🛠️ All DevTools

Show HN: Ember, a native iOS Hacker News reader I built around accessibility I read HN on my phone every day and never really settled on a reader, so I wrote my own and finally tidied it up enough to put out there.<p>It&#x27;s plain SwiftUI with no third-party dependencies. A few things I spent the most time on:<p>Comments are parsed and drawn as native text instead of being dumped into a web view. Links, italics, quotes and code blocks behave like the rest of the OS, text selection works, and threads collapse instantly. The whole comment tree comes back from the Algolia API in a single request, which felt a lot nicer than walking the Firebase API node by node.<p>Accessibility. Nothing depends on color on its own, so points, read state and selection all carry a shape or an icon too. VoiceOver reads each story as one coherent element with proper actions, Dynamic Type and Reduce Motion are respected, and there&#x27;s a color-blind mode. The first-run setup actually looks at your device&#x27;s accessibility settings, switches on the matching options, and tells you what it changed instead of making you hunt for them.<p>Then the usual things you&#x27;d expect: Top&#x2F;New&#x2F;Best&#x2F;Ask&#x2F;Show&#x2F;Jobs, search, saved stories, read tracking, an in-app reader, light and dark, and a handful of accent colors.<p>It only talks to the public HN APIs, there&#x27;s no account and nothing is tracked. Source and screenshots are in the repo.<p>I&#x27;d most like feedback on the comment rendering and the accessibility choices, since those were the parts I cared about getting right. Happy to answer anything about how it&#x27;s put together.

Epidurals are a miracle technology

Show HN: StartupWiki – A Free Alternative to Crunchbase I&#x27;ve been building StartupWiki, a free startup database designed to make it easier to discover and research companies.<p>The original motivation was frustration with how difficult it can be to find information on early-stage startups. Most databases need accounts, or subscriptions, ro just feel too cluttered. I wanted a website that felt like Wikipedia, no accounts, no subscriptions, no weird metrics, just go in, the info is on the page.<p>The project is still very early, but currently includes:<p>Startup profiles Search and filtering Company categorization Public API (in progress)<p>I&#x27;m especially interested in feedback on:<p>What information you look for when researching startups Features missing from existing startup databases API use cases<p>I&#x27;d love to hear feedback.

US Scientist John Jumper to Leave Google DeepMind for Anthropic

The European Social Stack

Windows 11 New Media Player Uses 3.5x More RAM, Charges for Popular Video Codecs

Show HN: We post-trained a model that pen tests instead of refusing Anthropic and OpenAI&#x27;s publicly available models are explicitly guard-railed so that they refuse offensive tasks. And their cyber-focussed models are gated for enterprises. This leaves SMEs and mid market open to major vulnerabilities.<p>AI can be used as both an adversarial and defensive tool in the world of cyber. A worst case outcome is if only the adversaries have access.<p>Meanwhile, most existing AI cyber tools are just wrappers. The problem is that they still have all the guardrails on from the foundation model where they will inherit its refusals.<p>For this project we&#x27;ve post-trained a specific model on a decade of capture-the-flag contests. This won&#x27;t be made available to anyone and everyone, but we do believe that responsible SMEs and midmarket companies also need access to these tools in order to identify key vulnerabilities in their systems; not just enterprises.<p>We have developed two modes that run over a CLI:<p>• Security scan: a read-only audit of your local codebase for vulnerabilities. It only reports what it can tie to a specific file and line, so you&#x27;re not wading through vibes-based findings.<p>• Pen test: an active adversarial mode that will try to break a live system in a sandboxed environment. It proves each vulnerability by running the exploit and showing the request it sent and the response your code gave back, not a confidence score. Currently gated.<p>To show what the scan does, we pointed it at Bank of Anthos and it found an integer overflow in the transfer path: amount is an int, and amount + fee can overflow negative, so the balance check passes and you move funds you don&#x27;t have. Plus the usual auth and secrets issues. (Bank of Anthos is Google&#x27;s open-source bank. It&#x27;s a known app and some of it is intentionally weak, which is the point: you can clone it and re-run the scan yourself instead of trusting a screenshot)<p>The base model is a Kimi K2.6 (open weights). We didn&#x27;t pretrain from scratch. We post-trained it ourselves, SFT on CTF writeups, then RL with verifiable rewards against actual exploit checks.<p>How the harness works:<p>Along with the model we built the harness to support this. The harness runs on a multi-agent swarm: an orchestrator splits the job across subagents running in parallel, each owning a slice, then synthesising one report.<p>The CLI is a local binary (brew&#x2F;curl). It reads your code locally, then sends context to our inference API over TLS tcpdump it and you&#x27;ll see exactly what leaves and where. Install is free; and you can run a scan for free up to 2m tokens, then need to pay for tokens beyond this.<p>For full disclosure this is a product part of Cosine (YC W23)<p>Up for debate: tool safety, e.g. domain verification is one method that proves control but not necessarily permission. How would you gate a pen-test tool given that?

Show HN: TownSquare, a tiny presence layer for websites <a href="https:&#x2F;&#x2F;cauenapier.com&#x2F;blog&#x2F;townsquare_release&#x2F;" rel="nofollow">https:&#x2F;&#x2F;cauenapier.com&#x2F;blog&#x2F;townsquare_release&#x2F;</a><p><a href="https:&#x2F;&#x2F;cauenapier.com&#x2F;blog&#x2F;townsquare&#x2F;" rel="nofollow">https:&#x2F;&#x2F;cauenapier.com&#x2F;blog&#x2F;townsquare&#x2F;</a>

Show HN: Make every bug perfectly reproducible We are building a VM that helps you simulate realistic production conditions, model latencies, different interleaving, user requests, and find bugs.<p>Every non-deterministic property is turned into a knob you or a coding agent can control. We have helped teams perfectly reproduce support incidents and found bugs in some of the world&#x27;s most well tested software (including a database)<p>I you would like to try it out, I am giving away $100 in free credits to first 100 signups.

[Other] A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding

Cyberdecks, going analog, and convivial technology

Help I accidentally a wigglegram

Efficient C++ Programming for Modern C++ CPUs, Chapter 4/part 2

Cirrus: ATProto Personal Data Server That Runs on Cloudflare Workers

Aikido Code Audit

Russell Vought is going to destroy American Science

The UK's new under-16 social media ban will cause more harm than it prevents

Hide Secrets from AI Agents and NPM install using Airgap

Coding a Brick Tower [video]

Amazon drops Sam Altman movie after announcing OpenAI partnership