MurphyA/hacker-news huggingface dataset:
by paxys | 2026-02-25 15:39:14+00:00
Well it's an auction. They only set the starting price, and it keeps lowering periodically until someone buys.

What they can do is:

- Raise the price of already rented servers (which is happening Apr 1)

- Increase the minimum price beyond which a server is removed from auction and dismantled (I believe it is 30 euros right now)
Show HN: Stintly – Offline-first app for freelancers with on-device AI
by ryanfielding | 2026-02-25 15:39:41+00:00
I built Stintly, an all-in-one business management app for freelancers, contractors, and self-employed professionals. It runs entirely offline with all data stored locally on your device.

What it does:
- Invoicing & estimates with on-site signature capture
- Expense tracking with receipt scanning and voice input
- Time tracking with one-tap timers
- Job/project management with photo documentation
- Schedule C tax tracking with quarterly estimates
- Client management with revenue history
- Reports & analytics with PDF export

What makes it different:

Privacy-first: All data lives on your device. No account required. No tracking, no ads, no data selling. Optional iCloud backup if you want it.

Offline-first: Works 100% without internet — SQLite on device. Most competitors (FreshBooks, Wave, QuickBooks) require a connection.

On-device AI: 20+ AI features (receipt OCR, voice expense entry, cash flow forecasting, tax optimization, client insights) run locally via Llama on Metal GPU. No data leaves your phone.

Tech stack: React Native/Expo, SQLite, NativeWind, on-device LLM via react-native-llama.cpp with Metal acceleration, custom OTA updates via Cloudflare Workers + R2.

Pricing: Free tier (5 clients, 5 invoices, unlimited use) forever. Pro at $12.99/mo, Premium with AI at $19.99/mo.

Currently on iOS (iPhone/iPad/Mac). Would love feedback from other freelancers and indie devs on what's missing or what you'd want from a tool like this.

App Store: https://apps.apple.com/us/app/stintly-invoice-expenses/id675...

Website: https://stintly.app
by throwaway27448 | 2026-02-25 15:39:55+00:00
> This administration really, truly lives under the delusion that they hold "all the cards".

I think it's simpler than that: they think the world is a zero-sum game, so why bother being anything but utterly confrontational at every turn?

Of course, that's a childish way to view the world, but we're a childish people.
by dasil003 | 2026-02-25 15:40:12+00:00
Safety is a nice idea but it’s not structurally pursuable at this point. Everything is moving too quickly and we don’t exactly know what is useful or not, just like we don’t know what’s safe or not.

Anyone pursuing safety will be outcompeted by someone who isnt. Given the amount of investments there is no patience for any calls to slow down. I tend to believe this won’t actually end in disaster as I don’t think it’s actually economical to put AI everywhere with enough real control that we can’t manage the risks as they evolve, but it’s a low confidence prediction.
by SubiculumCode | 2026-02-25 15:40:37+00:00
This is the standing reason that is always given for why we must all sit in freeway traffic clogs, and I think it's B.S., because it assumes that there are viable alternatives available in near-medium term, but that isn't always the case. The alternative to freeways that are supposed to compensate is a joint combination of denser housing and mass transit, which in California, is not happening at all...zoning laws and the slow pace of building mass transit due to regulation slow-down and the need to service urban sprawl, prevent that solution from relieving traffic pressure. Don't speak of busses, because taking two hours to get to work is not better than one hour. So..the freeways stay the same number of lanes and my commute time continues to grow, and I am tired of hearing it is for the best.

So yes, lower LLM costs would probably lead even more LLM usage and greater energy expenditures, but then again, so does having a moving economy, and all that comes with that.
by muzani | 2026-02-25 15:40:50+00:00
Roles are recommended in the Claude documentation: https://platform.claude.com/docs/en/build-with-claude/prompt...

I've been using Cursor Commands to swap roles in and out.

My favorite role has been this guy named Murphy, who has the misfortune where anything that can go wrong would go wrong. It's been great at sniffing out bugs, doing PRs and especially finding race conditions.
by fodkodrasz | 2026-02-25 15:41:08+00:00
I had issues with performance/power management, and had to abandon Podman Desktop on Windows. Have not checked out recently, but my issues may possibly be solved by

https://github.com/podman-desktop/podman-desktop/issues/1035...

Basically I had a 5 second periodic CPU spike after some update. Also I had some compose issues, and some issue with Fedora based WSL. These together were blockers for me at that point, but I'm using podman on my pet Fedora server, and it works (using quadlets there) perfectly there, and will retry it on Windows also when I get the time.
by yassi_dev | 2026-02-25 15:41:24+00:00
Totally understand - I am a long time flower user for example, and I am familiar with having to harden that installation a bit.

What I'm aiming for here is slightly different - keeping everything inside Django so there are no extra services to run or configure or proxy. As long as you surface the admin somewhere, then that is the place to find your tooling (including celery monitoring)

There will always be room for both approaches. A lightweight proxy/redirect could be something to explore in the future.
by JumpCrisscross | 2026-02-25 15:41:33+00:00
> US 'diplomats' are campaigns big donors, or primary supports

To be clear, there are political and career diplomats, and each administration mixes and matches to its taste. (The current one veers strongly towards political appointees. That is to say, folks who raised money.)

This is how most foreign services are run, with maybe the exception of China.
by chris_money202 | 2026-02-25 15:41:35+00:00
I think there are plenty of people working on it still, I am even working on a startup that prioritizes safety for physical autonomous systems!

The problem is that safety is written in blood. Airlines implemented flight recorders / black boxes and various processes after major incidents. A major mistake occurs that causes death or destruction to property, or both, an investigation occurs, we learn from it, and introduce new laws and regulations to prevent a reoccurence.
by maest | 2026-02-25 15:41:38+00:00
Reminds me of the "US high healthcare costs are subsidising EU cheap healthcare".

The rough argument was: pharma companies need big payoffs when they discover a new drug and, due to structural characteristics of the US market, that's where they can get the highest prices.

So pharmas make a large chunk of their profits in the US and then sell drugs more cheaply in e.g. Europe.

Fairly weak and incomplete argument [1], but I've seen this pushed seriously by people in public debates in the US.

[1] - a couple of obvious issues with this argument are: 1. why is it Europe's fault that the US has structural issues that prevent it from negotiating drug proces as a united front? 2. healthcare costs are largely inflated by admin costs in the US. Drugs can be expensive too, sure, but this argument ignores the big cost intrinsic to the insane insurance and billing system prevalent in the US.
Show HN: TMDD – continuous threat modelling that makes your code more secure
by attasec | 2026-02-25 15:41:40+00:00
My name is Mikolaj and I built tmdd tool, a CLI that keeps an up-to-date threat model of your app (in YAML format) in your repo and generates security-aware prompts for AI coding agents. Here's why:

I am a security engineer. Oftentimes I observed situations where "technical" security levels were pretty high, but the business logic and authorization related issues made the apps pretty vulnerable. In my experience, no SAST or DAST is able to spot this kind of issues; some of them might be captured during the pentests, but the pentests are time-boxed, so you never have the guarantee that everything was thoroughly analysed.

That's why I decided to build this framework (name TMDD is a shortcut for Threat Modeling Driven Development, but it's more than that).

How it works:
1. you init the threat model with <code>tmdd init</code> command - the yaml files that describe the threat model are created in your repo (either empty or from the template).
2. you load threat modeling skill into your coding agent - I tested with Cursor and Claude Code
3. The agent does the threat modeling and updates yaml files
4. IF you want to add a new feature, you can use <code>tmdd feature "feature name"</code> command, that will update the YAML and generate security-focused development prompt, that you can then feed to agent
5. You can generate complete threat model report with diagram using tmdd-report

E.g. without TMDD, you ask Cursor to build a password reset flow and it might ship it without rate limiting or token expiration. With TMDD, the agent gets a prompt that lists those as required controls because they're in the threat model.

And even without the AI workflow, you get a structured, version-controlled threat model - which many appsec teams don't have today :)

Why is matters:
1. It takes Threat Modeling closer to the code - instead of using whiteboard, you do threat modeling with help from AI Agent can refer to exact lines in your codebase. You can also track mitigations and who's reviewed mitigations for the last time
2. It's similar to Claude Code Security in some ways, but works with any agent that has terminal access - no vendor lock-in ;)
3. Threat Model documentation lives alongside your repo and is stored in YAML, so you can version control it, etc.
4. you can build custom <code>catalog.yaml</code> file, and use a catalog of threats for threat modeling of all products at your company

Let me know what do you think about it.
Repo is here:
https://github.com/attasec/tmdd

We are also working on SaaS version (core remains open-source, but additional features, collaboration tools and UI will be available), you can learn more here: https://attasec.com
by ReptileMan | 2026-02-25 15:41:40+00:00
Does it have to be /pol to be pissed off that one's country loses almost a century in its development due to communism and post communist transition period. Stalin killed more of its people than Hitler did. Mao's body count was bigger than probably all of the war casualties combined. And pol pot was the most charming communist of them all in relative terms. Oh and North Korea.

Eastern Europe bore the brunt of the war's damage and was left for 50 year under the oppressive boot of the stupidest ideology the world has ever known. And poorly executed to boot.
Show HN: Kinetic SQL – A lightweight, real-time SQL Engine for Node.js
by im_kapilkumar | 2026-02-25 15:41:53+00:00
Hi HN, I'm the author.

I've spent years building Node.js backends (mostly Express and NestJS) and I’ve consistently found traditional ORMs like TypeORM too heavy, while Prisma’s subscription models didn't quite fit my need for lightweight CDC (Change Data Capture). I wanted something universal that felt closer to the metal but still handled real-time events seamlessly.

Over the past couple of days, I built Kinetic SQL. It's a thin, highly flexible SQL wrapper for Node.js (supporting Postgres, MySQL, and SQLite).

The CORE focus:
Framework Agnostic: Works beautifully with Express, Fastify, or Vanilla Node, with a dedicated seamless-integration module for NestJS included as a bonus.

Real-time Subscriptions: Listen to table changes (INSERT/UPDATE/DELETE) natively and push to clients (perfect for live dashboards).

Zero-Touch Interfaces: The CLI (npx k-sql gen) reads your schema and auto-generates absolute type safety. No more writing interfaces by hand.

Native DB Functions: Call your database procedures directly as native JavaScript methods.

To stress-test the real-time engine, I built a high-frequency stock market simulator (running on a free Vercel/Render stack with a 0-second cold start):

Live Demo: https://live-stock-simulator.vercel.app/
NPM: https://www.npmjs.com/package/kinetic-sql

I'd love to hear your thoughts on the API design.
(P.S. MSSQL support is coming soon!)
by vincentalbouy | 2026-02-25 15:42:04+00:00
Latency is something we’re actively working on. Because the agent sometimes calls multiple tools (venue retrieval, cost estimation, ranking, etc.), it can feel slower than a traditional search UI. We’re optimizing tool chaining and caching right now, but it’s definitely an area where we need to improve. If it ever feels sluggish, that’s on us.

Filtering UI: Also agree. We leaned heavily into conversation because planning is iterative and constraint-driven, but that doesn’t mean everything should require typing. A hybrid approach (chat + explicit filters/sliders/toggles) probably makes more sense for power users. We already have structured results on the right adding faster, direct manipulation controls there is a logical next step.

Appreciate you calling it out. If you were using this for real, what filters would you expect to be immediately clickable instead of typed?
by FusspawnUK | 2026-02-25 15:42:10+00:00
Took a crack at this earlier. the leader board is a little weird. seems to be like 2 real dudes and the rest are fake profiles.
a
Scores resetting on each new upload also encourages leaving changes unimplemented in the hopes of getting more battles over time.

The largest winner having 50 wins against 14 other opponents for instance). That guy adding a new script would instantly plummet down the leader board capping out at 14 wins again, Putting it below the 2nd place user.

The leader board will quickly become "who can have a mostly competent AI and never change it" over who actually has the better script.
by jfaganel99 | 2026-02-25 15:42:12+00:00
That's a great question. This is how I would think about it:

The number of vulnerabilities by itself doesn't mean much. It has more to do with the size of the codebase and the attack surface than with the quality of the code. There is a big difference between 10 findings in 500 lines and 10 findings in 500k lines.

What matters more:

1. How bad it is and how easy it is to use. An auth bypass is not the same as a timing attack in theory. Check to see if the vulnerabilities are in code paths that can be reached in your deployment.

2. The strongest signal is the maintainer's response. How quickly do they reply? Do they take the results seriously or ignore them? A project that fixes problems quickly and gets people involved in a good way is much better than one that has no findings and no security process. For LangFuse specifically, they agreed with two of the findings and said that two of them were acceptable risks. This is a reasonable response. It's worth following up on the V4 non-response, but maintainers are busy and things get missed.

3. The kind of bugs is important. It's normal for any codebase to have logic errors, like the ones we found. You don't want to see the same type of vulnerability happen over and over again, because that means there is a systemic gap.

The only reason a project shows up in our results is because it's popular enough for us to look at it. I'd be more worried about projects that have never been looked at for security.

If you want to know more about LangFuse specifically, you can find all the information on the site: https://www.kolega.dev/security-wins/
by notanastronaut | 2026-02-25 15:42:33+00:00
This. Anthropic didn't really have a choice, at that point, short of killing its company and closing its doors ahead of time.

"Pentagon officials said the Defense Department is planning to keep using Anthropic's tools, regardless of the company's wishes."

NPR - Hegseth threatens to blacklist Anthropic over 'woke AI' concerns

Clearly the threat to go to Grok was just a bluster, which says volumes about what the admin thinks of Grok vs Claude.
by Freak_NL | 2026-02-25 15:42:34+00:00
Belgium too:

https://www.theguardian.com/world/2026/feb/18/belgium-invest...

And of course Joe Popolo in the Netherlands:

https://www.theguardian.com/world/2025/nov/11/displays-black...

(He later doubled down on the decision to erase any mention of the racial segregation black US soldiers were submitted to while serving in the army during WWII.)
by alephnerd | 2026-02-25 15:42:41+00:00
Much of the capital is US originated and domiciled.

American public pension funds alone hold $6 Trillion in AUM [0] and American endowment funds hold a little under $1 Trillion in AUM [1], and tend to be the LPs for most VC funds as most institutional investors follow the Yale Investment Model.

[0] - https://www.census.gov/newsroom/press-releases/2025/2024-ann...

[1] - https://nces.ed.gov/fastfacts/display.asp?id=73
by Xeoncross | 2026-02-25 15:42:50+00:00
Sorry, but it's honestly just a lot of our journeys. Started on scripting languages like PHP/Ruby/Lua (self-taught) or Java/VB/C#/Python (collage) and then slowly expanded to other languages as we realized we were being held back by our own tools. Each new language/relationship makes you kick yourself for putting up with things so long.
by petcat | 2026-02-25 15:42:56+00:00
Yes, we all know that ASML is a multi-national effort, with critical technology components provided by several countries. The point is that the EUV light source is one of the critical technology components and it has not been replicated anywhere else (so far, see xLight founded by Dept. of Energy engineers and funded by the US gov).

It's a bargaining chip that this administration will undoubtedly use to make sure that US access to ASML lithography machines remains undisturbed.
by pksebben | 2026-02-25 15:43:04+00:00
I find myself in the awkward place of being both. I use LLMs to offload busywork and to allow me to get work done that I otherwise wouldn't have time for, but I also see that we're walking a pretty tenuous tightrope when it comes to pretty much every concern we've ever had with technology bundled in one place and amplified 1000x.

It's the old rag of "tech is the tool, ethics are the user" in an era where people who are unethical have become loud and proud about it and the tech is recursive reinforcement power tools on steroids.
by vasco | 2026-02-25 15:43:25+00:00
A safety team at the hammer company cannot prevent me from using it to bang your head.

You can align to the user wants and so you are a hammer. This is alignment>safety.

Or you take a safety first approach where the AI decides what safe is and does its own bidding instead of yours. This is safety>alignment.

I prefer hammers to be honest. Mostly because humans can be prosecuted, AIs can't. So if the human wants to commit crime with the AI it should be able to, because the opposite turns to dystopia fast.
by ceejayoz | 2026-02-25 15:44:10+00:00
> There were lots of administrations who could have said to other countries ,,let's get rid of the nukes together'' while USA was the only string power.

There was only one administration with that opportunity, really; Truman.

Every other administration has had a nuclear armed Russia in play.

Attempts to do what you describe were still quite common, starting as early as the 1950s. https://en.wikipedia.org/wiki/Nuclear_arms_race#Treaties
by joe_mamba | 2026-02-25 15:44:25+00:00
You're missing the point. Nobody will take back anything since that hurts everyone, but if the US wanted they could license EUV tech to Nikon or Canon and give ASML a huge PITA of refreshed competition.

Similar to TRUMPF lasers and Zeiss optics, other companies from US and Japan like Coherent and Canon could have a crack at replicating the laser and mirrors given enough IP and resources if the US really wanted to decouple from ASML, since they're still man made objects, not magic things given by gods.

US is the richest country in the world and the second biggest manufacturer after China. Do you think the country that built the SR-72 and other sci-fi shit wouldn't be able to make a EUV lithography machine in house if they were to treat it like a Manhattan project instead of a side hustle?
by delecti | 2026-02-25 15:44:29+00:00
The EU is to blame for cookie banners on basically every website on the internet.

I wish the US had something similar, and that there was more enforcement of disallowing "accept all" buttons without an equivalent "reject all" option. I also recognize that websites don't need the banner if they aren't trying to track me, but lets not pretend there aren't annoying consequences.
by kakacik | 2026-02-25 15:44:34+00:00
Project this a decade or two into future and I honestly don't have a solution for the west but a gradual decline into mediocrity. We have less corruption and communicate directly also about problems, so at least that will work for us for some time too.

But maybe China and similar places will elevate their overall prosperity enough that people will refuse to be treated like this en masse, so there is some hope.
by krisoft | 2026-02-25 15:44:46+00:00
> If this were a question on a grade school word problem test then just say 100

Let me repeat the question again: "If 5 machines can produce 5 parts in 5 minutes, how long will it take for 100 machines?" Do you think that by adding 95 more machines they will suddenly produce the same 5 parts 95 minutes slower?

What kind of machine have you encountered where buying more of them the ones you already had started working worse?

> then I would challenge you to come up with a version that's specified rigorously enough for any sufficiently picky interviewee.

This is nonsense. The question is under specified. You don't demonstrate that something is underspecified by formulating a different well specified question. You demonstrate it by showing that there are multiple different potentially correct answers, and one can't know which one is the right one without obtaining some information not present in the question.

Let me show you that demonstration. If the machines are for example FDM printers each printing on their own a benchy each, then the correct answer is 5 minutes. The additional printers will just sit idle because you can't divide-and-conquer the process of 3d printing an object.

If the machines are spray paint applying robots, and the parts to be painted are giant girders then it is very well possible that the additional 95 paint guns make the task of painting the 5 girders quasi-instantaneous. Because they would surround the part and be done with 1 squirt of paint from each paint gun. This classic video demonstrates the concept: https://www.youtube.com/shorts/vGWoV-8lteA

This is why the question is under specified. Because both 1ms and 5 minutes are possibly correct answers depending on what kind of machine is the "machine". And when that is the case the correct answer is neither 1ms nor 5 minutes, but "please, tell me more. There isn't enough information in the question to answer it."

Note: I'm struggling to imagine a possible machine where the correct answer is 100 minutes. But I'm sure you can tell what kind of machine you were thinking of.
by rmast | 2026-02-25 15:44:48+00:00
I’m not at all affiliated with this project, just came across it and thought it looked interesting - it kind of resembles the sled from a CD drive tray. I could imagine an open hardware version of the printable files being created if they don’t already exist.

A quick search for the stepper motor drivers used shows sets of 5 for around $15, perhaps pair with a cheaper microcontroller than the Arduino Uno and total BOM costs could be $30 or so.