MurphyA/hacker-news huggingface dataset:
by Aurornis | 2026-03-13 15:08:05+00:00
> Zero-knowledge proofs are the way to go for this type of thing,

The benefit of zero-knowledge proofs is that the hide information about the ID and who it belongs to.

That’s also a limitation for how useful they are as an ID check mechanism. At the extreme, it reduces to “this user has access to an ID of someone 18+”. If there is truly a zero-knowledge construction using cryptographic primitives then the obvious next step is for someone to create an ad-supported web site where you click a button and they generate a zero-knowledge token from their ID for you to use. Zero knowledge means it can’t be traced back to them. The entire system is defeated.

This always attracts the rebuttal of “there will always be abuse, so what?” but when abuse becomes 1-click and accessible to every child who can Google, it’s not a little bit of abuse. It’s just security theater.

So the real cryptographic ID implementations make compromises to try to prevent this abuse. You might be limited to 3 tokens at a time and you have to request them from a central government mechanism which can log requests for rate limiting purposes. That’s better but the zero-knowledge part is starting to be weakened and now your interactions with private services require an interaction with a government server.

It’s just not a simple problem that can be solved with cryptographic primitives while also achieving the actual ID goals of these laws.
by primaprashant | 2026-03-13 15:08:09+00:00
I encourage everyone to use speech-to-text tools to give detailed context to coding agents. As a developer, I love my keyboard and I can understand if you're skeptical. I was too. But using speech-to-text is one of the high-leverage things you can do as a developer.

We all know LLMs work better when given more context and clear instructions. When you're working with coding agents, you're giving instructions to them multiple times a day, every day. Over time, you end up giving much better instructions and detailed context if you use speech-to-text compared to manually typing all those instructions all the time.

There are tons of open source and proprietary products for speech-to-text which offer inference on local machine or on cloud. So I put together a curated list of 30+ open-source tools across Linux, macOS, Windows, Android, and iOS. Most support offline recognition. Pick whatever you find suitable, but I definitely recommend giving speech-to-text a try for your LLM workflows. And if you're skeptical, give it a week and then re-evaluate.

https://github.com/primaprashant/awesome-voice-typing
by matteocantiello | 2026-03-13 15:08:27+00:00
Thanks! Data sources are shown here: https://github.com/matteocantiello/88mph
I agree it would be cool to not just expose the top singles of the year, but potentially choose the top songs in a different genre, so that pop isn't dominating. So maybe having the option to choose musical genre first (e.g. Metal, and the whole website's look changes to a dark-gothic UI :) and then navigate the charts of top metal hits for each country. Which reminds me I need to add Finland
by ruszki | 2026-03-13 15:08:47+00:00
Why is this not the “shit people do shit things” category? This happens even without being immigrants. Large part of my family lives in a way poorer neighborhood than what we can afford, because we don’t care to move. People who have problem with this had other problems even before we got richer. There is exactly zero difference. The exact same people are snark as before, just for something else now. They were and would be snark even without this.

This seems to me a very bad attempt to hide xenophobia.
by madshalden | 2026-03-13 15:08:52+00:00
Explore the terrifying symmetry of scale—from the "not-space" beyond the universe to the infinite canyons inside an atom. Learn how axioms and fortune don't just add; they compound at an exponential rate, building a momentum that eventually moves on its own. It’s the mightiest force in the universe, and it’s the only intuition that matters.
by georgeecollins | 2026-03-13 15:08:52+00:00
I'm old, so I am a stopped clock. However, I have invested my whole life including good times and bad. I believe that for a retail trader -- someone who doesn't get paid to trade other people's money-- options are bad. OK yes there are special cases like when your job requires you to hold a lot of one stock etc. I'm not going to make the case why here I am sure it has been argued to death.

I do remember smart friends getting interested in options at different times in the last thirty years because they make higher returns. Then they have a period where make lower returns, or have a real problem. I don't think its worth the attention and the trading cost for most people, even people who understand what a short is. You can't argue with a person who has been doing really well with them for five years but it always seems like people stop.
Show HN: Grab – A declarative stream processor for delimited text data
by anwitars | 2026-03-13 15:09:03+00:00
I built grab because I wanted a more readable way to handle delimited data (CSV, TSV, whitespace) than the usual mix of awk and cut. It replaces cryptic 'schema' like $11 with a declarative one.

The goal was to build something with just enough features to serve a better UX while staying fast enough to stay out of the way.

ps aux | grab -d whitespace -m user,pid,cpu,mem,_:4,start,time,command:gj --json --skip 1
# Result:
# {"user":"root","pid":"1","cpu":"0.0","mem":"0.0","start":"Mar10","time":"0:03","command":"/sbin/init"}
# ...

Key points:

- Readable mappings: Define schemas like <name> to map columns to fields, with support for <name>:N for aggregating multiple columns into arrays, <name>:g for greedy mapping (into arrays), _ to skip columns and even <name>:Nj to join multiple columns into a single field.

- Performance: Zero-copy tokenization in Rust. It processes ~17.1M fields/sec. On my machine, it shapes a ps aux dump into JSON in about 13ms.

- Schema enforcement: By default, it tells you exactly which line failed and why on stderr, rather than silently producing garbled data.

- Small & static: Single 800KB binary, zero dependencies.

I’m sharing it now to see if this "schema-first" approach to shell piping feels as useful to others as it has been for me.

Repo: https://github.com/anwitars/grab

Crates.io: https://crates.io/crates/grab-cli
by genthree | 2026-03-13 15:09:19+00:00
Depends very much on whether the kids' interests leans toward doing computer stuff, or doing stuff with computers.

And they can do the former in a VM anyway. Install Linux, or a BSD, and go. With the bonus that you can experiment fearlessly because you've got snapshots and the worst-case for experimentation still leaves you with an entirely functioning laptop. Or use a cheap VPS, remotely.
by jbstack | 2026-03-13 15:09:34+00:00
As an aside, app descriptions that just say "a lightweight alternative to X" are very unhelpful. That tells me nothing if I don't know what X does, and I don't want to have to go down a rabbit hole just to understand your product. It's particularly bad in this case, because even OpenClaw's Github page doesn't clearly tell me what it actually does; just that it's some kind of assistant that I can communicate with via WhatsApp etc. I appreciate that many people are already familiar with OpenClaw, but you shouldn't assume.

It's better if your app's description just tells me what it does in a direct way using plain language. It's fine to tell me it's an alternative to something, but that should be in addition to rather than instead of your own description.
by mothballed | 2026-03-13 15:09:38+00:00
This is revealed as a fraudulent premise in many states, though. For instance, Illinois doesn't require ID to vote, yet requires an FOID to bear a firearm.

How is it that you don't need an ID to exercise the rights of voting 'citizens', but you need one to exercise the right of 'people'? Consider that virtually all 'citizens' are also 'people', and even if you argue they are not, the portion of voting citizens that aren't 'people' is inconsequential compared to the supposed "10%" that can't muster an ID.

It's almost as if both sides of the argument are just using logically inconsistent arguments that just aligns with whatever gets the voting demographics they like. In fact, Vermont is the only state I know of that gives both full rights of citizens and full rights of people to those without ID in a manner consistent with the anti-ID argument usually presented.
by lxgr | 2026-03-13 15:09:52+00:00
Docker sandboxes sound exactly like what Apple is doing with their `container` framework. It's missing several Docker features still, but if I were to pick a minimal, native runtime, it would probably be that, not the multi-gigabyte monster that is Docker for macOS.

On Linux, however, I absolutely don't want a hypervisor on my quite underpowered single-board server. Linux namespaces are enough for what I want from them (i.e. preventing one of these agent harnesses to hijack my memory, disk, or CPU). I wonder why neither OpenClaw nor NanoClaw seem to offer a sanely configured, prebuilt, and frequently updated Docker image?
by matbilodeau | 2026-03-13 15:09:52+00:00
The judge was “satisfied that the Doe defendants were given fair warning of the possibility that their personal information could be disclosed by Cogeco.”

The broadband outfit “provided the Doe defendants with first and second notices from (Hellboy Productions’) counsel which asserted (its) copyright in the work and alleged infringement of the work by the Doe defendants. The first notice advised of Cogeco’s obligation to retain records that will allow for the identification of the Doe defendants and the second notice warned of the plaintiff’s ability to make a formal legal request to Cogeco to compel the Doe defendants’ identity.”

First, the law firm sends them notices, giving them seven days to take the movie down and stop giving it away. If they comply, then typically nothing happens.

If they don’t stop, the firm issues a second notice indicating it reserves the right to sue the alleged movie pirates.
by iamnothere | 2026-03-13 15:10:44+00:00
Download the source code and ISOs of distros without age gating and put them on durable media. Tell your friends about the issue and its implications (legislating how an OS works is a huge deal, is likely unconstitutional, and opens up the door to all kinds of future abusive laws). Find like minded people so if the worst happens you will have mutual support and can work together on circumvention of any future restrictions. Work on your C skills.
by 8organicbits | 2026-03-13 15:10:49+00:00
I think you are hung up on the word "leak".

Putting a secret subdomain in a DNS query shares it with the recursive resolver, who's privacy policy may permit them to share it with others. This is a common practice and attackers have access to the aggregated datasets. You are correct that third-party web servers or CDN could share your HTTP path, but I am not aware of any examples and most privacy policies should prohibit them from doing so. If your web server provider or CDN do this, change providers. DNS recursive resolvers are chosen client side, so you can't always choose which one handles the query. Even privacy-focused DNS recursive resolvers share anonymized query data. They remove the source IP address, since it's PII, but still "leak" the secret subdomain.

Any time you send secret data such that it travels to an attacker visible dataset it is vulnerable to attack. I call that a leak but we can use a different term.
by jvidalv | 2026-03-13 15:11:00+00:00
Exactly, this why if I use next.js I always hijack the api routes and use Elysia, it comes with something called eden that makes the typing e2e fantastic, can't recommend it enough.

As a side note, I'm slowly moving out of Next.js, as you said, is bloated, full of stuff that is just noise and that benefits them (more network requests more money) for little user benefit.

Right now for me the gold standard is Vite + Tanstack Router. (And Elysia for api/server, but thats unrelated).
by gravity2060 | 2026-03-13 15:11:48+00:00
What does it mean to say 30,000 monthly credits and 1500 daily refresh credits? If my project takes 7000 credits (the way your demo does) then does that mean I couldn’t actually do it on the lowest available pricing plan because I couldn’t use 7000 credits in one run? If this is the case, what am abysmal pricing model!
by stanac | 2026-03-13 15:11:58+00:00
It's probably just <video> element without "controls" attribute.

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

> controls

> If this attribute is present, the browser will offer controls to allow the user to control video playback, including volume, seeking, and pause/resume playback.

Edit: I misunderstood, you are asking

> how they'd managed to hide the video context menu

Not sure, but it works in FF for me
by malfist | 2026-03-13 15:12:21+00:00
For someone claiming to be an AI skeptic, your post here, and posts in your profile certainly seem to be at least partially AI written.

For someone claiming to be an AI skeptic, you certainly seem to post a lot of pro-AI comments.

Makes me wonder if this is an AI agent prompted to claim to be against AIs but then push AI agenda, much like the fake "walk away" movement.
Show HN: Gohpts-IPv4/IPv6/TCP/UDP Transparent Proxy with ARP/NDP/Rdnss Spoofing
by shadowy-pycoder | 2026-03-13 15:12:48+00:00
GoHPTS got updated to v1.12.1 with support for IPv6 protocol and NDP spoffing support (RA/NA spoofing, RDNSS injections)

GoHPTS has in-built functionality to perform NDP spoofing in IPv6 networks with Router Advertisement (RA) and Neighbor Advertisement (NA) packets. It also includes RDNSS option in RA packets to put host as a IPv6 nameserver for affected clients. When combined with transparent proxy mode (TCP/UDP), NDP spoofing allows `gohpts` to proxy traffic for clients in the local networks. As is the case with [ARP spoofing](#arp-spoofing), you can set ndp spoof options with single `-ndpspoof` flag:

Example:

sudo env PATH=$PATH gohpts -d -T 8888 -M tproxy -sniff -body -auto -mark 100 -ndpspoof "ra true;na true;targets fe80::3a1c:7bff:fe22:91a4;fullduplex false;debug true"

For more information about ndpspoof options see `gohpts -h` and https://github.com/shadowy-pycoder/ndpspoof

Plese note that some options like `rdnss`, `gateway`, `interface` are set automatically by `gohpts` itself to properly function as a proxy.

Since `gohpts` proxies all connections via upstream SOCKS5 server, you need to have a working server with IPv4/IPv6 and TCP/UDP support. Obviously, a remote machine (e.g. VPS) should also have IPv6 connectivity working. Needless to say, the machine on which `gohpts` is installed should be part of network with IPv6 support.

Example setup for NDP spoofing to work correctly:

1. Connect to VPS

ssh remote@203.0.113.10

2. Install dependencies

GO_VERSION=$(curl 'https://go.dev/VERSION?m=text' | head -n1)
cd ~/Downloads/ && wget https://go.dev/dl/$GO_VERSION.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf $GO_VERSION.linux-amd64.tar.gz

3. Setup SOCKS5 server (make sure firewall rules do not block used ports)

git clone https://github.com/wzshiming/socks5.git && cd socks5
go build -o ./bin/socks5_server ./cmd/socks5/*.go
./bin/socks5_server -a :3000

4. Go back to your host machine and install `gohpts` installation

5. Run `gohtps`:

sudo env PATH=$PATH gohpts -s 203.0.113.10:3000 -T 8888 -Tu 8889 -M tproxy -sniff -body -auto -mark 100 -arpspoof "fullduplex true;debug true" -ndpspoof "ra true;debug true
" -6 -d

6. Get another device (phone, tablet, etc) and connect it to the same network. Try to access Internet and check if some traffic appears on your host machine. Check public IP address with some online tools (it should match your VPS address `203.0.113.10` in this case or global IPv6 address)

7. Stop proxy by hitting Ctrl+C

8. Profit!

Links:
https://github.com/shadowy-pycoder/go-http-proxy-to-socks)
https://codeberg.org/shadowy-pycoder/go-http-proxy-to-socks)

https://github.com/shadowy-pycoder/ndpspoof
https://codeberg.org/shadowy-pycoder/ndpspoof

https://github.com/shadowy-pycoder/arpspoof
https://codeberg.org/shadowy-pycoder/arpspoof
by Bridged7756 | 2026-03-13 15:13:02+00:00
Unlimited access to APIs. A security hazard. A slot machine but with your work. Not kidding, that's what I think of it. I can see its value I guess, as in, "give me a summary of my today's emails" or "What are my new messages", "tell Susie to do X", being able to automate or streamline things for technical and non technical people, but what else can it do that is so revolutionary? Sure these things are cool and novel, and I don't doubt that they might make things easier, but they don't make things THAT easier. I've heard of it, and ive floated around the hype for a while now, but I just don't think it brings that much to the table. Is it there something I'm missing? I find clankers to be really stupid and prone to hallucinations (INB4, yes even Opus 4.6) and the worst thing I'd want to happen is to have them mess my stuff or leak my API keys or something.
by aleda145 | 2026-03-13 15:13:24+00:00
Super cool!

I'm completely sold on the canvas layer. Embracing non linearity is such a boon when you're on the ideas stage. When you have verified it though, moving it to another medium (a document, presentation or just code) is often the best choice.

Do you see the canvases created with Spine as "one off" that you discard when you have got your deliverable, or as something living that you keep around?

I'm building a side project for running SQL on a canvas (kavla.dev), so I'm thinking about canvas workflows all the time!
Show HN: Open-source CLIs for Procore and EagleView (construction software APIs)
by sv123 | 2026-03-13 15:13:28+00:00
Hi HN. We're OpsRev. We build AI operations agents for construction companies.

These two CLIs are what our agents use internally to talk to Procore (construction project management) and EagleView (aerial property measurements). We decided to open-source them because the developer tooling in construction software is rough and nobody should have to re-solve the same auth and pagination problems we did.

procore-cli - pulls projects, RFIs, submittals, daily logs, budgets, schedules, and directory data from the Procore API. Handles OAuth2, company/project scoping, and pagination.

https://github.com/opsrev/procore-cli

eagleview-cli - covers the full measurement ordering lifecycle: browse products, price orders, place orders, retrieve reports and PDFs. Has sandbox mode for safe testing.

https://github.com/opsrev/eagleview-cli

Both are TypeScript, MIT licensed, and output JSON on every command (errors too, on stderr). We designed them for AI agent consumption but they work just as well in scripts, pipelines, or just poking around an API from the terminal.

Construction is a $2T industry that still runs on a lot of manual data entry between systems. If you're building anything in this space, hopefully these save you some time. Happy to answer questions about the APIs or how we use these in our agent workflows.
by GuB-42 | 2026-03-13 15:13:38+00:00
To me, Instagram is a public platform at its core, where people publish things for the whole world to see. Private messages are just a secondary feature.
It is like having a conversation in a restaurant, where the guy at the next table can listen to everything, but usually doesn't. Good enough for planning a surprise party, not for truly sensitive information. Kind of like private messages in Reddit, Discord, etc... a convenient feature, but don't expect real privacy.

Messenger has a higher expectation of privacy, Facebook is more at the "group of friends" level. While Instagram is a public restaurant, Facebook is more like a house party. WhatsApp has the highest expectation of privacy as it is designed for private, often one-to-one conversations first.
by skaiuijing | 2026-03-13 15:14:22+00:00
I built a small real‑time operating system for ARM Cortex‑M as a step‑by‑step guide to teach how an RTOS is built from scratch.
The kernel starts from a few hundred lines and grows through context switching, scheduling, interrupts, and simple IPC — all explained in a minimal, readable way.

If you want a practical, tiny example that shows exactly how to write an operating system for microcontrollers, this project is designed for that.
by grayscale-dev | 2026-03-13 15:14:29+00:00
I built Base25 for startup SaaS teams that want one simple place to collect feedback, prioritize what matters, share a roadmap, and publish updates without enterprise-heavy tooling.

What it does:
- Feedback board (internal + customer input)
- Roadmap view
- Changelog publishing
- Flat pricing: $30/month (no tiers/add-ons)

Would love blunt feedback on:
1. onboarding clarity
2. anything confusing or missing
3. whether the pricing/value feels right vs alternatives like Canny/Featurebase/Productboard
Show HN: A 3-line wrapper that enforces deterministic security for AI agents
by tonyww | 2026-03-13 15:14:40+00:00
If you are building AI agents with frameworks like browser-use, LangChain, or OpenClaw, you've likely hit the "blast radius" problem.

A misconfigured prompt or hallucination can cause an agent to navigate to a phishing domain, expose an API key, or confidently claim a task succeeded when it actually clicked a disabled button.

The standard fix right now is "LLM-as-a-judge"—taking a screenshot after the fact and asking GPT-4, "Did this work and is it safe?" That introduces massive latency, burns tokens, and is fundamentally probabilistic.

We built predicate-secure to fix this.

It’s a drop-in Python wrapper that adds a deterministic physics engine to your agent's execution loop.

In 3 to 5 lines of code, without rewriting your agent, it enforces a complete three-phase loop:

Pre-execution authorization:

Before the agent's action hits the OS or browser, it is intercepted and evaluated against a local, fail-closed YAML policy. (e.g., Allow browser.click on button#checkout, Deny fs.read on ~/.ssh/*).

Action execution:

The agent executes the raw Playwright/framework action.

Post-execution verification:

It mathematically diffs the "Before" and "After" states (DOM or system) to prove the action succeeded.

To avoid the "LLM-as-a-judge" trap, the execution of the verification is purely mathematical. We use a local, offline LLM (Qwen 2.5 7B Instruct) strictly to generate the verification predicates based on the state changes (e.g., asserting url_contains('example.com') or element_exists('#success')), and then the runtime evaluates those predicates deterministically in milliseconds.

The DX looks like this:

from predicate_secure import SecureAgent from browser_use import Agent

1. Your existing unverified agent

agent = Agent(task="Buy headphones on Amazon", llm=my_model)

2. Drop-in the Predicate wrapper

secure_agent = SecureAgent( agent=agent, policy="policies/shopping.yaml", mode="strict" )

3. Runs with full Pre- & Post-Execution Verification

secure_agent.run()

We have out-of-the-box adapters for browser-use, LangChain, PydanticAI, OpenClaw, and raw Playwright.

Because we know developers hate giving external SaaS tools access to their agent's context, the entire demo and verification loop runs 100% offline on your local machine (tested on Apple Silicon MPS and CUDA).

For enterprise/production fleets, the pre-execution gate can optionally be offloaded to our open-source Rust sidecar (predicate-authorityd) for <1ms policy evaluations.

The repo is open-source (MIT/Apache 2.0). We put together a complete, offline demo showing the wrapper blocking unauthorized navigation and verifying clicks locally using the Qwen 7B model.

Repo and Demo: https://github.com/PredicateSystems/predicate-secure

Another demo for securing your OpenClaw:

https://github.com/PredicateSystems/predicate-claw

Demo (GIF):

https://github.com/PredicateSystems/predicate-claw/blob/main...

I'd love to hear what the community thinks about deterministic verification vs. probabilistic LLM judges, or answer any questions about the architecture!