MurphyA/hacker-news huggingface dataset:
by kllrnohj | 2026-02-21 00:47:04+00:00
"flashing" a phone is largely the same as any OTA update. There's of course always a risk of it going wrong, disk failures are always possible, but it's exceptionally hard to do so accidentally. Especially with custom ROMs where they basically never include a new bootloader, so "flashing" is no different than installing an OS on a desktop system - it's just writing to the boot partition. Which you can always do again since the bootloader is still available.
Show HN: Cellarium: A Playground for Cellular Automata
by andrewosh | 2026-02-21 00:47:09+00:00
Hey HN, just wanted to share a fun, vibe-coded Friday night experiment: a little playground for writing cellular automata in a subset of Rust, which is then compiled into WSGL.

Since it lets you dynamically change parameters while the simulation is running via a TUI, it's easy to discover weird behaviors without remembering how you got there. If you press "s", it will save the complete history to a JSON file (a timeline of the parameters that were changed at given ticks), so you can replay it and regenerate the discovery.

You can pan/zoom, and while the main simulation window is in focus, the arrow keys can be used to update parameters (which are shown in the TUI).

Claude deserves all the credit and criticism for any technical elements of this project (beyond rough guidelines). I've just always wanted something like this, and it's a lot of fun to play with. Who needs video games these days.
by publius_frog | 2026-02-21 00:48:08+00:00
(Throwaway account.)

Several people have mentioned that "you can just own your own data, so that's enough, right?"

Interoperating with Bluesky requires you to either 1) opt into the did:plc standard, which is a centrally controlled certificate transparency log, or 2) have all your users create did:web accounts by manually setting DNS records.

So it is not possible to build on Bluesky at all without opting into this centrally controlled layer. This original post covers this, but maybe not in enough detail to stop commenters from missing the point.

Bluesky the company controls 95%+ of PDSes in the system, which control users' private keys, and they're extending PDSes to include more functionality that prevents users from easily exiting the network, e.g. private data is being implemented in a way where Bluesky LLC can see all your activity. The protocol changes often and with limited community input.

This is being done because "there are no other ways to do it" and "our users are okay with it". The community does pretty consistently attack people who dissent (e.g. look at what happened when Mastodon leaders objected). There's a lot of cheerleading for people who do opt into the system, and there's really no incentive for informed criticisms.

It's not really decentralized or neutral infrastructure; it's a great network for a number of specific subcultures who have a nice space away from X, and I hope the team embraces that.
by vvpan | 2026-02-21 00:48:21+00:00
> At every layer, the answer is "anyone can run their own." At every layer, almost nobody does.

But people do and it is reportedly fairly easy so the majority of people are on Bluesky's layers while all is well. But also I don't understand why any of this is a reason to be "wary", it's a great place to be with some unique technical properties - it is way more "open" than any other platform of similar scale.
by pimlottc | 2026-02-21 00:48:21+00:00
Please reduce the aggregation of map markers. It's not helpful to group every mine in southwest US in a single point in California that makes it look like they are none in any other state. I see this all the time on maps and it's really frustrating. Aggregate markers are helpful when the individual points are actually overlapping on the map, otherwise they obscure location data.
by lucb1e | 2026-02-21 00:48:35+00:00
Yes, this routing is common. German energy company recommended by a climate organization had a somewhat similar vulnerability and no security contact, so I call them up and.. mhm, yes, okay, is that l-e-g-a-l-@-company-dot-de? You don't want me to just send it to the IT department that can fix it? Okay I see, they will put it through, yes, thank you, bye for now!

Was a bit of a "oh god what am I getting into again" moment (also considering I don't speak legal-level German), but I knew they had nothing to stand on if they did file a complaint or court case so I followed through and they just thanked me for the report in the end and fixed it reasonably promptly. No stickers or maybe a discount as a customer, but oh well, no lawsuit either :)
by ceejayoz | 2026-02-21 00:48:41+00:00
https://en.wikipedia.org/wiki/Trump_v._United_States

> Trump v. United States, 603 U.S. 593 (2024), is a landmark decision of the Supreme Court of the United States in which the Court determined that presidential immunity from criminal prosecution presumptively extends to all of a president's "official acts" – with absolute immunity for official acts within an exclusive presidential authority that Congress cannot regulate such as the pardon, command of the military, execution of laws, or control of the executive branch

Seems accurate.
by staticassertion | 2026-02-21 00:49:00+00:00
I think this is just sort of the wrong framing. Yes, a plane having a DoS is a critical failure. But it's critical at the level where you're considering broader scopes than just the impact of a local bug. I don't think this framing makes any sense. If you're building a plane, who cares about DoS being a CVE? You're way past CVEs.

CVEs are helpful for describing the local property of a vulnerability. DOS just isn't interesting in that regard because it's only a security property if you have a very specific threat model, and your threat model isn't that localized (because it's your threat model). That's totally different from RCE, which is virtually always a security property regardless of threat model (unless your system is, say, "aws lambda" where that's the whole point). It's just a total reversal.
Show HN: WatchTurm – an open-source release visibility layer I use in my work
by WatchTurm | 2026-02-21 00:49:09+00:00
I built this to solve a recurring problem in multi-repo, multi-environment setups:
it’s surprisingly hard to answer “what is actually running where?” without checking several systems.
WatchTurm is an open-source release visibility layer. It aggregates metadata from sources like GitHub, Jira and CI (e.g. TeamCity), generates a structured snapshot of environment state, and surfaces it in a single control view.

It doesn’t replace CI/CD or manage deployments. It sits above automation and focuses purely on visibility:
- what version runs in each environment
- how environments differ
- what changed between releases

I’m currently using it in my own daily work and would really appreciate technical feedback, especially from teams with multi-environment pipelines.

repo: https://github.com/WatchTurm/WatchTurm-control-room
by dang | 2026-02-21 00:49:14+00:00
Edit: for me the most practical insight to come out of these threads, so far, is that Show HNs for generated repos/sites/projects would be more interesting if people were required to share the prompts, and not just the generated output. This makes sense to me because for such projects, the prompts are the real source. For such cases, the GH repo or generated artifact is actually the object code, and if that's all that's shared, it's less interesting and there's less to discuss.

I think we're probably going to implement this unless people come up with strong reasons not to do it.

--- original comment ---

Recent and related:

Is Show HN dead? No, but it's drowning - https://news.ycombinator.com/item?id=47045804 - Feb 2026 (423 comments; subthread https://news.ycombinator.com/item?id=47050421 is about what to do about it)

AI makes you boring - https://news.ycombinator.com/item?id=47076966 - Feb 2026 (367 comments)
by duskwuff | 2026-02-21 00:49:20+00:00
I have a feeling it might be less "avoid negative publicity"; more "give a premium experience to influencers" (for a broad definition of that term).

A user - like mbo's mother - who posts a lot of content which generates a lot of reposts and other positive interactions is basically a gold mine for Facebook. It's in their interest to treat that user with kid gloves to get them to keep posting, even if it means foregoing some revenue opportunities.
by toomuchtodo | 2026-02-21 00:49:39+00:00
It is not time efficient to try to win the votes of simple people. You blame Democrats, I blame the people who voted for this and are shocked he did what he said he was going to do.

Mass deportation? Tariffs? Dismantling the government? Hate? All things he campaigned on. He is doing exactly what his voters were told he was going to do. Dems are going to win those votes? Unlikely, they’re not going to run a candidate that appeals to their “values”:

> “He’s not hurting the people he needs to be”: a Trump voter says the quiet part out loud
A Trump voter hurt by the shutdown reveals the real reason the president attracts hardcore supporters.

> The president’s particular brand of identity politics — the racist attacks on blacks and Latinos, the Muslim ban, his cruel treatment of women — similarly depends on negative rather than positive appeals. Antoine Banks, a political psychologist at the University of Maryland, wrote a book on the connection between anger as an emotion and racial politics. When politicians gin up anger, an emotion that necessarily has a negative target, voters tend to think about the world in more racial (and racist) terms. Trump makes his voters angry, he centers that anger on hated targets, and that makes them want to take his side.

> This is what makes Trumpism work. This is the dark heart of our political moment. Even people who are tremendously vulnerable themselves, like Crystal Minton, support Trump because of his capacity to inflict pain on others they detest. The cruelty, as the Atlantic’s Adam Serwer says, is the point.

https://www.vox.com/policy-and-politics/2019/1/8/18173678/tr...
Show HN: Give your OpenClaw agent a face and voice with LiveKit and LemonSlice
by arbayi | 2026-02-21 00:50:20+00:00
For a fun side weekend project we gave our own OpenClaw agent called "Mahmut" a face and had a live interview with it. It went surprisingly well.

Here's a sneak peek from the interview: https://x.com/ptservlor/status/2024597444890128767

User speaks, Deepgram transcribes it, OpenClaw Gateway routes it to your agent, ElevenLabs turns the response into speech, and LemonSlice generates a lip synced avatar from the audio. Everything streams over LiveKit in real time.

Latency is about 1 to 2 seconds end to end depending on the LLM. The lip sync from LemonSlice honestly surprised us, it works way better than we expected.

The skill repo has a complete Python example, env setup, troubleshooting guide, and a Next.js frontend guide if you want to build your own web UI for it.
by insane_dreamer | 2026-02-21 00:51:36+00:00
I closed my FB account about 10 years ago - it wasn't even that the feed was so bad back then, but I found social media mentally unhealthy and wanted to break the habit. I closed my Twitter account a few years later.

But recently I had to re-open by FB account (surprisingly the platform still had some knowledge of me as I didn't have to start from scratch; maybe I hadn't fully deleted my account, I can't remember) just to access FB Marketplace (I prefer local second-hand stuff rather than buying new when possible). I mostly use Craigslist, but FB Marketplace has unfortunately become more popular, and so I have to have a FB account just for that. I don't post, I don't visit the feed (I couldn't tell you whether I'm getting the same treatment as the OP) or anywhere but Marketplace, but I still don't like the fact that my account is there.

I wish I could use FB Marketplace without FB, or that people would just stop using FB Marketplace and go back to Craigslist :/
by mullingitover | 2026-02-21 00:52:15+00:00
> Then KSA makes a nuke.

imho that's the real endgame anyway, the US is just hired muscle to beat up KSA's regional rival, and eventually when the US is done collapsing and retreating to isolationism KSA will do a big show of their nuclear weapons.

If KSA wants a nuke they'll get it, and the US politicians they've purchased will all applaud them for the accomplishment.
by jcgrillo | 2026-02-21 00:53:27+00:00
I suppose I should have been more specific--pattern matching in text. We humans do a lot more than processing ascii bytes (or whatever encoding you like) and looking for semantically nearby ones. If "only" because we have sensors which harvest more varied data than a 1D character stream. Security researchers may get an icky feeling if they notice something or another in some system they're analyzing, which leads eventually to something exploitable. Or they may beat their head against a problem all day at work on a Friday, go to the bar afterwards, wake up with a terrible hangover Saturday morning, go out to brunch, and while stepping off the bus on the way to the zoo after brunch an epiphany strikes like a flash and the exploit unfurls before them unbidden like a red carpet. LLMs do precisely none of this.
by tombert | 2026-02-21 00:54:15+00:00
It baffles me that Polymarket is legal.

Even if there wasn't any kind of insider betting going on, it just seems so disgusting to turn literally everything into a casino.

There's a bet going on right now about Jesus coming back before 2027 [1], and a part of me wants to do it because I'm pretty confident Jesus isn't coming back by the end of the year (or any year), but it seems kind of wrong to try and extract money out of people who are gambling away their money.

[1] https://polymarket.com/event/will-jesus-christ-return-before...
by danudey | 2026-02-21 00:54:45+00:00
> New "Xbox" games run best on PS5 Pro (for consoles at least).

I dunno, the way Windows 11 is going these days that caveat is getting a lot of scrutiny. I would say that, in many cases, they run best on PS5 Pro full stop - at least until the GabeCube releases, for those who can afford it.
by alephnerd | 2026-02-21 00:54:47+00:00
> If KSA wants a nuke they'll get it

> eventually when the US is done collapsing and retreating to isolationism KSA will do a big show of their nuclear weapons

They will not. They will go the same way Iran did. Iran used to be our KSA back in the day.

KSA getting a nuclear weapon means threatening the UAE, which now has a defense pact with India. A KSA (or UAE) nuclear bomb leads to a four-way KSA-UAE-India-Pakistan war.

Both the Gulf states hold India and Pakistan back from extended wars, and India+Pakistan hold the Gulf from falling into a regional war.

In fact, it's been Pakistan that has been setting the US's Iran policy under Trump [0][1][2].

[0] - https://www.intelligenceonline.com/middle-east-and-africa/20...

[1] - https://www.intelligenceonline.com/middle-east-and-africa/20...

[2] - https://www.intelligenceonline.com/asia-pacific/2025/07/09/p...
by squigz | 2026-02-21 00:54:55+00:00
I'm not entirely sure what this is supposed to mean. Like... yes? But my point was, a school may have a very wide range of age groups. A K-12 school will have students from ages ~4 to ~18. Even a regular primary school will have 7 year olds along with 14 year olds. Point being, a book that is inappropriate for the younger students at a school may not be for the older students; and I don't see why the older students shouldn't have access to those books.
by api | 2026-02-21 00:54:55+00:00
Does it require people change defaults? If so then 99% will never use it.

A system or protocol is whatever the easiest user journey is. Anything outside of that will never be seen by many users unless there is some value to be gained by going there. And that value has to be something gained now, not a hypothetical like insurance against future closing of the network. People don’t like to buy insurance.
by aciccarelli2 | 2026-02-21 00:55:28+00:00
I hit this while pasting ~8K of DOM markup into Claude Code and iterating on selectors for a Chrome extension. About 40 minutes in, compaction fired and the summary said "user provided DOM markup" but the actual content was gone. Claude started guessing at selectors it had seen 20 minutes earlier.

The transcript with the original markup is still sitting at ~/.claude/projects/ as a .jsonl file — the compaction summary just has no pointer back to it.

I found 8+ open issues on the repo describing different symptoms of this same root cause. The proposal is to add line-range annotations to compaction summaries so Claude can surgically recover just the chunk it needs from the transcript on demand. Zero standing token overhead.

Curious if others have hit this in different scenarios or found workarounds that actually stick.
by xvxvx | 2026-02-21 00:55:32+00:00
An older company I worked for went out of their way to find a pen tester that would basically rubberstamp everything and give them a pass. I actually uncovered major issues with the software during that process, to the point where it was unusable. Major components were severely out of date and open to attack. Other parts didn't even work as advertised. I didn't stick around much longer.
by b65e8bee43c2ed0 | 2026-02-21 00:56:12+00:00
bro, facebook was the first internet thing for a lot of people. with it, millions of *oomers got in touch with people they didn't see in years/decades. it was unironically good before the enshittification, and we still don't have a mainstream replacement. we probably can't ever have one, really.
by insane_dreamer | 2026-02-21 00:56:19+00:00
Similar experience; it was good 15 years ago. I left* and closed my account ~10 years ago.

* because 1) I found it sucked up time I needed for more productive things and I was getting "hooked" on social media, and 2) it wasn't good for my mental health -- if all you see is the glamour side, even if they're people you know, it was easy for me to feel that my life sucked in comparison. It didn't make me happy.
by unyttigfjelltol | 2026-02-21 00:56:53+00:00
Contacting the authorities led the company to hire lawyers— for communication with the data protection authority.

The lever lawyers have to “make it go away” is “law says so.” They’re not going to beg for mercy, they’re not going to invite you to coffee, no “bug bounty.” From their perspective if they arm-wrestle the researcher into an NDA, they patched the only known breach, retrospectively.

Perhaps it’s not prosocial or best practice, but you can clearly see how this went down from the company perspective, with a subject organization that has a tenuous grasp of cyber security concepts.
by 8organicbits | 2026-02-21 00:57:09+00:00
I think of PESETAS as more defensive than what a single protocol can handle. Imagine posting to Bluesky and using automation to syndicate the post to Twitter, Facebook, Mastodon, Threads, and more. If Bluesky goes evil, or you otherwise decide to ditch it, you've mitigated the network effect as you have followers on other platforms already. People can still find you and your content isn't lost.

Imagine if Bluesky decides to ban you, and continues to ban accounts you create elsewhere. Atproto ensures non-Bluesky PDS can see you, but you've lost 99% of the userbase.
by bdangubic | 2026-02-21 00:58:29+00:00
> already was president for 4 years, which - aside from a lot of crazy talk - was a pretty stable and prosperous time.

you did NOT just write this seriously???! :) I hope you are being as sarcastic as one can be or did you sleep through it. just check how much of the total national debt comes from his first term… it is arguably the least “stable and prosperous” 4 years any American who is alive has ever seen
by irusensei | 2026-02-21 00:58:41+00:00
I hear you but if you think about it who else has an incentive and skills to create something like Nostr? Who are the people interested in free speech, signatures and decentralization and with the skills to pull it up?

And since you mentioned primarily Bitcoin users those are the crypto folks that seem to be very against the idea of tokenizing everything.

From what I understand by posting something on Nostr you are posting signed events to a list of dumb relays. These events can be of many types and include hints of discoverability. There is no blockchain and no token and the thing they call zap is just a link to a lightning address that is up to the client to show.

Your account is your key pair so you are not at the whims of a power tripping administrator.

It seems like the perfect nesting ground for non corporate user content and pocket islands of communities. Nothing prevents someone from implementing a relay or community that bans any talk about Bitcoin or crypto. I for one would love to see closed content focused relays in Nostr.
by suzzer99 | 2026-02-21 00:59:21+00:00
I have my Facebook feed curated enough that it shows me reels I like (landslides, dance-offs, kids or animals doing cute things - nothing salacious). Of course, AI crap filters in, but a majority are still good.

Even the sponsored posts are very often interesting summaries of historical events or scientific wonders. They're AI most of the time, which goes on and on. So I read the first part and then go to wikipedia if I'm more interested.

So it does work if you train it on what you like.
by tptacek | 2026-02-21 00:59:25+00:00
It's good at spotting stuff, like:

* Overusing verbs

* Poor structure

* Bad transitions between grafs

* Passive voice

And even bigger-picture stuff, like "you might want to zoom in here" or "this section isn't paying off". I've only in the past few months started using it for proofreading, and it's pretty solid.

But if you take any of its words, you're infecting your writing with Claude's tone, and it will show.

It's super useful as a reader of your writing. It's a terrible collaborator, unless you're writing for an audience of middle managers.
by 12_throw_away | 2026-02-21 01:00:56+00:00
I'm a little hung up on this part:

> These PRs were accompanied by a security alert with a nonsensical,
> made up CVSS v4 score and by a worrying 73% compatibility score,
> allegedly based on the breakage the update is causing in the ecosystem.

Where did the CVSS score come from exactly? Does dependabot generate CVEs automatically?