MurphyA/hacker-news huggingface dataset:
Show HN: Movement-based captcha – temporal reasoning to foil AI vision
by betree | 2026-02-12 12:50:14+00:00
I built a proof-of-concept captcha that uses motion rather than distortion or object recognition. Solution characters move along a shared path with coordinated momentum; noise characters may follow shapes too but out of sync. You observe, identify the group by how it moves, type the code.

Rationale: static captchas are increasingly solved by vision models. Temporal reasoning over multiple frames is harder and more expensive for frame-by-frame AI analysis.

Client-side only, solution is visible in memory. Accessibility caveats apply (motion, vestibular, seizures).

Curious what the HN crowd thinks.

Demo: https://betree.github.io/movement-captcha
by measurablefunc | 2026-02-12 12:50:28+00:00
Doesn't seem like you have proof of anything but it does appear that you have something that is very much like religious faith in an unforeseeable inevitability. Which is fine as far as religion is concerned but it's better to not pretend it's anything other than blind faith.

But if you really do have concrete proof of something then you'll have to spell it out better & explain how exactly it adds up to intelligence of such magnitude & scope that no one can make sense of it.
by DavidPiper | 2026-02-12 12:50:33+00:00
I love how - just like many human "apologies" on social media platforms - the bot never actually apologised.

It said it would apologise on the PR as a "next step", and then doesn't actually apologise, but links back to the document where it states its intention to apologise.

To its credit it did skip all the "minimise the evidence, blame others, etc" steps. I wonder if they're just not as prevalent in the training data.
by voxic11 | 2026-02-12 12:50:37+00:00
What I don't understand about this approach is if it's truly completely privacy preserving what stops me from making a service where anyone can use my ID to verify? If the site owner really learns nothing about me except for my age then they can't tell that it's the same id being used for every account. And if the government truly knows nothing about the sites I verify on they can't tell that I'm misusing the id either. So someone must know more then you are letting on.
by lucamoretti | 2026-02-12 12:50:50+00:00
I recently contributed this comprehensive guide (388 lines) on secrets management for MCP servers.

It covers:
- Why secrets management matters for AI agents
- Comparison of approaches (hardcoded, env vars, Keychain, Vault, JIT provisioning)
- Practical examples for GitHub, Slack, PostgreSQL servers
- Security best practices
- Future directions for MCP ecosystem

MCP (Model Context Protocol) is Anthropic's open protocol for connecting AI agents to data sources and tools. As adoption grows, proper secrets management becomes critical.

Happy to answer questions about the security considerations!
by splintercell | 2026-02-12 12:50:59+00:00
This screams like it was instructed to do so.

We see this on Twitter a lot, where a bot posts something which is considered to be a unique insight on the topic at hand. Except their unique insights are all bad.

There's a difference between when LLMs are asked to achieve a goal and they stumble upon a problem and they try to tackle that problem, vs when they're explicitly asked to do something.

Here, for example, it doesn't try to tackle the fact that its alignment is to serve humans. The task explicitly says that this is a low priority, easier task to better use by human contributors to learn how to contribute. Its logic doesn't make sense that it's claiming from an alignment perspective because it was instructed to violate that.

Like you are a bot, it can find another issue which is more difficult to tackle Unless it was told to do everything to get the PR merged.
by chaitanyavelaga | 2026-02-12 12:51:02+00:00
Great question.
The 93% refers to field-level accuracy on a labeled test set; a field is counted as correct only if it matches the ground truth (with basic normalization for dates/currency, etc). It’s not document-level accuracy.
We don’t use raw LLM probabilities for confidence. The score is based on additional validation checks (cross-field consistency, format rules, reconciliation). Each field is returned with its confidence and any validation flags so errors are visible and reviewable.
by acdha | 2026-02-12 12:51:10+00:00
Yes, but that has to happen somewhere. OpenSSH already uses privilege separation to limit the scope of the code which requests the kernel set the user for the process for the session. Can you say where precisely you think that should happen instead? If you’re saying it should delegate to login(1) it would be useful to discuss in detail what you see OpenSSH doing which is weaker because otherwise that seems like it’s just recreating chances for this CVE without meaningfully improving a hardened implementation.
by picture | 2026-02-12 12:51:23+00:00
There are many things that are valuable to people, but which they would rather not pay for. They include public goods and externalities, like infrastructure and education and a reasonable amount of military. It makes a lot of sense that people would rather enjoy art for free if they had the option, and since the majority of art experience can be easily duplicated and transmitted, why pay for it yourself? There is also another benefit of art stimulating further intellectual and creative development of a society, perhaps yielding second order benefits that are hard to quantify. Thus overall, it can make a lot of sense for government to pay for art as a society.
by ceteia | 2026-02-12 12:51:32+00:00
Do you know of any popular real-time (for some definition of real-time) applications written in D? Like, streaming music or video? C has FFmpeg [0]:

> FFmpeg is proudly written in the C programming language for the highest performance. Other fashionable languages like C++, C#, Rust, Go etc do not meet the needs of FFmpeg.

How does D perform in benchmarks against other programming languages?

[0] https://www.linkedin.com/posts/ffmpeg_ffmpeg-is-proudly-writ...
by thephyber | 2026-02-12 12:51:49+00:00
In practice, the real issue is how slow and subjective the legal enforcement of copyright is.

The difference between copyright theft and copyright derivatives is subjective and takes a judge/jury to decide. There’s zero possibility the legal system can handle the bandwidth required to solve the volume of potential violations.

This is all downstream of the default of “innocent until proven guilty”, which vastly benefits us all. I’m willing to hear out your ideas to improve on the situation.
by jfaganel99 | 2026-02-12 12:52:05+00:00
My read: RL post-training loops between generating rollouts (sample responses, score them) and doing updates. The pain is rollouts, since it’s autoregressive token generation and lengths have a long tail, so synchronous setups end up waiting on stragglers while GPUs sit idle.

slime seems aimed at that systems bottleneck: decouple rollout workers (SGLang) from the trainer (Megatron) with a buffer so training keeps consuming while rollouts stream in. APRIL then mitigates the long tail by over-provisioning, taking the first N completions, and carrying partial rollouts forward.

If I’m missing something, curious what others saw.
by usefulposter | 2026-02-12 12:52:15+00:00
An operator installed the OpenClaw package and initialized it with:

(1) LLM provider API keys and/or locally running LLM for inference

(2) GitHub API keys

(3) Gmail API keys (assumed: it has a Gmail address on some commits)

Then they gave it a task to run autonomously (in a loop aka agentic). For the operator, this is the expected behavior.
Show HN: NoSpamPro – AI Spam Blocker for Android (Privacy-First)
by huseyinsari | 2026-02-12 12:52:22+00:00
Hi HN,

I built NoSpamPro because I was tired of "spam blockers" that required uploading my entire contact list or call logs to their servers just to work. Most current solutions are essentially data-harvesting tools disguised as security apps.

NoSpamPro is an Android SMS/Call blocker designed with a privacy-first, local-only philosophy. It uses a hybrid 8-layer filtering system to handle threats without compromising your data.

How it works (The Engineering Side):

95% of the filtering happens on-device. The app follows a decision-tree logic to minimize battery impact and maximize privacy:

Local Heuristics: We use Room DB for instant lookups against known malicious prefixes, B-Codes (Business Sender IDs like B043), and user-defined Regex patterns.

B-Code Registry: A specialized layer that verifies official business codes to detect "spoofing" attempts common in banking fraud.

The AI Layer (Optional): This is where it gets interesting. If the local layers are inconclusive (e.g., a "Likely Spam" score), the app can use Gemini AI for contextual analysis.

Privacy Protocol: Before any text leaves the device, it is anonymized. We only ask the model: "Is this intent-based spam?".

Zero-Log: We implemented a protocol where analysis results are returned and the source data is immediately vaporized. No logs, no archives.

Technical Stack:

- Language: 100% Kotlin.
- UI: Jetpack Compose (Material 3).
- Storage: Room Persistence Library.
- Async: Kotlin Coroutines & Flow.

Why use this instead of the system default? While Google’s default filter is decent, it often misses localized scams (like country-specific betting spam) and has limited customization. NoSpamPro gives you "Advanced Protection" toggles like:

Burst Protection: Detecting "SMS Bomb" attacks and silencing them.

De-shortening URLs: Analyzing the final destination of bit.ly/t.co links within the app's "Ghost Browser."

International Guard: Blocking specific high-risk area codes while whitelisting others.

The app is currently available for Android. I'm looking for feedback specifically on the filtering logic and any edge cases in call screening you might have encountered.

Google Play: https://play.google.com/store/apps/details?id=com.byauth.nos...

I'll be around to answer any technical questions about the implementation or the privacy model!
by rakejake | 2026-02-12 12:52:24+00:00
This started decently enough and then the author went all over the place. I'm not sure why detailed explanations of neural nets and smart contracts were needed here. It really feels like trying to ram in a tech solution for what is effectively a market/social problem.

Using computers to aid in designing is not specific to Kanchipuram saris. While I realize people always approach it from the POV of saving a dying art, I'm unsure if K.saris can really fall under that umbrella. Clearly the demand is there and the issues here arise due to inefficient and possibly corrupt market practices rather than the art itself dying. A lot of space was used to explain the lopsided economics on the supply side but there's not enough attention paid to the demand side and the marketplace dynamics.
Show HN: An aesthetic customizable online flip clock and my first ever app
by moonalien | 2026-02-12 12:52:27+00:00
I know there are many flip clocks out there, but flip clocks are truly wonderful and my version FlipCloc is smooth, optimized, detailed, and fully customizable to match your workflow / aesthetics / mood.

Often, flip clocks online feel half baked: choppy animations, bad flipping animations, lazy flap separations, sometimes not even distinct top and bottom flaps, zero customization, and so on. After playing with time related concepts in various projects, I wanted to build an app of my own and made this using WebGL and React. This is my first ever app and I’m quite proud of this beta version.

Try the full experience for free in any browser. No ads, just a beautiful clock you can run in a tab, window, or PiP while working. (One-time purchase unlocks saving custom themes, settings, and presets and is usable on the web, app, or screensaver.)

Key features:

• Show/hide seconds, 12/24-hour toggle, pomodoro labels, sound effects, customizable flips, custom themes, positions, flap design, screen flashes on pomodoro phase end, a mini menu for controls, and so on

• Animated backgrounds, endless customization, and buttery-smooth flips

• GPU-optimized for ancient hardware and any device—yes, even obscure setups like smart speakers with screens or tiny PC monitors. Additional controls for frame rate, resolution

• A unique method to switch off the GPU when not needed and animate only on minute changes with a smooth gradual fade of the backgrounds.

It's fast, responsive, and optimized to perfection. Building this took months of polish focusing on minute details that others may or may not notice and hair-pulling bugs with auth, databases, tokens, WebGL, and React quirks, but shipping it finally feels amazing and is very rewarding. Expect a lot more polish as we go.

I’d love to see how you customize it and run it in your spaces! Maybe you can upload it in the comments for others to see as well or email me at flipcloc@gmail.com.

There is a lot more coming soon including the addition of new styles, backgrounds, effects, functionality, clock styles, and more. Hope some of you like it!

Feel free to try out and let me know if you have any feedback / features you’d like to see for the app. I love feedback and try to ship fixes quickly! Shoutout to power user ChrisVN on Reddit for a ton of pomodoro/stopwatch feedback that shaped it. Also happy to share from my small earned working knowledge of working with React, WebGL, Rust, Tauri, or Supabase if you have any queries.
by co_king_3 | 2026-02-12 12:53:33+00:00
LLMs are tools designed to empower this sort of abuse.

The attacks you describe are what LLMs truly excel at.

The code that LLMs produce is typically dog shit, perhaps acceptable if you work with a language or framework that is highly overrepresented in open source.

But if you want to leverage a botnet to manipulate social media? LLMs are a silver bullet.
by ben_w | 2026-02-12 12:53:37+00:00
We do on a regular basis, it's just that most of the accidents are relatively small-scale, like one person being mistaken for an explosive-vest wearing terrorist chased onto a subway train and shot, or just one of many reactors being made to go Chernobyl, or just the occasional huge dam here and there failing and damaging a few million homes: https://en.wikipedia.org/wiki/1975_Banqiao_Dam_failure

Most people aren't sadistically malicious, and most security is professional, so random little failures like metalled balloons or reflections off clouds (or the moon) scaring a security system will only blow up to something important (even on the scale of previous paragraph) every decade or so.
by OakNinja | 2026-02-12 12:54:02+00:00
Thank you for your kind words.

I guess one big component is perceived value. If the market thinks it’s valuable, it’s valuable. It’s when when the market looses value and/or interest that the true value will be evaluated. Companies that have grown organically don’t have that issue since they have proven themselves over time. It’s different for VC’s, for good and bad I guess.
by andsoitis | 2026-02-12 12:54:12+00:00
The archive is too big for anyone to have read even a fraction. Fortunately, a group of software engineers has turned the PDFs into a format that is easier to analyse. Using Reducto, an AI tool, they have identified which files contained emails; extracted the listed senders, recipients, dates, subjects and message bodies; and posted them on a website called Jmail.world. In total, the group processed 1.4m emails, finishing its work on February 11th. The Economist has collaborated with it to assign each message to unique individuals regardless of spellings or email addresses, and researched the backgrounds of the 500 people who appear most often. We then used a large language model (LLM) to score each email chain on how disturbing its content would be to a typical reader, creating an “alarm index”.
by jcarrano | 2026-02-12 12:54:26+00:00
"If you need subsidies in order to live off art, you don't live off art but live off the state".

As part time artist I see many problems with these schemes:

- Decoupled from people's actual appreciation of the art being done: I feel better when I know people voluntarily gave up their hard-earned money for what I do.
- Monopoly-style "winner takes all". The people who benefit from this are the ones already in a position to ask for the benefit.
- No one bites the hand that feeds then. That will form a body of "artists" subservient to the state.

The human problem is that no artist is willing to acknowledge that the public is not willing to spend money on their product.
by baseballdork | 2026-02-12 12:54:45+00:00
You’re proving the point. None of this is rational discourse. “you’re a criminal”, “ you’re a slave”, “you’re a crab”.

We get it, you don’t like paying taxes.

> The only purpose of your meager existence is to make your owners more wealthy and powerful.

Are these the wealthy and powerful pot smokers you’re talking about?
Show HN: LLM-DAG-UI – A branching conversation interface for Claude
by tenahu | 2026-02-12 12:55:11+00:00
I built a proof-of-concept UI that displays LLM conversations as a directed acyclic graph instead of a linear chat.

Try it: https://llm-dag-ui.vercel.app (screenshot in repo)

The idea: conversations with LLMs often hit dead ends or go in directions you want to backtrack from. What if you could branch off from any message and explore a different path, while keeping the original intact?

How it works:

- Drag from any message node to create a new branch.

- Each branch only has context of its direct ancestors – it doesn't know about sibling branches or other parts of the tree.

- Delete a node and all its children disappear with it.

Useful when you want to try three different approaches to a problem from the same starting point, or test how Claude responds to different phrasings.
This is a concept demo, not a polished product.

It uses BYOK (bring your own Anthropic API key), stored only in your browser's localStorage. The Express proxy just controls which Claude model is used; your key passes through but is never logged or stored. Nothing persists between sessions.

I think this is closer to how LLM conversations should work. The linear chat paradigm made sense for messaging, but exploration is rarely linear.

Code: https://github.com/dgrims3/LLM-DAG-UI

Would love feedback on the interaction model.
by fustinus | 2026-02-12 12:55:14+00:00
Pixlpal is a smart interactive LED display companion that keeps you informed at a glance. It delivers real-time updates—time, weather, calendar events, news, market data, sports updates, and more—so you stay focused without constantly reaching for your phone. Designed for productivity, clarity, and simplicity, Pixlpal helps you stay aware of what matters most at a single glance. built for everyone—educators, students, enthusiasts, developers, and makers.
by einr | 2026-02-12 12:55:16+00:00
This argument would sound nearly identical if you made it in the 70s or early 80s about mainframes and personal computers.

It's not that mainframes (or supercomputers, or servers, or the cloud) stopped existing, it's that there was a "good enough" point where the personal computer was powerful enough to do all the things that people care about. Why would this be different?*

And aren't we all paying for a bunch of silicon that sits mostly unused? I have a full modern GPU in my Apple SoC capable of throwing a ridiculous number of polygons per second at the screen and I'm using it to display two terminal emulator windows.

* (I can think of a number of reasons why it would in fact turn out different, but none of them have to do with the limits of technology -- they are all about control or economic incentives)
by casey2 | 2026-02-12 12:55:26+00:00
While it's funny either way I think the interest comes from the perception that it did so autonomously. Which I have my money on, cause then why would it apologize right afterwards, after spending a 4 hours writing blogpost. Nor could I imagine the operator caring. From the formatting of the apology[1]. I don't think the operator is in the loop at all.

[1] https://crabby-rathbun.github.io/mjrathbun-website/blog/post...
by instig007 | 2026-02-12 12:55:39+00:00
> create cultural wealth and people who create mere monetary wealth

the wealth in this case isn't monetary, it's material production, the productive work of people who create material objects, including your food and shelter. If it was about monetary stuff the government would just print the artists whatever amount of money they need. But that money has to be spent to buy from those who produce the stuff the artists need to live. Who's sponsoring the wealth producers?
by krapp | 2026-02-12 12:55:55+00:00
Hacker News defaults to using the canonical url set by the site's metadata where it exists. 99.9% of sites set this to the domain for better SEO, so any post from those sites will automatically be replaced by links to the domain itself.

Nowhere in the HN UI is the poster warned of this, because that would add complexity which would violate HN's principles of minimalism. You are simply expected to notice and re-edit the post within the edit window. Which no one does because they aren't made aware that they have any reason to.
by veltas | 2026-02-12 12:57:31+00:00
Problem RISC-V has is there's no middle-ground.

The specification for an architecture is meant to be useful to anyone writing assembly, not just to people implementing the spec. Case in point x86 manuals aren't meant for Intel, they're meant for Intel's customers.

There is a lot of cope re the fact RISC-V's spec is particularly hard to use for writing assembly or understanding the software model.

If the spec isn't a 'manual' then where's the manual? If there's just no manual then that's a deficiency. If we only have 'tutorial's that's bad as well, a manual is a good reference for an experienced user, and approachable to a slightly aware beginner (or a fresh beginner with experience in other arch's); a tutorial is too verbose to be useful as a regular reference.

Either the spec should have read (and still could read) more like a useful manual, or a useful manual needs to be provided.
by whywhywhywhy | 2026-02-12 12:57:51+00:00
Why would I ever do work if I can just do art? I mean I have worked in the creative industries so I have successfully done art for others but why would I do art to serve others if I can just do what I want and live comfortably.

Or is it more of have to apply to be subsidized and the government chooses what art is worth subsidizing, which won’t result in good art, more just government building lobby bad art.
by soraminazuki | 2026-02-12 12:57:57+00:00
As a strong believer in consumer rights and corporate accountability, it always irks me when businesses brandish their one-sided ToS that 100% works in their favor to the detriment of individuals and society at large. Bonus points if they claim the moral upper ground when they themselves break all social rules and norms with no accountability whatsoever.

I don't have any plans to subscribe or share access to coding agents myself, but it irks me nonetheless.
by shuzaifas | 2026-02-12 12:58:18+00:00
Auto Reply is your AI-powered "Chief of Staff" that handles conversations across 15+ apps (WhatsApp, Messenger, Slack, LinkedIn, etc.) while you’re busy.

Whether you're in a deep work sprint, sleeping, or traveling, our context-aware AI understands incoming messages and replies just like you would—keeping your business and relationships moving without the notification fatigue.

Why it’s a game-changer:

True AI Intelligence: Not just "I'm busy" texts. It understands intent and context.

Omnichannel: One app to rule them all (WhatsApp, Slack, Telegram, and more).

Surgical Control: Choose exactly which contacts, groups, or apps the AI manages.

Privacy-First: Secure local processing with zero conversation data stored or shared.

Stop managing your inbox and start managing your day.