frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Dexterous robotic hands: 2009 – 2014 – 2025

https://old.reddit.com/r/robotics/comments/1qp7z15/dexterous_robotic_hands_2009_2014_2025/
1•gmays•2m ago•0 comments

Interop 2025: A Year of Convergence

https://webkit.org/blog/17808/interop-2025-review/
1•ksec•12m ago•1 comments

JobArena – Human Intuition vs. Artificial Intelligence

https://www.jobarena.ai/
1•84634E1A607A•15m ago•0 comments

Concept Artists Say Generative AI References Only Make Their Jobs Harder

https://thisweekinvideogames.com/feature/concept-artists-in-games-say-generative-ai-references-on...
1•KittenInABox•19m ago•0 comments

Show HN: PaySentry – Open-source control plane for AI agent payments

https://github.com/mkmkkkkk/paysentry
1•mkyang•21m ago•0 comments

Show HN: Moli P2P – An ephemeral, serverless image gallery (Rust and WebRTC)

https://moli-green.is/
1•ShinyaKoyano•31m ago•0 comments

The Crumbling Workflow Moat: Aggregation Theory's Final Chapter

https://twitter.com/nicbstme/status/2019149771706102022
1•SubiculumCode•35m ago•0 comments

Pax Historia – User and AI powered gaming platform

https://www.ycombinator.com/launches/PMu-pax-historia-user-ai-powered-gaming-platform
2•Osiris30•36m ago•0 comments

Show HN: I built a RAG engine to search Singaporean laws

https://github.com/adityaprasad-sudo/Explore-Singapore
1•ambitious_potat•42m ago•0 comments

Scams, Fraud, and Fake Apps: How to Protect Your Money in a Mobile-First Economy

https://blog.afrowallet.co/en_GB/tiers-app/scams-fraud-and-fake-apps-in-africa
1•jonatask•42m ago•0 comments

Porting Doom to My WebAssembly VM

https://irreducible.io/blog/porting-doom-to-wasm/
1•irreducible•42m ago•0 comments

Cognitive Style and Visual Attention in Multimodal Museum Exhibitions

https://www.mdpi.com/2075-5309/15/16/2968
1•rbanffy•44m ago•0 comments

Full-Blown Cross-Assembler in a Bash Script

https://hackaday.com/2026/02/06/full-blown-cross-assembler-in-a-bash-script/
1•grajmanu•49m ago•0 comments

Logic Puzzles: Why the Liar Is the Helpful One

https://blog.szczepan.org/blog/knights-and-knaves/
1•wasabi991011•1h ago•0 comments

Optical Combs Help Radio Telescopes Work Together

https://hackaday.com/2026/02/03/optical-combs-help-radio-telescopes-work-together/
2•toomuchtodo•1h ago•1 comments

Show HN: Myanon – fast, deterministic MySQL dump anonymizer

https://github.com/ppomes/myanon
1•pierrepomes•1h ago•0 comments

The Tao of Programming

http://www.canonical.org/~kragen/tao-of-programming.html
2•alexjplant•1h ago•0 comments

Forcing Rust: How Big Tech Lobbied the Government into a Language Mandate

https://medium.com/@ognian.milanov/forcing-rust-how-big-tech-lobbied-the-government-into-a-langua...
3•akagusu•1h ago•0 comments

PanelBench: We evaluated Cursor's Visual Editor on 89 test cases. 43 fail

https://www.tryinspector.com/blog/code-first-design-tools
2•quentinrl•1h ago•2 comments

Can You Draw Every Flag in PowerPoint? (Part 2) [video]

https://www.youtube.com/watch?v=BztF7MODsKI
1•fgclue•1h ago•0 comments

Show HN: MCP-baepsae – MCP server for iOS Simulator automation

https://github.com/oozoofrog/mcp-baepsae
1•oozoofrog•1h ago•0 comments

Make Trust Irrelevant: A Gamer's Take on Agentic AI Safety

https://github.com/Deso-PK/make-trust-irrelevant
7•DesoPK•1h ago•4 comments

Show HN: Sem – Semantic diffs and patches for Git

https://ataraxy-labs.github.io/sem/
1•rs545837•1h ago•1 comments

Hello world does not compile

https://github.com/anthropics/claudes-c-compiler/issues/1
35•mfiguiere•1h ago•20 comments

Show HN: ZigZag – A Bubble Tea-Inspired TUI Framework for Zig

https://github.com/meszmate/zigzag
3•meszmate•1h ago•0 comments

Metaphor+Metonymy: "To love that well which thou must leave ere long"(Sonnet73)

https://www.huckgutman.com/blog-1/shakespeare-sonnet-73
1•gsf_emergency_6•1h ago•0 comments

Show HN: Django N+1 Queries Checker

https://github.com/richardhapb/django-check
1•richardhapb•1h ago•1 comments

Emacs-tramp-RPC: High-performance TRAMP back end using JSON-RPC instead of shell

https://github.com/ArthurHeymans/emacs-tramp-rpc
1•todsacerdoti•1h ago•0 comments

Protocol Validation with Affine MPST in Rust

https://hibanaworks.dev
1•o8vm•2h ago•1 comments

Female Asian Elephant Calf Born at the Smithsonian National Zoo

https://www.si.edu/newsdesk/releases/female-asian-elephant-calf-born-smithsonians-national-zoo-an...
5•gmays•2h ago•1 comments
Open in hackernews

The spectrum of isolation: From bare metal to WebAssembly

https://buildsoftwaresystems.com/post/guide-to-execution-environments/
97•ThierryBuilds•3w ago

Comments

ThierryBuilds•3w ago
I wrote this because I kept seeing developers (myself included) confuse language-level isolation like Python venv with OS-level isolation like Docker. I wanted to trace the actual technical boundaries between them.

The article maps out the differences between common execution environments—from physical bare metal and VMs to containers, process sandboxes, and virtual environments—to create a mental model of where the "isolation boundary" actually sits for each tool.

ianand•3w ago
Since you mention serverless it might be worth mentioning firecracker and v8 isolates.
ThierryBuilds•3w ago
Thank you for the feedback. I will definitely add them as example solutions for serverless.
pjmlp•3w ago
Or CGIs running on httpd inside HP-UX Vaults, that is how old the idea happens to be.
ignoramous•3w ago
> how old the idea happens to be

TFA is missing a host of many a popular isolation techniques like Isolates, Code Interp / Binary Translators [0], Enclaves, Exclaves, Domains/Worlds, (RISC V) SEEs, TEEs, SEs, HSMs, pKVMs ...

[0] https://news.ycombinator.com/item?id=38950949

lateral_cloud•3w ago
Did you really write it though? Within the first paragraph it's fairly obvious this is heavily LLM-generated.
aragilar•3w ago
It also has weird definitions. Is nix a virtual environment? Is homebrew a virtual environment? Why is a sandbox different to a container? Type-1 vs Type-2 hypervisors are quite different, and there's no discussion about processes vs threads.
tadfisher•3w ago
I don't know what it is about LLM-generated text, but when I read it I cannot understand the meaning it is trying to convey. The words are all there, but it is fatiguing to repeatedly parse phrasing like "it's not X but Y" and "you aren't just X, you are Y". The entire article is organized as a sequence of these statements, and this is not hyperbole.
zipy124•3w ago
Because it is statistical. It has no understanding of the purpose of writing which is to convey information. It can only show you the statistically most likely text, although very good sometimes, it also has its limitations.
fuzzfactor•3w ago
>1. Physical Machine (Bare Metal) This is the foundation.

Nobody should ever forget this.

But I would say this next part is about the opposite for bare metal though:

>Use Case: High-performance computing (HPC), large databases, or legacy systems that require direct hardware access.

To get the utmost reliability out of adequate hardware then bare metal is more suitable for almost everything except for special situations.

Unless something is really wrong with the software or the overall hardware/software approach.

ThierryBuilds•3w ago
Thanks for the feedback. These are typical use cases where the convenience of higher level abstractions may be less important than the benefits of direct access to the hardware.
shevy-java•3w ago
WebAssembly somehow does not seem to be able to break-through, unlike HTML, CSS, JavaScript did.
mickael-kerjean•3w ago
Or the people who write wasm don't talk too much about it. My OSS work (https://github.com/mickael-kerjean/filestash) has tons of it:

1. to create web versions of applications that are traditionally desktop only to render things like Parquet, PSD, TIFF, SQLite, EPS, ZIP, TGZ, and many more, where C libraries are often the reference implementations. There are almost a hundred supported file formats, most of which are supported through WASM

2. to create plugins that extend the backend and add your own endpoint or middleware as a way to enforce the code run in a constrained environment without the ability to send people's file out

3. in the workflow engine to enable people to run their own sandboxed scripts without giving those a blank check to go crazy

thecupisblue•3w ago
It is more of a silent thing. Running in the background, internal libs, deployment tools, plugin tools.

But also - it's lacking things like a unified positioning + required knowledge to understand it is quite large compared to average dev + most people have no real use for it. It's mostly too "abstract high level" and "low level" for most devs.

bflesch•3w ago
> This website collects anonymous usage analytics data via GoatCounter and Umami.

My uBlock origin shows that googlefonts.com and fonts.googleapis.com are being blocked.

It irks me a bit that your message explicitly mentions two trackers but it fails to mention the Google tracking. Google is also not mentioned in your privacy policy. Is there a reason for this?

nake89•3w ago
Your message sent me down a weird rabbit hole of trying to find privacy friendly alternative to google fonts. I found this: https://github.com/coollabsio/fonts They claim to be a privacy friendly drop-in replacement. Their main website: https://fonts.coollabs.io/
cardanome•3w ago
The easiest solution is to simply self host your fonts.
mrob•3w ago
The easiest solution is to use the default font. This has the additional benefit of being the most legible font for every reader, because it's the one they have the most experience reading.
Piraty•3w ago
remember the times when common sense was to not accept the remote site's fonts, and thus web devs should not use them
bflesch•3w ago
Yes. I recommend everybody to do a deep dive into font file formats and you'll see a lot of monsters hiding.
yencabulator•2w ago
That definitely deserves better tooling!
rafram•3w ago
Google Fonts is not a tracker.

https://developers.google.com/fonts/faq/privacy

> For clarity, Google does not use any information collected by Google Fonts to create profiles of end users or for targeted advertising.

bflesch•3w ago
Google has carte blanche to lie to foreigners for national security purposes, it's not even illegal for them. The data is fed into the mass surveillance systems.

IP, user agent, language headers and network timings are enough to fingerprint and associate you with any other accounts at US tech companies. The visited website is linked via Referer / Origin headers to your browsing history.

All of this tracking is passive and there is no way to check for an independent observer.

Yet here you are defending the most privacy invasive company on the planet.

pwdisswordfishy•3w ago
Well, if Google said it, it must be true.
sillyblob67•3w ago
By default, loading Google Fonts from Google’s servers exposes user data to Google (e.g., IP Address, User agent, Referrer, Timestamps, Cache identifiers).

It's passive tracking, but it's tracking.

bmitch3020•3w ago
The spectrum comes with multiple tradeoffs, and isn't a simple "bare metal is more secure" narrative. Because as you move into VMs, containers, and code sandboxes, you lose isolation which increases risks, but you also gain capabilities to limit the application which decreases risk. So I believe the most secure approach is layered with much multiple types of isolation working together.

For example, you may isolate a specific customer to bare metal so an escape doesn't compromise other customers. But within that bare metal, you may run containers because they make it easier to work with a read only root filesystem that's also trivial to upgrade. You can also add on user namespaces and seccomp in the container to minimize the risk of a container escape. And then the application may have its own sandbox that limits individual capabilities and which API calls it can run.

Every use case is different, and some layers may not be available depending on that use case. But rather than picking one point on the spectrum, one should pick a list of technologies that best solve each use case.

ThierryBuilds•3w ago
Agreed. Beyond security, we must consider other critical factors such as cost, ease of maintenance, and operational overhead.
Loic•3w ago
This is the engineering approach in a factory. You always have multiple layers of security systems.

The analogy is that each layer is a slice of Emmental cheese. You end up with a bad event, only if all the holes in the slices align.

creata•3w ago
venv and sandboxes are such categorically different things that painting it as a spectrum the way this article does is more misleading than helpful.

I also think the article shouldn't mention chroot. From the man page:

> In particular, it is not intended to be used for any kind of security purpose,

I guess it could be part of a sandbox, but there are better tools for that purpose.

(I'm not sure what point there is in giving feedback on an article that's almost entirely LLM-generated, though.)

ThierryBuilds•3w ago
The article is not only about security. Thanks
FjordWarden•3w ago
Ah, I think I found the reason as to why WebAssembly (in a browser or some other sandboxed environment) is not a suitable substrate for near native performance. It is a very ironic reason: you can't implement a JIT compiler that targets WebAssembly in a sandbox running in WebAssembly. Sounds like an incredibly contrived thing to do but once speed is the goal then a copy-and-patch compiler is a valid strategy for implementing a interpreter or a modern graphics pipeline.
syrusakbary•3w ago
> you can't implement a JIT compiler that targets WebAssembly in a sandbox running in WebAssembly

That's not completely true. With dynamic linking (now supported in WASIX), you can generate and link Wasm modules at runtime easily.

fwsgonzo•3w ago
This is true. A multi-tier JIT-compiler requires writable execute memory and the ability to flush icache. Loading segments dynamically is nice and covers a lot of the ground, but it won't be a magic solution to dynamic languages like JavaScript. Modern WASM emulators already implement a full compiler, linker and JIT-compiler in one, almost starting to look like v8. I'm not sure if adding in-guest JIT support is going in the right direction.
nickdothutton•3w ago
No LPARs (IBM) or LDoms (Oracle), although I appreciate someone might never have to encounter those things these days. They sit above bare metal and below hypervisor VMs.