skysight-inc/HackerNews huggingface dataset:
Show HN: Authduck – Playground Server for OpenID Connect Clients
Hey HN

I'm currently living my dream, being paid to do what I love: programming, something I've been doing since middle school for over 15 years.

In those years doing programming, I’ve always thought that OpenID Connect/OAuth for Authentication is an amazing idea that more programmers should be familiar with. Using (properly configured) SSO may be one of the best security investment made by companies. It also saves a lot of works, both for companies (by delegating user management-related features to third party) and users (by reducing friction when using new services).

However, one of the challenges I encountered when I started learning this was that setting up an OIDC/OAuth server is too much work. I think there should be a better way to let people play with OIDC than creating dummy OAuth client in Github. Then, several months ago I decided that this would be a great excuse to play with Go & HTMX.

So I created Authduck. It's an OIDC Server/Provider that you can use to test your OIDC Client. I built it with Go, Echo framework, SQLite, HTMX, Alpine. The app is available as a single executable for Linux, Mac, & Windows, although admittedly I haven’t test it outside Linux yet. Its also available as Docker image via ghcr.io .

Currently there is a public instance at https://authduck.fly.dev . You could try it against other OIDC Playground Client such as openidconnect.net or others. Currently it only support Authorization Code Flow without PKCE, but I hope to find time soon to work on supporting other flows.

I hope this simple application could be of use to many web developers out there. Please let me know what you think.

Regards,

Azophy
One feature area where Gitlab is still better for realworld stuff is CI (Gitlab CI vs Github Actions). Yes, you can do most things on both, but Gitlab CI makes a lot more sense.

In general, Github still feels like it's built for hobby coders (focusing on simplicity instead of configurability - which doesn't have to be a bad thing) while Gitlab feels like it's built for professional teams from the ground up.
They won't. Just as most modern devs can't edit assembly and would take days to write a bare bone network communcation, they won't need to learn certain things we did. And they will excell in other skills, making some old aged senior devs obsolete.
A senior that uses modern dev tool chains will allways have a huge edge. That has allways been true. But that senior relying only on their hard earned knowledge will become the kind of dinosaurs we knew when we started.
> As you get older, you start to experience more adverse health affects. You start to need medical attention more. Especially if you've been denied healthcare for the first 65 years.

Sort of: as you get older, time catches up to you. In the USA for, heart disease kills 1015/100k for both genders (see: https://usafacts.org/articles/what-are-the-top-causes-of-dea... in Germany, it is just 673/100k for just men alone. We have an obesity problem, not a healthcare problem, when it comes to life expectancy.

> Well I think you misrepresent that greener grass is greener. Other countries literally live longer and healthier when they have socialized healthcare. It's a pretty easy metric to track, and pretty straightforward. Do you want the general population to live longer? Do you want the general population to be healthier? Do you want the general population to be saddled with crippling medical debt? Sometimes the grass is greener. And we have the data to prove it.

The question here is QALYS. We quite literally avoid this discussion in the US at all (see this: https://pubmed.ncbi.nlm.nih.gov/19738253/). The issue isn't that we disagree about the issues: it's that the issues are not addressed and Americans pretty much always say "spend more".

Europe has already begun rationing, by the way (see this: https://pmc.ncbi.nlm.nih.gov/articles/PMC1831659/#:~:text=Be....) It's not as though it doesn't already occur; we simply choose to blame insurance companies instead of a national system.

> In the link you shared, other social-safety-net countries had lower spend per capita. They have a better social safety net. So how can that be the issue?

Healthier populations. Americans make awful health choices.

> At least you're honest that you own a health-insurance business and you're biased. A single-payer system would destroy your income, and I guess that's pretty scary, so it's in your best interest to fear-monger.

Not really. Margin shifts along value chains; it's rarely destroyed. All that would happen is the profits would shift to another location. Then the game becomes how to get there.
> Diamonds are possibly the biggest scam in human history.

> To the naked eye, the lab-grown diamond looks identical to a natural stone. GIA, an education and standards nonprofit founded in 1931, uses the same criteria to grade both kinds of stones, said chief laboratory and research officer Tom Moses.

> But Moses *says* he can spot the difference using special equipment: Natural diamonds *often* have a different growth structure. They also *may* have trace amounts of nitrogen trapped inside.
I find the "in 1 file" message confusing.

Does it mean sqlite, so just 1 file which is the database?
That's a fair point. I have coworkers with kids but I've noticed the lead is a workaholic (with a child) and that reflects on the rest of the team.
How did you log in to the demo when the stated credentials in the README don’t work?
I have friends who are building products from scratch using tools like Cursor. It’s impressive what someone who is already an expert developer can do. What I don’t see (yet) are these tools delivering for non developers. But this as just a matter of time.

I see a lot of devs who appear to be in a complete state of denial about what is happening. Understandable, but worrying.
Free plans don't work when the cost of providing a service is high. Google, Facebook and the like can happily give away their products for free and lose money on the bottom N% of users, because it still amounts to pennies. Netflix has high bandwidth and content licensing costs that scale per user, so they need some barrier to entry.
Sounds like a very American approach. ;)
I'm curious, if you're interviewing at a company, what's the best way to figure out of the lead/team has this balance? What kind of questions could you ask without sounding like you're trying to be lazy?
Yes. I built a tool exactly for this use case: a coding task that requires context from multiple files and edit across multiple files.

Do let me know what you think.

https://prompt.16x.engineer/
do you have examples of companies that are rational and steady?
Only if you're allowed to go home and enjoy those 1.25 hours and still get paid the same.
Perhaps because 'packing' kind of implies adding a few extras to what's already there. We can assume your conclusion is always true.
No one questions that hand made bread tastes better, just as hand crafted code will always be better in some areas.

But will we need the entire army of "coders" that we currently have?
Take a look at the latest version of cursor - its composer tool does exactly this.
Ask HN: How did Twilio go from 'Up in 5 min' to one of the longest onboardings?
I remember the first time I saw a Twilio demo for sending SMS in at an event in NYC. It was beautiful and simple.

I just tried to add SMS to an app recently, and I must say, tis not sweet as it was before. I think I even have to wait for some months, get some approvals blah blah just to send SMS using Twilio.

How and when did this happen? It is quite a terrible and arduous process now.
> Thus the rational

I think you meant rationale
Great article, Addy gets to the core of it and explains in a non-biased (pro or con), non-hype way. The examples, patterns and recommendations match what I've seen pretty well.

I've been working on an agentic full-app codegen AI startup for about a year, and used Copilot and other coding assistance tools since it was generally available.

Last year, nobody even thought full app coding tools to be possible. Today they're all the rage: I track ~15 full codegen AI startups (what now seems to be called "agentic coding") and ~10 coding assistants. Of these, around half focus on a specific niche (eg. resolving github issues, full-stack coding a few app types, or building the frontend prototype), and half attempt to do full projects.

The paradox that Addy hints at is that senior, knowledgeable developers are much more likely to get value out of both of these categories. For assistants, you need to inspect the output and fix/adapt it. For agentic coders, you need to be able to micromanage or bypass them on issues that block them.

However, more experienced developers are (rightly) wary of new hyped up tools promising the moon. It's the junior devs, and even non-developers who drink the kool aid and embrace this, and then get stuck on 70%, or 90%... and they don't have the knowledge or experience to go past. It's worse than useless, they've spent their time, money, and possibly reputation (within their teams/orgs) on it, and got nothing out of it.

At the startup I mentioned, virtually all our dev time was spent on trying to move that breaking point from 50%, to 70%, to 90%, to larger projects, ... but in most cases it was still there. Literally an exponential amount of effort to move the needle. Based on this, I don't think we'll be able to see fully autonomous coding agents capable of doing non-toy projects any time soon. At the same time, the capabilities are rising and costs dropping down.

IMHO the biggest current limit for agentic coding is the speed (or lack of) of state-of-the-art models. If you can get 10x speed, you can throw in 10x more reasoning (inference-time computing, to use the modern buzzwords) and get 1.5x-2x better, in terms of quality or capability to reason about more complex projects.
You might look into why rgba_255 return a fixed-length tuple while rgba_float returns a fixed-length list.

If it's so important to test isinstance(r, int) then you should also have tests for g and b, and likely similar tests for the floats.

Is is really worthwhile to 'Convert back to ints and compare' when you know the expected rgba floats already?
> For much of human history, knowledge was transferred orally, so maybe humans are naturally better at that.

I'm dubious of that inference: For much of human history (we are mostly unchanged from 200k years ago), we lived poorly and made no technological progress.

When all we had was oral knowledge transfer, we spent at least a couple of 100k years making no progress.

When writing was invented, progress came almost immediately.

To me it seems fairly clear that progress was basically non-existent until writing was invented. This makes me think that oral knowledge sharing is the worst form there is.
I've been saying for a while that formal verification seems like the obvious way forward here. Test cases are good but only cover a limited number of cases, whereas formal verification can cover all cases.

The biggest reason that we don't see formal verification being used more is that it takes some time to formally define the output of an algorithm and significantly more time to convince a theorem prover that your code is correct according to the pre- and post-conditions. If we can get LLMs to work well alongside formal verification tools then I think that would greatly improve their usefulness.

Here's a made up and trivial example of how I imagine this might look:

User: Write me a binary search over "type A_Type is array (Integer range <>) of Integer;"

LLM: Implementing the following:

function Search (A : A_Type; Target : Integer) return Integer with Pre => Sorted (A) and Target in A, Post => A(Search'Result) = Target;

First implementation:

function Search (A : A_Type; Target : Integer) return Integer is
Left : Integer := A'First;
Right : Integer := A'Last;
begin
while Left <= Right loop
declare
Mid : Integer := (Left + Right) / 2;
begin
if A (Mid) = Target then
return Mid;
elsif A (Mid) < Target then
Left := Mid + 1;
elsif A (Mid) > Target then
Right := Mid - 1;
end if;
end;
end loop;
end Search;

Compiler:

Phase 1 of 2: generation of Global contracts ...
Phase 2 of 2: flow analysis and proof ...

wrapper.adb:12:36: medium: overflow check might fail, cannot prove lower bound for Left + Right
12 | Mid : Integer := (Left + Right) / 2;
| ~~~~~~^~~~~~~~
reason for check: result of addition must fit in a 32-bits machine integer
wrapper.adb:12:45: info: division check proved

wrapper.adb:14:19: medium: array index check might fail
14 | if A (Mid) = Target then
| ^~~
reason for check: value must be a valid index into the array

LLM: Looks like there's a possible overflow for very large arrays, attempting new solution...

Etc. until a valid solution is found and the result is returned to the user.

As an aside, this bug was present in Java for 9 years and would have been caught by formal verification (which admittedly was more difficult at the time): https://research.google/blog/extra-extra-read-all-about-it-n...
Thinking that AI assistants are going to make programmers better, as opposed to just faster, is liking thinking hiring a paralegal is going to make you a better lawyer, or hiring a nanny is going to make you a better parent, etc. It's helpful, but in terms of offloading some things you could do yourself.
This feels like a space designed with humans in mind as opposed to a purely transitory space. It's stunning
Note the license is similar to AGPL. Don't expect to use it in any production apps, stick with Pocket base for now.
Not like most had a choice, they already had office documents and windows, what else were they going to pick?

Your historical pile of millions of MSOffice documents is an ocean sized moat.
Apache Pinot is written in Java, which is a garbage-collected language and also a rare choice for mainstream databases.

Any idea if that would affect its performance?

The last time I checked there are several databases written in Go, which is also garbage-collected, but never saw one in Java except Apache Derby.
Leadership Power Tools: SQL and Statistics
aider does this, plus there's an architect mode to help think through, well, architectural aspects
> With which I mean to say that there is a lot of nonsensical projects being done out there, that still make a living for many people.

I don't know why this is a bad thing. I don't think projects that you believe are nonsensical shouldn't exist just because of your opinion, especially if they're helping people survive in this world. I'm sure the people working on them don't think they're nonsensical.
That sounds like a horrible environment to work in. How’s your senior dev retention?
What do you mean? Would you please elaborate on that?
A good point, but unfortunately we're going to need to get used to the new paradigm.

The LLM costs a minute fraction of the cost of employing a human junior developer.
This is what metrics are for
> This is the system Americans have chosen.

Said more accurately: this is the system chosen for Americans, against many of their wishes, by the officials some of them elected.
Introduce a new event in a Lua hook mechanism
That's also so cool we are getting externally validated!
https://x.com/MinisterOfEng/status/1864793214282019065
My kudos to MinisterOfEng!
> because the US doesn't need monopolies

They seem to love them very much, though. (Microsoft, Google, Apple, Facebook)
GitLab has accepted my patches…do you have a timeline for when Github will do the same? Sure, maybe the directions are different, but the baselines couldn't be more different either.
You made a very specific time prediction. Claiming something will happen eventually is an entirely different thing.

We all expect just about every technology to get better eventually, but you may notice some things seem to be taking decades.

Edit: realized I replied as if Nevermark was the source of the first post, so just note that's not the case.
Cynomania perhaps?
Gitea became for profit, there's still a non profit fork called Forgejo which has become fairly popular
I used Valtio for a guitar pedal librarian program recently and it's fantastic. Had zero issues with proxy state, it all "just worked".
Short term memory post-it wristwatch?
Often I find that my short term memory fails.

For example, when driving to the store I think of something I want to buy.
When I get to the store I can't remember it. Or I need to get something
from my basement and because I got interrupted on the way I forgot what
I wanted.

What we need is a simple "wristwatch" device that acts like a simple post-it
note with a button to record a couple words (e.g. buy bread), a button to play back the words, and a button to clear the words. The device should hold up to
20 messages.

Surely someone is capable of making this.

Note that a wristwatch form factor means I don't have to carry my phone
and play with an app.
It’s policy. Doha airport was designed by a company in St Louis. Doha airpot is a masterpiece and St Louis airport is a garage.
And De Beers is spending lots of money to try and turn the public against them.

Here's a random De Beers ad campaign touting the supremacy of "natural diamonds" – https://www.youtube.com/watch?v=LlapaTCpa78

> 'Worth the Wait' is a fresh, authentic campaign connecting the journeys of ‘Zillennial’ couples who are leading the engagement recovery. The campaign captures the incredible journey that natural diamonds take as the ultimate symbols of modern love.
When are they releasing chatgpt bro?
Given the smaller size and fact that you can smoke weed, it's better
This is why metrics rule and logging in production need only be turned on to debug specific problems and even then have a short TTL
Well the time isn't wasted - you get code! In my experience even with the added work of checking the AI's output, overall it is faster than without coding assistants.
It means the application compiles down to one binary.
As a Jetbrains AI user I think it’s great.

I don’t ever use the code completion functionality in fact it can be a bit annoying. However asking it questions is the new Google search.

Over the last couple of years I’ve noticed that the quality of answers you get from googling has steeply declined, with most results now being terrible ad filled blog spam.

Asking the AI assistant the same query yields so much better answers and gives you the opportunity to delve deeper into said answer if you want to.

No more asking on stack overflow and having to wait for the inevitable snarky response.

It’s the best money I’ve spent on software in years. I feel like Picard asking the computer questions
Currently, this is my favorite test prompt for AI coding tools:

Make a simple HTML page which
uses the VideoEncoder API to
create a video that the user
can download.

So far, not a single AI has managed to create a working solution.

I don't know why. The AIs seem to have an understanding of the VideoEncoder API, so it seems it's not a problem of not having the infos they need. But none comes up with something that works.
Compression is only ever as good as the information it is given, if given text, it can do an OK job using general entropy encoding. However, most data is not text, even log data is not text. Log data is timestamps, numbers, enums, indices, guids, text, etc. Each of those categories, combined with how they are layed out, can be compressed in different optimal ways, resulting in different optimal compression ratios based on your specific log format. As a simple example, compressing 3D meshes as meshes is an order of magnitude better than compressing 3D meshes as text.

Sure, zipping your logs gives you a LOT, and you should do it, but if the result disappoints it is not the end of the road, at all.
> , Apple having without a doubt the best consumer processor

too bad it doesn't run (properly) other OS. than Apple's
Reminder that the US is so big and has a weak federal government, that there can be dramatic differences between states.

Hawaii: 81.0 (highest)

Mississippi: 71.9 (lowest)

Unfortunately, even Hawaii is barely above average compared to EU countries.
You can (Github Enterprise)!
It's horrible, absolutely terrible! No one would ever want to live there! Please, do not move there! /s
>36% use the same credentials for personal and professional accounts

Does Big Tech even allow multiple accounts? When watsapp asks a phone number to register, what do you type?
Same here. We had a very fragmented landscape (multiple idp tools, some tools using internal users,...). We consolidated everything to entra (450 apps and counting) and everybody couldn't be happier. Full sso on everything + scim where available.

We do offcourse have conditional access + PIM for admins but that is to be expected.

You just need a good strategy on how you are going to tackle IAM and then just stick to it.
> None of the sources you quote is RTE.

You didn't watch or understand them. The first thread referenced, on x.com, offers a link towards https://www.youtube.com/live/xP4jL4b_Nnk?si=P4X_qMV9vtkpVD7z...
This guy is RTE's official representative. Please listen to what he says, and let me know whether you persist to deny or reckon.

> merit order

A technical merit order, established to optimize and therefore to prefer the most adequate (overall) source. It is enforced for ages and for all sources, it isn't some arbitrarily established rule aiming at hurting poor nuclear lil'baby. If nuclear cannot compete it will disappear. The processus already started.
It's not unnecessary if you don't want to write and maintain a backend. Single page apps are easily statically hosted on a CDN. They don't run, they can't go down. They can use a server less platform API like Firebase and Supabase. They can be hosted for free at low traffic. Compare with rolling, monitoring and maintaining your own server, ssh-ing if it goes down, dealing with auth, containers, VMs etc.
Going from punched cards to interactive terminals surely must have been a big productivity boost. And going from text based CAD to what is possible on modern workstations has probably also helped a bit in that field.

In that view I'd say the productivity boost by LLMs is somewhat disappointing, especially with respect to how amazing they are.
Office Hours | Senior/Staff Software Engineer | Hybrid (SF/NYC) / Remote (US) | $160k-$210k + equity | https://officehours.com

We're a consulting platform and marketplace.

On one side (demand), we help businesses (consultants, investors, and startups) find, connect, and learn from experts. On the other side (supply), we help make it easy for experts to get paid to share what they know.

Similar to Uber or Airbnb, things are simple on the surface: search, match, connect, and pay. But under the hood, there are fun and challenging engineering problems across search, discovery, recommendations, data, logistics, payments, and performance.

We're looking for an experienced (5+ years) backend engineer to help us solve them. The ideal candidate will likely be a generalist with a lean towards past data engineering or search/recommendation experience.

Our small, tight-knit, driven, curious, and collaborative team has built a robust, high-quality platform. If you're interested in helping us scale it up, apply using the link below.

https://bookofficehours.notion.site/Senior-Software-Engineer...
Bar is 2.
i enjoyed full spread magazine ads no matter what the content. feels like history but you are on to something
> But for a dedicated and loyal coworker, I'm willing to sacrifice some of my productivity

probably the more we sacrifice of our own productivity the quicker they gain experience (and seniority) right? the only confusing thing that confused me personally in your statement was that they would have to be loyal. Isn't that something that one can only hope but must be proven over time. Meaning that at the time you trust that they turn out well you have no way of proving that they are "loyal" yet. Loyalty is nigh impossible to request upfront? I mean, ... you have to deserve it. And a lot can also go wrong on the way.