but who's probably neither a rapist nor a murdered.

The same propagandist publications that will never write a word about Laken Riley or Iryna Zarutska (killed to the tune off "take that, white girl") shall happily post pictures of good people getting arrested by ICE.

Here are some nice people anti-ICE people want to see freely roaming US cities:

https://www.ice.gov/most-wanted

Very serious double standards at play.
by tovej | 2026-02-21 07:57:13+00:00
I don't understand the idea that you "could not think about implementing a feature".

I can think of roughly 0 fratures of run-of-the-mill software that would be impossible to implement for a semi-competent software developer. Especially for the kinds of applications you mention.

Also it sounds less like you're productive and more like the vibeslop projects are distracting you.
by necovek | 2026-02-21 07:57:36+00:00
A person who is like that is rarely called a "lovely person": how does that lovely interaction look like when you point such an egregious flaw out to them?

And tbh, this has nothing to do with being self-taught: by the time I enrolled in CS program, I was arguably self-taught and could spot issues like this myself. But I pride myself in learning from my mistakes and learning fast.

So it's more likely a character thing: if you are willing to admit when you are wrong, you'll learn much faster!
by bigiain | 2026-02-21 07:58:11+00:00
Also here:

"In NSW, paintball is classified as a "prohibited firearm" under the Firearms Act 1996. However, it can still be legally played under strict licensing conditions. Unlike in some states where it is more loosely regulated, players and operators in NSW must comply with a range of legal requirements to ensure safety and legality."

These rules have changed, I think back before COVID they reclassified them as sporting equipment instead of firearms, but still brought in a whole bunch of licensing rules and requirements similar to gun ownership.

You can't just walk into KMart and walk out with a paintball gun here. |Or paintball markers.
by defrost | 2026-02-21 08:01:28+00:00
> never reporting on the actual criminals arrested by ICE

Because the numbers are so low.

Still, don't despair, the shortfall is over inflated by Fox News and their ilk who make a major production out of the the few actual criminals deported (although they rarely report on the citizens who are arrested)

Swings and arrows (as the saying doesn't go).

Less than 14% of those arrested by ICE in Trump's 1st year back in office had violent criminal records, document shows

https://www.cbsnews.com/news/ice-arrests-violent-criminal-re...
by iriisatremotely | 2026-02-21 08:02:16+00:00
The model routing discussion is fascinating. We're seeing similar patterns in how startups approach global talent - the best solution depends heavily on context. For engineering teams distributed across timezones (we work a lot with LATAM developers), the real bottleneck isn't just the model or the tool, it's understanding when to apply what. Same with inference: a 16k tok/s chip is incredible for real-time voice agents, but most startup use cases don't need that latency. The interesting question is whether we'll see more specialized hardware for niche applications, or if general-purpose solutions will keep winning through sheer volume economics.
by iriisatremotely | 2026-02-21 08:02:41+00:00
Nice work shipping this. The 2k lines of Swift for a fully functional native app is impressive - shows how much SwiftUI has matured. The CI/CD pipeline for macOS code signing is genuinely hard, so thanks for open-sourcing that part. For anyone building side projects: this is the kind of portfolio piece that actually demonstrates real engineering skills. Much more valuable than yet another todo app when you're applying for jobs.
Show HN: DomeAPI (YC F25) was acquired. pmxt is the open-source equivalent
by SamTinnerholm | 2026-02-21 08:02:59+00:00
Hi HN, I'm the maintainer of pmxt.

With Polymarket's recent acquisition of DomeAPI to bring their infrastructure in-house, there is a sudden gap for developers building cross-market arbitrage bots, tracking whale wallets, or running quantitative models across prediction markets. If you are trading across Polymarket, Kalshi, or Limitless, you need a unified API to avoid getting locked into a single exchange's ecosystem.

pmxt is stepping in to fill that void.
by tolerance | 2026-02-21 08:03:08+00:00
> Does Carr want Netflix to show the Pledge before every stream? The first stream of the day? Are they asking streaming providers to prioritize nationalistic programming in their recommendation algorithms outside of nationalistic holidays? Will they subsidize TV and movies for having a little more freedom in them? So many questions.

These scenarios all seem imminent, their precedence not withstanding.

In a strange way this notice actually comes across as transparent, considering the thought that everything you described could be achieved without the public being informed of the cooperation between the state and media.

Tangentially, this entire thing could be a veiled notice to Netflix on how to curry the favor necessary to wrestle Warner Bros. away from the Ellisons.

Conspiratorially, I’ve read that a lot of production for TV/film is moving overseas and I can’t help but imagine these studios and sets being used for other purposes.
Show HN: Using classic dev books to guide AI agents
by ZLStas | 2026-02-21 08:03:41+00:00
I've been experimenting with turning principles from classic software engineering books (Clean Code, DDIA, etc.) into structured "skill" files that AI agents can use during code review. Each skill is an opinionated instruction set grounded in known engineering wisdom — not a summary or excerpt.
Repo: https://github.com/ZLStas/skills
I'm trying to figure out the best way to wire this into a practical workflow — whether as a review layer or as a tool to iteratively refactor a legacy codebase into something clean and well-structured. A few open questions I'd love input on:

Does it make sense to use book-based principles as a structured lens for AI-driven code review?
How would you set up sub-agents to iteratively review LLM output — one agent creates, another evaluates — without the review becoming shallow or repetitive? Has anyone tried a different approach that worked better?
How do you maintain project context across multiple review passes so the agent doesn't lose sight of the bigger picture?
by gethly | 2026-02-21 08:03:58+00:00
You keep hoping things won't get too bad, but they will. You just keep delaying the inevitable. So it's better to switch now to get the initial hurdles of such a big change over with as soon as possible. It's not easy, getting used to completely strange behaviours and new things in general. Abandoning what worked for you for years for something completely foreign. You have to force yourself to withstand the first few days or week(s), but then it becomes the new normal and you'll be fine.

Personally, I am still on W10 and and delaying the move, so i'm not holier than thou. It's tough. But I also am a programmer/power user and am on my PC 24/7, sort of, so this disruption must be timed properly for me to make the move, which is not necessarily the case for most people/average users.

Phone on the other hand, as long as it works and does not limit me, I have no need to use different ROM, it's more of a want. But i do not see me doing anything until the system stops being supported or it breaks or something else. So it depends on how you use it.
by permo-w | 2026-02-21 08:10:16+00:00
I could be wrong, but I think I've seen it fail on more obscure sites. But yeah it seems unlikely they're maintaining so many premium accounts. On the other hand they could simply be state-backed. Let's say there are 1000 likely paywalled sites, 20 accounts for each = 20k accounts, $10/month => $200k/month = $2.4m a year. If I were an intelligence agency I'd happily drop that plus costs to own half the archived content on the internet.

Surely it wouldn't be too hard to test. Just set up an unlisted dummy paywall site, archive it a few times and see what the requests looks like.
by sonofhans | 2026-02-21 08:10:23+00:00
Also, you say “self driving software” but you’re linking to a Tesla press release. Do you think Tesla currently has the best self driving software? It seems to me that Waymo and Mercedes are way ahead, both of them putting their money where their mouth is insurance-wise, and using better tech. Yet neither Waymo nor Mercedes would claim their tech is anywhere near as good as a human.
by defrost | 2026-02-21 08:10:26+00:00
> the British don't need a visa to come to America as tourists.

They require a visa OR a visa equivalent.

To enter or transit through the US, you must have either an Electronic System for Travel Authorisation (ESTA) OR a visa.

GOV.UK travel advice to UK nationals seeking US entry. https://www.gov.uk/foreign-travel-advice/usa/entry-requireme...

The woman having a visa is common and doesn't negate the tale told.
by solatic | 2026-02-21 08:10:45+00:00
There are three things you can do with your money - save it (e.g. investments), give it away (e.g. charity), or spend it (e.g. housing, vacations). Whether or not somebody's investment strategy (i.e. saving) is optimal for their income level has nothing to do with the frugality of their lifestyle (i.e. spending).
by KronisLV | 2026-02-21 08:10:49+00:00
I don’t know whether the free version of Nginx has a Relying Party Implementation, but I have used this plugin for Apache2 and OIDC in the past: https://github.com/OpenIDC/mod_auth_openidc

This page might have something, but I can’t read it myself on mobile cause it shows up broken: https://openid.net/certification/certified-openid-relying-pa...

I know it’s not just OAuth but OIDC had a pretty decent provider support and I could even self-host a Keycloak instance - it was annoying to setup but worked okay in practice, could define my own users and then just get a decent login page when needed and otherwise just got into the sites I wanted.

Personally though, it felt a bit overkill when compared to basicauth for anything not run in public or for a lot of users.
by rdmuser | 2026-02-21 08:10:49+00:00
A new more grounded list focused on specifically blocking content farms and similar low quality sites.

A nice alternative to this very broad anti ai list:
https://github.com/laylavish/uBlockOrigin-HUGE-AI-Blocklist

Edit: Oh I should mention I found it through reddit and there is some good discussion there where they describe how they find stuff etc:
https://www.reddit.com/r/uBlockOrigin/comments/1r9uo3j/autom...