MurphyA/hacker-news huggingface dataset:
Show HN: ExtraSuite – pull / push for Google Drive
by ksri | 2026-03-05 16:01:52+00:00
ExtraSuite is a terraform like tool for google drive files - sheets/docs/slides/forms/app scripts. It is meant for agents to make targeted edits to files.

While ChatGPT / Claude etc can create the initial versions of the files, the real complexity is in the workflow after the initial version. Team members add comments to provide feedback, or you decide several days later to make minor edits. Re-generating the entire sheet or doc is just not feasible. Our team members resorted to manual edits.

We looked around for a library to edit google drive files. We found gspread for google sheets - and our first version used it. It worked well - but it used way too many tokens. Every change required writing python code. This led to the first version of `extrasheet` - which pulls a spreadsheet and converts it into data.tsv, formula.json and several other files. Initial versions duplicated the formula in every cell for a column; subsequently we detected a formula was the same for a range and automatically compress it. Result - our teams were able to make more complex excel models, make targeted edits and perform analysis using fewer tokens and less capable models.

Subsequently, we followed the same approach for google docs. This turned out WAY COMPLEX. The batchUpdate API for google docs in insanely complex - you have to painstakingly compute the index. `extrasuite doc push` now detects changes, computes indexes, resolves internal dependencies and ultimately pushes the changes only to google docs.

As usage increased, we added google slides (this is pre-alpha), google forms, and even app scripts - all using the same pull-edit-push workflow.

One more differentiator is the usage of service accounts for the agent. The SA has no permissions other than the ability to read/comment/edit the specific files that have been shared with it. This means that agent edits are completely auditable. It is clear to everyone in the team that "Alice used her agent to write this document" - because it shows up clearly in the documents version history.

To achieve this service account, we deploy a lightweight gateway server that mints 1:1 service accounts per employee on demand. This isn't scalable as there are limits to how many service accounts you can create in a google cloud project (typically 100) - but this hasn't been a problem for us as yet.

The gateway server is strictly optional. You can download service account JSON keys and use it to authenticate if you wish, but we dislike giving keys to employees. A gateway server simplifies the workflow significantly for non-tech users.

Try it out, and hopefully it is of use to others.

P.S. This complements gog and gws, does not replace it. Neither of those tools has a workflow to perform in-place complex edits in a declarative manner.
by ray023 | 2026-03-05 16:02:18+00:00
Lenovo has faced multiple serious scandals and negative incidents that have significantly damaged its reputation, particularly around security, customer trust, and transparency.

Adware Scandal (2015): Lenovo pre-installed Superfish VisualSearch on thousands of laptops, which injected ads into web searches and installed a universal self-signed root certificate. This allowed man-in-the-middle (MITM) attacks, exposing users’ encrypted traffic—including passwords and banking details—to anyone on the same network. The private key for this certificate was identical across all affected devices, making it trivial for attackers to exploit. Lenovo initially denied the threat, claimed the software was safe, and only issued a removal tool after intense public and media backlash. Even then, the tool removed the adware but left the dangerous root certificate in place, giving users a false sense of security.

UEFI and Firmware Backdoors (2015–2025): Lenovo shipped laptops with UEFI-based installers that could reinstall software even after a full OS reformat. Security researchers found persistent firmware-level malware that could not be removed by standard reinstallation. In 2025, reports from Bloomberg suggested U.S. military investigators found backdoored chips in Lenovo motherboards capable of logging keystrokes and transmitting data—though Lenovo denied knowledge.

ThinkPad Spyware (2015): Lenovo was found to have pre-installed Omniture software (a web analytics tool) on ThinkPad and ThinkCentre devices, which collected detailed user behavior data, including keystrokes and browsing habits. This was done without clear user consent and sparked privacy concerns.

Customer Service Failures and Refusal to Refund (2022–2026): Multiple users report fraudulent replacement practices, such as sending lower-spec laptops than ordered (e.g., a 1TB SSD instead of 2TB), refusing refunds, and ignoring customer complaints. One user reported being denied a refund for over a year despite returning a defective gaming laptop, with Lenovo repeatedly failing to respond or escalate cases—even after threats of legal action.

Product Misrepresentation and Delayed Shipments (2022): Customers reported false delivery timelines—such as a Cyber Monday order taking over a month to ship—leading to missed deliveries and poor communication. One Reddit user called it a "scam" due to misleading advertising and unresponsive support.

Security and Trust Erosion: The repeated pattern of pre-installing dangerous software, ignoring security warnings, and failing to act responsibly has led to widespread distrust. Experts and users alike now warn that Lenovo devices may be compromised at the firmware level, and many advise avoiding Lenovo products for sensitive or secure tasks.

These incidents reflect a recurring pattern of security negligence, poor customer service, and questionable business practices, raising serious concerns about Lenovo’s integrity and long-term reliability.
by lorenzoguerra | 2026-03-05 16:02:21+00:00
>We also ran the full dataset of 263 URLs (254 phishing, 9 confirmed legitimate) through Muninn's automatic scan. This is the scan that runs on every page you visit without any action on your part. On its own, the automatic scan correctly identified 238 of the 254 phishing sites and only incorrectly flagged 6 legitimate pages.

...so it has a false positive rate of 67%? On a ridiculously small dataset?
Show HN: hugpoint.io – Find the fairest meeting spot for a group
by prunax | 2026-03-05 16:02:24+00:00
I built hugpoint.io to solve a specific problem: when a group tries to decide where to meet, the first person to suggest somewhere implicitly anchors the decision around their own location.

Everyone else agrees to avoid friction. Someone ends up with a disproportionate commute. Nobody mentions it.

The tool calculates each person's reachable zone using real transit data (not straight-line distance), finds the intersection, and surfaces Google Places results inside that overlap — ranked by a Fairness Score that measures how equally reachable a venue is for everyone in the group.
Technical decisions worth discussing:

Isochrone-based rather than Euclidean midpoint — crow-flies distance is meaningless in a city with asymmetric transit

Per-person travel mode support — one person cycling, another on the Subway, a third driving

Session state serialised to URL hash so any search is shareable without accounts

Built entirely with AI tools as a non-technical founder — happy to talk about that process if useful

No accounts, no paywall, works in the browser.

Would genuinely appreciate feedback on the technical approach and any edge cases you'd throw at it.

hugpoint.io
by eitau_1 | 2026-03-05 16:02:35+00:00
I've started questioning this premise given that concentration of CO2 in the lungs (while resting) never falls below 10000ppm (I'm possibly underestimating this number).

Though I'm not excluding the possibility that indoor CO2 concentration strongly correlates with cognitive underperformance, which may be caused by other compounds emitted by human body.
by john_strinlai | 2026-03-05 16:02:42+00:00
>what's the false positive / negative rate of both approaches

the false positive rate is 100%. they just say everything is phishing:

"When we ran the full dataset through the deep scan, it caught every single confirmed phishing site with zero false negatives. The tradeoff is that it flagged all 9 of the legitimate sites in our dataset as suspicious, which is worth it when you're actively investigating a link you don't trust."
by SilverElfin | 2026-03-05 16:02:47+00:00
It’s not that surprising. The entire tariff saga was one trading opportunity after another for insiders who knew which announcements were going to come out.

Lutnick is a particularly corrupt individual though. He’s in the Epstein files like Trump and Musk and Thiel. But he also took over Cantor by suing the widow of Cantor after his death. And now he hands the company to children and has no shame about openly nepotistical decisions like this.
by parad0x0n | 2026-03-05 16:03:04+00:00
fair point. I think they should ALSO be in your CLAUDE.md. Doing Claude reviews with the exact same instructions still makes sense because the PR itself is often a co-production between AI and the human who gives the instructions (and in the coding process the agent might be more sycophantic toward the user's ideas). Additionally, when writing code, Claude is more focused on writing code that works and puts a lot of your repo into context, while during reviewing it pays more attention to these guidelines
by mikehostetler | 2026-03-05 16:03:08+00:00
We have a full dashboard called `jido_studio` that will be available soon that helps visualize it.

Teaser screenshot is here: https://x.com/mikehostetler/status/2025970863237972319

Agents, when wrapped with an AgentRuntime, are typically a single GenServer process. There are some exceptions if you need a larger topology.
by wat10000 | 2026-03-05 16:03:16+00:00
Congress needs to step up and take its power back from the executive. There was no good reason for the President to have this power in the first place. Why the hell do we have emergency powers to impose tariffs? Is there going to be a fleet of nuclear-armed bombers headed for the USA and the only way to stop them is to impose tariffs? It's ridiculous.

Congress has been gradually handing their power over to the executive for decades. For decades, people have been warning that this was setting up for major abuse if you got a particularly bad president. Well, guess what....
by dmix | 2026-03-05 16:03:22+00:00
> the corporation said 94% of people in the UK continued to use the BBC each month, but fewer than 80% of households contributed to the licence fee.

That's a pretty good ratio no? Plenty of services survive with lower ratios than that. Do they really expect every household to pay? Or is the issue they have much bigger spending plans than they make from it.
by antonyh | 2026-03-05 16:03:44+00:00
Yes, for some definition of OS. It could build a DOS-like or other TUI, or a list of installed apps that you pick from. Devices are built on specifications, so that's all possible. System API it could define and refine as it goes. General utilities like file management are basically a list of objects with actions attached. And so on... the more that is rigidly specified, the better it will do.

It'll fail miserably at making it human-friendly though, and attempt to pilfer existing popular designs. If it builds a GUI, it's be a horrible mashup of Windows 7/8/10/11, various versions of OSX / MacOS, iOS, and Android. It won't 'get' the difference between desktop, laptop, mobile, or tablet. It might apply HIG rules, but that would end up with a clone at best.

In short, it would most likely make something technically passable but nightmareish to use.
by vladvasiliu | 2026-03-05 16:04:02+00:00
I haven't tried this much on this Lenovo laptop, but on my HP ones, both Intel and AMD, the main difference I notice under Windows is that the laptop stays warm to the touch in this mode, whereas in S3 on older machines it used to go cold. Additionally, with both Linux and Windows, the battery drains much more quickly compared to the old S3 mode (even though on Linux it gets cold to the touch).

The HP Intel is the one I use Windows most often on (since sleep is basically borked on Windows on the AMD one), and on that machine, I actually hear the fans running while in standby (it wasn't actually fully on, judging by the LED pulsating instead of being continuously on). Which is absurd, since the fans are hardly ever audible under Linux in normal office use.
by Herring | 2026-03-05 16:04:07+00:00
Education is a public good, therefore good education is socialist, and Americans are very hyper-individualist (aka antisocial). History suggests that Americans generally only move toward communal support systems during extreme crises, like the shift during the Great Depression. Even Covid wasn't enough to get people asking for universal healthcare, it has to be much worse.

Overcoming 'American Exceptionalism' to adopt a successful model like the Finnish education system would probably require a massive crisis. The current system will just limp along until then.
by umvi | 2026-03-05 16:04:10+00:00
Ok, but what if in the future I could guarantee that my generative model was not trained on the work I want to replicate. Like say X library is the only library in town for some task, but it has a restrictive license. Can I use a model that was guaranteed not trained on X to generate a new library Z that competes with X with a more permissive license? What if someone looks and finds a lot of similarities?
by rayiner | 2026-03-05 16:04:22+00:00
Did you read the ruling? And the appellate court decision below?

Thomas joined fully with Kavanaugh’s dissent. He wrote separately to articulate his view of the scope of non-delegation doctrine. He pointed out tariffs and taxes are different, in that tariffs implicate international relations, which is primarily within the province of the president. His analysis is extremely cogent. I was actually talking with my wife (we’re both Fed Soc people) that the administration should have pushed that angle much harder in the argument.

Did you read the Federal Circuit en banc decision? You don’t get two Obama appointees to vote in favor of the Trump’s administrations unprecedented tariffs when the legal issue “isn’t close.”
by mholt | 2026-03-05 16:04:48+00:00
I never loved the idea of GSB or centralized blocklists in general due to the consequences of being wrong, or the implications for censorship.

So for my masters' thesis about 6-7 years ago now (sheesh) I proposed some alternative, privacy-preserving methods to help keep users safe with their web browsers: https://scholarsarchive.byu.edu/etd/7403/

I think Chrome adopted one or two of the ideas. Nowadays the methods might need to be updated especially in a world of LLMs, but regardless, my hope was/is that the industry will refine some of these approaches and ship them.
by greyface- | 2026-03-05 16:04:54+00:00
Additional context:

https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555

https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(techni...

https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathre...

Apparent JS worm payload: https://ru.wikipedia.org/w/index.php?title=%D0%A3%D1%87%D0%B...
Show HN: A Linter for Skill.md Files
by theahura | 2026-03-05 16:05:05+00:00
We wrote a linter for our own internal use, and today we decided to open source it.

SKILLs are the easiest way to configure agents, and you can get a lot of juice from a few well written SKILL files. Unfortunately, most SKILL files are not well written. They are way too long, they waste tokens explaining things that the model already knows, and many don't even follow the agentskills.io spec.

Linters help automate low hanging fruit changes that we find we constantly need to make.

You can run the linter as a one-liner:
`npx nori-lint lint path/to/SKILL.md` or
`npx nori-lint fix path/to/SKILL.md`

SKILL files are hard to lint deterministically, so there are several rules that require an LLM to do part of the review. You can set up a .nori-lint.json file to include an Anthropic API key, which will kick off a bunch of llm analysis rules.
by dfxm12 | 2026-03-05 16:05:41+00:00
The article specifically mentions Lucy & Sesh. A quick Google search confirmed some suspicions:

Sesh (2025): Max Cunningham is the Founder & CEO of Sesh, a nicotine pouch startup. In September 2025, Sesh raised $40 million in funding from investors including 8VC, a firm co-founded by Peter Thiel.

David Renteln is the ceo of Lucy. I couldn't find a direct link between Thiel and Lucy, but it looks like Thiel has been friends with Renteln for a while and invested in Renteln's Soylent.
by jcranmer | 2026-03-05 16:05:47+00:00
> And the supreme court doesn't hear cases that are 100% obviously illegal.

There is an argument in about two months' time as to whether or not the Birthright Citizenship clause of the 14th Amendment actually guarantees birthright citizenship in the US. There is no serious legal argument in favor of the interpretation being advanced by the Trump administration, that it does not. And yet here we are.
by PaulDavisThe1st | 2026-03-05 16:05:51+00:00
Insurance company deal: if you pay us $X now, and then Y happens, we will make you whole, even though that cost may very well exceed $X.

Lutnick deal: we pay you $X' now, and if Y' happens, we collect everything which will substantively exceed $X'.

This is not insurance, its closer to shorting stocks.

Oh, one other thing: the insurance company has essentially nothing to do with Y at all, in the sense that they have no control over Y and generally speaking no involvement in it (think: accidents, floods, storms, fires). By contrast Lutnick is the Secretary of Commerce of the United States of America.
by DrammBA | 2026-03-05 16:06:09+00:00
Also the maintainer's clean room argument is very flimsy when they freely admit to:

> I've been the primary maintainer and contributor to this project for >12 years

> I have had extensive exposure to the original codebase: I've been maintaining it for over a decade. A traditional clean-room approach involves a strict separation between people with knowledge of the original and people writing the new implementation, and that separation did not exist here.

> I reviewed, tested, and iterated on every piece of the result using Claude.

> I was deeply involved in designing, reviewing, and iterating on every aspect of it.
by happyopossum | 2026-03-05 16:06:09+00:00
Also in other news:

"Amid online claims Commerce Secretary Howard Lutnick’s sons, Brandon and Kyle Lutnick, senior executives at Cantor Fitzgerald, could benefit from the Supreme Court’s tariff ruling, a firm spokesperson told Newsweek it has “never executed any transactions or taken risk on the legality of tariffs.""

[0] https://www.newsweek.com/howard-lutnick-sons-may-make-money-...
Show HN: ConvertlyAI – Format raw transcripts into 10 social assets
by ConvertlyAI | 2026-03-05 16:06:34+00:00
Hey HN,

I built ConvertlyAI (https://convertlyai.online) to solve my own post-production bottleneck. As a writer and creator, I found that producing the core content—whether a long-form manuscript or a video—was only half the battle. Chopping that single piece of content up into highly specific formats for Twitter threads, LinkedIn carousels, and newsletters was causing massive burnout.

I wanted a system where I could upload a raw YouTube transcript or an MP3, and have an engine strictly format it for 10 different platforms without losing the core message or sounding like a robot.

How it works under the hood:
The stack is Next.js, Supabase, and the OpenAI SDK (GPT-4o).

The biggest challenge wasn't generating text; it was preventing the AI from generating garbage text. I spent a lot of time engineering strict system-level guardrails to force the model to be "High Signal, Low Noise."

Banned Vocabulary: I hardcoded rules to strip out generic AI fluff words (e.g., "Unlock," "Delve," "In today's fast-paced world," "Supercharge").

Strict Formatting: Each of the 10 outputs has a dedicated sub-prompt. For example, the Twitter thread logic forces "1/X" numbering and bans hashtags in the hook, while the LinkedIn logic strictly formats text for slide carousels.

Audio Processing: I built a transcription pipeline so users can just upload raw MP3s if they don't have text ready.

I'm currently dogfooding the product to automate my own content distribution and running a credit-based billing system to manage the compute costs for the AI and audio processing.

I would love for you to tear it apart. I'm specifically looking for feedback on:

The UI/UX of the dashboard when managing saved "Magic Prompts."

The strictness of the output formatting—if you run a transcript through it, does it actually sound human to you?

Happy to answer any questions about the prompt engineering, the tech stack, or the API routes!
Show HN: AgnosticUI – A source-first UI library built with Lit
by roblevintennis | 2026-03-05 16:06:53+00:00
I’ve spent the last few years building AgnosticUI. It started as a CSS-first monorepo with logic manually duplicated across framework packages. It turned into a maintenance nightmare.

I recently completed a total rewrite in Lit to align with web standards and unify the core. One major architectural shift was moving to a "Source-First" model. Instead of a black box in node_modules, the UI source lives in your local project workspace.

This makes the components fully visible to LLMs, preventing the hallucinations common when AI tries to guess at hidden library APIs. I wrote a technical post-mortem on Frontend Masters detailing the hurdles of this migration (Shadow DOM a11y, Form Participation, and @lit/react vs React 19): https://frontendmasters.com/blog/post-mortem-rewriting-agnos...
by raggi | 2026-03-05 16:07:11+00:00
It’s not a good idea and that’s where I’d really start with the dated commentary here rather than focusing on the polling mechanism. It depends on the application but if the buffers are large (>=64kb) such as a common TCP workload then uring won’t necessarily help that much. You’ll gain a lot of scalability regardless of polling mechanism by making sure you can utilize rss and xss optimizations.
by nilsbunger | 2026-03-05 16:07:18+00:00
We’re going to be in a very weird place:

* LLMs make it trivial to recreate almost any software using its test suite (maybe not a derivative work)

* LLM generated code has no copyright (according to current court interpretations)

Soon we will be able to make an unlicensed copy of anything if we have its test suite and a little money for tokens.