The best Hacker News stories from Show from the past day
Latest posts:
Show HN: Rscrypto, pure-Rust crypto with industry leading public benches
Show HN: Tired of duct-taping access control into agent prompts. Here's the fix
Show HN: Mnemo – local-first AI memory layer for any LLM (Rust, SQLite,petgraph)
Show HN: Ideogram 4.0 – open-weight 9.3B text-to-image model
It's our new text-to-image model: a 9.3B single-stream diffusion transformer trained entirely from scratch.<p>We focused heavily on controllability through structured JSON prompts, with strong text rendering, spatial awareness through bounding box guidance, and color palette control.<p>It has the best text rendering of any open-weight model we've tested so far, and the NF4 quantized checkpoint runs on a single 24GB GPU.<p>For more technical details and examples see our blog post: <a href="https://ideogram.ai/blog/ideogram-4.0/" rel="nofollow">https://ideogram.ai/blog/ideogram-4.0/</a><p>We will be happy to answer any questions :)
Show HN: Paseo – Beautiful open-source coding agent interface
Repo: <a href="https://github.com/getpaseo/paseo" rel="nofollow">https://github.com/getpaseo/paseo</a><p>Homepage: <a href="https://paseo.sh/" rel="nofollow">https://paseo.sh/</a><p>Discord: <a href="https://discord.gg/jz8T2uahpH" rel="nofollow">https://discord.gg/jz8T2uahpH</a>
Show HN: Nutrepedia – Nutrition info in 29 locales built with Clojure and Htmx
Show HN: I reverse-engineered the world maps of Test Drive III (1990 DOS game)
Show HN: Edsger – A handwritten Clojure REPL for the reMarkable 2
Show HN: Synapse – 2.9MB Mac app with screenshot, clipboard, Keep Awake and more
Show HN: A free Linux adaptation of NETworkManager by BornToBeRoot
Show HN: Live breath detection and biofeedback from a phone microphone
Hi everyone, I am Felix, a famliy doctor from ZH, Switzerland.
A couple of month ago I started this little project called
shii • haa, a breathing app that uses the phone`s microphone
for live biofeedback<p>My prior work in emergency medicine and intensive care was
closesly linked to breathing, mostly in critical situations...
and let me to reevaluate my own way of breathing. over time
one question popped into my mind: can medical knowledge and
biofeedback make an app actually promote self-awareness instead
of attaching your goals to the award system of the app.<p>it combines signal processing, a breathing state machine and ML.
The state machine follows inhale, exhale and transitions in the
mic signal. A quality layer rejects noisy or ambiguous windows
before signals are used for feedback. All processing is done
on-device, no speech or raw audio is uploaded.<p>What I'm trying to avoid is turning breathing into another score
or game. The app gives feedback on rhythm, depth and regularity,
but the point is more "notice what you are doing" than "perform
well".<p>I'd be interested in feedback, especially from people who have
worked on signal processing, health UX, or Android/iOS audio
issues.
Show HN: RePlaya – self-hosted browser session replay with live tailing
Hi HN, I'm one of the founders of s2.dev. RePlaya (<a href="https://github.com/s2-streamstore/replaya" rel="nofollow">https://github.com/s2-streamstore/replaya</a>) is a self-hosted browser session replay tool using rrweb (<a href="https://github.com/rrweb-io/rrweb" rel="nofollow">https://github.com/rrweb-io/rrweb</a>).<p>It occurred to me that a durable stream per session would be a much neater architectural foundation for much of what you'd want from such a tool. As a unique feature, it also made live tailing straightforward because the player can read from the same stream the recorder is appending to.<p>The alternative architecture is likely an ingest firehose which is then indexed, with associated complexity and latency. You'd have to string together multiple data systems like a message queue, a metadata database, and blob storage and/or an OLAP database.<p>Here the only dependency is S2, which has an open source version you can self-host called s2-lite (<a href="https://news.ycombinator.com/item?id=46708055">https://news.ycombinator.com/item?id=46708055</a>).<p>How it works:<p>- one S2 stream per browser session<p>- large rrweb events (like a full snapshot) get framed across multiple binary S2 records and reassembled on read<p>- active sessions are tailed with an S2 read session, and bridged to the browser over SSE<p>- session listing relies on stream names encoding reverse timestamps, as S2 returns a lexicographic order listing<p>- relying on fencing tokens so a stopped session can't be written to again by a late recorder<p>- retention and GC are handled via S2 stream config, so no background job needed<p>Curious to hear from folks on the tool or the stream-per-session model!
Show HN: RePlaya – self-hosted browser session replay with live tailing
Hi HN, I'm one of the founders of s2.dev. RePlaya (<a href="https://github.com/s2-streamstore/replaya" rel="nofollow">https://github.com/s2-streamstore/replaya</a>) is a self-hosted browser session replay tool using rrweb (<a href="https://github.com/rrweb-io/rrweb" rel="nofollow">https://github.com/rrweb-io/rrweb</a>).<p>It occurred to me that a durable stream per session would be a much neater architectural foundation for much of what you'd want from such a tool. As a unique feature, it also made live tailing straightforward because the player can read from the same stream the recorder is appending to.<p>The alternative architecture is likely an ingest firehose which is then indexed, with associated complexity and latency. You'd have to string together multiple data systems like a message queue, a metadata database, and blob storage and/or an OLAP database.<p>Here the only dependency is S2, which has an open source version you can self-host called s2-lite (<a href="https://news.ycombinator.com/item?id=46708055">https://news.ycombinator.com/item?id=46708055</a>).<p>How it works:<p>- one S2 stream per browser session<p>- large rrweb events (like a full snapshot) get framed across multiple binary S2 records and reassembled on read<p>- active sessions are tailed with an S2 read session, and bridged to the browser over SSE<p>- session listing relies on stream names encoding reverse timestamps, as S2 returns a lexicographic order listing<p>- relying on fencing tokens so a stopped session can't be written to again by a late recorder<p>- retention and GC are handled via S2 stream config, so no background job needed<p>Curious to hear from folks on the tool or the stream-per-session model!
Show HN: DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that checks what you have set and fixes it for you. I looked for an existing one first and couldn't find it. It started as a small weekend project and turned into a small research project on the nuances of cooldowns across package managers. Not a proof of P vs NP, but a small convenience that can save you and your loved ones from the next supply chain attack. I've raised this in a couple of HN threads since (<a href="https://news.ycombinator.com/item?id=47878158">https://news.ycombinator.com/item?id=47878158</a> and <a href="https://news.ycombinator.com/item?id=48156360">https://news.ycombinator.com/item?id=48156360</a>) but never actually did a Show HN for the tool itself.<p>If you know how to edit your ~/.npmrc, which settings apply to npm vs pnpm, and which one wants minutes vs days vs seconds, you probably don't need this. But if you vibe code and just want a one click fix (or you have a PhD in CS from Stanford, ex-FAANG, started 3 YC companies, now work at Anthropic, and still just want a one click fix), read on.<p>DepsGuard is a single Rust binary, no runtime deps, MIT. Run depsguard and it scans your user-level and repo-level configs, shows a table of what is and isn't set, you pick what to change, hit d for the diff, and apply. It writes a timestamped backup first and depsguard restore rolls it back. depsguard scan is read-only if you just want the report.<p>The settings are the simple ones that work: min-release-age / minimumReleaseAge (npm, pnpm, yarn, bun, and uv all name it differently and use days vs minutes vs seconds, which is half of why doing this by hand is annoying), ignore-scripts, and on newer pnpm block-exotic-subdeps, trust-policy: no-downgrade, and strict-dep-builds. It also handles Renovate and Dependabot cooldowns.<p>The whole thing is a bet on timing. The malicious @bitwarden/cli 2026.4.0 was up ~19 hours and got 334 installs. axios was pulled in ~3h, ua-parser-js in hours, node-ipc in days. A 7-day gate means your installer never resolves any of those, they're gone before the window even opens. It does nothing for the slow ones (event-stream sat 2+ months), and it's not SCA, it won't scan your existing lockfile for known CVEs, that's a different layer.<p>Disclosure: I'm a co-founder and CTO at Arnica (a commercial appsec startup) and built this because putting the same recommendations on each blog post felt like yelling at the clouds. It's free and MIT, no account, no telemetry. I'm also not the only one who had the idea (didn't know at the time), cooldowns.dev does the cooldown part across more ecosystems with a shell helper and is worth a look. DepsGuard covers fewer ecosystems but adds the other settings and the diff/backup/restore flow.<p>If you want to try it: cargo install depsguard, or brew/apt/winget/scoop, all in the README.<p><a href="https://github.com/arnica/depsguard" rel="nofollow">https://github.com/arnica/depsguard</a> (full settings table and FAQ at depsguard.com)<p>Is this an overkill that could have been a shell script? Probably yes (but I wanted windows support, why not).<p>Did it save someone from a supply chain attack? Also probably yes.<p>Do I know personally someone that without it wouldn't have bothered changing their settings after repeatedly asking, but eventually did it when I gave them depsguard? Absolutely yes.
Show HN: Eyeball
Show HN: Eyeball
Show HN: Textile – A desktop app for weaving together bits of text
Hi all,<p>I'm excited to show off Textile, a desktop app I recently built.<p>Textile can combine bits of text using various inputs, such as commands on your computer, the contents of your clipboard, and hard-coded strings that you provide. It lets you carefully build up and modify a dynamic string, step by step, until it's exactly how you need it. The saved steps can then be executed on demand, with the click of a button or using a keyboard shortcut.<p>I built Textile because I was often constructing complicated, dynamic URLs from various sources that all existed on my computer. I got tired of manually switching between different apps, copying and pasting various chunks of text, and assembling them all together somewhere. I've also found Textile to be quite useful as a kind of repository for obscure bits of static text, such as ½ and other fraction characters, when I can't be bothered to remember their built-in keyboard combinations.<p>I also built Textile because I wanted to learn Electron, although I expect there will be some gnashing of teeth about this here. :) I think desktop development is quite interesting, in part because it doesn't require me, the developer, to pay for an API server and database in the cloud. The app itself is both the UI and the "server," and the local drive is effectively the "database." I knows this trades away syncing with the cloud but, on the other hand, there's something nice about knowing that your files are on your drive and not on somebody else's server.<p>I realize that something like Textile may already exist, and may have much more functionality but, again, I wanted to learn. I must say that multi-sequence keyboard shortcuts are hard, and there are cases that don't work right in Textile. I feel vulnerable admitting that my approach has much room for improvement!<p>For what it's worth, I did not use an LLM to write any code for Textile (although I did ask many questions of an LLM, as an alternative to Googling).<p>Textile is open source, free to use, and does not require sign up, email, phone, or other such barriers. Try it and let me know what you think!<p>(Note: I don't have access to hardware running Windows or Linux, so Textile is only available for macOS at the moment.)
Show HN: Textile – A desktop app for weaving together bits of text
Hi all,<p>I'm excited to show off Textile, a desktop app I recently built.<p>Textile can combine bits of text using various inputs, such as commands on your computer, the contents of your clipboard, and hard-coded strings that you provide. It lets you carefully build up and modify a dynamic string, step by step, until it's exactly how you need it. The saved steps can then be executed on demand, with the click of a button or using a keyboard shortcut.<p>I built Textile because I was often constructing complicated, dynamic URLs from various sources that all existed on my computer. I got tired of manually switching between different apps, copying and pasting various chunks of text, and assembling them all together somewhere. I've also found Textile to be quite useful as a kind of repository for obscure bits of static text, such as ½ and other fraction characters, when I can't be bothered to remember their built-in keyboard combinations.<p>I also built Textile because I wanted to learn Electron, although I expect there will be some gnashing of teeth about this here. :) I think desktop development is quite interesting, in part because it doesn't require me, the developer, to pay for an API server and database in the cloud. The app itself is both the UI and the "server," and the local drive is effectively the "database." I knows this trades away syncing with the cloud but, on the other hand, there's something nice about knowing that your files are on your drive and not on somebody else's server.<p>I realize that something like Textile may already exist, and may have much more functionality but, again, I wanted to learn. I must say that multi-sequence keyboard shortcuts are hard, and there are cases that don't work right in Textile. I feel vulnerable admitting that my approach has much room for improvement!<p>For what it's worth, I did not use an LLM to write any code for Textile (although I did ask many questions of an LLM, as an alternative to Googling).<p>Textile is open source, free to use, and does not require sign up, email, phone, or other such barriers. Try it and let me know what you think!<p>(Note: I don't have access to hardware running Windows or Linux, so Textile is only available for macOS at the moment.)
Show HN: A CSS 3D Engine (no WebGL)
Show HN: A CSS 3D Engine (no WebGL)