MurphyA/hacker-news huggingface dataset:
Show HN: Shibuya – A High-Performance WAF in Rust with eBPF and ML Engine
by germainluperto | 2026-02-23 18:36:31+00:00
Hi HN,

I’ve been working on Shibuya, a next-generation Web Application Firewall (WAF) built from the ground up in Rust.

I wanted to build a WAF that didn't just rely on legacy regex signatures but could understand intent and perform at line-rate using modern kernel features.

What makes Shibuya different:

Multi-Layer Pipeline: It integrates a high-performance proxy (built on Pingora) with rate limiting, bot detection, and threat intelligence.

eBPF Kernel Filtering: For volumetric attacks, Shibuya can drop malicious packets at the kernel level using XDP before they consume userspace resources.

Dual ML Engine: It uses an ONNX-based engine for anomaly detection and a Random Forest classifier to identify specific attack classes like SQLi, XSS, and RCE.

API & GraphQL Protection: Includes deep inspection for GraphQL (depth and complexity analysis) and OpenAPI schema validation.

WASM Extensibility: You can write and hot-load custom security logic using WebAssembly plugins.

Ashigaru Lab: The project includes a deliberately vulnerable lab environment with 6 different services and a "Red Team Bot" to test the WAF against 100+ simulated payloads.

The Dashboard:
The dashboard is built with SvelteKit and offers real-time monitoring (ECharts), a "Panic Mode" for instant hardening, and a visual editor for the YAML configuration.

I'm looking for feedback on the architecture and the performance of the Rust-eBPF integration.
by mamcx | 2026-02-23 18:37:08+00:00
> years of bug fixes and edge-case improvements can't be accounted for by simply using a newer/better code-base.

Partially is in fact true: Just because the Rust use a better type system (after ML) + better resource model (aka borrow checker), and if you are decently good, you eliminate, forever!, tons of problems.

It can't solve things that arise by complex interactions or just lack of port subtle details like in parsing poor inputs (like html) but is true that changing the language in fact solve tons of things.
by 0xy | 2026-02-23 18:37:17+00:00
If you are making a prediction on the viability of AGI assuming that an entirely new technology will make the efficiency problem of LLMs moot then you're essentially engaging in mysticism, aren't you?

It is correct to say it is mathematically impossible, as all the people making AGI claims rely upon advances that are not even theoretical, they have not even been discovered yet, and the mere possibility of them is questioned by many scientists.

LLMs have hard and soft limits all over the place preventing AGI. You aren't gonna train and loop yourself to AGI because the compute does not exist, and will not exist.

My 4+ year point was for a single memory fab. Increasing capacity by merely 5% (generous assumption) takes 4 years and $10bn. It's starting to sound like the path to AGI in the current paradigm will cost infinite dollars and take infinite years of build-out.

Even with a transformational efficiency breakthrough, you still have hard limits all over the place. Where are you going to store all the data? Memory constraints again.
by adrian_b | 2026-02-23 18:37:24+00:00
In general the nutritional value of the food is less affected by microwave cooking, because you can use much lower heating times and it is easy to ensure that the temperature is not too great.

Moreover, at microwaves it is easy to cook without adding water (whenever you are cooking meat or vegetables with high content of water, e.g. potatoes; when not adding water, using a glass vessel covered with a glass lid is normally mandatory), or only by adding a minimum amount of water, which avoids the leaching of water-soluble nutrients.

These properties ensure that food cooked at microwaves in the right way (e.g. without water whenever that is possible) is frequently tastier than when cooked by traditional means. The only exception is for people who like burned food, as this method for degrading food is more difficult to do at microwaves.

While the fact that food is less affected by microwaves than by most other methods of cooking is intuitively obvious, there have been published several research articles where it was investigated the degradation of several essential nutrients, e.g. vitamins, during cooking by various methods, and they confirmed a minimum degradation during microwave cooking, caused by shorter cooking times and lower peak temperatures.

When cooking at microwaves, you normally do not cook everything together, because meat requires different parameters than vegetables and there are 3 or 4 classes of vegetables that require different parameters. So you typically cook the ingredients separately and you mix them after cooking, when you also add ingredients like oil, which should better not be heated.
by tlavoie | 2026-02-23 18:37:47+00:00
On the other hand, the morels that seemed to come with a load of wood chips were great for the year or two we had them.

I tried growing a little wine cap bed once, and it hadn't gone well. Perhaps it was the chickens pecking at it, can't say. I do still get wine caps on occasion, but they have migrated to more far-flung parts of the yard.
by cmrdporcupine | 2026-02-23 18:37:52+00:00
I'm not OP but here's my disadvantages. Rust is the way I earn my living, and also my open source tool of choice. And my background is 25 years of SWE career:

1. build / compile times can be atrocious

2. crates.io inherits the npm philosophy, which means fairly unmoderated space of third party deps and because the Rust stdlib doesn't have a lot in it, extensive third party crate (lib) usage is strong in Rust. As a result most Rust projects have rather sprawling dependency trees, often with duplicated functionality (multiple Base64, rand, sha256, etc crates). I personally have a problem with this (auditability, accountability, security, complexity etc). Others don't.

3. Despite being nominally runtime agnostic, Rust async basically is tokio and it's almost impossible to use another runtime once you factor in third party deps. In many ways Rust is the language that tokio ate. In fact even if you opt out of async entirely, you often end up with tokio as a dependency simply because the community just seems to expect it.

4. Despite advertising itself as a "systems" language, some basic systems programming facilities I expect from my C++ background are still fundamentally not there. In particular, per-container/struct pluggable allocators still isn't a thing and the feature to add it (allocator-api) has sat unmerged in nightly for almost ten years at this point and it doesn't look good for it landing any time soon.

5. If you're working in the embedded space, there's still plenty of devices that will not have a workable Rust toolchain option yet.

I still choose it for new projects instead of its competitors C++ or Zig. But I think it's important to recognize there are compromises like any other tool.

As much as people might insist otherwise, there will in fact come a day when there are "multiple Rusts" by which I mean multiple styles and ways of doing things -- just like C++. For myself, for example... if it were my repository and my team and my hiring, and I was starting from scratch... I'd be extremely careful about third party crate adoption and have an extremely minimalistic approach there. And I don't use tokio. Though my paying jobs do.
by mothballed | 2026-02-23 18:38:50+00:00
Tobacco, yes you can order pipe tobacco and cigars online sent to your house without ID.

Guns yes, you can buy a schmidt-rubin cartridge rifle or black powder revolver sent straight to your home from an online (even interstate) vendor no ID or background check, perfectly legal.

Alcohol yes, you can order wine straight to your house without ID.

These are all somewhat less known "loopholes" but not really turned out to be a problem despite no meaningful controls on the seller. You probably didn't even know about these loopholes, actually -- that's how little of a problem it's been.
by Aachen | 2026-02-23 18:38:54+00:00
Hmm yeah I guess it could be that they see this sound byte (quoting one scientist's opinion, not a study's results) as having answered the question. It's not reported to be the best way though, just what "Achieving fluency in the real world requires" (any at all?)

The article speaks of so much research but, if this is indeed the 'answer', uses nothing of it in answering the question. Could have just put that sound byte up top and saved themselves and us the further trouble...

Also, what's feedback even supposed to mean? Like Anki? Like having a speaker correct your grammar from the get-go as you speak, or do you speak a bunch first and learn by stumbling and do they correct major mistakes at first only? There's a million ways to fill meaning into these words. Sustained exposure is obvious, but none of the other words are any guide
by pessimizer | 2026-02-23 18:38:55+00:00
The point is to undermine data protection; this debate is useless. It's a question about power and control, not a technical one. The people lobbying for this don't care about children, and neither are they getting big support from a constituency clamoring for this. This is an intelligence initiative, and a donor initiative from people who are in a position to control the platform (all computing and communications) after it is locked down.

It's not even worth talking about online. There's too much inorganic support for the objectives of nation-states and the corporations that own them.

Legislation has been advanced in Colorado demanding that all OSes verify the user's age. It will fail, but it will be repeated 100 times, in different places, smuggled attached to different legislation, the process and PR strategies refined and experimented with, versions of it passed in Australia, South Korea, maybe the UK and Europe, and eventually passed here. That means that "general purpose" computing will be eventually be lost to locked bootloaders.

https://www.pcmag.com/news/colorado-lawmakers-push-for-age-v...

[edit: I'm an idiot, they already passed it in California https://www.hunton.com/privacy-and-cybersecurity-law-blog/ca...]

And it will be an entirely engineered and conscious process by people who have names. And we will babble about it endlessly online, pretending that we have some control over it, pretending that this is a technical discussion or a moral discussion, on platforms that they control, that they allow us to babble on as an escape valve. Then, one day the switch will flip, and advocacy of open bootloaders, or trading in computers that can install unattested OSes, will be treated as organized crime.

All I can beg you to do is imagine how ashamed you'll be in the future when you're lying about having supported this now, or complaining that you shouldn't have "trusted them to do it the right way." Don't let dumb fairytales about Russians, Chinese, Cambridge Analytics and pedophile pornography epidemics have you fighting for your own domination. Maybe you'll be the piece of straw that slows things down just enough that current Western oligarchies collapse before they can finish. Maybe we'll get lucky.

Polls and ballots show that none of this stuff has majority organic support. But polls can be manipulated, and good polls have to be publicized for people to know they're not alone, and not afraid they're misunderstanding something. If both candidates on the ballot are subverted, the question never ends up on the ballot.

The article itself says nothing that hasn't been said before, and stays firmly under the premise that access to content online by under-18s is suddenly one of the most critical problems of our age, rather than a sad annoyance. What is gained by having this dumb discussion again?
by Dunedan | 2026-02-23 18:38:55+00:00
> My understanding is that the simulation will be bottlenecked by the slowest PC.

That's correct. While 0ad is an RTS, behind the scenes it's still turn-based and in multiplayer games turns can only progress once every participants PC has responded. That's also why the game also feels slow when a player has a bad latency to the player hosting the game.
by andrewflnr | 2026-02-23 18:39:05+00:00
I caught the reference. To the extent it applies at all, I obviously think it reinforces my point. But badly engineered cars, members of an existing category that we know can be done tolerably well, are a very strained analogy to brand new software deployed by people who understand how it works and therefore the risks they are taking.

And actually, the deployer has a lot more control over the havoc the software can cause than the creator. They choose what credentials to give it, whether and how closely to monitor it, any other guardrails, etc. If the operator of the bot discussed in OP had intervened soon after it went off the rails, we wouldn't be here.

So sure, I would also tell the makers of this software to knock it off. Don't put out products that are the network equivalent of a chainsaw on a roomba, no matter how many cool tiktoks it creates. But when I'm talking to people running claws or whatever, they no longer have the excuse of ignorance. So the advice is still: Do not run the program.
by NewsaHackO | 2026-02-23 18:39:11+00:00
Cool down, it's just an extension of my original example. It's not in bad faith at all; it's exactly what people are doing to the LLMs. If you break ToS by doing aggressive systemic jailbreaking and get some paragraphs of well-known works in the process, it's not fair to say that the LLM is breaking copyright law. Perhaps a more concrete example would be if I steal a book, and someone else steals a book from me and copies and distributes it, would I be the person breaking copyright law?
by gigel82 | 2026-02-23 18:39:33+00:00
Where can we learn more about your architecture?

Someone brought up the need for device attestation for trust purposes (to avoid token smuggling for example). That would surely defeat the purpose (and make things much much worse for freedom overall). If you have a solution that doesn't require device attestation, how does that solve the smuggling issue (are tokens time-gated, is there a limit to token generation, other things)?
by AlexandrB | 2026-02-23 18:39:44+00:00
I don't think you can frame some of these arguments as belonging to a fringe minority. I remember watching an episode of "Penn & Teller's Bullshit"[1](2004) where they featured several pro-legalization advocates. These folks said or implied similar things (it's not bad for you, it helps cancer patients). These were not marginal "crazy" voices.

[1] https://en.wikipedia.org/wiki/List_of_Penn_%26_Teller:_Bulls...
by magic_hamster | 2026-02-23 18:39:49+00:00
There's an abundance of young people looking to get away from apps, smartphones and being constantly online. Sure landlines are not making a huge comeback, but these young people are looking for alternatives. You hear some revival attempts for old tech because it's focused on doing one thing like making a call or playing music while not taking over your attention and time. People want to stop doomscrolling. Meta, Apple and other huge corpos are betting on wearables and are already using marketing that emphasizes unobtrusive tech. We'll see what happens.
by hagbard_c | 2026-02-23 18:39:51+00:00
Nope, water vapour is the gas phase of water mixed with other gases while steam is just the gas phase of water. Water vapour can condense into tiny droplets which can freeze into ice crystals, both of which are visible as 'clouds'. Steam is not visible until it condenses into droplets at which point it no longer is steam but water suspended in another medium, usually air.
by kseniamorph | 2026-02-23 18:40:00+00:00
I feel like the authors make a logical inconsistency. They present the drop in "identify missing context" behavior in artifact conversations as potentially concerning, like people are thinking less critically. But their own data suggests a simpler explanation: artifact conversations show higher rates of upfront specification (clarifying goals +14.7pp, specifying format +14.5pp, providing examples +13.4pp). It's obvious that when you provide more context upfront, you end up with less missing context later. I'd be more sceptical about such research.
by umanwizard | 2026-02-23 18:40:01+00:00
FWIW, the GP comment's claim that you're lucky if you can compile 2-year-old code is exaggerated, but so is yours. Rust does not offer "strong stability guarantees". Adding a new method to a standard type or trait can break method inference, and the Rust standard library does that all the time.

In C or C++, this isn't supposed to happen: a conformant implementation claiming to support e.g. C++17 would use ifdefs to gate off new C++20 library functions when compiling in C++17 mode.
by bityard | 2026-02-23 18:40:04+00:00
TIL that the lowest common denominator for engagement on the Internet is boobs. Ha!

Anyway, I know exactly what you mean. I have certainly seen YouTube pigeonhole me into a demographic that I'm not even remotely part of. One day I watched some ham radio-related content and then a couple of rugged flashlight reviews and YT decided I was a tacticool doomsday prepper would NOT stop suggesting videos about conspiracy theorist podcasts and how to make guns at home.
by 5o1ecist | 2026-02-23 18:40:11+00:00
Man, if that's what you think of white people, then you're probably really going to hate the Koreans ... right?

https://www.perplexity.ai/search/hey-hey-which-country-has-t...

> Korea is cited by historians as having the longest unbroken chain of slavery in recorded history, spanning roughly 1,500–2,000 years from antiquity until its gradual abolition in 1894.

> please keep it to yourself

Your right to freedom of speech ends where you demand of others to limit their own.
by tencentshill | 2026-02-23 18:40:28+00:00
They still believe the Xbox brand is not contingent on the Xbox console existing. The goal is renting (already accomplished) and streaming (still sucks) your games from a server. Mark my words, a thin client is the last hardware Xbox will ever release. Eventually, it will be just another app on every smart TV, losing the physical brand presence in every customer's home entirely, and in that stage, it will be competed out of existence. Their only way to prevent this is contingent on there being a Microsoft-owned GPU server farm in each state. Lucky they just got a massive budget to build those out (as AI, for now).
by dom96 | 2026-02-23 18:40:28+00:00
That's really awesome. I hope that soon we will also have humanity verification without sacrificing our anonymity.

With LLMs and paid actors wreaking havoc on social media I do think that social media needs pivot towards allowing only human users on it. I wrote about this here: https://blog.picheta.me/post/the-future-of-social-media-is-h...
by Sabrees | 2026-02-23 18:40:46+00:00
Initially keep it simple; Mechanical for between row weeding. I'll probably start strapping a couple of these to some linear actuators:
https://www.getearthquake.com/products/fusion-drill-powered-...
(they work surprisingly well)

Beyond that for in-row weeding a engraving laser on a Delta:
https://github.com/Agroecology-Lab/Open-Weeding-Delta/tree/m...

Or if I'm feeling rich by then this third party weeder looks pretty good
https://github.com/Laudando-Associates-LLC/LASER
by netcan | 2026-02-23 18:40:53+00:00
>Better the nanny state than Nanny Zuck.

For me this is a crux, at least in principle. Once online media is so centralized... the from argument freedom is diminished.

There are differences between national government power and international oligopoly but... even that is starting to get complicated.

That said... This still leaves the problem in practice. We get decrees that age-restriction is mandatory. There will be bad compliance implementations. Privacy implications.

Meanwhile a while... how much will we actually gain when it comes to child protection.

You can come up will all sorts of examples proving "Facebook bad" but that doesn't mean these things are fixed when/if regulation actually comes into play.
by reliabilityguy | 2026-02-23 18:41:01+00:00
> In the US, #1 and #2 are invalid and meritless. Wholly and without reservation. One of the huge reasons for the First Amendment is to ensure that people are able to counter lies uttered in the public sphere with truth.

How does digital ID prevents you from speaking out? For example, 2nd amendment requires a lot of hoops in some jurisdictions, which were deemed constitutional, and not violating 2nd amendment. Same with the 1st amendment. You can argue that with digital IDs there will be less privacy and anonymity than before, but it’s a different story.

Moreover, influence campaigns are not about truth or lies, but about making the public loose face on the institutions. A good example of it today is Russia, where the public does not believe that democratic elections are possible at all, in principle.

> #3 is handled by parental controls that have existed in mainstream OSs for quite some time now.

It is not handled perfectly at all, and easily bypassed. To pretend that information access on the internet can be regulated through parental controls is ridiculous.
by dragonwriter | 2026-02-23 18:41:36+00:00
> You clearly did not work on steam-powered ships (or land-based steam power plants

Well, that's true, I haven't, BUT still I went back and forth writing and deleting and rewriting and eventually deleting a whole digression about the special case of the jargon of steam power and how it uses “wet steam” (or “saturated steam”) for “steam” in the general use sense and “dry steam” for “water vapor” and “superheated steam” for dry steam created by heating wet steam away from contact with water, before deciding that was way too much, but, yeah, that's all true. (And, in details about the actual processes used, a lot more than I knew or would have gone into even if I had and had decided to keep the digression.)
by levkk | 2026-02-23 18:41:49+00:00
Not really, replication lag is generally an accepted trade-off. Sync replication is rarely worth it, since you take a 30% performance hit on commits and add more single points of failure.

We will add some replication lag-based routing soon. It will prioritize replicas with the lowest lag to maximize the chance of the query succeeding and remove replicas from the load balancer entirely if they have fallen far behind. Incidentally, removing query load helps them catch up, so this could be used as a "self-healing" mechanism.
by axus | 2026-02-23 18:41:54+00:00
Microsoft has done a good job with Microsoft accounts and Microsoft Family Safety. It's about as user-friendly as you'll get outside of Apple, though the speed could be improved. And this only covers PCs, Android 's system is less good.

Even with this, the problem requires more than pushing a button. Time, thought, and adjustment are needed. Like home maintenance, its necessary but not everyone can do it without help.

Getting AI assistance is good advice.
by falcor84 | 2026-02-23 18:42:04+00:00
Interesting, and my main take a way is that ~16 million sessions is enough to distill Claude. That's extremely doable - obviously, as it's been done repeatedly - but it just looks very feasible in general.

If I think of the number of lessons and educational conversations that a human would have to acquire their lifetime knowledge, I would hazard to say that AI-to-AI learning no longer requires many orders of magnitude beyond that.