news.ycombinator.com
Show HN: Probus, AI vuln scanner (PRs merged in Vercel AI SDK, n8n, LangGraph)https://news.ycombinator.com/item?id=48022411Hi HN, I've been running this on my own dependency tree for the past few months. Probus is a vulnerability scanner that uses three agents. One picks the files worth deep-scanning. One writes raw findings. The third reads the code on its own and rejects any finding that doesn't have a real attack vector. While building it I pointed it at projects I use day to day. Bugs that came out of this and got reported as PRs:n8n: password-reset JWTs being logged at debug level (n8n-io/n8n#29405) Vercel AI SDK: role: "system" injection in createAgentUIStream, a runtime schema bypass in ToolLoopAgent, and a prototype-property collision in getMediaTypeFromUrl (vercel/ai#14749, #14750 merged, #14751 merged) LangGraph.js: NoSQL injection in MongoDBSaver via unvalidated thread_id / checkpoint_ns / checkpoint_id types (langchain-ai/langgraphjs#2353) browser-use: path traversal in remote-fetched templates.json fields (browser-use/browser-use#4777) Haystack: SSRF and arbitrary file read via unrestricted OpMay 5, 2026 1:39 PM
bing.com
Dad’s book offers life lessons for Raiders’ Treydan Stukeshttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8d135d97624d128ae07eb6c71d6834&url=https%3A%2F%2Ftucson.com%2Fsports%2Farizonawildcats%2Ffootball%2Farticle_9fb0cd51-54c8-424c-b70d-e5161fbb26cc.html&c=15037075445168500392&mkt=en-usLAS VEGAS — Treydan Stukes couldn’t help but read the words in his dad’s voice. It was the same affirmations and lessons the Las Vegas Raiders' second-round draft pick had been hearing in his home his ...May 5, 2026 8:01 AM
bing.com
Donkey Kong Bananza's Next DLC Event is Right Around the Cornerhttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8b614466694c57a56047255db8b9f7&url=https%3A%2F%2Fgamerant.com%2Fdonkey-kong-bananza-dlc-event-may-2026%2F&c=4630705472925483538&mkt=en-usMarc Deschamps has been writing about video games and popular culture for more than a decade. A reporter at GameRant, Marc has also been published at sites like IGN, Nintendojo, and ComicBook. Gaming ...May 5, 2026 1:30 AM
github.com
Show HN: Kanban-CLI – a web UI for local Markdown todo listshttps://github.com/Vochsel/kanban-cliAs we all are, I've been experimenting with ways to reduce external saas spend, and continually bring traditionally external pieces of context (prs, docs, trello boards) into the one mono repo.I have toyed with a markdown todo list and setting claude/codex into a "ralph" loop previously, but always missed the web ui for organising, planning, and tracking things in progress.So codex and I build kanban-cli, an installable or npx-runnable cli util that takes one or more markdown files, and uses markdown headers and todo syntax to track and manage agentic tasks.Let me know your thoughts, or if you've got a more convenient way of managing tasks!I was tempted to link to the project landing page https://kanban-cli.vochsel.com as I made a cute example demo, but linking to the repo felt less self-promo-y.Cheers!May 5, 2026 12:28 AM
allbsides.com
Show HN: I indexed 8,643 BSides talks across 227 chapters and 6 continentshttps://allbsides.com/Hi HN,I'm Roland, and for the past few weeks, I've been building AllBSides — a directory of every BSides conference talk uploaded to YouTube. As of today, 8,643 talks from 5,927 speakers across 227 chapters in 68 countries. Combined runtime is 280 days. The transcripts come to about 60 million words.The archive came together in stages:1. Manually map every BSides chapter's YouTube channel 2. Pull every video and transcript from Supabase 3. Run each transcript through Haiku for tag extraction (tools, topics, difficulty, team, talk style, research method, and much more) 4. Run results through Sonnet for categorization and dedup 5. Final pass goes through Opus for verification 6. Do a manual verification - at one time, the pipeline showed over 16k AI suggestions for manual verification. Today, most are resolved.Total LLM cost so far: about €200. The whole pipeline is rebuildable from scratch.Each talk gets its own page with embedded video, full transcript, speakers, tags, and "related talMay 4, 2026 10:10 PM
github.com
Show HN: The Rouge is my attempt at an AI product factoryhttps://github.com/gregario/the-rougeI named the Rouge after Ford's River Rouge complex, it took in raw materials and popped out Model A's at the other end. I've been trying to build the AI equivalent; ideas come in one end, and an MVP pops out the other.It has a UI to manage projects and the "catalogue" of capabilities the Rouge has to build with. Building a project has two phases: Spec involves some or all of the following, depending on how big the project is: brainstorming, competitive research, taste evaluation, specs (writes up the user stories the loop tackles one at a time), infrastructure decisions (for the foundation step), design system, legal docs, marketing copy. Each of these disciplines has its own prompt, outputs, and quality gates.Build is then an autonomous build/evaluate/fix loop until it ships. I took inspiration from Karpathy's autoresearch for the build loop. Rouge takes one story at a time, builds it, and then tests it when built. The work is tracked on disk between these loops.The tests are externalMay 4, 2026 4:29 PM
news.ycombinator.com
Ask HN: Is a hands-off, family-friendly, de-Googled "home lab" feasible?https://news.ycombinator.com/item?id=48009180I finally got a kick in the pants. I now need a new AC2200 access point for my Google Wifi 5 mesh. Which is no longer sold. And Google decided to make Wifi 6 non-backwards-compatible. So I can either:1) Find one on eBay and try to keep an unsupported system limping along.2) Finally put in the time to set up something under my control.Several things have been bugging me:* The complexity & expense - but mostly complexity - of streaming video in 2026.* The looming worry that one random whim from Google could wipe out my most valuable data (the photos & videos of my kids growing up).* The overall awfulness of the Google Home app & the unreliability of Google Home devices, like speakers.* The amount of personal & family data I implicitly share with Google by just living our regular, daily lives.Someone, somewhere has built exactly the sort of setup I want, and there's a good chance they're on HN. There're probably several "unknown unknowns" that I'm blind to, so I'd appreciate any tips fromMay 4, 2026 2:23 PM
bing.com
LSU DL Lamar Brown Sends Recruiting Pitch to Top Recruit in the 2027 Cyclehttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8d2e675eea4909ab6b7231231266ee&url=https%3A%2F%2Fwww.si.com%2Fcollege%2Flsu%2Frecruiting%2Flsu-dl-lamar-brown-sends-recruiting-pitch-to-top-recruit-in-the-2027-cycle&c=10499269583871491376&mkt=en-usThe LSU Tigers have been heating up on the recruiting trail, and getting back to their roots of landing some of the top talent around the country to play in the purple and gold. The newest addition, ...May 4, 2026 6:01 AM
github.com
Show HN: I modeled Peru's 1993 Constitution as a Git historyhttps://github.com/Duvet05/Constitucion-Politica-del-PeruThe 1993 Peruvian Constitution has been amended 36 times. Those amendments are normally buried in PDFs and official gazettes.This repo treats each reform as a Git commit with the real promulgation date, so git blame constitucion.md shows the exact law that introduced or changed each line.A few things that came out interesting: - Three laws from 2021 (31280, 31304, 31305) were struck down by the Constitutional Court. They show zero lines in blame — the court ruling appears as a revert commit. - Alberto Fujimori's signature was removed from the constitution in 2000 by Law 27600. Law 32265 (March 2025) restored it. git blame attributes lines 1–4 to that 2025 law. - The right to water (Art. 7-A) is attributed to Law 30588, 2017. The right to free internet (Art. 14-A) to Law 31878, 2023.The reconstructed public history branch is here: git clone --branch history https://github.com/Duvet05/Constitucion-Politica-del-Peru.gi...May 3, 2026 7:20 PM
scanon.ai
Show HN: A Privacy tool that finds and hides sensitive data in phtots/videoshttps://www.scanon.ai/HI HN!First time poster here, but I feel that my product is finally ready to showcase to HN. Me and my team built an amazing privacy tool that uses computer vision to analyze, detect, and hide sensitive data in photos or videos. It detects the identifiable visual data (faces, license plates, tattoos, phone numbers, etc.) and applies a blur effect over them to remove them from sight automatically!Right now it only works on faces, we are working to add license plates but the biggest milestone for us has been video support. We just added it and even though it is getting better and improving it is a huge step forward, as it is about 1000x harder than processing an image.We are currently searching for concrete PMF with business and creator niches, but we would love any feedback the community can provide!We made it 100% anonymous, with no personal data required for signup, in memory processing only, and zero photos and videos stored! Privacy is our focus. Just create a password and your accoMay 3, 2026 6:09 PM
news.ycombinator.com
Year old Nepali and unemployed, any advice for me?https://news.ycombinator.com/item?id=47998200I am in a spectacular situation.I graduated from CSE degree a bit late. I was 24 by the time I graduated. Then I worked in private firm for 2+ years.Then I quitted my job to prepare for Government IT jobs because they were stable, gave a Officer Level role for someone who is a BTech graduate.It has been 9 months since I started studying.Although I have little bit of savings, I was living with my parents.The household situation got really toxic with my father and I moved to my uncle's house(based on my mother's suggestion and coordination with uncle).I have been staying at my uncle's house for 4+ months.All I have been doing is studying for government job in this free time.The problem is whenever they see me playing in my free time, the aunt feels "Oh look he is wasting time". I do not think they are wrong to feel so. In no other countries of the world would anyone feed someone for free for 4+ months.Now I am done with syllabus. And the expectations from my parents and uncle(specially tMay 3, 2026 3:53 PM
github.com
Show HN: Diom – Backend primitives (queue, rate limit, etc.) in one Rust binaryhttps://github.com/svix/diomHey HN, my name is Tom and I'm the founder of Svix. We've been working on Diom (https://diom.com) for the last 6 months, and I'm excited to finally share it on HN!Diom is a single Rust binary that replaces Redis, RabbitMQ, Kafka, and a lot of custom code for many common use-cases. It's open-source, self-contained, and has no external runtime dependencies.While building Svix, we had to reimplement the same backend primitives that everyone reimplements when building a service: robust caching, rate-limiting, idempotency, and more. We also constantly felt the tension between building something custom on top of existing infra (like Redis and Postgres) and adding more dedicated services (like RabbitMQ and Kafka) which we would then need to configure, operate, back up, and maintain. This was even worse for us because Svix is open-source, so additional infrastructure meant additional burden on our customers.Six months ago we finally decided to build Diom. It's a self-contained open-source servMay 3, 2026 12:38 PM
bing.com
What do people mean when they say their nervous system is overloaded or needs a reset?http://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8d978fafa94b4ea5d5acc7f39007bf&url=https%3A%2F%2Fmedicalxpress.com%2Fnews%2F2026-04-people-nervous-overloaded-reset.html&c=7013528237993263212&mkt=en-usYou might have heard people talking about their nervous system being "overloaded" or "dysregulated" when they're going through periods of heightened stress. Or perhaps you've been offered ways to ...May 2, 2026 4:00 PM
mljar.com
Show HN: Mljar Studio – local AI data analyst that saves analysis as notebookshttps://mljar.com/Hi HN,I’ve been working on mljar-supervised (open-source AutoML for tabular data) for a few years. Recently I built a desktop app around it called MLJAR Studio.The idea is simple: you talk to your data in natural language, the AI generates Python code, executes it locally, and the whole conversation becomes a reproducible notebook (*.ipynb file). So instead of just chatting with data, you end up with something you can inspect, modify, and rerun.What MLJAR Studio does:- Sets up a local Python environment automatically, runs on Mac, Windows, and Linux- Installs missing packages during the conversation- Built-in AutoML for tabular data (classification, regression, multiclass)- Works with standard Python libraries (pandas, matplotlib, etc.)- Works with any data file: CSV, Excel, Stata, Parquet ...- Connects to PostgreSQL, MySQL, SQL Server, Snowflake, Databricks, and Supabase.For AI: use Ollama locally (zero data egress), bring your own OpenAI key, or use MLJAR AI add-on.I built this becauMay 2, 2026 10:21 AM
github.com
Show HN: Manage Casio G-Shock watches from the browserhttps://github.com/izivkov/gshock-smart-sync-webappI've been maintaining GShockSmartSync (Android) for a while, and a recurring ask was "can I do this without installing an app?" So I built a browser-based version using the Web Bluetooth API.What it does: - Time sync with NTP (atomic-clock precision) - Full alarm management (all 5 alarms) - Reminders/events with labels - Watch settings (illumination, sound, display) - Battery level monitoring - Zero install, zero accounts — all BLE traffic stays local between your browser and the watchTech: Next.js + TypeScript, Web Bluetooth API, Material Design 3. Supports 19+ G-Shock models with per-model capability detection.Live demo: https://gshock.avmedia.org Source: https://github.com/izivkov/gshock-smart-sync-webappCan be self-hosted on a Raspberry Pi or any Node-capable server.Browser support: Chrome/Edge/Opera (desktop & Android). iOS needs Bluefy or WebBLE. Safari and Firefox don't support Web Bluetooth — that's a vendor decision, not a fixable limitation on my end.One honest limitation: WeMay 2, 2026 9:48 AM
bing.com
Why Next Season's Success for UCLA Falls on Trent Perryhttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8d4a918a5d4aa9bf2dc4eed196bec7&url=https%3A%2F%2Fwww.si.com%2Fcollege%2Fucla%2Fbruins-why-next-season-success-falls-trent-perry&c=9299393815280887569&mkt=en-usThe Bruins have hit this offseason hard, but there is still a glaring issue that has not been addressed. The Bruins have been able to bring in a lot of players to fix last season’s issues — rebounding ...May 2, 2026 9:30 AM
bing.com
I got a behind-the-scenes look at Walmart's new digital price tags that are sparking controversyhttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8d773a3d0747608facdfe9b4188f10&url=https%3A%2F%2Fwww.msn.com%2Fen-us%2Fmoney%2Fcompanies%2Fi-got-a-behind-the-scenes-look-at-walmarts-new-digital-price-tags-that-are-sparking-controversy%2Fss-AA22dvJT&c=1089642183173772085&mkt=en-usWalmart has been rolling out digital price tags across the US. I visited two stores to see how the tech works for employees and customers.May 2, 2026 3:45 AM
github.com
Show HN: An Agent First Slack CLIhttps://github.com/tilework-tech/nori-slack-cliHey folks,My team and I have been building a background agents as a service product. One of the things we needed pretty early on was for some way for the agents to be able to drive slack.Right now, I don't think there are many good agent-first ways of doing this. I don't love MCP -- it's just too many tokens in the context window, and agents seem to do better with CLIs because they can embed them in code and so on. But other CLIs that exist are either a) subsets of the web api that only focus on human needs and b) have polished terminal UIs with spinners and colors and interactive things that make it hard for LLMs to actually use them.nori-slack-cli is a very thin dynamic wrapper over @slack/web-api (i.e. bolt). Whatever the SDK can call, the CLI can call. When slack adds a new method it should just work without a new release on our end. (Inspired by the GWS cli: https://github.com/googleworkspace/cli).So you(r agent) can do things like:`nori-slack chat.postMessage --channel C123 --texMay 1, 2026 7:05 PM
news.ycombinator.com
Ask HN: Struggling with managing i3/tmux/vim. Need to simplify.https://news.ycombinator.com/item?id=47978205I use i3 for managing my tiles/windows ( and I like the features like the scratch pad). I like tmux even though it has pretty awful keybinds (relative to i3) for pane/window navigation, but it's super convenient for managing and saving sessions and restoring them when i reboot my laptop.For many years, I've used marimo/jupyter/obsidian for research and writing notes and vim for quick edits, but I've switched to primarily vim as my go to editor and it's been nice to ditch the browser and focus on 1 tool, plus plugins like telescope are very convenient.But I'm getting overwhelmed with the variety of options I have for navigating/switching/resizing my windows/panes/buffers/sessions/etc.There's a lot of keybinds to remember and execute on the fly, and honestly I'm running out of meta keys. I keep thinking that there must be a simpler way.And sometimes simple issues seem hard to fix without adding more keybinds. A specific example I am facing right now is very similar to this post, and therMay 1, 2026 6:25 PM
news.ycombinator.com
Show HN: Ramble, iOS voice notes that send webhookshttps://news.ycombinator.com/item?id=47976481Hi HN, I'm JPI wanted to automate my voice notes - pocket the phone (or watch), walk and talk, then send the transcript to my agent for processing. So I built Ramble for myself.It's a simple app. An on-ramp into your systems. Free. Open source. No accounts.Why a new app? 1) Apple Voice Memos are great, but no way to automate the result. You're also stuck with Apple's transcription (it got slightly better in iOS26 but still not the best) 2) Voice transcription in Claude / ChatGPT / messaging apps is built for short back-and-forth chat, not capturing a 10-minute walking ramble. They also don't let you record offline on Apple Watch. 3) I wanted a minimal distraction-free app to record thoughts and trust they'll be delivered. Nothing more.I've been using Ramble on my phone & watch for months. Talk-to-think became a regular habit and I started getting real value from it. I highly recommend long-form talking to voice notes as a way to process your thoughts, regardless!Some technical notes:NaMay 1, 2026 4:14 PM
