frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

I Found 39 Algolia Admin Keys Exposed Across Open Source Documentation Sites

https://benzimmermann.dev/blog/algolia-docsearch-admin-keys
68•kernelrocks•2h ago

Comments

toomuchtodo•2h ago
Great write up. Reminder that if you commit these to a Github Gist and the provider partners with GitHub for secrets scanning, they’ll rapidly be invalidated.
pwdisswordfishy•2h ago
That's just a tautology.

"If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated".

The above is a true statement for all X.

nightpool•1h ago
? Yes? Toomuchtodo is reminding the author (and other commenters), that github gists are one way to make sure secrets are secured / remediated before making a public post like this. Maybe not the most responsible whitehat action, but I can see it being useful in some cases where outreach is impractical / has failed.

Unfortunately, it doesn't look like Algolia has implemented this

TurdF3rguson•48m ago
I'm not following this at all. It seems like OP is saying if you share a secret in your (private?) gist and give Algolia permission to read the gist, they will invalidate it. But why would the secret be in a gist and not a repo? Also if you're aware enough to add that partner it seems you're aware to not do dumb things like that in the first place.
richbell•41m ago
If you find an exposed token in the wild, for a service supported by GitHub Secret Scanning, uploading it to a Gist will either immediately revoke it or notify the owner.
wat10000•1h ago
English is not formal logic.

In formal logic, that statement is true whether X is GitHub, or Lockheed-Martin, Safeway, or the local hardware store.

In English, the statement serves to inform (or remind) you that GitHub has a secret scanning program that many providers actually do partner with.

pwdisswordfishy•58m ago
Yes, and in the real world where Grice's Maxim of Relevance is in force, then when the secrets issuer that is the subject of the discussion isn't one of those partners, then an informative "reminder" that GitHub "has a secret scanning program" with a bunch of other partners is not actually informative. It's as superfluous and unhelpful as calling to let someone know you're not interested in the item they've posted for sale on Craiglist (<https://www.youtube.com/watch?v=xWG3jKzKcm8>).
richbell•52m ago
How is reminding people that they can safely revoke exposed API keys not informative? Why are you being so combative?
wat10000•39m ago
It's more useful than telling someone that their statement is a tautology in formal logic.
fix4fun•2h ago
Interesting how many people already are playing with these API keys ? ;)
stickynotememo•1h ago
So why hasn't the HomeAssistant docs page been nuked yet?
netsharc•1h ago
Man, talk about unnecessary graphs... ok graph 2 is maybe tolerable, although it's showing the popularity of the projects, not a metric of how many errors/vulnerabilities found in those projects.

I'm not a newspaper editor, but I think if this was an article for one, they'd also say the graphs are unnecessary. It smells of "I need some visual stuff to make this text interesting"...

throwaway5465•1h ago
It's Friday night / Saturday morning. Who wants to be reading text?

Especially on night mode themes.

Besides, can we read anymore? In the age of 'GPT summarise it me' attention spans and glib commentary not about the content of the article being all many people have to add, perhaps liberal application of visualisations adds digestive value.

binarymax•53m ago
Dude there’s only three graphs in there. Do they really bother you that much? The third may be a bit unnecessary but I think the visuals add to the post.
netsharc•25m ago
So you agree partially with what I said.

The poster is 16, he can take it as feedback towards effective writing. Or the intellectual HN crowd can just downvote it and dissuade me from contributing and helping a kid (oh look at me, how fucking noble am I, right?).

Ah, that feeling of "Am I the only one who gets it around here?". I wanted to explain to you why graph 2 is dumb, and graph 1 is very little information, but heck, I felt dissuaded.

integralid•18m ago
I liked the graphs. When skimming posts i often stop on graphical elements and decide if I want to understand the context or continue skimming. In this context, all three graphs were useful for me.

Posts with just text are sense and just not nice to read. That's why even text-only blog posts have a tendency to include loosely-related image at the top, to catch reader's eye.

TechSquidTV•39m ago
I have been developing an OpenClaw-like agent that automates exactly this type of attack.
_pdp_•8m ago
Why? This is just regex search and there are plenty of tools that do this perfectly fine.

1M context is now generally available for Opus 4.6 and Sonnet 4.6

https://claude.com/blog/1m-context-ga
130•meetpateltech•7h ago•35 comments

I Found 39 Algolia Admin Keys Exposed Across Open Source Documentation Sites

https://benzimmermann.dev/blog/algolia-docsearch-admin-keys
68•kernelrocks•2h ago•18 comments

Can I run AI locally?

https://www.canirun.ai/
906•ricardbejarano•12h ago•237 comments

Show HN: Channel Surfer – Watch YouTube like it’s cable TV

https://channelsurfer.tv
399•kilroy123•2d ago•136 comments

Mouser: An open source alternative to Logi-Plus mouse software

https://github.com/TomBadash/MouseControl
183•avionics-guy•6h ago•57 comments

Qatar helium shutdown puts chip supply chain on a two-week clock

https://www.tomshardware.com/tech-industry/qatar-helium-shutdown-puts-chip-supply-chain-on-a-two-...
409•johnbarron•12h ago•380 comments

Hammerspoon

https://github.com/Hammerspoon/hammerspoon
195•tosh•6h ago•75 comments

Coding My Handwriting

https://www.amygoodchild.com/blog/cursive-handwriting-in-javascript
14•bwoah•4d ago•0 comments

OpenTelemetry for Rust Developers

https://signoz.io/blog/opentelemetry-rust/
24•dhruv_ahuja•3d ago•3 comments

Human Rights Watch says drone strikes in Haiti have killed nearly 1,250 people

https://haitiantimes.com/2026/03/11/hrw-condemns-haiti-drone-strikes-killing-children/
113•e12e•2h ago•52 comments

Parallels confirms MacBook Neo can run Windows in a virtual machine

https://www.macrumors.com/2026/03/13/macbook-neo-runs-windows-11-vm/
183•tosh•11h ago•246 comments

New 'negative light' technology hides data transfers in plain sight

https://www.unsw.edu.au/newsroom/news/2026/03/New-negative-light-technology-hides-data-transfers-...
58•wjSgoWPm5bWAhXB•2d ago•39 comments

TUI Studio – visual terminal UI design tool

https://tui.studio/
545•mipselaer•14h ago•273 comments

Elon Musk pushes out more xAI founders as AI coding effort falters

https://www.ft.com/content/e5fbc6c2-d5a6-4b97-a105-6a96ea849de5
306•merksittich•8h ago•441 comments

Our Experience with I-Ready

https://moultano.wordpress.com/2026/03/12/our-experience-with-i-ready/
5•barry-cotter•43m ago•1 comments

Using Thunderbird for RSS

https://rubenerd.com/using-thunderbird-for-rss/
63•ingve•3d ago•9 comments

I beg you to follow Crocker's Rules, even if you will be rude to me

https://lr0.org/blog/p/crocker/
22•ghd_•1h ago•32 comments

Stanford researchers report first recording of a blue whale's heart rate (2019)

https://news.stanford.edu/stories/2019/11/first-ever-recording-blue-whales-heart-rate
47•eatonphil•5h ago•35 comments

MetaGenesis Core – offline verification for computational claims

https://www.metagenesis-core.dev/
11•Lama9901•2d ago•6 comments

Lost Doctor Who Episodes Found

https://www.bbc.co.uk/news/articles/c4g7kwq1k11o
213•edent•19h ago•71 comments

Exploring JEPA for real-time speech translation

https://www.startpinch.com/research/en/jepa-encoder-translation/
27•christiansafka•2d ago•7 comments

Show HN: Context Gateway – Compress agent context before it hits the LLM

https://github.com/Compresr-ai/Context-Gateway
61•ivzak•7h ago•44 comments

Bucketsquatting is finally dead

https://onecloudplease.com/blog/bucketsquatting-is-finally-dead
308•boyter•16h ago•160 comments

Your phone is an entire computer

https://medhir.com/blog/your-phone-is-an-entire-computer
234•medhir•7h ago•233 comments

Source code of Swedish e-government services has been leaked

https://darkwebinformer.com/full-source-code-of-swedens-e-government-platform-leaked-from-comprom...
200•tavro•15h ago•193 comments

Launch HN: Spine Swarm (YC S23) – AI agents that collaborate on a visual canvas

https://www.getspine.ai/
84•a24venka•11h ago•65 comments

Launch HN: Captain (YC W26) – Automated RAG for Files

https://www.runcaptain.com/
45•CMLewis•9h ago•24 comments

John Carmack about open source and anti-AI activists

https://twitter.com/id_aa_carmack/status/2032460578669691171
220•tzury•7h ago•326 comments

The Wyden Siren Goes Off Again: We'll Be "Stunned" by NSA Under Section 702

https://www.techdirt.com/2026/03/12/the-wyden-siren-goes-off-again-well-be-stunned-by-what-the-ns...
355•cf100clunk•8h ago•105 comments

Meta Platforms: Lobbying, dark money, and the App Store Accountability Act

https://github.com/upper-up/meta-lobbying-and-other-findings
1152•shaicoleman•14h ago•479 comments