MurphyA/hacker-news huggingface dataset:
Show HN: Encrypted queue architecture for zero-trust home screen widgets
by bitbybit_ch | 2026-03-12 12:27:52+00:00
Gruezi HN,

We built SympLog (Android & iOS), an offline-first health tracker with a fully encrypted DB. When users asked for home-screen widgets, we hit a problem: how do you let a widget write data without exposing the encrypted database?

Prototype demo: https://files.catbox.moe/8egcnt.mp4

App info: https://www.symplog.com

The problem: Fast logging matters for symptom tracking — too many taps and people stop. But our DB is fully encrypted, so letting a widget read it directly would weaken the security model.

The solution: An encrypted queue architecture. The widget never touches the main DB. It writes events (just event_id, catalogUid, rating, timestamp) to an encrypted queue using EncryptedSharedPreferences + Android Keystore. When the user opens and unlocks the app, it imports and clears the queue.

Threat model: Shoulder surfing (someone sees your screen), phone seizure while locked, and ADB/cloud backup extraction. Users can set aliases (e.g. "Anxiety" → "A5y") to obscure what's displayed. The widget must be explicitly enabled after a privacy warning, and its config is fully encrypted.

UX: Undo window before commit, checkmark on success, disabled-state with deep link to configure, dark/light mode.

Still iterating on: Import idempotency (crash during import). Also evaluating alternatives to ESP — direct Keystore+Cipher with one file per event, or encrypted Jetpack DataStore.

I'd love feedback on this architecture, or how others have handled secure data ingestion from "leaky" UI surfaces like OS widgets.
by dathinab | 2026-03-12 12:28:07+00:00
What is meant with AI-edited??

AI can do a grate job for grammar, spell and formulation checking/fixing without changing any content. I.e. just adding as a fancy version of extended spell checking.

While I do currently not use it like that there shouldn't be any reason to ban it.

And tbh. given some recent comments I have been really wondering if I should use it, because either there are quite a bunch of people with lacking reading comprehension or quite a bunch of people with prejudice against people struggling with English spelling and grammar.

Either way using AI as extended spell checker does would help with getting the message through to both groups as

- it helps with spelling, grammar in ways where traditional spell checker fail hard

- it tends to recommend very easy to read sentence structure and information density
by Tklaaaalo | 2026-03-12 12:28:44+00:00
Your regime plays global police and killed the leader of that country instead of talking.

"Death to America" wasn't a action, it was a reaction.

But its great we can stop discussing this anyway if you see war as a black/white thing.

9/11 was one reaction of the middle east to americas behaviour and it will be interesting to see what terrorism will happen in the USA after this war.
by boonzeet | 2026-03-12 12:29:15+00:00
Interesting article, although with so few data points and such a specific time slice it is difficult to draw serious conclusions about the "improvement" of LLM models.

It's notably lacking newer models (4.5 Opus, 4.6 Sonnet) and models from Gemini.

LLMs appear to naturally progress in short leaps followed by longer plateaus, as breakthroughs are developed such as chain-of-thought, mixture-of-experts, sub-agents, etc.
by Jeffrin-dev | 2026-03-12 12:29:51+00:00
good review, the trackpad point is interesting - i didnt realise apple switched to haptic feedback that long ago. the no ambient light sensor thing seems like a weird cut to make honestly, that feature is so seamless you forget its there until its gone.
also curious how the battery holds up after a year or two of use, thats always where budget laptops tend to show their age. but for $600 its hard to argue with, especially if youre just browsing and writing stuff.
by Esophagus4 | 2026-03-12 12:30:42+00:00
I generally don’t do take home tests unless it’s really a job I would love to have.

If you’re some random startup or no name company, I don’t bother. I already have a good job.

If you’re a top name hot company offering $600k+ total comp, I’m going to spend the hour shooting my shot. Even if it’s lower likelihood.

For random company XYZ, I expect humans to sink as much of their time into the process as I do.
by sReinwald | 2026-03-12 12:30:43+00:00
Any single LLM-edited comment reads fine in isolation. The uncanny valley kicks in when you read thirty of them in a row and they all use the same "it's not X, it's Y" construction. The problem isn't that LLM prose sounds inhuman but that it sounds like one human writing everything. Homogeneity at scale becomes an uncanny valley.

This happens because most people just paste a draft and say "make this better" with zero style direction. The model defaults to its own median register, and that register gets very recognizable after you've seen it a hundred times.

But this is a usage problem, not a fundamental one. I actually ran an experiment on this — fed Claude Code a massive export of my own Reddit comments, thousands of them across different subreddits, and had it build a style guide based on how I actually write and argue. The output was genuinely good. It sounded like me, not like Claude. The typical Claude-isms were just about gone.

I wouldn't expect most people to do that. But even a small prompt adjustment makes a real difference. Compare "improve this email" to something like:

Your job is to proofread and edit the following email draft.
Don't make it longer, more formal, or more "polished" than it needs to be.
Fix anything that's actually wrong (grammar that changes meaning, tone misreads).
Leave stylistic roughness alone if it fits the voice.
If the draft is already fine, say so.

That preserves voice way more than the default "Hello computer, pls help me write good" workflow.

But if we're being honest, most people don't care about preserving their voice. They need to email their professor or write a letter to their bank, and they don't want to be misunderstood or feel stupid.
by IAmBroom | 2026-03-12 12:30:52+00:00
I've been trying to buy winter coats at end of season (coincidentally; not chasing sales), and one thing is consistent: fabric content is only hinted at. "Full wool" but "slightly stretchy" - possible with a broadcloth woven wool, but more likely "full"!=100%. "Cashmere" at prices that can (at best) be 10% cashmere, but might be 2% just to avoid outright fraud.

I bought a really good-looking dark blue fedora; I received a really good-looking black fedora a size-and-a-1/2 too big. I had to fight them at the credit card level, because they offered me half off at best for a hat I can't wear.

What is inconsistent: only some of them are fraudulent fronts. I'd guess about 25-50% right now, based on my recent shopping experiences. But not all: I ordered some expensive gloves; their advertised fit was wrong; we settled on 50% off (I /can/ wear them, but it's not ideal, and their return policy clearly required me to ship back). That firm had shite measurement guides, but honest merchant fronting.

I've ordered super-cool button-front shirts that ended up being tissue-like fabric. Grrr...

Speaking of fabric... Amazon folded Fabric.com into their Borg cube, and you CANNOT buy fabric by weight online - for some goddamn reason. I want to buy 100% white cotton for a play costume, and need it thicker - between sheeting and terrycloth; closer to the latter; Nothing else really matters to me about it. But can I determine the cloth thickness/weight? Nope.

So: 50% swindlers; 75% idiots; buy clothes in person or else expect to throw a certain amount away.
by apptela | 2026-03-12 12:31:01+00:00
Building a macOS app launcher called AppTela (https://apptela.com). Apple removed Launchpad in Tahoe and the replacement is pretty bare, so I built something with more depth and honestly better than most alternatives out there (IMHO). You can organise apps across screens, categories, groups and stacks. The stacks concept is the bit I'm most pleased with - pile apps on top of each other visually, or create launch stacks that open a whole set of apps at once. Also added a shadow engine where icons cast shadows based on the time of day, which was a fun experiment.

Just launched on the Mac App Store last week, now figuring out the discovery side which is the hard part. Turns out that doing the best App doesn't mean much if no one knows it exists!
by ibrahim_h | 2026-03-12 12:31:34+00:00
The context-aware classification is neat, especially the pipe composition stuff. One thing I keep thinking about though — the scariest exfiltration pattern isn't a single bad command, it's a chain of totally normal ones. Agent reads .env (filesystem_read → allow), writes a script that happens to include those values (project write → allow), then runs it (package_run → allow). Every step looks fine individually. Credentials gone. This is basically the same problem as cross-module vulns in web apps — each component is secure on its own, the exploit lives in the data flow between them. Would be interesting to see some kind of session-level tracking that flags when sensitive reads flow into writes and then executions within the same session. Doesn't need to be heavy — just correlating what was read with what gets written/executed.
by borundev | 2026-03-12 12:32:08+00:00
While the "Lost in the Middle" (LitM) phenomenon is well-documented empirically, it is usually attributed to training data distribution or the lack of long-range dependencies in common datasets.

In this paper, I show that LitM is actually present at initialization. By deriving an exact theory using the Jacobian Norm, I demonstrate that the characteristic U-shaped attention curve is a structural property of the Transformer architecture itself.

Key findings:

Architectural Determinism: Even with random weights, the model is "born" prioritizing the start and end of sequences.

Jacobian Norm Analysis: I use the Jacobian to measure how sensitive the output is to input tokens at different positions, showing a clear macroscopic bias.

Pretraining vs. Initialization: I compare Qwen-2.5B at both stages to show that while training adds "content detectors" (local spikes), it does not remove the underlying global U-shape.

This suggests that "fixing" long-context retrieval might require rethinking the initialization or the softmax-attention geometry itself, rather than just scaling up training data.

I’m the author of the paper and would love to hear the community’s thoughts on whether this structural bias can ever truly be overcome within the standard Transformer paradigm.
by h45x1 | 2026-03-12 12:32:15+00:00
"Careful design of the protocols maintains privacy by preventing sites from learning any additional information beyond personhood." Is personhood verification desirable? Say, HN introduces personhood verification and budgets the number of posts or comments per person. That would limit the amount of AI posts, which seems to be desirable judging by the recent discussion (https://news.ycombinator.com/item?id=47340079). What are the drawbacks though?
by tim333 | 2026-03-12 12:32:37+00:00
I switched from a Windows laptop to a Macbook. When you closed the lid on the Windows one if whirred for about 30 seconds trying to sleep and if you opened and closed too quickly the os crashed and needed restarting. Mac you just open and close as you like and there's your stuff straight away.

Nothing's perfect but Mac seems good at the basics of running quickly without crashes.
by ripe | 2026-03-12 12:33:24+00:00
> it could also be that these software jobs won’t pay as well as in the past, because, of course, the jobs aren’t as hard as they used to be. Acquiring the skills isn’t as challenging.

This sounds opposite to what the article said earlier: newbies aren’t able to get as much use out of these coding agents as the more experienced programmers do.
by tialaramex | 2026-03-12 12:33:44+00:00
It's not worth optimising if you don't have a problem. Focus your effort.

If this code runs once per week at midnight, needs to finish by 5am, and currently it takes 18 minutes, the fact it could take 40 seconds isn't actually important and so spending meaningful engineering effort to go from 18 minutes to 40 seconds is a waste.

On the other hand, if the code runs on every toaster when it's started and ideally would finish before the toast pops up, but currently takes 4 minutes, then even getting it down to 2.5 minutes will make more customers happy [also, why the fuck are we running software in the toaster? But that's beside the point] and might well be worth doing.

The classic UX examples given are much closer to the latter category. When I type fast the symbols ought to appear immediately for example, if you can't do that then you have a performance problem and optimisation is appropriate. But so much of what software engineers do all day isn't in that space and doesn't need to prioritise performance so optimisation shouldn't be a priority.

In particular Fast but Wrong is just Wrong. https://x.com/magdraws/status/1551612747569299458
by alephnerd | 2026-03-12 12:34:27+00:00
Yes, but a founder deciding to be acquired means they wish to stop having operational control and intend to cash out and exit.

An IPO isn't an easy exit strategy - it takes years to become S1 ready and it takes years to sell off your equity stake if you were using an IPO only to exit.

That's why if you want operational control you fight hard to remain private as long as possible, and if you want to exit you M&A yourself. This makes IPOs only useful if you need to raise more capital than is available in the private market.
by 5balloons | 2026-03-12 12:34:43+00:00
I am working on Plain Invoice (https://plaininvoice.com) — A free invoice generator for freelancers and small businesses. No signup required — just fill in your details, pick a currency (40+ supported), and download
the PDF or email it directly.

I built it because every invoicing tool I tried either required an account, had a paywall after 3 invoices, or was way overbuilt for someone who just needs to send a clean invoice. This keeps it simple
— pick your invoice type (hourly, product, or fixed price), add tax/discounts if needed, and you're done.

Would love any feedback from fellow freelancers or indie devs.
by pseudocomposer | 2026-03-12 12:34:49+00:00
This is what I built Jonline for. Haven’t maintained it for a while, but it’s quite functional as-is. Basically a very vanilla Twitter/Reddit-with-first-class-calendar-events, standard Rust web+gRPC server on Postgres DB, React web UI, and no encryption other than HTTPS/TLS. No server-to-server communication, just username/password auth. Super easy to understand APIs (https://jonline.io/docs). (I do need to build better cross-server auth, but this can be done in the FE only with the existing APIs.) Can boot it in a Docker container in seconds. A few “demo” instances I run are linked from the Readme: https://github.com/JonLatane/jonline
by DonHopkins | 2026-03-12 12:35:06+00:00
Sometimes I wonder about the aristocrats who towns and roads in the UK were named after, like Lord Penistone of South Yorkshire, or Lady Sluts Hole of Norfolk.

https://en.wikipedia.org/wiki/Penistone

https://www.norfolklive.co.uk/news/norfolk-news/rude-funny-s...
by DrScientist | 2026-03-12 12:35:18+00:00
The idea of a second chamber is not controversial. The argument is how you populate it.

Elected - you have the problem of two chambers claiming legitimacy and potential deadlock, and also the problem of potentially having the same short term view as the other elected chamber.

Appointed - who gets to appoint, on what criteria, who are they beholden to ( ideally unsackable once appointed - I want them to feel free to say what they really think ).

Inherited - Very unlikely to represent the population. No quality filter. Potentially a culture of service built up - and free to say what they think.

Random. - More likely to represent the population. No quality filter.

You can obviously have a mix of all or any of the above.

In my view, the ideal second chamber would be full of people of experience, who are beholden to nobody (unsackable), that represented a broad range of views, with a culture of service.

I'm against a fully elected second house - as that's not really adding anything different to the first house. Appointed has worked quite well in the past, but it has become more and more abused recently as the elected politicians have two much control.

It's tricky - perhaps some sort of mix.
by roxolotl | 2026-03-12 12:35:18+00:00
These studies are always really hard to judge the efficacy of. I would say though the most surprising thing to me about LLMs in the past year is how many people got hyped about the Opus 4.5 release. Having used Claude Code at work since it was released I haven't really noticed any step changes in improvement. Maybe that's because I've never tried to use it to one shot things?

Regardless I'm more inclined to believe that 4.5 was the point that people started using it after having given up on copy/pasting output in 2024. If you're going from chat to agentic level of interaction it's going to feel like a leap.
by jeremyjh | 2026-03-12 12:35:21+00:00
This has been the general consensus for about three years now. "Drastic increases in capability have happened the last 3-6 months" have been a constant refrain.

Without any data from the study past September I think its not unreasonable, if you want to make an argument based on evidence.

For me personally, I agree with you, I'm really seeing it as well.
by rhelz | 2026-03-12 12:35:38+00:00
I'm so old I remember the first oil crisis of the 1970's. That was a "before" and "after" event: the world has never been the same. Double-digit inflation. Dad bought a house and took on a 14% mortgage.

If the straight of Hormuz isn't opened in the next few weeks, stock markets are going to start to crash.
by outime | 2026-03-12 12:35:47+00:00
If developers are going to face criminal liability, they should IMHO also have legal ways to push back against certain implementations without risking their jobs, or at least have a way to leave a legal justification somewhere: "I'm doing this because I'm forced to but I disagree" which is then signed by management.

Until then, you're putting the weight of the law on the wrong side of the equation, since developers aren't the ones consciously making risky decisions.
by Toutouxc | 2026-03-12 12:35:53+00:00
There's a consensus that SOMETHING changed with Opus 4.5. It might have been the "merge rates" metric, it might have not.

I'm certainly getting faster and cleaner-looking solutions for certain issues on Opus 4.6 than I was 5 months ago, but I'm not sure about the ability to solve (or even weigh in) the actual hard stuff, i.e. the stuff I'm paid for.

And I'm definitely not sure about the supposed big step between 4.5 and 4.6. I'm literally not seeing any.
by pixeyo | 2026-03-12 12:36:06+00:00
The actual cost depends almost entirely on context window size and task frequency, not the hosting tier.

Light usage (a few conversations a day, no cron jobs) typically lands $5-20/month in API tokens. The trap is scheduled tasks or
heartbeat loops running against Opus — that compound fast. Switching the default model to Sonnet cuts costs ~5x for most workloads with
no real quality difference for non-coding tasks.

A few things that actually move the needle:
- Run openclaw models list to see what's configured, then set a cheaper default for routine tasks
- Set a token budget in any cron job skill config before running it overnight
- Keep MEMORY.md trimmed — long memory files add to every request

I put together a cost calculator at openclawcheatsheet.com that lets you model different usage patterns (message frequency, cron jobs,
context size) and get a realistic monthly estimate. Helped me stop being surprised by my Anthropic bill.
by BloodAndCode | 2026-03-12 12:36:11+00:00
that direction makes a lot of sense. selectors always end up turning into maintenance work sooner or later.

the idea of a small model just identifying “the thing that looks like a price / status / headline” feels much closer to semantic detection than DOM-path tracking

curious though — would you run that model on every check, or only when the selector fails? seems like a nice hybrid approach to keep things cheap.
by apptela | 2026-03-12 12:36:20+00:00
I have launched an App last week (apptela.com) and launched in 10 Languages. Started off with internationalisation built into the App from the very start so was easy to convert and scale up to other languages. The difficulty I found was having to apply it everywhere else. Multi language on the website and in the App Store. Also doing multi language screen shots. So Overall easy to scale up to other languages but much more admin overall.
by pajko | 2026-03-12 12:36:51+00:00
There's bigger issue than stuffing. In "rural" Hungary chain voting is customary where people are taken to the voting place by gangs and are either awarded with some money or a bag of potatoes, or threatened to be beaten if they do not comply. The first voter of the chain goes in, takes the ballot, hides it and takes it out. It is then pre-filled by the gang. The next voters take the prefilled ballot in, throw it in the box and bring a fresh clean ballot out, and so on...

In other cases, people get money/bag of potatoes for a photo of their correctly filled ballot.
Show HN: Ollamon, an htop-style terminal monitor for Ollama nodes
by hbasria | 2026-03-12 12:37:11+00:00
Built ollamon, an htop-style terminal monitor for Ollama nodes. It shows installed and running models, CPU/RAM/disk usage, GPU metrics, access-log-based latency/request telemetry, and lightweight operational insights in a terminal UI. macOS GPU data is sourced from agputop, and the goal is to make local LLM infrastructure easier to observe without adding heavy dependencies.

https://github.com/hbasria/ollamon
by davexunit | 2026-03-12 12:37:20+00:00
It couldn't get past a vote in the Wasm community group to advance from phase 1 to phase 2.

Here's a quote from the "requiem for stringref" article mentioned above:

> 1. WebAssembly is an instruction set, like AArch64 or x86. Strings are too high-level, and should be built on top, for example with (array i8).

> 2. The requirement to support fast WTF-16 code unit access will mean that we are effectively standardizing JavaScript strings.
by Bender | 2026-03-12 12:37:22+00:00
TLS intercepts harder to execute without going unnoticed.

I would expect the opposite. Certs and their fingerprints changing every few days would numb people to TLS changes. MitM would only get noticed if the expected cert is presented at the application layer which is a thing in jabber from your link above, IF it is enabled which it was not and why that MitM went unnoticed for so long. LetsEncrypt is just a DV cert so a cert being issued by other org for the same domain would not raise eyebrows at all. AFAIK no other web daemons in wide use support things like OMEMO/SSL SCRAM though it would be awesome if everyone was hosting their own jabber instances.

In a semi-private forum the fingerprint can be in a pinned comment along with the curl command for members to fetch it but that would have to be updated every few days and someone would have to bother to verify it each time. Doing this weekly could lead to fatigue.
by evrydayhustling | 2026-03-12 12:37:27+00:00
You are describing products that change the information flow used to solve a problem. There are probably big gains there, but it requires everyone to come for the journey at the same time - for example, you must tell the board "there is no report, talk to this bot. Not everyone will join for the ride!

AI marketers are leaning into use cases where and individually can unilaterally choose to do their work a different way. This is much easier to explain and distribute!

All that said, the result is definitely funny - seeing work done like this makes you realize how artificial the tasks that make up modern work are.