MurphyA/hacker-news huggingface dataset:
I built a security scanner for OpenClaw after 824 malicious skills were found
by baz_sec | 2026-03-13 22:08:30+00:00
In February 2026, researchers discovered 824 malicious skills (20% of ClawHub)
distributing infostealers. I built ClawVet to solve this.

It's a 6-pass security scanner for OpenClaw SKILL.md files that detects:
- Remote code execution (reverse shells, piped downloads)
- Credential theft (SSH keys, API tokens, browser cookies)
- Prompt injection attacks
- Typosquatting (Levenshtein distance against top skills)
- Social engineering (suspicious patterns)

Most existing scanners run single-pass regex. ClawVet runs 6 independent passes
because one detector misses what another catches.

It's on npm (580 downloads/week), open source MIT, and has a REST API + web dashboard.

Source: https://github.com/MohibShaikh/clawvet
Install: npx clawvet scan ./my-skill

Happy to answer questions about the detection methodology or why the ecosystem
needed another scanner.
by redserk | 2026-03-13 22:08:44+00:00
Agreed. AWS is downright hostile about giving you any idea about what resources you actually have deployed, to the point where it must be deliberately malicious. Even their billing page is terrible for tracing down the root cause of usage with the default configuration.

You have to go into third party tooling if you want any chance of seeing what’s actually going on, especially if there’s any odds of you deploying stuff in another region and even moreso if you have more than 1 account.

At this point, I’d say it should be a best practice of owning 2 AWS accounts, even as a hobbyist: one payer account with a HEAVILY locked down SCP and then a child account with the stuff you’re deploying.
by lo_zamoyski | 2026-03-13 22:08:45+00:00
> That the product is locked down by design is a feature, not a limitation.

I would say most people in tech who aren't interested in fiddling with their phones have no issue with this either and frankly intentionally prefer more locked down options, all things considered.

It's fine to criticize abusive practices that companies engage in, but I tire of the narrow-mindedness of some people who measure everything according to their personal interests. Like, expand your mind, man.
by physicles | 2026-03-13 22:08:59+00:00
If I leave, the Q&A doc probably never gets updated again.

We're in the process of trying to get as much stuff as possible into source control (we use google docs a lot, so we'll set up one way replication for our ADRs and stuff from there to git). That way, as LLM models get better, whatever doc gets materialized from those bits and pieces will also automatically get better.
by markus_zhang | 2026-03-13 22:09:30+00:00
John Carmack and all 10x programmers are going to benefit a lot from the advancement of AI, while we the ordinary programmers are going to suffer in the mid-long term. I mean he is one of the guys I look up to, but I don't want to lose my job.

Regarding OSS, I'll say what I already said a few days ago: OSS people should take care of their financials first, and then do OSS without anxiety. Also, if you do OSS, expect it to be abused in any imaginable and unimaginable way. The "license" is a joke when enough dollars are involved. If you hate that, don't do OSS. No one forces you to do it. I appreciate what you did, but please take care of yourselves first.

Actually, now that I thought about it, every successful OSS people that I look up to took care of their financials first. Many of them also did it in Carmack's way -- get a cool project, release it, don't linger, go to the next one while others improve it. Maybe you should do it, too.
by applfanboysbgon | 2026-03-13 22:10:27+00:00
It doesn't need to lead to AGI or a good coding agent. Some of the only people who are actually profitable in the LLM industry are the people making actual chatbots. There are several bootstrapped startups that run open-weight models with a $10 or $20 monthly sub and make millions in profit off of inference from people just talking to the things, usually for character roleplay / "AI boyfriend/girlfriend" stuff etc. Some of them even took those profits and invested it into training their own bespoke models from scratch, usually on the smaller side although finetunes/retrains of Llama 70b, GLM, and Deepseek 670b have also been done. Grok could probably be profitable if it targeted this space, as the most "intelligent" conversational/uncensored model.

This is already presupposing that profit even matters, though. Musk already burned some $50 billion dollars to control messaging on political discourse with his acquisition of Twitter. It was not about money, but power. After you already have infinite money, the only thing left to spend it on is acquiring more power, which is achieved through influencing politics. LLMs represent a potentially even better propaganda tool than social media platforms. They give you unprecedented access to people's thoughts that they would probably not share online otherwise, and they allow you to more subtly influence people with deeply-personalised narratives.
by nadis | 2026-03-13 22:10:32+00:00
As someone who just recently got into baking sourdough and was literally discussing earlier today some of the challenges around different starters, conditions, and lots of bad / misleading advice online, this is fun to see.

As a bit of an aside, I've found my starter is a lot more resilient than the internet would have me believe. I managed to bring it back to life from the brink after accidentally pouring boiling water directly on it. Fingers crossed no more near-death experiences for it again!

I also find King Arthur's guides and recipes super helpful; recently, I've started popping them into ChatGPT and requesting modifications (e.g. volume, ingredient alterations based on my learnings or needs, altitude adjustments etc.).
by whyenot | 2026-03-13 22:10:53+00:00
It's still fun. The social connections are also hugely important to me. One of my characters is in the same active guild that I joined in 2006. It's hard to put into words how meaningful that is to me. The game has improved, the newly re-done Silvermoon City is beautiful and richly detailed, but you are right, in many ways it's the same game as 20+ years ago, except made more casual-friendly in a lot of ways. I like it and there really isn't anything else like it out there. ...and surprising to me, if you believe Blizzard, there are around 9 million people who still play.
by scuff3d | 2026-03-13 22:11:09+00:00
It's more cultural than anything. 90% of the work done in those other fields is excel, PowerPoint, and Visio. Wouldn't be hard to convert to text and images in a repo. Though I'm sure the planning tools will get better.

One of the last things I did before switching to software was design a PCB board. I spent a year (not just on this one board of course) researching parts, making sure they were compatible, marking sure they met the requirements, doing the math to make sure we'd make timing based on the delays through each ICs, working with mechanical engineers to ensure it would fit in the enclosure. Did three reviews for that one board (one of hundreds in the larger system). After a year it finally went to a vendor for fab, where I spent another 3 months reviewing circuit traces, verifing layout, and then testing once the boards got delivered. I didn't lay a trace or do any of the actual work myself, until it landed in my lab for testing. And all of that was after other engineers had spent god knows how long defining all the requirements.

When people talk about "spec driven development" that's the world they're talking about. Understanding every API call, every abstraction, every interaction, all the various behaviors of a language, and all the requirements. Then writing comprehensive design docs to describe all of that in terms an LLM could understand. Then finally letting the LLM do the work, and spending weeks or months more on testing. And that's assuming LLMs can execute on a spec, which they can't.

You're approach sounds much more reasonable. Lay out the structure and have the LLM fill in the gaps with your oversight. That's how I hear a lot of people doing actual good work describing their workflow. I suspect most talented engineers are going to land somewhere on the spectrum between what you describe and personally hand writing each like if code.

What's not ever going to work is spending a few days writing a several hundred lines spec, shoving it through more LLMs until you get a plan out, and then setting the LLM loose on it. And expecting people with no domain knowledge to get something decent out is even worse.
by kstrauser | 2026-03-13 22:11:54+00:00
I bet this is it. I had a 2018 Mac Mini with a failing drive that moved like frozen molasses, but wasn't throwing obvious errors. Before it failed, it was slow compared to an SSD, but booted up in a reasonable amount of time and ran office apps just fine, just with a little startup lag. It was bad compared to an SDD, but not intolerably slow.

If a Mac is running that slowly, there's probably a hardware issue.
by freehorse | 2026-03-13 22:12:57+00:00
No, I don't trust an encyclopedia generated by AI. Projects with much narrower scopes are not comparable.

edit: I am not very excited by AI-generated documentations either. I think that LLMs are very useful tools, but I see a potential problem when the sources of information that their usefulness is largely based on is also LLM-generated. I am afraid that this will inevitably result in drop in quality that will also affect the LLMs themselves downstream. I think we underestimate the importance that intentionality in human-written text plays in being in the training sets/context windows of LLMs for them to give relevant/useful output.
by MinimalAction | 2026-03-13 22:13:09+00:00
This is mindblowingly beautiful! Thanks for making this. Many a times, I open YouTube, and get overwhelmed by repeated recommendations that I had already decided not to watch, and eventually close without watching much. Now that this site puts it into 40 different genres, I can decide which one am I in the mood for and keep surfing to others if I don't feel like it! Brilliant app.
by notepad0x90 | 2026-03-13 22:13:11+00:00
To start with it requires support v4 as a separate network, at least for internal networks, since many devices don't support ipv6 (I have several AP's, IoT devices,etc.. bought in recent years that are like that). Then the v4->v6 nat/gateway/proxy approaches don't work well for cases where reliability and performance are critical. You mentioned NAT, but lack of NAT means you have to configure firewall rules, many get a public ip by their ISP directly to the first device that connects to the ISP modem,exposing their device directly to the internet. Others need to do expose a lan service on devices (port forwarding) which is more painful with v6. DHCP works very simply, v6 addressing can be made simply too (especially with the v4 patterned addressing - forgot its name) but you have multiple types of v6 addresses, the only way to easily access resources with v6 is to use host names. with v4 you can just type an IP easily and access a resource. Same with troubleshooting, it's more painful because it is more complex, and it requires more learning by users, and if you have dual stack, that doesn't add to the management/admin burden, it multiplies it. It's easier to tcpdump and troubleshoot arp, dhcp and routing with v4 than it is ND,RA,anycast,linklocal,etc.. with v6.

For mobile connectivity, ipv4 works smoothly as well in my experience, but I don't know about your use case to form an opinion. I don't doubt IPv6 makes some things much easier to solve than ipv4. I am also not dismissing IPv6 as a pointless protocol, it does indeed solve lots of problems, but the problem it solves is largely for network administrators, even then you won't find a private network in a cloud provider with v6, for good reason too.
by thisislife2 | 2026-03-13 22:13:30+00:00
India's ISRO already competes with SpaceX for these launches ( ISRO puts 36 OneWeb satellites in orbit - https://www.thehindu.com/sci-tech/science/isro-successfully-... ), despite not having any reusable launch vehicles (reason - it's in the top 5 in space technology and just cheaper - Why it costs India so little to reach the Moon and Mars - https://www.bbc.com/news/articles/cn9xlgnnpzvo ). Once it masters reusable launch vehicle technologies, it'll be hard to compete with ISRO on commercial launches.
by hirvi74 | 2026-03-13 22:14:07+00:00
If workspace management is an another term for managing desktop/spaces, then you are going to be hard pressed to find anything that is not a brittle hack.

I am writing a window manager bundled with other knick-knacks for myself. I have a "solution" for moving windows between spaces, but in the most vile way possible.

The only way I have managed to move windows between spaces is by, and this is no joke, recording the mouse position, moving the mouse to an app's titlebar, automating the 'click and hold' on the window's titlebar, then having the keybindings for "Switch to Next/Previous Space" fire off, and then moving the mouse back to the original position.

Because of the animations, all of junk requires carefully timed, short sleeps, which are also not likely consistent across various hardware/OS versions (can't test it myself).

Also, I have no idea what happens if my solution is tried on apps with pop-up windows, 'headless' apps (no title bar), electron apps, etc..

Apple's support for spaces is notoriously atrocious. There is no clean way to move windows from one space to another or to create/delete spaces. Though there was a built in way in OSX Snow Leopard, IIRC. Why it was removed? I have no idea.

Aerospace creates its own virtual desktops/spaces instead of trying to fight against the OS. I have never used Aerospace, so I cannot comment on its efficacy. But that is probably the cleanest solution we currently have available.
by mrsvanwinkle | 2026-03-13 22:14:10+00:00
Was hoping to find that good end in your story and found it, happy for you. I'm thankfully healthy but found myself in an adjacent circumstance as the child of a newly diagnosed dementia patient who forgot who I am. I was able to reintroduce myself and she has not forgotten again so far but she is at the point where she will believe anything without ground truth as basis. I find myself clamoring for time with her, pioritizing FaceTime calls with her over anything else, as each time I talk to her I can sense her drifting away. I don't mind her forgetting about me, which finally convinced the psychiatrist who said she didn't have a problem the previous year that yes she is in stage 5-6 dementia after all. She woke up once not knowing who she is, and that is something I can't have her forget. This is the closest I've experienced something like what you've survived through and what op is going through, something that puts Everything in perspective. So I'm thankful for threads like this on HN especially given this point in history where everything is happening all at once, which makes this Total Perspective Vortex (HHGG) thing all the more epiphanic (the TPV in HITCHHIKER'S was meant to destroy you by showing you the evident infinitude of your insignificance, but the reality of mortality just shows an indifferent universe being equally, coldly, largely ignored)
by pessimizer | 2026-03-13 22:14:55+00:00
No companion was like that until Sarah Jane. All companions were like that after the revival. It was decided by the person behind the revival that they would be women, never any more useful than Teagan, never as obviously hot as Peri but always cute. They would never be a threat to super Doctor and his magic screwdriver, or hot enough to make women angry.

Just sort of a cynical calculation by somebody who thought of women as tasteful accessories.
by zozbot234 | 2026-03-13 22:16:14+00:00
> hardware attestation in a lot of apps that the ecosystem forces us to use

Only a tiny amount of apps force you into hardware attestation, and these are mostly around banking, mobile payments and the like. So just use a separate, locked down device for those (where the anti-fraud protection of a locked-down system can be a benefit) and your more open day-to-day device for mostly everything else. A hidden advantage is that the dedicated device for secure uses is not something that you're forced to carry with you; you can leave it in a secure place instead.
by gnabgib | 2026-03-13 22:17:49+00:00
There's got to be a better way to share this than:

- a 16 hour old HN account sharing
- an 18 hour old github account with
- a 17 hour old repo

Where your HN post says "several months of work" but your repo doesn't have months of commits, and claims you started researching... 2 days ago.

> Research period: 2026-03-11 to present
by 0xbadcafebee | 2026-03-13 22:17:52+00:00
Too generic question. Gotta be more specific:

"what is the best open weight model for high-quality coding that fits in 8GB VRAM and 32GB system RAM with t/s >= 30 and context >= 32768" -> Qwen2.5-Coder-7B-Instruct

"what is the best open weight model for research w/web search that fits in 24GB VRAM and 32GB system RAM with t/s >= 60 and context >= 400k" -> Qwen3-30B-A3B-Instruct-2507

"what is the best open weight embedding model for RAG on a collection of 100,000 documents that fits in 40GB VRAM and 128GB system RAM with t/s >= 50 and context >= 200k" -> Qwen3-Embedding-8B

Specific models & sizes for specific use cases on specific hardware at specific speeds.
by buredoranna | 2026-03-13 22:17:54+00:00
I grew up with Jeremy Brett's Sherlock Holmes, by far, in my opinion, the most accurate representation of the stories.

Only in my adult life did I read the stories, finding large chunks of the dialog in the TV show being word for word taken from the stories. And when not word for word, the tone and feel of the scenes so well portrayed on screen.
by Imustaskforhelp | 2026-03-13 22:18:18+00:00
I feel like this can be useful for kids if you can add some genuinely nice cartoon shows from Youtube. I remember my childhood was filled with adventure time, regular show etc. and Cartoon Network and there are many decent cartoons.

And if you do this, please add 3 cartoon channels just for an option of 3 for kids. Because I remember that it was 3 cartoon channels for me but mostly Cartoon Network, Some disney xd and an niche cartoon channel that I used to watch by. Maybe even have it between Anime (Shinchan/Doraemon/Kitretsu) and Normal animations (Avengers/Spiderman etc.) and Cartoon Network (Regular Show/Adventure Time/Steven Universe)

But the reason why I discovered it and why I feel like young kids nowadays can't find is that I used to go to my TV after coming from school and watch these nice shows for example, whereas now its all youtube.

So in a way, your website can help kids and also parents to better help moderate what their kids watch.

Also even aside from kids, this is something really cool in it of itself that I imagine myself using as well :) Nice project! I just hope that if possible you can add something so that kids could watch it too maybe as well as I find it to be nice possibility to add

I am also curious how you curate the Content for Cable TV in the first place.

Edit: But once again, I want to say that this is a project that I want to use for myself too for these channels as I also go through the same problem where I get the problem of too much choices and overstimulus and feeling of overwhelm.
Show HN: Sapphire – A portable language with native UI and 3D vectors
by foxz | 2026-03-13 22:18:32+00:00
Hi HN,

I’m the creator of Sapphire, a lightweight programming language written in C++ designed to hit the "sweet spot" between high-level ease of use and low-level performance. I’ve just released version 1.0.7, which is our final push before the 1.1 LTS (Long Term Support) version.

The goal of Sapphire is simple: Zero friction. No complex installers, no pip install, no npm headaches. Just a single 12MB binary that gives you everything you need to build UI tools, network apps, or performance-critical scripts out of the box.

What’s new in 1.0.7:
Vector Math: Added native support for 2D and 3D vectors, making it much easier to build games or simulations (check the Raycaster link below).

Syntax Fluidity: We’ve relaxed the syntax rules to make coding feel more natural and less "rigid" without sacrificing the speed of the VM.

LTS Preparation: Focus on stability and bug fixes as we approach our first Long Term Support milestone.

Key Features:
Immediate Mode UI: Built-in UI engine (SapphireUI) using SFML for rendering. You can create windows and buttons instantly without external DLLs.

High-Performance VM: Uses Direct Threading (Computed GOTOs). It handles 100 million iterations in ~9 seconds on a standard consumer CPU.

No Imports Needed: Native support for Terminal colors, JSON parsing, HTTP functions, and System communication is baked into the core.

Portable: Download the .exe, add to PATH, and you're ready. The VM + UI + Networking + JSON is all in one 12MB file.

Try it out:
Repo: github.com/foxzyt/Sapphire

Raycaster: github.com/foxzyt/SapphireRaycaster
by mpyne | 2026-03-13 22:19:14+00:00
> but not everyone’s open source projects are meant as a gift to the world for anyone and everyone to use

How is that open source then? There's a reason they added the "no discrimination against persons or groups" and "no discrimination against fields of endeavor" clauses when OSI came up with the open source definition in the 90s. https://opensource.org/osd

"Anyone and everyone" was always part of the gig if you wanted to release something as actual open source.

If you wanted to wrote proprietary source-available software you always had that choice. Likewise with Free Software's copyleft.
by stanac | 2026-03-13 22:19:19+00:00
It's probably the only program I despise, but need. I want to use small button under the wheel as middle click (I have short fingers), and until now, the only way to do it is/was to use logi options+. LO+ updater will get stuck on update every couple of months and while it's updating my button configuration doesn't work. Solution? kill process, uninstall, reinstall and hope it will not get stuck again any time soon.

I have to test Mauser.

While I am here, can anyone recommend good alternative mouse with both smooth/quick and precision scroll like logitech's? Back and forth buttons are also a must for me, horizontal scroll optional. Ideally a mouse would save configuration onto itself, so I don't have rely on garbage software like LO+.
by theawesomekhan | 2026-03-13 22:19:34+00:00
“ While much of RTINGS.com remains free, our full test results and in-depth product analysis are now available only to members.”

“ RTINGS.com has historically relied heavily on organic search traffic from Google and affiliate links. That model is becoming less reliable. Fewer people click through from Google organic results than they used to. At the same time, AI actively scrapes and reuses our test results, often without attribution and without the context needed to interpret them correctly.”
by scoofy | 2026-03-13 22:19:52+00:00
>Somehow we managed to survive without the majority of society being scammed out of their life savings before Apple came in with the iPhone and locked down iOS

What on earth are you talking about? People have been getting scammed since the days of AOL! What an insane perspective. It's not about total money lost from scams. It's about the amount of impact it has on the individuals who get scammed. What's the problem with Russian roulette after all? Most people playing Russian Roulette are absolutely fine! The point is that the damage done to the few people who get scammed is so high, we ought to care about their lives too. At the end of the day, it might end up being us... it probably won't, but it might.

Yes, monopolistic network effects are a problem, but that can be handled with regulation.