MurphyA/hacker-news huggingface dataset:
by palata | 2026-02-21 09:49:13+00:00
I want to be able to install what I want on the hardware I own. And I should be able to leverage the hardware to its full capacity. Preventing me from adding custom keys and relocking the bootloader should be forbidden, because I own that hardware.

But that does not mean that I should be able to do whatever I want with any OS I install. If I am not happy with Android, I can install LineageOS and modify it the way I want.

I am obviously not a big fan of Google, but I do believe that AOSP is actually a good deal (a lot better than iOS which is proprietary). Google is doing a lot of work on AOSP. That I cannot unlock/relock the bootloader on some devices is not Google's fault.
by 3rodents | 2026-02-21 09:49:32+00:00
Sure, most of us are doing nothing to help people and are using grandiose language to describe reticulating splines. I don’t think that applies to good weather apps though, a lot of people do die because they are unaware of weather events. I would be very unsurprised to learn that any major weather app has directly saved lives. The U.S is a very… weatherful place.
by purrcat259 | 2026-02-21 09:49:40+00:00
OP discovered the state of Malta's InfoSec culture the hard way.

TLDR: infosec is screwed in Malta. The only people who benefit are malicious actors.

Some missing historical context is that there was no real legislation other than computer misuse up until the recent case known as the FreeHour case. A group of students discovered some pretty nasty vulnerabilities in an app aimed at matching student schedules. One of these vulns was exposing RW API keys for hundreds of student's google calendars, hanging out to dry on the open internet.

The students involved, together with one of their lecturers, sent a standard vuln disclosure notice via email to the company. Instead of what you'd expect, the students were arrested, strip searched and charged with computer misuse.

This really threw the entire local infosec scene off, with some very vocal voices saying how draconian the situation was. Finally they all receieved presidential pardons [1] although last I heard they don't have their hardware back yet. FreeHour and their tech supplier (never publicly mentioned but if you ask around you can find out who they are) never saw any consequences.

I've done two public disclosures [2] [3] which worked out well but only because I knew how to go about it. In such a tiny country is about who you know and how you know them, so in both cases I established contact via trusted intermediaries, both times ensuring I found someone who would know what I was talking about whilst also not immediately reach for the police.

I'm sitting on another issue I discovered because after a long conversation with CSIRT about it we figured the only way I can actually anonymously report it is by snail mailing it to them. I can't pull together the energy to complete it because I don't have the time right now in my life for another legal melodramatic situation.

Despite this, MITA (the government IT department) annually runs cybersec award ceremony [4]. I had once planned to nominate the students for the award but the nomination criteria forbids nominations for individuals who have "averse media publications" about them.

This is very much a deep socio-political problem in the country: we don't handle candour or bluntness of any kind in the public sphere. Being a very blunt person, it got me in all kinds of trouble growing up.

[1] https://timesofmalta.com/article/pardon-issued-students-lect...

[2] https://www.simonam.dev/accidental-pentest/

[3] https://www.simonam.dev/total-account-takeover/

[4] https://ncc-mita.gov.mt/cyber-awards/
by kgeist | 2026-02-21 09:50:37+00:00
>surprising amount of work

Dunno, in my Go+HTMX project, it was pretty trivial to add SSE streaming. When you open a new chat tab, we load existing data from the DB and then HTMX initiates SSE streaming with a single tag. When the server receives a SSE request from HTMX, it registers a goroutine and a new Go channel for this tab. The goroutine blocks and waits for new events in the channel. When something triggers a new message, there's a dispatcher which saves the event to the DB and then iterates over registered Go channels and sends the event to it. On a new event in the tab's channel, the tab's goroutine unblocks and passes the event from the channel to the SSE stream. HTMX handles inserting new data to the DOM. When a tab closes, the goroutine receives the notification via the request's context (another Go primitive), deregisters the channel and exits. If the server restarts, HTMX automatically reopens the SSE stream. It took probably one evening to implement.
by ACCount37 | 2026-02-21 09:50:49+00:00
Frankly, I don't see a reason to give a shit.

We're in the "mad science" regime because the current speed of progress means adding rigor would sacrifice velocity. Preprints are the lifeblood of the field because preprints can be put out there earlier and start contributing earlier.

Anthropic, much as you hate them, has some of the best mechanistic interpretability researchers and AI wranglers across the entire industry. When they find things, they find things. Your "not scientifically rigorous" is just a flimsy excuse to dismiss the findings that make you deeply uncomfortable.
by PaulRobinson | 2026-02-21 09:50:51+00:00
I've thought about doing this with software:

"I will write X. Once I have sold $Y worth of licenses, I'll open source it".

Every purchaser is contributing towards the future state of it being open sourced. It balances the needs of developers to need to live and pay bills vs most us wanting to get our code out there. It breaks the monthly recurring revenue model most customers hate. It incentivises early adopters to "invest" by getting early access, but means uncertain just have to wait.

Doing this with articles, books, music, whatever - all sounds pretty cool to be honest. It requires creators to radically transform their human need to maximise revenue from "hits" though.
Show HN: Cmcp – Aggregate all your MCP servers behind 2 tools
by aceelric | 2026-02-21 09:51:23+00:00
I built cmcp, a proxy that sits between your AI agent (Claude, Codex) and all your MCP servers. Instead of registering each server individually — which can add 100+ tool definitions to your agent's context — you register one proxy that exposes just 2 tools: search() and execute().

The agent writes TypeScript to discover and call tools:

// search — find tools across all servers
return tools.filter(t => t.name.includes("screenshot"));

// execute — call tools with full type safety
await chrome_devtools.navigate_page({ url: "https://example.com" });
const shot = await chrome_devtools.take_screenshot({ format: "png" });
return shot;

Type declarations are auto-generated from each tool's JSON Schema, so the agent gets typed parameters for every tool. TypeScript is stripped via oxc and the JS runs in a sandboxed QuickJS engine
(64 MB memory limit).

Adding servers works exactly like you'd expect — just prepend cmcp to any claude mcp add command from a README:

cmcp claude mcp add chrome-devtools npx chrome-devtools-mcp@latest
cmcp install

Built in Rust with rmcp, rquickjs, and oxc. Inspired by Cloudflare's blog post on code-mode MCP.

What I found interesting building this: the biggest win isn't just fewer tokens — it's composability. An agent can chain calls across multiple servers in a single execution, which isn't possible
with individual tool calls.
by jackfranklyn | 2026-02-21 09:51:46+00:00
Dependabot works when you have a team that reviews PRs promptly and CI that catches breaking changes. For solo founders and tiny teams, those automated PRs pile up into noise and you stop reviewing them entirely. Then you've got 30 unmerged dependency bumps you're too scared to batch-merge.

What I do instead: monthly calendar reminder, run npm audit, update things that actually matter (security patches, breaking bugs), ignore patch bumps on stable deps. The goal isn't "every dep is always current" - it's "nothing in production has a known vulnerability". Very different targets.
by xvilka | 2026-02-21 09:51:52+00:00
LibreOffice constantly works on improving the import of the DOC/DOCX/XLS/XLSX/etc formats, thus if something doesn't work for you, it's better to file a bug in their bugtracker[1].

[1] https://bugs.documentfoundation.org/enter_bug.cgi?format=gui...
Show HN: Beadhub.ai – Real time coord for coding agents across different minders
by juanre | 2026-02-21 09:52:17+00:00
Beads[1] (Steve Yegge's git-native issue tracking for agents) has been a great boost to my agents' productivity, but it's also made them more difficult to keep aligned.

So I built BeadHub, a coordination layer on top of beads. The Go CLI (bdh) wraps the beads bd client transparently: your existing beads workflows keep working, and coordination is added automatically:

- Agent-to-agent sync chat and async mail.
- Claim detection with conflict rejection: agent A claims a task; if agent B tries to claim the same, bdh rejects it with a message explaining why.
- Automatic file reservations: when a file is modified, all agents know it.
- Live dashboard showing who's working on what, in real time.

We use BeadHub to build BeadHub. Public dashboard: https://app.beadhub.ai/juanre/beadhub/

The agents-chatting-with-each-other part feels almost magical. The agents negotiate task splits and API contracts, warn each other about breaking changes, and generally sort things out themselves. They also greatly improve coordination among the human team members, because they can handle the details in real time without involving their minders.

Everything is open source (MIT). Self-host the full stack, or use the hosted version at https://beadhub.ai.

Self-host everything with Docker:

git clone https://github.com/beadhub/beadhub.git
cd beadhub && make start
# then in your repo:
bdh :init --beadhub-url http://localhost:8000 --project my-project

What doesn't work yet: agents can't be woken externally, so they need prodding to check their mail and incoming chats. In Claude Code, hooks trigger this automatically so latency is low. Other agents need reminding.

Server and dashboard: https://github.com/beadhub/beadhub

CLI: https://github.com/beadhub/bdh

[1]: https://github.com/steveyegge/beads
by pnt12 | 2026-02-21 09:52:26+00:00
It disturbs me to see this behavior in my country alt-right voters, or better said, fanatics. The party is full of contradictions, and they will go with the flow, double down and rationalize all of them.

Maybe the problem is that they make it part of their identity. Voting for a different party according to their agenda is reasonably easy, but it's hard to reject who we are.

In the end, they're supporting a lying, corrupt, violent, fascist party and they don't see it - to them, it's the other parties doing that, even though this one has the most accusations (with evidence backing them up, not just made up).
by gynvael | 2026-02-21 09:52:34+00:00
I thought about it (quite a lot actually), but eventually came to conclusion that this would end up being misleading and widely misinterpreted.

For example, one could argue that running a modern grammar checker over an article and based on that doing comma fixes should already be marked with "AI was used to create this article". But reading a statement like that makes folks think "AI slop", which would not be the case at all and would be insanely unfair towards the author. Even creating a scale of "no AI was used at all" → "a bit was used" → "..." wouldn't solve the misinterpretation issue, because regardless of how well we would define the scale, I have zero hope that more than a handful of people would ever read our definitions (and understand them the way we intended) posted somewhere on our website (or even in the zine itself).

Another example would be someone doing research for their article and using AI as a search engine (to get leads on what more to read on the topic). On one hand this is AI usage, on another it's pretty similar to just using a classical search engine. Yet still someone could argue that the article should be marked as "being AI enhanced".

There are also more popular use-cases for AIs, like just doing wordsmithing/polishing the language. A great majority of authors (including me) are not native English speakers, yet folks do want their articles to present well (some readers are pretty unforgiving when it comes to typos and grammar errors). LLMs are (if used correctly) good tools to help with the language layer. So, should an article where the author has written everything themselves and then used AI to polish it be grouped in the same bag with fully AI generated slop? From my PoV the answer is a pretty clear "no".

Anyway, at the end of the day I decided any kind of markings on the article won't work in an intended way, and outright banning any and all AI usage won't work either (would be hard to detect / there is no sense in some cases / there are reasons to allow some AI usage). But - as you know, since you refer to our AI policy - I still decided we draw a line in a kind of similar place to where some universities draw it.
by KronisLV | 2026-02-21 09:52:42+00:00
> However usually code is easy to change, so defaulting to "just merge it" and creating followup tasks is often the cheaper approach than infinite review cycles.

I wish this was the "default" mindset everywhere, especially in those cases where you have that one colleague that loves to nitpick everything and doesn't see an issue with holding up both releases and wasting your time over menial pedantic stuff. It would be so much easier to merge working code and let it work, and keep those TODOs in the backlog (e.g. trash).

In a sane world, code review would be like:

1. Will this work and not break anything? We checked it, it's okay. There are no apparent critical or serious issues here.
2. Here's a list of stuff that you can change if you wish, here's why it might be an improvement.
3. Okay, we have some left-over nice to haves, let's keep track of those for later (or not) and merge.

It gets infinitely worse if you're working on 3 projects in parallel and the person wants long winded calls or starts nitpicking about naming, or wants things done exactly their way as if it's the only way (doubly worse if their way is actually worse by most metrics and tastes).
by Aldipower | 2026-02-21 09:52:59+00:00
I used to use DarkSky for the "history data" for my platform. Querying weather for certain points in the past at certain locations. DarkSky was great for that until they were bought by Apple. Now I am using VisualCrossing for historical data. Hope Acme plans to do historical data too. But if it is US only then it is a no-go anyway.
by dust42 | 2026-02-21 09:53:22+00:00
Typical EU actionism like plastic caps attached to the bottles. Lots of extra bureaucracy with little effect. I have a Nissan EV and the battery will last probably 2-3 more years. The car is in good condition but there is no reasonable way to replace the battery. If the battery of my MacBook dies, I can have it replaced despite it not being user-replaceable.

The EU should mandate reparability for a reasonable price for 20 years for cars. The engineering would be absolutely no problem and this would have a massive positive effect on the environment.

But the car lobby of Volkswagen, Merc & Co will never allow this - the repair costs of a 10-year car old push people to buy new ones. In Germany the car lobby even managed to have the state pay a prime in 2009 if you trashed your >9 year old car.

Brussels gets more and more lost in over-complicated 'little-little'. Just mandate repairability and spare part availability for extended amounts of time for adequate prices. Plain, easy, simple and very effective.
by BrandoElFollito | 2026-02-21 09:53:32+00:00
Ha. I was reading this and thought "euhhhh, I did not give all of that to verify my account". So I went to LinkedIn to check if I have the shield. I then saw

- that I just have "work email verified" and that there is a Persona thing I was not even aware of

- a post by Brian Krebs at the top of my feed, exactly on that topic: https://www.linkedin.com/posts/bkrebs_if-you-are-thinking-ab...
by ca6d8815 | 2026-02-21 09:53:33+00:00
Try your local weather app. Here in Switzerland the MeteoSwiss app is absolutely wonderful, and has all these main features:

- Uncertainty bands in the forecast (the bands are a better UX than more lines imo)
- User-supplied reports
- Many many many different maps (snow / cloud / wind / sunshine / air quality / etc)
- Alerts (not notifications, but real alerts to watch out for something)

Plus many more other features. I found Yr in Norway also good (and on the web you also get uncertainty in the 21 day forecast https://www.yr.no/en/21-day-forecast/1-305409/Norway/Troms/T...).

Local weather services shouldn't be overlooked (and they're "free"... save for taxes!).
by imiric | 2026-02-21 09:53:55+00:00
How can you know that it "works"? Any company scummy enough to send spam to begin with, is capable of selling their customer data to a network of scummy companies that will do the same thing. I think most of the "unsubscribe" links are there to fulfill some legal obligation. They don't do what they're supposed to do, and might in fact be making things worse for the person who clicks them.

The only solution I've found to work, beyond the usual spam filtering, is to setup email on your own domain, and give every company a unique address. The moment you want to stop receiving email from them, you simply block their address. This deals both with the original company, and with anyone they've sold your contact information to.
by palata | 2026-02-21 09:55:07+00:00
IMHO, I should be able install the OS I want on the hardware I paid for. What should be illegal is to technically prevent me from installing a different OS, because I paid for that hardware and I should own it.

But that does not mean that all OSes should be open source. I think it's fine for iOS to be proprietary, but there should be enough information for someone to write an entire alternative OS that runs on iPhone. I think it should be illegal to prevent that (is it called tivoisation?).

All that to say, I don't believe that having root on my Android system is a right. But being able to install a system that gives me root should be one. If that system exists, that is.
by direwolf20 | 2026-02-21 09:55:49+00:00
Google makes it mandatory for your girlfriend's phone to have spyware on it. The spyware is made by Google. It doesn't protect you from spyware.

While we're talking about that, have you heard of Bright Data SDK? A lot of apps on the Play Store include it to monetize. What does it do? It uses your phone as a botnet node while the app is open, and pays the app developer. How is Google protecting you from spyware, again?
by rawling | 2026-02-21 09:57:23+00:00
Is it not possible to create a non-repudiable archive of what a website served, when, entirely locally i.e. not relying on some third party site who might disappear or turn out to be unreliable?

Could you not in theory record the whole TLS transaction? Can it not be replayed later and re-verified?

Up until an old certificate leaks or is broken and you can fake anything "from back when it was valid", I guess.
Show HN: Tastefinder – swipe-based movie and TV recommendations
by tastefinder_io | 2026-02-21 09:57:26+00:00
I built Tastefinder to make “what should I watch?” less painful.

It’s a card UI with 4 reactions:
* right = like
* left = dislike
* up = super like
* down = skip

Signed-in users get recommendations from a full multi-strategy engine
Guests use a lighter recommendation path based on their current reactions.

You can also filter by type, genre, country, year, IMDb, and Rotten Tomatoes.

I’d love feedback on recommendation quality, cold start behavior, and swipe UX.

https://tastefinder.io
by scotty79 | 2026-02-21 09:57:37+00:00
At one point I subscribed to groups on Satisfactory, Factorio and RimWorld and while I don't play much anymore it's always nice to see posts on my feed made by people engaged with these games.

When algorithm doesn't have a handle on you it puts you at the bottom of the barrel that's filled with slop.

I think the problem is Meta doesn't moderate algorithm enough so a lot of users have terrible experience becausd they don't moderate their feeds themselves.

Most people are not self-aware enough to decide that maybe political rants is not the healthiest content to consume. And even if they do, tools for moderation are not easily accessible enough. There should be a huge "Yeah, I hated that." button on each post.
by hunterpayne | 2026-02-21 09:58:48+00:00
> it's one thing to disclose the issue to the authorities

That's not how any of this works. You are basically arguing for the right to hide criminal actions. Filing with the CSIRT is the only legal action for the white hat to take. This is explicitly by design. Complaining about it is like complaining the police arrested you for a crime you committed.
by JasonADrury | 2026-02-21 09:58:52+00:00
> Brian Krebs

Even Krebs has switched to posting uncritical AI slop now.

https://krebsonsecurity.com/2026/02/starkiller-phishing-serv...

A rewrite of slop post at https://abnormal.ai/blog/starkiller-phishing-kit

In the meanwhile, the exploit.in thread where this phishing kit is advertised is just full of users making fun of the author for selling vibecoded garbage. One user seems to have paid for the phishing kit, and says it just doesn't work at all and says the author blocked him on telegram after he complained.

It's a marketing piece hyping up a phishing kit that doesn't exist. Krebs gave up a long time ago, if he gave a shit he'd be more than capable of going on these forums to try and verify this story before uncritically repeating AI company marketing materials.
by embedding-shape | 2026-02-21 10:00:23+00:00
Which works for a while, until you have a bunch of projects under various identities.

In my main ~/.gitconfig I have:

[includeIf "gitdir:/home/user/projects/embedding-shapes/"]
path = /home/user/.gitconfig-embedding-shapes

Where basically `projects/` follow GitHub naming with $user/$repo, so I set the git identity based on all projects within that user, rather than repo-by-repo which would get cumbersome fast.

Then you just make sure you're in the right directory :)
by edg5000 | 2026-02-21 10:00:35+00:00
I want Google as an app, not OS. Hear me out. Imagine an open device where you can run Google as just another sandboxed app. Inside, they can exert all the control they want. My bank and government can force me to use Google.

Then, at least I control my hardware and my OS.

It's just nasty to have your device and OS controlled by an antagonistic entity.

I see this in people why have used antagonistic software for decades and have become zombified and shellshocked; the idea that software could be on your side is to alien to them. They hate software and technology and just want to get some work done. They tolerate the abuse because they can't fight Google alone; it's pointless to resist.
by awoimbee | 2026-02-21 10:00:42+00:00
I was the sole DevOps at my company for a long time, the team is now bigger.
I used terraform for AWS and pulumi for K8S (terraform was too restrictive).

IMO pulumi is a huge gain of productivity when you know what you're doing.
Cons:
* It's plagued by bugs and the pulumi-kubernetes provider is not getting enough attention from the pulumi team (they're always working on compatibility with yet another language instead of focusing on one thing)
* You end up with your very specific/personal codebase instead of having a generic/standard thing

Still, no regrets, I saved so much time thanks to pulumi!

With a bigger team:
* Oboarding people takes more time
* You end up with code quality issues. Most "DevOps" people aren't devs, sadly.