Hacker News Reader

_jzlwon Show HN: Generate Passwords from Regex Constraints

Okay, this is kindof incredible. The ability to create a complicated regex from smaller pieces combined in a logical way is insane. This has so many uses.

https://github.com/gruhn/regex-utils#comment-regex-using-com...

_jzlwon Grok Is Glitching and Spewing Misinformation About the Bondi Beach Shooting

[flagged]

_jzlwon Pilot narrowly avoids 'midair collision' with US Air Force plane near Venezuela

"Outrageous" is an understatement. Why does it always seem like military aircraft get a free-pass to break FAA regulations, communicate with no one when in shared airspace, and endanger the lives of everyone in civilian aircraft without any repercussions? This isn't the first time something like this has happened, and it doesn't always end in a near-miss.

_jzlwon Show HN: Wiki.txt

This seems like something intentionally easy for AI to consume, but hard for humans to read.

Why not allow for formatting and the ability to organize documents into a hierarchy via links? We could use some kind of standard, generalized markup language for this, so that a variety of agents acting on behalf of the user ("user agents," so to speak) can present the information in a visual and interactive manner while the source text remains machine-readable.

_jzlwon Denial of service and source code exposure in React Server Components

Idk about Phoenix, but having tried Blazor, the DX is really nice. It's just a terrible technical solution, and network latency / spotty wifi makes the page feel laggy. Not to mention it eats up server resources to do what could be done on the client instead with way fewer moving parts. Really the only advantage is you don't have to write JS.

_jzlwon Denial of service and source code exposure in React Server Components

It's funny (in a "wtf" sort of way) how in C# right now, the new hotness Microsoft is pushing is Blazor Server, which is basically old-school .aspx Web Forms but with websockets instead of full page reloads.

Every action, every button click, basically every input is sent to the server, and the changed dom is sent back to the client. And we're all just supposed to act like this isn't absolutely insane.

_jzlwon Show HN: Forms are boring AF, so I built a conversational survey tool

If you're not willing to accept feedback, and just trying to advertise your paid product (which is all this looks like), then a Show HN is not appropriate. Flagged.

(Also, I think you're confused about your own product. Your users are not the survey-takers. But if it's not for them, then it's not for anyone, because anyone using this product will not reach those respondents, as you've just admitted. Hence my feedback, which you ignored.)

_jzlwon Show HN: Forms are boring AF, so I built a conversational survey tool

A couple problems with this:

1. Nobody likes AI support chatbots. Give me a human dammit. So you're off to a bad first impression with whoever's taking the survey.

2. I can fill out a survey way faster than I can talk to an AI chatbot. While I'm busy waiting for the AI to "think" I could be looking at the next question.

3. The first thing I do when I bother to take a survey is see how many questions it is. I'm happy to provide feedback for a service I use regularly, but I'm not letting you waste my time with a ten-page, hundred-question survey. If I can't see how big the survey is right off the bat, I won't bother at all.

_jzlwon Why the Sanitizer API is just `setHTML()`

Ah, I see what they're talking about. That's a good article; my brain totally skipped over that link. Thanks.

_jzlwon Why the Sanitizer API is just `setHTML()`

Well that's... certainly a take. But I have to disagree. Most traffic coming to blog posts is not from people who know you and are personally following your posts, they're from people who clicked a link to the article someone shared or found it while googling something.

It's not hard to add one line of context so readers aren't lost. Here, take this for example, combining a couple parts of the GitHub readme:

> For those who are unfamiliar, the Sanitizer API is a proposed new browser API being incubated in the Sanitizer API WICG, with the goal of bringing this to the WHATWG.

Easy. Can fit that in right after "this blog post will explain why", and now everyone is on the same page.

_jzlwon Why the Sanitizer API is just `setHTML()`

The author really needs to start with that. They say "the API that we are building" and assume I know who they are and what they're working on, all the way until the very bottom. I just assumed it's some open source library.

> HTML parsing is not stable and a line of HTML being parsed and serialized and parsed again may turn into something rather different

Are there any examples where the first approach (sanitize to string and set inner html) is actually dangerous? Because it's pretty much the only thing you can do when sanitizing server-side, which we do a lot.

Edit: I also wonder how one would add for example rel="nofollow noreferrer" to links using this. Some sanitizers have a "post process node" visitor function for this purpose (it already has to traverse the dom tree anyway).

_jzlwon Using Python for Scripting

Well, that's kind of what I mean. For scripts in a python project, you can freely use whatever packages you need. But for one-off scripts, if you need bs4 or something, you're screwed. Either your script now has external dependencies or it requires special tooling.

It just feels strange that C# of all languages is now a better scripting tool than Python, at least out of the box. I did notice uv has exactly the feature I'm looking for, though it's obviously third-party:

https://docs.astral.sh/uv/guides/scripts/#declaring-script-d...

Is everyone just using uv now instead of pip, perhaps? Or is just another alongside pipenv, conda, poetry, etc.? (Python's not my main these days, so I'm out of the loop.)

_jzlwon Using Python for Scripting

How do you handle packages? I want scripts to a be a single file with a shebang, not a repo with a requirements.txt that I need to run in a venv. To me, this is the biggest blocker to using Python for any non-trivial scripting (which is precisely the kind where I wouldn't want to use bash), but I'd like to know how others deal with it.

C# scripts let you reference packages in a comment at the top of the file, for example:

https://devblogs.microsoft.com/dotnet/announcing-dotnet-run-...

_jzlwon How I block all online ads

Take a look at AdGuard Home. It's functionally similar to pihole but overall better made / easier to use (IMO). I only use the first AdGuard DNS Filter and have only need to allow one domain to unbreak a site, but I also combine it with the browser extension (DNS-level blocking isn't going to remove all ads no matter what you do). You can check the query log to see what's getting blocked.

_jzlwon I forked instead of taking the easy way out

Server-side rendering is a well-established term.

_jzlwon Trains cancelled over fake bridge collapse image

This is the part that I find insane. What if the bridge had collapsed, and no one had bothered to post a picture of it to social media?

_jzlwon GitHub Shop

https://thegithubshop.com/collections/shop-all/products/1541...

That's actually really cool.

I wonder if it's an addressable LED strip you could hack or just white LEDs behind tinted plastic.

_jzlwon Ask HN: Best tricks to make a PWA feel more native?

Native mobile or native desktop? The former is relatively easy, at least for Android. React and Angular both have very good Material UI libraries. But making a PWA feel like a native desktop app is hard. There's a reason most Electron apps adopt their own unique theme. I've never seen a component library that fully replicates a desktop UI without feeling like a web app, not even Microsoft's own Fluent UI web components.

_jzlwon Apex: Universal Markdown Processor

The link doesn't give any examples of the extended featureset, but there's some neat stuff here:

https://github.com/ttscoff/apex/wiki/Syntax

_jzlwon Chinese fighters target SDF jets with radar lock-on, Japan says

> We have lodged a strong protest with the Chinese side and demanded strict measures to prevent recurrence

This is like a school teacher telling the bully to knock it off and then walking away.

_jzlwon Bitwarden Lite

Those are the pros, but what are the cons? Surely there are limitations for it to be called "lite", else they'd have just added support for all that to the regular version.

_jzlwon Show HN: Nano.noq – Experimental key-container format

1. What's the purpose of the "random padding"? Remember that an LLM is incapable of thinking logically, so it'll often do things that seem purposeful but aren't.

2. Consider using an actual checksum like CRC-32 rather than a truncated hash if your intent is to detect data corruption (see https://stackoverflow.com/a/72580031)

3. Obfuscation is a fool's errand; as you said, it provides no security, but therefore it also serves no purpose except to give a false sense of security, which is often more dangerous than none at all. Actual private key container formats (like PKCS#8 and #12) allow for encrypting the key with a passphrase, which is something you might consider instead.

4. "AES-GCM keys" are not a thing; they're just AES keys (which are just random bytes of a set length).

_jzlwon Show HN: Pbnj – A minimal, self-hosted pastebin you can deploy in 60 seconds

People don't usually expose self-hosted services directly to the internet, even if they have a login page. You use a reverse proxy, that way they can be HTTPS, share port 443, and use subdomains (Caddy makes this really easy). And then adding auth becomes trivial, and you can even put your services behind some SSO sign-in if you want to.

If possible though it's best to use a VPN so that nothing needs to be accessible from the internet at all (not to mention then you can access your NAS shares w/o needing a web UI). That's why I actually prefer when self-hosted apps don't have their own auth system, or at least let me disable it. If everything's internal only, I don't need it anyway.

_jzlwon CSS now has an if() conditional function

> The items are packed flush to each other in the center of the alignment container along the cross axis

You're right, the entire Values section seems to still be worded exclusively for flexboxes. The description at the top adds "or a grid or block-level element's block axis".

_jzlwon CSS now has an if() conditional function

align-content: center;

(supported on block elements since sometime last year)

_jzlwon Updating My Bash Prompt

I'm a fan of https://starship.rs/guide/

_jzlwon Meta Is Killing Messenger Desktop Apps PWAs Are Finally Taking Over?

It's such a shame that desktop apps are dying while the replacement still doesn't manage to feel native and can't even do multithreading properly.

_jzlwon Valve reveals it’s the architect behind a push to bring Windows games to Arm

> acting in their own self-interest end up benefiting everyone

I'm so sick of people acting like Valve is some saint that does no wrong. Their market dominance means game developers wanting to reach the PC gamer market must comply with Valve's terms. Why do you think every Japanese visual novel released on the platform is a cut down, all-ages version that requires an off-site patch to restore the full game (and often even then it's censored in weird ways)? They got sick of being delisted while Valve turns a blind eye to all the trash porn games.

Ask yourself, does a marketplace that exerts creative control over specific studios' works while threatening financial repercussions if they don't comply benefit everyone? That sounds more like the mob to me.

Stop deifying companies.

_jzlwon Google unkills JPEG XL?

Same here! Not to mention having ebooks on my phone means I can read anywhere, anytime. I read more, not less, lol.

_jzlwon Google unkills JPEG XL?

Have you ever tried reading a PDF ebook on a phone? Small font size, doesn't fill the entire screen (phones are taller), margins make it appear even smaller... even if you have good eyesight it's a pain. The whole point of PDF is to preserve a page layout as authored. EPUB is meant to adapt to your device.