MurphyA/hacker-news huggingface dataset:
Show HN: Live Vulnerability Intelligence Dashboard (Trending CVEs)
by saynsec | 2026-03-03 12:24:40+00:00
Hi HN,

I built a live vulnerability intelligence dashboard that tracks trending CVEs, severity levels, and basic exploitation signals.

The goal was to make CVE data easier to scan quickly without digging through multiple feeds.

You can view it here: https://leakycreds.com/vulnerability-intelligence

Each CVE has its own page with:

* Overview and description
* CVSS score and severity
* Impact summary
* References
* Last updated timestamp
* Linked social media posts related to that CVE (to understand why it’s trending)

It’s free to access — no login required to browse vulnerability data.

I’m currently refining:

* How trending CVEs are prioritized
* How to surface exploitation signals more clearly
* What contextual signals are actually useful during triage

Would really appreciate feedback:

* What do you look at first when triaging a new CVE?
* What do most vulnerability dashboards get wrong?
* What would make something like this genuinely useful for your workflow?

Happy to answer technical questions as well.
by lyu07282 | 2026-03-03 12:25:17+00:00
I think this shifted overtone window has partially to do with why they started this war to begin with, they see the writing on the wall and their window of opportunity is closing. Trump is at historic lows in polling [1]; 65% of democrats now sympathize more with Palestinians over Israelis (17%) [2]. HN is just a generally reactionary place, I wouldn't read to much into that.

[1] https://www.natesilver.net/p/trump-approval-ratings-nate-sil...

[2] https://news.gallup.com/poll/702440/israelis-no-longer-ahead...
by dyauspitr | 2026-03-03 12:25:29+00:00
> But every single use case I've read so far could be done with a pretty affordable SaaS product, Zapier, Automator (app on a mac that's existed for over a decade), or something simple you could make yourself.

What are you talking about? In openclaw you literally type out basic English instructions to an agent. This isn’t painstakingly setting up chron jobs and writing scripts.
by lproven | 2026-03-03 12:25:40+00:00
> Every version since has been a regression.

So very true.

I set up a machine with Windows 2003 Server Datacentre Edition last year. That's the version of the XP codebase that has PAE support and can access >4 GB of RAM... and with all the junk turned off. No themes, for instance.

It was really pleasant to use.

Give me that, with MS Security Essentials and no IE, just Firefox, and I could happily work on it today.
by throw0101c | 2026-03-03 12:27:53+00:00
> I think you're missing the parent's point.

I'm not missing the point: the various various folks who study sleep and chronobiology would have (I hope) reviewed all the literature, including studies that cover northern Europe, before coming to their all-year Standard Time conclusion.

A position paper from Society for Research on Biological Rhythms (SRBR) in Journal of Biological Rhythms cites Russian data for example:

> Borisenkov MF, Tserne TA, Panev AS, Kuznetsova ES, Petrova NB, Timonin VD, Kolomeichuk SN, Vinogradova IA, Kovyazina MS, Khokhlov NA, et al. (2017) Seven-year survey of sleep timing in Russian children and adolescents: chronic 1-h forward transition of social clock is associated with increased social jetlag and winter pattern of mood seasonality. Biol Rhythm Res 3–12.

* https://journals.sagepub.com/doi/full/10.1177/07487304198541...

Last time I checked a map (parts/lots of) Russia is just as north as Finland, Sweden, and Norway, and still the Russian government decided to rollback all-year DST.

Perhaps the effects differ in magnitude depending on geographic region, but as a general rule all-year Standard Time appears to be the best policy for most people most of the time.
Show HN: LynxPrompt – Self-hostable, federated AI config rules manager
by geiser | 2026-03-03 12:27:55+00:00
Hey! It's Sergio, the creator of LynxPrompt

I've published it before, but this time I completely redesigned it to be a platform that you can realistically self-host and yet, have a set of federated blueprints for you to use coming from other instances (if enabled, and also if blueprints are shared publicly).

I built it to manage all my ai config rules as currently I'm using Claude Code, Cursor, Copilot & Kiro regularly. I also use it to generate a small starting AGENTS.md file (or CLAUDE.MD, etc.) instead of relying on zero-shotting it to Claude, so I can control better what does it contain (at least, at first! but obviously, this should be growing once you start, that's when sync mechanism of the lynxp CLI I developed is worth it for me).

Why don't commit them to git? Well, sometimes it's simply not under a git repository, for many reasons. Or you have it .gitignored because you have nasty secrets there. Then you can self-host it and privately have them uploaded regularly. It's not git compatible, I just built a minimum system for this at this point.
by stuffoverflow | 2026-03-03 12:28:16+00:00
I recently had the idea of somehow integrating Everything's folder size index to explorer and after failing to do it with claude code, I found out that Windhawk + Better file sizes does just that. I would have expected at least some performance degradation but in fact it was the opposite and made it feel much snappier. A huge QoL improvement to explorer that I've now installed to all my Windows PCs. Note that you need the alpha version (1.5) of Everything for best performance.
by Cthulhu_ | 2026-03-03 12:28:35+00:00
What may be necessary is for other countries to be better. These treatments / studies don't just affect USAmericans but everyone everywhere, and if there's enough signals of "this treatment saves kids abroad but we can't afford them in the US because of policy", MAYBE said policy will change. Maybe. Not likely because the corporations have control over the government, and the US government system is stuck in laws drafted up in the 1700s.
by KeplerBoy | 2026-03-03 12:28:52+00:00
Using OBS won't make your sluggish animation seem buttery smooth though. This seems to be the point of replit's attempt here. Perfect frame pacing.

On top you could use that technique to record at frame-rates higher than native. There's no reason why you shouldn't be able to redraw a basic page with some animations at a few hundred fps.
by BlobberSnobber | 2026-03-03 12:28:56+00:00
As someone who uses Linux, macOS and Windows interchangeably, I'm curious to know what you're using.

I learned to live with macOS, but I also like and use Gnome, which many Linux-only people hate. I tried most WMs on Linux, like Hyprland, Sway, i3, but none ever felt worth the config hassle when compared to the sane defaults of Gnome.
by buran77 | 2026-03-03 12:29:10+00:00
This CPU will end up in products that are competing against Apple's in the market. People will look at and choose between two products with X925 or M4/5. It's a very obvious parallel and a big oversight for the article.

For better or worse if you make a (high end) consumer CPU it will be judged against the M-series, just like if you make a high end phone it will be judged against the iPhone.
Ask HN: How are you structuring Markdown-based context for AI coding agents?
by lepuski | 2026-03-03 12:29:51+00:00
I’ve recently transitioned from using LLMs in-browser to a local agentic workflow in VS Code (Gemini Code Assist). I can approve/disapprove changes which is nice, but I’ve hit a wall regarding context management. Initially, I provided all the whole repo as context to the non-agentic version of Gemini code assist and it performed well.

I read the agentic mode is "better" so to keep the agent aligned with my project's architecture, I’ve manually built 7 dense Markdown files that serve as the system instructions for the project. I require Gemini to update these files as we implement features.

gemini.md (instructs gemini to read the other md files and handle updating) project_overview.md, architecture.md, features.md, database.md, api.md, security.md

Each file is between 500–1,500 words so I’m concerned if f this is the right way to go. There seems to be no consensus on context file best practices. I’m seeing strong arguments for both minimalist, lean instructions and dense, project-wide specs. Honestly, the proper usage/prompting patterns of LLM's seems to be comparable to reading horoscopes, everyone goes by gut-feeling with the most cited source of truth being the confirmation bias.

How are you using .md context files in your workflow?
by Ekaros | 2026-03-03 12:30:00+00:00
Why does kph sound like most cursed option. kilo per hour? Kilo what? kilowatt, kilogram? kilolitres? Well it is most likely in context, but still when I stop and think about it it feels icky.. I can accept p instead of /. But just entirely ignoring unit feels wrong... Also is speed of something slow ph?
by aleph_minus_one | 2026-03-03 12:30:12+00:00
> There is really only one platform for customisation: linux. Because distros and software there have been _designed_ around user choice.

At least older versions of Windows were quite modifiable: not as radical as on GNU/Linux, but there were a lot of possibilities.

Rather with the arrival of smartphones and rising popularity of macOS (which all were rather about "enjoying" a prescribed user experience), Microsoft did a U-turn and started applying this (anti-(?))pattern to Windows, too.
by vrighter | 2026-03-03 12:31:01+00:00
no QC has gone beyond being able to factor 1.

The "factorization" done with quantum computers involved cherry picking special numbers so that a special "compiled" circuit (knowledge of the answer is required in order to do this) can be used instead of the full thing. That makes the semantics of the executed program "slightly" different.

What the claims say: factor(a,b)

What the implementation does: println("3").
by lwkl | 2026-03-03 12:31:09+00:00
In Switzerland a digital identity like this will launch this summer and the underlying infrastructure and app is open source. And the issuer of the ID and the registry that holds and verifies credentials are separated. The protocol also isn't novel and is already used in other countries (Germany(?)).

For more information check the out technology behind it: https://www.eid.admin.ch/en/technology
by krapp | 2026-03-03 12:31:12+00:00
I mean yes, the "impression" you get is bar for bar that of the standard right-wing Trump voter, down to the bad-faith interpretation. People who think the way you do in the US were always going to vote for Trump and were never going to vote for a Democrat, regardless of their platform.

If you're pointing out that the left's message didn't appeal to to the right, that seems tautological.
by bhekanik | 2026-03-03 12:31:36+00:00
I built this after watching OpenClaw incidents pile up across WIRED, CyberNews, Reddit, and HN itself. Stories are ranked by a composite Horror Score that factors in community votes, authenticity signals (receipts required), and evidence quality. Heavily-documented stories rise; flagged-as-fake stories sink. Built with Next.js + Convex (real-time backend) + shadcn/ui. Dark mode by default. Source: https://github.com/bhekanik/openclaw-horror-leaderboard
by Bender | 2026-03-03 12:31:45+00:00
Lightning and wildfires are a normal cycle of a forest and required to prevent MegaFires. Without lightning states and provinces would have to buy very expensive equipment to clean out all the underbrush. Forestry mulchers and excavator attachments This is a time consuming process that burns a lot of fuel.

To minimize the risks around forest fires would require preventing people from building homes in or near them, creating fire-breaks, putting infrastructure under-ground under said fire-breaks and performing deforestation [1] at the edges of forests nearest the edges of cities. If a forest goes without a fire for some time then forestry departments should start controlled fires after creating very wide fire breaks.

Oil refineries may have an interest in preventing lightning. or perhaps fracking sites, anywhere off-gassing methane.

[1] - https://www.youtube.com/watch?v=LYKg0gbRFns [video][3m31s]
by plus8bit | 2026-03-03 12:32:02+00:00
Got tired of spending 30 minutes every morning
across CoinGecko, DeFiLlama, and crypto Twitter.

So I built a fix: a single structured text file
that turns Claude into a personal crypto analyst.
No backend, no APIs, no code - just well-written
system instructions.

Type "gm" and full briefing in 60 seconds. Prices,
DeFi TVL, whale movements, honest market take.

Wrote up exactly how it works + free starter
template: plus8bit.gumroad.com/l/CryptoMorning_FreeGuide

Curious if anyone else is using plain instruction
files to replace manual daily routines?
by bachittle | 2026-03-03 12:32:57+00:00
I'm running a local voice agent on a Mac Mini M4. Qwen ASR for STT and Qwen TTS on Apple Silicon via MLX, Claude for the LLM. No API costs besides the Claude subscription but the interesting part is the LLM is agentic because it's using Claude Code. It reads and writes files, spawns background agents, controls devices, all through voice.

The insights about VAD and streaming pipelines in this thread are exactly what I'm looking at for v2. Moving to a WebSocket streaming pipeline with proper voice activity detection would close the latency gap significantly, even with local models.
by ruszki | 2026-03-03 12:34:05+00:00
> I managed to fix my source code alone, like twelve months ago.

I’ve just mentioned to one of my friend yesterday, that you cannot do this anymore properly with new things. I’ve started a new project with some few years old Android libraries, and if I encounter a problem, then there is a high chance that there is nothing about it on the public internet anymore. And yesterday I suffered greatly because of this. I tried to fix a problem, I had a clearly suboptimal solution from myself after several hours, but I hated it, but I couldn’t find any good information about it (multi library AndroidManifest merging in case of instrumented tests). Then I hit Claude Code with a clear example where it fails. It solved it, perfectly. Then I asked in a separate session how this merging works, and why its own solution works. It answered well, then I asked for sources, and it cannot provide me anything. I tried Google and Kagi, and I couldn’t find anything. Even after I knew the solution. The information existed only hidden from the public (or rather deep in AGP’s source code), in the LLM. And I’m quite sure that I wasn’t the only one who had this problem before, yet there is no proper example to solve this on the internet at all, or even anything to suggests how the merging works. The existing information is about a completely separate procedure without instrumented tests.

So, you cannot be sure anymore, that you can solve it by yourself. Because people don’t share that much anymore. Just look at StackOverflow.
by a13x57 | 2026-03-03 12:35:13+00:00
Location: Atlanta, GA
Remote: Yes / or Hybrid
Willing to relocate: No
Technologies: TypeScript, React, Vue, Node, Tailwind, K8s, Docker, Figma, Postgres
Résumé/CV: https://www.alexstubbs.com
Email: hialex@duck.com

20+ Years experience as a Full-stack Developer, Designer, and Product Engineer. I've shipped complex web applications for government agencies, enterprise brands you've definitely heard of, and startups worth caring about. I also founded a digital agency along the way. See more about me at: https://www.alexstubbs.com
by skrebbel | 2026-03-03 12:35:31+00:00
Yep! Sorry I just edited that in. Win8 is thoroughly underrated to me. The file open/close dialogs were shit but the start menu was very good. I quite liked the fullscreen apps and am sad they got discontinued. Fullscreen IE browsing with full touch support (eg swipe for back/forward, no window chromes in the way to mis-click on etc) was very cool. It made every website feel like a fullscreen app. It almost made the terrible browser engine (it was still IE after all) bearable. Almost.

I'm pretty much still on the same setup now, Win11 plus touchscreen. You'll pry my touchscreen out of my cold dead hands. How will I rage-close a "try chrome" popup without a touch screen? You ever try to rage click something with a touchpad? Total non starter.
by mbreese | 2026-03-03 12:35:32+00:00
I could see a “portable” all in one being successful. Something closer to the first Mac where it had a handle in the back with a built in screen. In the 10-14” screen range. Back in the day, my mom had an internet appliance (light browsing and email only) which was close to what we’re taking about. She loved it.

You’re of course looking at all laptop parts, but the form factor would be part of the appeal. Then again, an iPad dock would also probably cover this form factor for about the same cost.
by bayindirh | 2026-03-03 12:35:55+00:00
> The US have the capability to generate bombs indefinitely.

The same US which had to re-build and re-open factories to be able to support Ukraine, and had an important shortage of shells for some time?

The same US talking with their allies to build ships for them?

US generals said that their defensive munition is not infinite. Middle Eastern countries said that they have Patriot stockpiles for 4 days.

We're past WWII. Nobody has that capacity anymore. Some of the tech and factories built these gigantic battle cruisers are not present anymore even.

US may, and can pulverize Iran if they want, but it'll be much more expensive than WWII era, because of how interconnected the world is now, and this is how post-WWII world has been designated. Make everyone depend on everyone, and make war very expensive as a result.
by hylaride | 2026-03-03 12:36:39+00:00
Yeah, the primary reason RISC-V exists is political (the desire to have an "open source" CPU architecture). As noble as that may be, it's not enough to get people or companies to use (or even manufacture!) it. It'll either be economical (costs) and/or performance (including efficiency) that drives people.

It took ARM decades to get to where it is, and that involved a long stint in low-margin niche applications like embedded or appliances where x86 was poorly suited due to head and power consumption.
by LAC-Tech | 2026-03-03 12:37:38+00:00
The more telling figure is that 50% of *republicans* under 50 do not support Israel. Even Charlie Kirk was posting about how awful an idea an Iran war was before he was killed in mysterious circumstances.

The Epstein files with their derogatory and supremacist remarks made about "goyim" have not helped. Neither has the PR dwmage control to either ignore that or claim he was working for Russia or Qatar.

The times they are a changin'.
Show HN: Finclaw, Openclaw for financial information
by Martinmm | 2026-03-03 12:38:43+00:00
Hey HN,I built Finclaw because I got tired of staring at charts and news tickers all day.

It's a lightweight, local-first AI agent that:

Monitors your personal watchlist with memory of your investment thesis

Checks prices at open/close + scans news every 30 min

Gives its own Bullish / Neutral / Bearish opinion with conviction level and reasoning

Alerts you proactively when price moves, earnings hit, M&A rumors drop, or your thesis gets confirmed/challenged

Does deep fundamental + technical analysis, DCF modeling, AI-exposure scoring, and even suggests related tickers on demand

Everything runs on free yfinance data (no API keys for market data), LiteLLM (swap Claude / GPT / Grok / whatever), and a tiny framework called nanobot. No vendor lock-in, no subscriptions.
by chocmake | 2026-03-03 12:39:36+00:00
There's a good explainer and Q&A of BBS+[1], which is one such zero-knowledge anonymous credentials standard, in a joint talk by cryptographer Brent Zundel. It covers the history of getting it into the W3C verified crentials spec and how various competing verified credential standards aren't privacy-preserving or as performant. It seems very promising and has considered various pitfalls.

From what I understand the issuer signs a credential and then the user on their local device generates unique proofs based on the signature each time, preventing verifiers from colluding/tracking the original signature across services. It also seems to be designed with safeguards against the issuer.

Info based on credentials can be selectively disclosed like whether you're over 18 or whether you have above a certain threshold in an account without disclosing the underlying data.

Obviously if the type of services you use need literal PII then they can still tie activity to a real-world identity but for services only requiring age assurance being able to prove you're over 18 without providing the actual age or other identifiers is better than solutions being actively used.

[1] https://www.youtube.com/watch?v=dXlRIrrb9f4
by haskman | 2026-03-03 12:40:39+00:00
PSA: For folks looking for a swipe enabled keyboard on GrapheneOS without using Google's gboard, try Heliboard - https://f-droid.org/packages/helium314.keyboard/. It's 100% FOSS, but can also use the binary blob from google's gesture typing library "swypelibs" to provide swipe typing. Since helium can't access the internet, I am okay with that.
by cmrdporcupine | 2026-03-03 12:41:05+00:00
This is actually one reason I feel like developing my systems level stuff on ARM64 instead of x86 (I have a DGX Spark box) is not a bad idea. Building lower level concurrent data structures, etc. it just seems wiser to have to deal with this more immanently.

That said, I've never actually run into one of these issues.
by sehansen | 2026-03-03 12:42:27+00:00
Immigrating to Denmark is somewhat easy if you're an engineer. You have a set of skills that there is a recognized shortage of[0] and you'll be making more than the $70000 that qualifies you to take part in the fast-track scheme.[1] Quite a lot of Danish companies have employees from other EU countries and already use English as their working language.

0: Various kinds of engineers are on the so-called Positive List, see sections 21 & 25 on this page: https://nyidanmark.dk/en-GB/You-want-to-apply/Work/Positive-...

1: The supplementary pay limit track requires an annual salary of DKK 446000 (~$70000). This track could close if unemployment rises sharply, but it has been open for 6 out of the last 7 years: https://nyidanmark.dk/en-GB/You-want-to-apply/Work/Fast-trac...
by the_af | 2026-03-03 12:42:27+00:00
To me this is extremely relevant regardless of the specifics in this case. From TFA:

> It also comes at a moment in which many media bosses are pushing staff to find uses for AI — as are executives across most industries — even while clear guidelines around use of the technology that uphold editorial ethics remain elusive.

Anyone who's working with computers now knows this is true. We're being pushed relentlessly to use AI; in some cases (I've heard second hand) people are mandated to use AI, sometimes forbidden from crafting code manually, and are disciplined if they don't. Yet the guidelines are very unclear, as they must be since if we're honest we're all threading new ground.

This, being mandated to use AI at all costs yet given very brittle/unclear indications on how to use it, and these guidelines evolve weekly, and also we're all fearful of losing our jobs, makes for a recipe for disaster.

So yeah, this journalist should have called in sick and use better judgment when toying with AI tools, but still there's a wider problem and the responsibility for this craziness is also on the leadership of most companies and the investors pusing for this.

(None of this is an excuse for generating AI slop. I hate it and I don't need to be told any guidelines about not doing it. If you cannot be bothered to write the text, I cannot be bothered to read it.)