19,685 results for one

news.ycombinator.com
Malicious NPM package pino-SDK-v2 exfiltrates .env secrets to Discordhttps://news.ycombinator.com/item?id=47273407We just analyzed a fresh supply chain attack on npm that's pretty well-executed.Package: pino-sdk-v2 Target: Impersonates pino (one of the most popular Node.js loggers, ~20M weekly downloads)Reported to OSV too- https://osv.dev/vulnerability/MAL-2026-1259What makes this one interesting: The attacker copied the entire pino source tree, kept the real author's name (Matteo Collina) in package.json, mirrored the README, docs, repository URL so everything looks legitimate on the npm page.The only changes: - Renamed package to pino-sdk-v2 - Injected obfuscated code into lib/tools.js (300+ line file) - No install hooks whatsoeverThe payload: Scans for .env, .env.local, .env.production, .env.development, .env.example files, extracts anything matching PRIVATE_KEY, SECRET_KEY, API_KEY, ACCESS_KEY, SECRET, or just KEY=, then POSTs it all to a Discord webhook as a formatted embed.The malicious function is literally named log(). In a logging library. That's some next-level camouflage.Why most scann
Mar 6, 2026 10:57 AM
bing.com
WIRED's Favorite 'Buy It for Life' Gearhttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8bbea26371446992746d44bae112fc&url=https%3A%2F%2Fwww.wired.com%2Fstory%2Fbuy-it-for-life%2F&c=5341592570021971957&mkt=en-usWe're all tired of spending money on stuff that breaks. Whether it's a tool that wears out instantly or a pair of pants that gets a hole too soon, it seems like more things in this world should be ...
Mar 6, 2026 8:27 AM
news.ycombinator.com
Gemini-flash-latest silently broke Search grounding for 1 monthhttps://news.ycombinator.com/item?id=47271099On January 21, Google quietly changed the gemini-flash-latest alias to point to gemini-3-flash-preview — a model that does not support Google Search grounding.The API never returned an error. HTTP 200, valid JSON, finish reason: STOP. The only thing missing was groundingMetadata. No warning, no deprecation notice, nothing.I run PartsplanAI, a B2B electronic components marketplace. Grounding is not optional for us — we use it to verify part specs against real datasheets and prevent hallucination. Wrong capacitance values or voltage ratings from a language model aren't just embarrassing; they cause real problems for engineers downstream.For approximately one month (late January through February 27), our AI features ran without any grounding. Every part recommendation, every spec search — generated purely from the model's pre-trained knowledge. The corrupted data accumulated in our database and was served to B2B customers. We had no idea.On February 27, I noticed recommendations weren't m
Mar 6, 2026 5:03 AM
spacepolicyonline.com
Anderson Breezes Through Senate Nomination Hearing to be NASA Deputy Administratorhttps://spacepolicyonline.com/news/anderson-breezes-through-senate-nomination-hearing-to-be-nasa-deputy-administrator/Retired Air Force Colonel Matt Anderson breezed through his nomination hearing today to be Deputy Administrator of NASA. One day after the Senate Commerce Committee approved a new NASA authorization […]
Mar 6, 2026 1:29 AM
news.ycombinator.com
The Future of Healthcare Will Be Built on Enhanced Datahttps://news.ycombinator.com/item?id=47266482Traditionally, healthcare relies on sporadic data collected during scheduled clinical visits. However, human physiology is an ongoing process, continuously responding to factors such as environment, activity, stress, pollution, allergens, and disease progression.We are advancing toward a transformative era characterized by continuous, real-world health monitoring enabled by sophisticated sensors, cloud computing infrastructure, and artificial intelligence. One of the most valuable yet underexploited physiological signals is exhaled breath.Exhaled breath contains a wealth of biochemical information, including markers of metabolism, inflammation, environmental exposures, physiological stress, and the early stages of various diseases. The primary challenge has not been the value of this signal, but rather the difficulty in capturing and analyzing it consistently, at scale, while maintaining anonymity.Innovative platforms such as Healthmetryx are addressing these challenges. Healthmetryx g
Mar 5, 2026 7:57 PM
recordsv.lt
Show HN: I built an AI tool that analyzes your Discogs vinyl collectionhttps://recordsv.ltI built recordsv.lt to explore a problem I ran into as a vinyl collector: once your collection grows, Discogs is great for cataloging but not great for understanding the collection itself.Recordsv connects to Discogs and analyzes your collection using the full release metadata — not just album titles but pressings, contributors, labels, and release history. The idea is to surface patterns that are hard to see manually.Some examples: * Pressing insights – compares different pressings of the same album and highlights when the version you own might not be the best sounding or most collectible one. * Contributor networks – maps relationships between artists, producers, engineers, and labels across your collection. You often discover unexpected connections between records. * Collection analytics – shows patterns in decades, genres, labels, and recording locations across the collection. * Contextual reviews – aggregates reviews and commentary about specific releases rather than just the albu
Mar 5, 2026 4:51 PM
github.com
Show HN: Tymeslot – Open-source cal.com alternative built with Elixir/Phoenixhttps://github.com/tymeslot/tymeslotHey HN, I'm Luka. I built Tymeslot — an open-source meeting scheduling platform.The existing open-source scheduling tools are functional but genuinely ugly. The booking page — the thing your clients actually see — looks like a CRUD form thrown together in an afternoon. I couldn't bring myself to send people to any of them, so I built something where the booking experience feels intentional by default.Both themes are fully customizable. Live demos here: https://tymeslot.app.Features: Google/Outlook/CalDAV calendar sync, auto-created video rooms (Google Meet, Teams, or self-hosted MiroTalk P2P), 90+ timezones, webhooks, n8n automation, embeddable widget, SSO via OIDC.Built on Elixir + Phoenix LiveView. Self-host via Docker, Cloudron, or Railway — or use the managed cloud (free tier, Pro at EUR 5/month). License is ELv2.I am happy to make this the leading open-source calendar solution over time. Check Github, I develop actively. What do you expect from a calendar and scheduling tool to sw
Mar 5, 2026 3:19 PM
liftstack.com
Show HN: Liftstack – Snippet-level A/B testing for CRM marketershttps://www.liftstack.com/I've spent years in CRM and email marketing, and one thing has always driven me mad: the constant pressure from the business to "test everything" when you know damn well you'll never reach statistical significance.Most ESP's use frequentist models. You need a fixed sample size calculated upfront, you can't peek at results early without inflating your false positive rate, and if your list isn't massive, you're waiting weeks for a result that often comes back inconclusive anyway. So teams either ignore the statistics entirely and just pick whichever variant "looks better" after a day, or they stop testing altogether. Either way, you learn nothing.On top of that, the testing workflow itself is painful. You duplicate your entire template, change the one thing you want to test (a subject line, a hero image, a CTA), split your audience, send, and wait. Want to test two things at once? Now you need four template versions. Three things? Eight versions. It scales terribly, and most teams just d
Mar 5, 2026 3:18 PM
esa.int
Training for the εpsilon missionhttps://www.esa.int/ESA_Multimedia/Videos/2026/03/Training_for_the_epsilon_missionESA astronaut Sophie Adenot began her training at the European Astronaut Centre in Cologne, Germany, where she studied spacecraft systems and crew operations — learning to think and act as an astronaut. Alongside this, she conditioned her body for spaceflight and prepared for the physical and operational demands of her mission.
Mar 5, 2026 12:00 PM
github.com
Show HN: Mnemora – Serverless memory DB for AI agents (no LLM in your CRUD path)https://github.com/mnemora-db/mnemoraHi HN,I built Mnemora because every AI agent memory solution I evaluated (Mem0, Zep, Letta) routes data through an LLM on every read and write. At scale, that means 200-500ms latency per operation, token costs on your memory layer, and a runtime dependency you don't control.Mnemora takes the opposite approach: direct database CRUD. State reads hit DynamoDB at sub-10ms. Semantic search uses pgvector with Bedrock Titan embeddings — the LLM only runs at write time to generate the embedding vector. All reads are pure database queries.Four memory types, one API: 1. Working memory: key-value state in DynamoDB (sub-10ms reads) 2. Semantic memory: vector-searchable facts in Aurora pgvector 3. Episodic memory: time-stamped event logs in S3 + DynamoDB 4. Procedural memory: rules and tool definitions (coming v0.2)Architecture: fully serverless on AWS — Aurora Serverless v2, DynamoDB on-demand, Lambda, S3. Idles at ~$1/month, scales per-request. Multi-tenant by default: each API key maps to an iso
Mar 5, 2026 10:41 AM
bing.com
« Nous faisons cela pour lui » : elle et son conjoint plaquent tout pour redonner vie au Sport 2000 de Niorthttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8cfe5abd514d088f1a0751bd02d926&url=https%3A%2F%2Fwww.ouest-france.fr%2Fnouvelle-aquitaine%2Fniort-79000%2Fnous-faisons-cela-pour-lui-elle-et-son-conjoint-plaquent-tout-pour-redonner-vie-au-sport-2000-de-niort-d97a2354-140a-11f1-8725-6cea811c3c37&c=6339030798834038286&mkt=en-usJeunes parents, Flora Paiva et Benjamin Habonneau se sont lancé le défi de redonner vie au magasin Sport 2000 de la zone commerciale Mendès-France à Niort, rouvert mardi 24 février 2026. Pour cela, ...
Mar 5, 2026 9:20 AM
typecrt.pages.dev
Show HN: TypeCrt – Zero-latency typing test in vanilla TS, no frameworkshttps://typecrt.pages.dev/Hey HN, I built TypeCrt because every typing test I tried had noticeable input lag at 150+ WPM. Monkeytype uses React. Keybr uses React. 10FastFingers feels like 2012. So I built one from scratch with vanilla TypeScript, vanilla CSS, and direct DOM manipulation — no React, no Vue, no Angular.The result: zero perceptible input latency, even at 200+ WPM.Some things I'm proud of:- CRT terminal aesthetic with 50+ themes and a visual theme creator - Adaptive practice mode ("KeyForge") that uses Markov chains to generate words targeting your weakest keys - Per-word burst speed breakdown, keystroke heatmaps, consistency tracking - Command palette (Ctrl+Shift+P), mechanical keyboard sounds, pace caret ghost - Cloud sync via Firebase, tiered analytics dashboardTech stack: TypeScript (strict) + Vanilla CSS + Vite. ~15K lines. No dependencies beyond Chart.js and Firebase.I'd genuinely love feedback from this community — especially on performance, UX, and what features would make you switch from y
Mar 5, 2026 9:18 AM
github.com
Show HN: FadNote – Zero-knowledge secret sharing for your CLI and AI workflowshttps://github.com/easyFloyd/fadnoteHi HN,I built FadNote because I realized that while services like Privnote or Yopass exist, they often feel like an "interruption" to a developer's flow. You have to leave your terminal, open a browser, paste, and copy again.FadNote is designed for integration, not just web-visiting. The goal is to provide a zero-knowledge "utility layer" that lives where you already work:OpenClaw Skill: For AI-powered workflow automation.CLI First: A zero-dependency Node.js script to pipe secrets directly from your terminal (echo "secret" | fadnote).Obsidian Plugin (In Dev): To share snippets directly from your knowledge base.The Security Model (Trust-less):Local Encryption: Secrets are encrypted via AES-256-GCM with 600,000 PBKDF2 iterations before they leave your machine.The URL Fragment: The decryption key is stored in the URL fragment (#key). Since browsers never send fragments to the server, I literally cannot read your data even if I wanted to.One-Time & Faded: The encrypted blob is deleted from
Mar 4, 2026 8:23 PM
firstvibe.app
Show HN: FirstVibe – AI analyzes your selfie and scores your vibe in 30 secondshttps://firstvibe.app/FirstVibe is an AI selfie analyzer that gives you a "vibe check" -- a personality and impression analysis based on your photo. Upload a selfie and get an overall score, personality label, 5 category scores (attractiveness, confidence, charisma, style, approachability), celebrity lookalike, aura type, dating energy, and a set of fun predictions and personalized improvement tips.It uses Claude's Vision API to read facial expressions, body language, styling choices, and overall energy from the photo. The difference from typical face-rating apps is that it focuses on personality and vibe rather than bone structure or symmetry (though it does golden ratio and face shape analysis too). The AI analyzes things like approachability, confidence level, conversation style, and what kind of first impression you make.Technical details: Rails 8, Hotwire/Turbo for real-time result streaming, PostgreSQL with JSONB for flexible AI output storage, Solid Queue for background jobs. Two Claude API calls run
Mar 4, 2026 3:49 PM
news.ycombinator.com
Show HN: I packaged decade of video infra battle scars into tools for AI agentshttps://news.ycombinator.com/item?id=47249002Hi HN,I’m Ashu, founder of VideoDB. I’ve spent a big chunk of my life building video infrastructure. Not video creation. Video plumbing.The stuff you only learn after production breaks: timebases, VFR, keyframes, audio sync drift, container quirks, partial uploads, live streams, retries, backpressure, codecs, ffmpeg flags, cost blowups, and “why is this clip unseekable on one player but fine on another”.This week we shared VideoDB Skills, a skill pack that lets AI agents call those infra primitives directly, instead of you wiring pipelines with screenshots plus FFmpeg glue.Repo: https://github.com/video-db/skillsWhat it enables (infra level):- Ingest videos and live streams- Index and search moments- Return playable evidence links- Run server side edits and transforms- Trigger automations from video eventsWhy this matters for agents:Agents can reason, write code, browse. But continuous media is still mostly invisible. In an agentic world, perception needs to be a first class interface,
Mar 4, 2026 3:34 PM
news.ycombinator.com
Open Memory Initiative (OMI) - an open DDR4 UDIMM reference designhttps://news.ycombinator.com/item?id=47248756Hi HN! I’m building the Open Memory Initiative (OMI): a community-driven engineering project to make system memory understandable, reproducible, and independently verifiable (not performance-leading, not commercial, not “competing with vendors”).A quick clarification upfront (based on earlier feedback): yes, JEDEC DDR/DIMM standards exist, and you can build/use memory controllers. My claim isn’t that DDR is unknowable. The gap I’m trying to close is that a complete, end-to-end, publicly reproducible DIMM module implementation (with explicit constraints, bring-up steps, and publishable validation evidence including failures) is still hard to find in one place, in a form others can rebuild without NDA/proprietary dependencies.OMI v1 target (intentionally narrow):DDR4 UDIMM reference design8 GB, single rank (1R)x8 DRAM devices, non-ECC (64-bit bus)Status:Stages 5–7 are complete/frozen (architecture decisions → block decomposition → full schematic + edge pin map integrity).We’re now in Sta
Mar 4, 2026 3:18 PM
news.ycombinator.com
Google Account "Digital Execution" While Auditing a Chrome Store Vulnerabilityhttps://news.ycombinator.com/item?id=47248397A Digital Execution in Real-Time: The Last Seconds of NTT PrimeThe Manifesto“Hello world, I am NTT Prime.I am writing this as an analyst—one who lives and works with irrefutable evidence, charts, and data. I have prepared screenshots and the most detailed technical analysis to show you how dangerous the ‘Zombie Assets’ vulnerability is.But, I want to offer my sincere apologies: I failed before the deadline. Imagine you are a researcher pouring your heart and soul into an Audit Report to protect the community. You have absolute faith in the Google ecosystem. You click on a captcha solver downloaded directly from the official Chrome Web Store—a tool approved and endorsed by Google itself.And then, BAM! No delay. No review. The moment that click echoed, a cold, impersonal message appeared:‘Your account has been disabled.’I witnessed my digital identity being executed in an instant. Google had trapped its own users: They approved the tool, they allowed it to exist on their ‘marketplace,’ a
Mar 4, 2026 2:56 PM
news.ycombinator.com
Gaia – open-source assistant that does for actions what ChatGPT did for answershttps://news.ycombinator.com/item?id=47247862Three years ago, finding information meant opening Google, clicking 4 links, reading, and piecing together an answer yourself. ChatGPT collapsed that into one step.We haven't had that moment for taking action yet. To set a recurring water reminder today, you still open your todo app, hit New Task, type it out, set a recurrence, and save. To block focus time, you open Calendar, find a slot, create an event, then update your Slack status separately. Every small action is a small tax. They add up to hours of invisible overhead every week.GAIA is our attempt at that shift. You tell it what you want done — or it acts before you have to ask.Gmail & Calendar "Summarise my unread emails and flag anything needing a reply" — runs every morning automatically. "Block 2 hours Thursday for deep work" → calendar event created, Slack status updated. "Draft a follow-up to anyone I haven't heard back from in 5 days" → drafted, waiting for your review.Slack & Notion "Turn the action items from today's st
Mar 4, 2026 2:30 PM
chromewebstore.google.com
Show HN: Focus Warden – Block sites, set time limits, and micro-learnhttps://chromewebstore.google.com/detail/focus-warden/chgkcjgkhgcajpndkpibgbpglempcegbI built Focus Warden, a Chrome extension for people who want more control over how they spend time online.The core features: - Block specific sites or entire categories (Social Media, News, Gaming) with one toggle - Set daily time limits per site — hard limits or soft limits with a snooze - Deep Focus mode that blocks everything except your whitelist; exiting early requires typing a custom phrase (default: "get distracted") - Micro-learning unlocks: earn extra time on a blocked site by completing a short learning resource you define yourself - Usage dashboard showing daily time spent per site - Global tab cap (default 20) to reduce tab hoardingEverything runs locally. No accounts, no servers, no analytics — your data never leaves your device.The micro-learning unlock was the feature I found most interesting to design. Rather than just punishing distraction, it gives you a productive off-ramp. You define the resource yourself, so it stays relevant to what you're actually trying to learn
Mar 4, 2026 2:20 PM
github.com
Show HN: Spendtrace, Feature-level AWS cost attribution (found a 17× gap))https://github.com/Joshyi-Abini/SpendtraceLast year our Bedrock costs tripled in six weeks. AWS Cost Explorer told us "Amazon Bedrock: $4,200." That was the entire report. We had eight features using the model. We had no idea which one had changed. We spent two days correlating deployment timestamps with billing spikes before we found it. A caching bug in our recommendations feature was making three model calls where it should have made one. $2,800 of that bill was a single if-statement. I built spendtrace to make sure that never takes two days again. bash```bash pip install spendtrace ```python```python import spendtrace spendtrace.auto_instrument() # patches boto3, openai, anthropic at startupfrom spendtrace import cost_track@cost_track(feature="ai_recommendations") def recommend(user_id): items = dynamo.get_item(...) # captured response = bedrock.invoke_model(...) # captured return response ```That's the whole install. No proxy, no sidecar, no config file. One decorator per feature entry point and every boto3 and LLM SDK ca
Mar 4, 2026 2:01 PM