MurphyA/hacker-news huggingface dataset:
by jghub | 2026-03-06 10:53:02+00:00
To answer your specific questions on shell integration:

cd - behavior:
It undoes the last directory change irrespective of whether you did it with builtin cd or via sd. If you do "sd project-a" and then "cd -", you go back to where you were before. The sd function is a "thin" wrapper that ultimately executes "command cd <pathname>", so it respects the shell's native $OLDPWD logic perfectly.

pushd and "odds":
In its current implementation, sd only records a visit when you specifically use the sd command (or its cd alias) to move. If you use pushd or popd directly, sd isn't invoked and doesn't "see" that movement. This keeps manual stack operations entirely separate from the automated ranking. To be clear: the shell managed pushd/popd stack is distinct from the dynamic score-sorted directory stack maintained/utilized by sd. Personally I simply do not have any more use for the former so would argue that sd not seeing cd actions initiated by push/popd is not an issue for the tool.

pushd replacement:
sd doesn't replace pushd/popd/dirs. Think of pushd as a manual bookmarking system and sd as a temporal index. They coexist: pushd is for explicit, manual stack management (presuming you still want/need it in addition to sd), while sd is for "get me to this project's source" jumps using shorthand.

The design goal is to be a "well-behaved citizen" of the shell. It doesn't break standard invariants; it just adds a shorthand layer that requires zero manual maintenance.
by pranshuchittora | 2026-03-06 10:53:08+00:00
Hey HN

I've been building mobile apps for half a decade. There are so many moments where you need to quickly check something — how does this screen look on a 12-inch device? Does the layout break in German where translation strings are twice as long? Does the geo feature work when the user is in Tokyo?

Then there's the everyday stuff — clearing app data to re-test onboarding, installing a fresh build on three devices at once, toggling dark mode to check contrast, sending a test push notification with a specific payload, grabbing screenshots for the App Store listing, checking what's actually in the local SQLite database when state looks wrong.

Each of these is a few terminal commands, a trip to Xcode/Android Studio, or some menu buried three levels deep. Over the years I wrote a lot of bash scripts. Then bash aliases. Then more scripts to chain the aliases together.

To consolidate all of that and make the DX actually pleasant, I built Simvyn — a local web dashboard + CLI that wraps simctl, adb, and devicectl into one interface. npx simvyn starts it up, discovers all your iOS Simulators, Android Emulators, and USB/WiFi-connected devices, and gives you everything from one place. No SDK, no app-side changes — works with any framework.

Try now > npm simvyn

If you've ever rage-typed adb commands at 2 AM, a star would mean a lot :)

GitHub - https://github.com/pranshuchittora/simvyn
by mlrtime | 2026-03-06 10:53:28+00:00
Lobbyists do not always mean minority. I'm sure it looks like that from the outside.

There are all kinds of laws that people don't like, me included. With every law there will be some winner/loser trade-off (for lack of better word). As OP said, that is society.

If the people here were so passionate about it, they would help come up with a better solution, not a "f* off" comment.
by Avamander | 2026-03-06 10:54:25+00:00
You take it too personally and if anyone is angry it's you. Listing shortcomings of a project is not "attacking", it's juvenile to think so. Shortcomings you refused to admit and your "explanations" were fundamentally misguided and incorrect. You eventually just resorted to FUD and blocking instead of actually looking at DNSSEC and DANE and the issues it has.

DNSSEC is a *bad* PKI, with infallible roots of trust, terrible adoption rate and horrible transparency. If someone misbehaves, you will have no idea, there will be no recourse and absolutely nobody is enforcing any standards on how things should be ran.

Bringing DMARC and phishing into this topic is a desperate grasp at straws if I have ever seen one.

DNSSEC defenders should actually know what they're talking about first.
by sd9 | 2026-03-06 10:54:44+00:00
I agree. I've got more lazy over time too. But the cost of creating code is so cheap... it's now less important to be perfect the first time the code hits prod (application dependant). It can be rewritten from scratch in no time. The bar for 'maintainability' is a lot lower now, because the AI has more capacity and persistence to maintain terrible code.

I'm sure plenty of people disagree with me. But I'm a good hand programmer, and I just don't feel the need to do that any more. I got into this to build things for other people, and AI is letting me do that more efficiently. Yes, I've had to give up a puritan approach to code quality.
by truetraveller | 2026-03-06 10:54:59+00:00
OK, it's not just RESEARCH, but "RESEARCHability" of the source content [in this case code], and also critical analysis ability [not saying you are deficient in anything, speaking in general terms].

In this example, if the 25 files are organized nicely, and I had I nice IDE that listed class/namespace members of each file neatly, I might take 30 minutes to understand the overall structure.

Morever, If I critically analyzed this, I would ask "how many times does this event of summarizing 25 files happen"? I mean, are we changing codebases every day? No, it's a one time cost. Moreover, manually going through will provide insight not returned by LLM.

Obviously, every case is different, and perhaps you do need to RESEARCH new codebases often, I dunno!
by mihaic | 2026-03-06 10:55:46+00:00
> If you wish to invite yourself into their responsibilities shouldn't you also invite yourself into their bedroom first?

You're turning of question of measure (how much should society be involved in raising children) into an all or nothing debate, which I explicitly want to reject.

> Does that actually work?

Yes, because of mass education almost every adult you meet can read and write, something new for the last 100 years. Just because a system has (currently huge) faults, doesn't mean we should remove the system entirely.
by Xelbair | 2026-03-06 10:56:00+00:00
Exactly the same way as i do now for such laws.

It's pointless, does not increase security, does increase complexity of every interaction, and introduces a lot of weird edge cases.

What i want is full anonymity enshrined in law, while at the same time giving parents, not governments, but parents, options to limit what their children can do on the internet.
by erk__ | 2026-03-06 10:56:23+00:00
The history section of the repo clears it up [0]

> LibreSprite originated as a fork of Aseprite, developed by David Capello. Aseprite used to be distributed under the GNU General Public License version 2, but was moved to a proprietary license on August 26th, 2016.

> This fork was made on the last commit covered by the GPL version 2 license, and is now developed independently of Aseprite.

Also I am not really sure if you can convince me that this is a open source license: https://github.com/aseprite/aseprite/blob/main/EULA.txt

Not that it is a unreasonable license, but it is not open source.

[0]: https://github.com/LibreSprite/LibreSprite?tab=readme-ov-fil...
by HiTechK | 2026-03-06 10:56:25+00:00
Hi HN,

I'm the maker of VibeSing. I wanted to build something that moved away from the "AI as a professional tool" narrative and towards "AI as a social toy."

VibeSing lets you clone your voice and immediately hear it on global trending tracks from around the world. We pull real-time charts via the iTunes API and run the voice conversion through a custom RVC (Retrieval-based Voice Conversion) pipeline.

Technically, the challenge was handling the audio processing (stem splitting, pitch shifting, and voice conversion) while keeping the UX fast enough for social sharing. We settled on generating 30-second high-quality clips optimized for mobile sharing rather than full-length studio covers.

We use:

- Next.js for the frontend/API.

- Replicate for RVC model hosting.

- iTunes Search API for trend discovery and preview assets.

- FFmpeg for final assembly and watermarking.

We’re curious about how you see the intersection of generative AI and social music. We’d love to hear your feedback on the output quality and the "Band Mode" multi-voice concept.

Check it out at www.vibesing.me
by matja | 2026-03-06 10:57:01+00:00
The actual RAM chips on a ECC DIMM are exactly the same as a non-ECC DIMM, there's just an extra 1/2/4 chips to extend to 72 bit words.

The main reason ECC RAM is slower is because it's not (by default) overclocked to the point of stability - the JEDEC standard speeds are used.

The other much smaller factors are:

* The tREFi parameter (refresh interval) is usually double the frequency on ECC RAM, so that it handles high-temperature operation.
* Register chip buffers the command/address/control/clock signals, adding a clock of latency the every command (<1ns, much smaller than the typical memory latency you'd measure from the memory controller)
* ECC calculation (AMD states 2 UMC cycles, <1ns).
Malicious NPM package pino-SDK-v2 exfiltrates .env secrets to Discord
by Sudhanshu2310 | 2026-03-06 10:57:29+00:00
We just analyzed a fresh supply chain attack on npm that's pretty well-executed.

Package: pino-sdk-v2
Target: Impersonates pino (one of the most popular Node.js loggers, ~20M weekly downloads)

Reported to OSV too- https://osv.dev/vulnerability/MAL-2026-1259

What makes this one interesting:
The attacker copied the entire pino source tree, kept the real author's name (Matteo Collina) in package.json, mirrored the README, docs, repository URL so everything looks legitimate on the npm page.

The only changes:
- Renamed package to pino-sdk-v2
- Injected obfuscated code into lib/tools.js (300+ line file)
- No install hooks whatsoever

The payload:
Scans for .env, .env.local, .env.production, .env.development, .env.example files, extracts anything matching PRIVATE_KEY, SECRET_KEY, API_KEY, ACCESS_KEY, SECRET, or just KEY=, then POSTs it all to a Discord webhook as a formatted embed.

The malicious function is literally named log(). In a logging library. That's some next-level camouflage.

Why most scanners miss it:
- No preinstall/postinstall hooks (most scanners focus on these)
- Executes on require(), not during install
- Obfuscated with hex variable names and string array rotation

Trusted metadata makes the npm page look legit

If you've installed it:

Remove immediately and rotate all secrets in your .env files. Treat it as full credential compromise.

Full technical analysis with deobfuscated payload and IOCs:
https://safedep.io/malicious-npm-package-pino-sdk-v2-env-exfiltration/
by strogonoff | 2026-03-06 10:57:32+00:00
Here’s what you could do if you somehow found yourself with an LLM-generated change to a codebase implementing a feature you want, and you wanted to do the most do expedite the implementation of that feature.

1. Go through all changes, understand what changed and how it solves the problem.

2. Armed with that understanding, write (by hand) a high-level summary of what can be done and why to implement your feature.

3. Write a regular feature request, and include that summary in it (as an appendix).
by matrixgard | 2026-03-06 10:58:04+00:00
The stack you're describing (multi-cloud Terraform across AWS/GCP/Azure handling law enforcement evidence) is genuinely complex to secure from the ground up — especially with the compliance exposure that comes with CJIS-adjacent data.

One thing worth thinking about before the new hire starts: the first infra person at a bootstrapped company almost always walks into cloud credentials that are broader than needed and Terraform state that's never had a security pass. Getting a baseline done before onboarding gives them a clean starting point and avoids inheriting someone else's decisions as their first task.

Happy to talk through the infra side if useful — I work with teams at this stage on exactly this.
by sombragris | 2026-03-06 10:58:32+00:00
Congrats to all the TeXLive team on a new release.

If you're stuck on something LaTeX related, remember there's the latest edition to The LaTex Companion. It even has an appendix explaining the (in)famously cryptic LaTeX/TeX error messages:

https://latex-project.org/help/books/

There's also, among other resources, the great LaTeX Font Catalogue:
https://tug.org/FontCatalogue/

Enjoy the new release!
by matrixgard | 2026-03-06 10:58:43+00:00
Multi-cloud Kubernetes at scale (AWS + Azure simultaneously) is one of those setups where IAM boundaries and secrets management tend to drift faster than the team realizes — each cloud has its own identity model and they don't map cleanly to each other, so the blast radius from a misconfigured service account is usually larger than anyone expects.

Worth doing a security pass on the existing setup before new platform engineers inherit it as the baseline. Distributed teams expanding across regions amplify this fast.

Happy to talk through the infra security side if useful — this is the kind of work I do with teams at this stage.
by benrutter | 2026-03-06 11:00:18+00:00
Intel is definitely the exception. For most companies, like Nike or Apple to take two, they in-house design work, but then contract out manufacturing to external companies, who often themselves subcontract out work further.

I'm speculating now, but it seems really likely if that type of distributed supply chain didn't exist, we'd see a closer coupling of design and manufacturing (at an extreme end factories designing and producing their own product).

That outsourcing of manufacturing has let US companies like Nike and Apple stay dominant in the design field, despite almost all their manufacturing being carried out by Asian companies.

Ultimately the global economy is very complicated, but a lot of it is predicated on that design/manufacturing split, which is only enabled by distributed manufacturing contracted out by brands.

I'm not trying to argue any of this is good/bad, but just that the concept of a 'brand' plays a huge function in determining what the world economy looks like, and isn't an empty concept.
by mihaic | 2026-03-06 11:00:19+00:00
I was born in a communist country in Eastern Europe, which is now crony capitalist. The issue is extremely complex, and all I can say in such a short paragraph is that ideologically-driven implementations are doomed to fail. It doesn't matter if you believe in "free-market", "the state", "free-speach", "socialism" or "equality", if you put these above the concrete reality of modern parenting, and how much harder it's getting compared to previous generations.
by Voklen | 2026-03-06 11:01:08+00:00
It's unclear, but it seems like this was someone testing to see if this exploit would really work. From the article:
> The severity was debated - Endor Labs characterised the payload as closer to a proof-of-concept than a weaponised attack - but the mechanism is what matters. The next payload will not be a proof-of-concept.

But it does seem odd not to use an actual payload right away.
by dist-epoch | 2026-03-06 11:01:18+00:00
The environmental impact of AI replacing a human programmer is orders of magnitude lower than the environmental impact of that programmer. Look up average US water consumption and CO2 emissions per capita.

And then add on top the environmental impact of all of the money that programmer gets from programming - travels around the world, buying large houses, ...

If you care about the environment, you should want AI's replacing humans at most jobs.
by mirsadm | 2026-03-06 11:02:03+00:00
I have an app which is fairly popular. This release cycle I used Claude Code and codex to implement all the changes / features. It definitely let me move much quicker than before.

However now that it's in the beta stage the amount of issues and bugs is insane. I reviewed a lot of the code that went in as well. I suspect the bug fixing stage is going to take longer than the initial implementation. There are so many issues and my mental model of the codebase has severely degraded.

It was an interesting experiment but I don't think I would do it again this way.
Show HN: Markdown-to-Book – Convert Markdown to KDP Ready PDFs and EPUBs
by vpuna | 2026-03-06 11:02:44+00:00
Author here. I'm a software engineer who started writing hard science fiction on the side. I built this tool because I wanted to write in plain Markdown and go straight to Amazon KDP without touching Word, InDesign, or Vellum.

The workflow: I write stories in .md files, one heading per chapter, --- for scene breaks. When I'm ready to publish, I run one command and get a paperback PDF, hardcover PDF, and Kindle EPUB with correct margins, typography, and scene breaks. The tool wraps Pandoc and XeLaTeX with a custom LaTeX template and a Lua filter that handles the scene break conversion. Commander.js is the only Node dependency.

I used this to publish my first novelette, a hard sci-fi story called "The Pull" about an astrophysicist mapping the Zone of Avoidance behind the Milky Way. The science in the story is grounded in real astrophysics (the Great Attractor, large scale cosmic flows, the Zone of Avoidance). I also built an author website at 'alanvoss.me' with Next.js and Payload CMS, deployed as a static site on Vercel, where you can read the first chapter and see the characters.

On AI use and Graphics: The story concept and science are mine. I used Claude Opus 4.6 to help with some character dialogue and for grammar and spelling checks. Character portraits on the website were generated with Midjourney and OpenAI image models. Book covers were made in Canva.

The tool itself is simple (~200 lines of JS), but it solved a real problem for me. The KDP margin requirements are fiddly, especially the difference between paperback and hardcover inner margins, and getting scene breaks to render correctly in both LaTeX and EPUB needed the Lua filter approach. Hopefully useful to other developers who write.

Please let me know if you have any questions about the tool, the publishing process, or KDP in general.
by i_think_so | 2026-03-06 11:04:23+00:00
Is that problem even fixable with what one might call normal means?

I presume it can't be with mere prompting, otherwise every single model would already include "Don't lie and don't make things up. If you don't know an answer, just say so."

It seems to me that the underlying algorithms would be inclined to confabulate simply because that's what LLMs do. But that's a bit beyond my math and programming understanding to say for certain.
by benrutter | 2026-03-06 11:04:31+00:00
I suppose we're just disagreeing on definition here - but I'd at least try to make the case that if people having a single thing they think of when they hear the word Nike, is necessary for a company to be able to structure itself that way legally.

Otherwise, individual manufacturing companies, don't have the financial incentive to give companies like Nike as big a portion of the profits as they do. Currently that system works, because the brand association of "Nike" gives people some kind of status/quality-assurance/whatever that they are happy to pay for.
Show HN: OxiLean – Pure Rust Interactive Theorem Prover (Zero C Deps, WASM)
by kitasan | 2026-03-06 11:04:46+00:00
Hey HN,

Just dropped v0.1.0 of OxiLean yesterday.

It's a full Interactive Theorem Prover written 100% in Rust (1.2 million lines across 11 crates). Inspired by Lean 4, implements Calculus of Inductive Constructions, universe polymorphism, dependent types, full tactic framework (intro/apply/simp/ring/omega etc.), and even LCNF-based codegen.

Key points that actually matter:
- Kernel has literally zero external crates and zero unsafe. Memory-safe by design, no unwraps, explicit errors everywhere.
- Runs in the browser via WASM (npm package @cooljapan/oxilean ready).
- REPL works out of the box: cargo run --bin oxilean
- No C/Fortran anywhere — unlike original Lean.

Repo: https://github.com/cool-japan/oxilean

WASM demo snippet in README if you want to play instantly.

On my machine I've already proven 99.24% of MathLib4's 179,668 declarations (aiming for 100% in 0.1.1 soon). Been grinding this because I got tired of C++/OCaml build hell in formal methods tools.

Curious what you think — especially if you're into formal verification in Rust or using Lean.
by jagged-chisel | 2026-03-06 11:04:52+00:00
This is the correct understanding. Go back to the selfie of the monkey. Is the monkey the creator of the photo? Does he own the copyright? No. The photographer who created the opportunity for the monkey to take the selfie is the holder of the copyright on that image.

Similarly, the operator of the LLM is the holder of the copyright of the LLM’s output.
by mikkupikku | 2026-03-06 11:04:59+00:00
"Bring your own tools" is not exactly novel in the workplace. Maybe so for office workers, but not more generally. Anyway, these particular tools are cheap enough that it hardly even matters who is expected to pay for them.

The $20 a month tier in particular is a trivial expense, on par with businesses that expect their workers to wear steel toed shoes. Some may give workers a little stipend to buy those boots, some not. Either way, it doesn't really matter.
by b3lvedere | 2026-03-06 11:05:29+00:00
I don’t really mind age verification, since we do it in real life (outside the internet) constantly for products and services that are meant for adults, like some-rated movies and alcohol.

I do mind a lot of the data process. I do not want my id, personal preferences or any metadata of my self stored anywhere ever. And IF by some weird law some process has to store some data somewhere of me, i want to have very easy full access to it so i can delete it whenever i want. You can keep the process itself but anything else has to go.

Yes, i have a passport. Yes, it was verified and validated. No you may not know or store the color of my eyes.

I also do not want curious kids to be prosecuted for poking around. They should teach them and thank them for finding flaws.
by capacity_guy | 2026-03-06 11:05:46+00:00
I'm 71. ADHD and dyslexic. I've been building enterprise systems for 45 years — mainframes to web apps.

Two years ago I built a CBT-I sleep app. It failed.

The failure wasn’t technical. It was cognitive. I designed a tool that assumed users had full executive function available when they used it. They didn’t. When people are depleted, working memory narrows, inhibition weakens, emotional reactivity increases, and sequencing suffers — exactly when structured tools demand those abilities.

That got me thinking: most productivity tools and corporate training assume optimal cognitive state.

But professionals rarely operate in optimal state all day.

So I built a simple model around four capacity states (Green, Yellow, Red, Shutdown). The core claim is:

An hour of cognitively demanding work in a depleted state produces less net value than an hour in a resourced state — and in some cases introduces negative value through rework or error.

To make that concrete, I built a calculator that estimates annualized loss based on:

* Salary (or value of time)
* Estimated hours spent in each state
* Estimated efficiency degradation %

The default degradation values (20% / 35% / 60%) are derived loosely from cognitive load and sleep restriction literature, but they’re obviously simplified.

What I’m looking for:

1. Are the degradation assumptions directionally sane?
2. Where would this model break down for engineering work?
3. Is there better literature on state-dependent productivity loss that I should be using?

I’m not looking for signups. I’m looking for holes in the model.