MurphyA/hacker-news huggingface dataset:
Show HN: Focido – social to-do where real people nudge you to finish tasks
by vladimir_fc | 2026-03-08 11:02:20+00:00
Focido is now live on App Store and Google Play after months of beta testing and weekly updates.

What is it?
A social to-do app where your goals live in a feed, and real humans (not AI) send nudges to help you follow through. We built it because solo trackers have ~20% completion rates, while social accountability apps like Strava get people moving consistently.

Key features:

Post tasks, get matched with motivators

Real-time nudges, replies, and task visibility

Nudge limits, cooldowns, anonymous tasks for privacy

Leagues, leaderboards, and motivator ratings

Custom reminder windows so it fits your schedule

Tech:
Flutter (iOS/Android), NestJS/Supabase backend, RevenueCat for IAP. Real-time with Supabase. MVP in ~4 months.

Why we built it:
Most productivity apps fail at completion. Humans are better at creating the right kind of pressure (guilt + reciprocity). Early data shows 3x completion uplift vs solo apps.

Links:
iOS: https://apps.apple.com/us/app/focido/id6757135734
Android: https://play.google.com/store/apps/details?id=com.focido.app...
Website:
https://focido.com

Open to questions about retention, matching, or the economics of human motivators. Curious what HN thinks of social accountability vs gamification.
by codethief | 2026-03-08 11:02:25+00:00
> I've been making the images reproducible before that with my own tooling

I've been doing the same, using https://github.com/reproducible-containers/repro-sources-lis... . It allows you to precisely pin the state of the distro package sources in your Docker image, using snapshot.ubuntu.com & friends, so that you can fearlessly do `apt-get update && apt-get install XYZ`.
by felipeerias | 2026-03-08 11:02:58+00:00
Most people seem to be expecting some kind of quantitative analysis: N developers undertook M tasks with and without access to a given AI tool, here is the statistical evidence that shows (or fails to show) the effect, and this result is valid across other projects and tools.

In practice, arriving at this ideal scenario can be very challenging. Actually feasible experiments will be necessarily narrow, with the expectation that their results can be (roughly) extrapolated outside of their specific experimental setup.

Another valid approach would be to carry out qualitative research, for example a case study. This typically requires the study of one (or a few) developers and their specific contexts in great detail. The idea is that a deep understanding of how one person navigates their work and their tools would provide us with insights that might be related to our specific situation.

Personally, in this particular area, I tend to prefer detailed qualitative accounts of how other developers are working on similar projects and with similar tools as me.

But in any case, both approaches are valid and complementary.
by piva00 | 2026-03-08 11:03:30+00:00
It took years to negotiate the nuclear deal that Obama got, it was productive, it was good enough to keep nuclear proliferation in check.

Comes dumbo and rips that off, goes back to "deal making" without any diplomacy, bomb them twice during the negotiation process after ripping off the previous deal.

Seems like the whole new negotiations from Trump's admin was just putting up an act after all... Quite disgusting.
Show HN: Malleon – turn real user sessions into automated tests
by godelshalt | 2026-03-08 11:03:31+00:00
Hey HN,

I've been building a tool called Malleon because I got tired of e2e tests that don't reflect what users actually do. And I have long been obsessed with using real user sessions for load testing. Having worked with tools like Tsung and Gatling for load testing, I often wished I could just replay yesterday's traffic x2 or x5 instead of using synthetic sessions. Malleon started as an attempt to bridge those two worlds.

The basic idea is: instead of writing tests from scratch, record real user sessions and turn them into replayable tests.

The SDK records things like:
- DOM interactions
- network requests
- console output
- timing between actions

The replay isn't a video. It reconstructs and replays the actual browser interactions against your app.

So a real user session becomes a reproducible test case.

Typical flow looks like:
- drop a small JS SDK into your app
- users interact with the site normally
- sessions get recorded
- you browse replays and find something interesting (bug, error, weird behavior)
- turn that session into a test and run it in CI

The test runner is self-hosted. You pull the Docker image and run it wherever you want. It drives a browser (headless or headful) and replays the interaction sequence.

Some things that turned out to be surprisingly tricky while building this:
- replaying interactions when the DOM has changed since recording
- handling viewport/layout differences
- making network replay transparent to the app
- keeping timing realistic without making tests slow

The system also collects logs, errors, and request timings so sessions are searchable and you can track network performance, see p90/p95/p99 stats, all that good stuff.

Links:
- Malleon: https://malleon.io
- Replay SDK: https://www.npmjs.com/package/@malleon/replay
- Replay CLI: https://www.npmjs.com/package/@malleon/replay-cli
- Docs: https://github.com/malleonio/malleon-documentation

Free tier available.

Curious if anyone else has run into the "our tests don't reflect what users actually do (or how they scale)" problem.
by impossiblefork | 2026-03-08 11:04:02+00:00
I actually don't think this looks that bad. I think it might even be good for them. If young people are eschewing helmets, I can see making a helmet law, but even if they take over a lane of traffic, they seem to be going in such large groups, that if they'd been in cars or other vehicles, moving in the most orderly manner imaginable, they'd be blocking the intersection just as effectively.

Consequently I think this is mostly fine. The big problems are the helmet issue and I also think they might need knee protection. 60 km/h is a bit high if they're made for 25 km/h, but most of this stuff is achievable with ordinary bicycles.
by rfunix | 2026-03-08 11:06:54+00:00
Tengu is an open-source MCP server that exposes 80 pentesting tools from Kali Linux (Nmap, Metasploit, Nuclei, SQLMap, ZAP, and more) to AI
assistants like Claude. Every tool call goes through input sanitization, target allowlisting, rate limiting, and audit logging — no shell=True,
ever.

It implements all three MCP primitives: 80 tools, 20 resources (OWASP Top 10, MITRE ATT&CK, CVE databases, default credentials, checklists), and 35
prompts — guided workflows for full pentests, vulnerability assessments, and professional report generation. Findings are automatically correlated
with CVEs for context and remediation guidance.

Works as a copilot (Claude Code / Claude Desktop) or as an autonomous agent with human-in-the-loop for destructive actions. Single `docker compose
up` to get started. Ships in 3 tiers: core, lab (with intentionally vulnerable targets), and full stack.

74 dedicated command injection tests. MIT licensed.

Would love feedback on the security model and MCP patterns.
by aiaboratory | 2026-03-08 11:07:05+00:00
This is exactly what I needed. I run Claude Code for ~8 hours daily and explaining what happened in a session to collaborators is painful either I share massive logs or try to summarize from memory.

One feature request: would be great to filter/highlight by tool type. When reviewing my sessions, I mostly care about the decision points (why did it choose Edit over Write? why did it run this command?) rather than the full output. Being able to jump between "thinking blocks" specifically would save a lot of scrubbing.

The single HTML file approach is smart I can already see attaching these to PRs for code review context.
by mikkupikku | 2026-03-08 11:07:18+00:00
Hearts and minds. That's what soldiers are meant to aim for, right?

If this war was meant to provide an opportunity for Iranian people to overthrow their regime and install a west-friendly government, and if Iranian people aren't actually going and doing that, then do we call off the war or are we going to keep it going indefinitely, as seems to be the modern fashion?
by spwa4 | 2026-03-08 11:08:36+00:00
What matters for Qwen models, and most/all local MoE models (ie. where the performance is limited) is memory bandwidth. This goes for small models too. Here's the top Apple chips by memory bandwidth (and to steal from clickbait: Apple definitely does not want you to think too closely about this):

M3 Ultra — 819 GB/s

M2 Ultra — 800 GB/s

M1 Ultra — 800 GB/s

M5 Max (40-core GPU) — 610 GB/s

M4 Max (16-core CPU / 40-core GPU) — 546 GB/s

M4 Max (14-core CPU / 32-core GPU) — 410 GB/s

M2 Max — 400 GB/s

M3 Max (16-core CPU / 40-core GPU) — 400 GB/s

M1 Max — 400 GB/s

Or, just counting portable/macbook chips: M5 max (top model, 64/128G) M4 max (top model, 64/128G), M1 max (64G). Everything else is slower for local LLM inference.

TLDR: An M1 max chip is faster than all M5 chips, with the sole exception of the 40-GPU-core M5 max, the top model, only available in 64 and 128G versions. An M5 pro, any M5 pro (or any M* pro, or M3/M2 max chip) will be slower than an M1 max on LLM inference, and any Ultra chip, even the M1 Ultra, will be faster than any max chip, including the M5 max (though you may want the M2 ultra for bfloat16 support, maybe. It doesn't matter much for quantized models)
by mlrtime | 2026-03-08 11:09:58+00:00
You seem intelligent so it is probably confusing to many why you are posting this.

You call it a trivial instruction, but it is not trivial. It was a core requirement for your own design that you neglected to specify. This is not different than leaving out any other core requirement for a engineering specification.

Most people would NOT want this requirement. Meaning most people wouldn't care if there are package dependencies are not, so the agent 100% did the right thing.
by yorwba | 2026-03-08 11:10:23+00:00
Those aren't even percentage increases, but standardized effect sizes. So if you take an individual survey respondent and all you know is that they self-reported higher AI usage, you can guess their answers to the self-reported individual effectiveness slightly more accurately, but most of the variation will be due to unrelated factors.

The question that people are actually interested in, "After adopting this specific AI tool, will there be a noticeable impact on measures we care about?" is not addressed by this model at all, since they do not compare individual respondents' answers over time, nor is there any attempt to establish causality.
by jmfldn | 2026-03-08 11:10:32+00:00
I'm somewhere in between. I'm excited about building more things faster and extending my capabilities. But I also love thinking about the underlying language, runtime, algorithms, the wider system. I want LLMs to enhance this for me, I want my understanding to go up as I write less code. It's also key to my job as a lead that I maintain understanding of the system for debugging, security etc.

So if I can do both with these tools, then great. I want to cognitively offload in a way that allows me to focus on the important bits. And I'm writing instructions to the LLM to help me do that eg 'help teach me this bit'. A builder and tutor at once.
by shooly | 2026-03-08 11:10:33+00:00
It sounds like you're talking about making an equivalent of Super Mario from the 80s, but modern games are in fact much more complex.

And no, just because people in the 80s enjoyed Super Mario doesn't mean it's the pinnacle of game design, and that there's no need to create anything more complex.

> It took less than a month of work for me to get a polished cross-platform system working on five platforms.

You simply don't know where the bugs and performance pitfalls are because you haven't encountered them, yet. That is especially true regarding consoles with their custom hardware and mobile devices with their abundance of cheap, often not well engineered hardware and sketchy drivers.
by forinti | 2026-03-08 11:11:35+00:00
I'm currently reading Heretics by the Cuban writer Leonardo Padura. The plot centers around a Rembrandt stolen from a Jewish family that tried to flee to Cuba in the 1930s and a big part of the story follows a young Jewish artist that takes up a kind of apprenticeship with Rembrandt. Padura seems to like stories that span many decades and even centuries as in this book.

Anyway, the book does a good job of describing Rembrandt's life even if the story is mostly fiction.
by stavros | 2026-03-08 11:12:05+00:00
Agreed, all this "but if you don't need certain skills any more, you'll lose them!" is tiring, and even more tiring because it's missing the entire point: yes, because I don't need them any more!

It feels like I'm reading an article crying "if you buy a car, you will lose your horse-shoeing skills!" every day lately.
by iss4cf0ng | 2026-03-08 11:15:42+00:00
OpenShell is a lightweight, open-source reverse shell management server written in Go.
It allows users to establish reverse shell channels and interact with them through a simple web-based graphical user interface (GUI).

If you encounter bugs or have suggestions, feel free to open an issue.

If you find this project useful, a on the repository would be greatly appreciated!
by ltning | 2026-03-08 11:15:52+00:00
The issue with creative and novel output from people is neither about intellectual property nor energy, though. So even someone who has nothing (personal) to lose by adopting these techs should be able to reflect on how that will make things look 5, 10, 20 years from now.

And I'm not talking about climate or poor starving artists here. But of course, if everyone thinks like you seem to do we might just give up on having a livable planet in 50 years. Or any significant scientific or artistic progress.
by mentalgear | 2026-03-08 11:16:09+00:00
Claude wins by a large margin

* Claude Opus 4.6 : 0.71

* Claude Opus 4.5 : 0.51

* KIMI-K2.5 : 0.37

* GLM-5 : 0.36

* GPT-5.2 : 0.23

Note: later GPT versions seem to be only available within openAi's proprietary codex cli, so can't be tested.

---

Of course, the interesting follow-up question is: How well perform these models with added agent tooling ("harness") ?

Maybe someone has tokens to burn and can run a matrix of agent tools over the top models and provide the results?
by Gravityloss | 2026-03-08 11:16:16+00:00
Good comment. For people with physics and mathematics skills and intuition, learning or discussing about color or music theory can be a little bit frustrating experience. Ie a lot of it is about traditions and some famous people's ideas and less about how it actually works under the hood. I guess similar things exist in most fields when you dig a little bit deeper. "We always apply this fudge factor to get the correct results". Even something considered hard science.

Of course artists can be very effective with whatever the toolsets they have learned, they sort of can transcend all the obfuscations and actually can express themselves. It's a bit hard to change everything then as the "user's transformations" are then baked in.

It's also true that mathematical models are often simplifications and one has to consider the whole end to end pipeline, where a more "accurate" transformation can yield a worse end result if applied blindly. I'm always reminded of the anecdote of when in the past, at some tv channel, they switched to more accurate weather forecast models. But the audience got worse forecasts, since the resident meteorologist was used to certain errors the old model produced and could compensate those, while the new model had maybe less errors in total but they were different. Happens all the time and why some engineer thinking something is objectively better might not actually be better for the customer...
Show HN: Golf Scanner – OSS tool to find and audit every MCP server
by antonig | 2026-03-08 11:16:35+00:00
Hey HN, I'm Antoni, CTO and cofounder of Golf (YC X25). We're open-sourcing our MCP server scanner: a single Go binary that discovers every MCP server configured across your IDEs and runs security checks against each one. Just `brew install golf-mcp/tap/golf-scanner && golf-scanner audit`.

We built this because we kept seeing the same thing at companies we work with: engineers install MCP servers in 30 seconds: connect Cursor to a production database, give Claude Code access to internal APIs, spin up an MCP server for Jira. And nobody on the security side knows it happened. There's no discovery mechanism. It's shadow IT, except now the "user" is an autonomous agent making tool calls on its own.

When you run `golf-scanner audit`, it scans your IDE and AI tool configs (user-level and per-project), identifies every MCP server, classifies each one by transport type, and runs ~15 security checks: command injection patterns in server args, hardcoded credentials, dangerous container configurations, script and binary permission issues, and known vulnerabilities via OSV for npm/PyPI packages. Everything is pure Go, single static binary. It produces a 0-100 risk score per server with severity-weighted findings.

The thing that motivated us to build this, and what we think the industry is getting wrong more broadly: most "AI security" tooling is actually LLM security: prompt injection detection, output filtering, guardrails on the model API layer. That protects one layer. But when someone connects Cursor to a production database via MCP, the risk isn't what the model says… it's what the agent does. The tool calls, the data access, the system connections happening downstream of the LLM. Your LLM guardrails won’t protect any of that. It's like putting a firewall on your CDN and calling your database secured. The threat model for an MCP-connected agent is closer to an unmanaged service account than a SaaS app. That's a fundamentally different security problem.

The scanner is one piece of Golf, our commercial product, an enterprise MCP control plane for managing agent tool access across your org. The platform runs the same scanner across your fleet via MDM, adds deeper checks (deep analysis of server source code for local servers, capabilities analysis for remote ones, rug-pull detection, toxic tool combinations etc.), and ties everything into a centralized inventory with access policies, PII scrubbing, and SIEM forwarding. Then you route all approved servers though our gateway to close the loop.

But if you just want to know "what MCP servers are on my machine and which ones look sketchy," that's the free tool.

brew install golf-mcp/tap/golf-scanner
golf-scanner audit

I'd genuinely love to hear from enterprise folks: How are you thinking about securing MCP servers and agent tool access today? What's missing from the current tooling?
by jonathanlydall | 2026-03-08 11:16:56+00:00
> A bit like how java people insisted on making naive getFoo() and setFoo() to pretend that was different from making foo public

But it's absolutely different and sometimes it really matters.

I primarily work with C# which has the "property" member type which is essentially a first-class language feature for having a get and set method for a field on a type. What's nice about C# properties is that you don't have to manually create the backing field and implement the logic to get/set it, but you still have the option to do it at a later time if you want.

When you compile C# code (I expect Java is the essentially same) which accesses the member of another class, the generated IL/Bytecode is different depending on whether you're accessing a field, property or method.

This means that if you later find it would be useful to intercept gets or updates to a field and add some additional logic for some reason (e.g. you want to now do lazy initialization), if you naively change the field to a method/property (even with the same name), existing code compiled against your original class will now fail at runtime with something like a "member not found" exception. Consumers of your library will be forced to recompile their code against your latest version for things to work again.

By having getters and setters, you have the option of changing things without breaking existing consumers of your code. For certain libraries or platforms, this is the practical difference between being stuck with certain (now undesirable) behaviour forever or trivially being able to change it.
by spwa4 | 2026-03-08 11:17:10+00:00
Judging by the reactions by Iranians hearts and minds are firmly on the US and Israeli side inside Iran. And it's mostly socialist/"pro-Palestinian" voices outside of Iran that scream about stopping the war. The more reasonable attitudes (which boil down to a reasonable discussion about "but is this war worth it?") are being totally drowned out on both sides, as per usual.

As for the Iranian side, on the Belgian government channel, there's an interview with 3 Iranian women. The title is "Willing to Risk Everything, Even Death": VRT NWS Speaks with 3 Women from Iran Despite Internet Blockade

https://www.vrt.be/vrtnws/nl/2026/03/06/getuigenissen-iran-1...

In it you will essentially find a description of

1) how bad the situation is

2) that it is actually better than normal life under the regime

3) that their biggest fear is to go back to the regime (and yes it's these women themselves that put forward the dramatized version that they'd like the war on Iran to continue even if it kills them personally)

I find this attitude in many places. Not quite as dramatic but the basic principle that Iranians fear, more than anything, more than the war itself, that the situation would go back to "normal life" under the islamic regime.

Meanwhile, the islamic regime has taken to emptying machine guns at residential blocks where people are musically celebrating the death of Khamenei. To ordering their troops to "shoot-to-kill" at children. And worse.
by ChrisMarshallNY | 2026-03-08 11:18:30+00:00
Great approach.

I usually use ChatGPT, as a chat (as opposed to an agent).

It explains everything quite well (if sometimes a bit verbose).

Today, I am going to do an experiment: I’ll be asking it to rewrite the headerdocs in one of my files (I tend to have about a 50% comment/code ratio), so it generates effective docc documentation. I suspect the result will be good.