You define a policy like "Verify JWT" or "Block SQLi patterns" in YAML. The tool compiles this into:\n- *AWS:* CloudFront Functions (JS) + Lambda@Edge (for heavier tasks) + WAF Rules.\n- *Cloudflare:* Workers (TS) using native APIs like `crypto.subtle`.
It handles the platform-specific quirks (e.g., CloudFront's limited JS environment vs Cloudflare's full Node-like environment) so you don't have to rewrite your security logic when switching providers.
Open source and ready for feedback:\nhttps://github.com/albert-einshutoin/cdn-security-framework"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Show HN: A single security policy for both AWS CloudFront and Cloudflare Workers"}},"_tags":["story","author_einshutoin","story_46989314","show_hn"],"author":"einshutoin","created_at":"2026-02-12T14:32:22Z","created_at_i":1770906742,"num_comments":0,"objectID":"46989314","points":1,"story_id":46989314,"story_text":"I released `cdn-security-framework` to abstract away the runtime differences between CDN providers.
You define a policy like "Verify JWT" or "Block SQLi patterns" in YAML. The tool compiles this into:\n- *AWS:* CloudFront Functions (JS) + Lambda@Edge (for heavier tasks) + WAF Rules.\n- *Cloudflare:* Workers (TS) using native APIs like `crypto.subtle`.
It handles the platform-specific quirks (e.g., CloudFront's limited JS environment vs Cloudflare's full Node-like environment) so you don't have to rewrite your security logic when switching providers.
Open source and ready for feedback:\nhttps://github.com/albert-einshutoin/cdn-security-framework","title":"Show HN: A single security policy for both AWS CloudFront and Cloudflare Workers","updated_at":"2026-03-05T23:35:28Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"lbriner"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"We are constantly bothered by buying departments doing what they think is "due diligence" by asking a tonne of abstract open-ended questions about security with no context, like,
"How do you manage security keys?"
"What encryption do you use?"
Unless you are self-employed, they are massive questions full of nuance and probably have 50 different answers on 50 different systems but these companies believe they have the right to ask.
I know we can use a Security-as-a-service company to answer these on our behalf but I wondered what more established companies do? Do you just say, "here is the standard security page and that's all you're getting", or do you also spend many hours answering "what backups do you take?""},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Ask HN: How do you deal with security questionnaires?"}},"_tags":["story","author_lbriner","story_30553086","ask_hn"],"author":"lbriner","children":[30553667,30557718],"created_at":"2022-03-04T10:58:13Z","created_at_i":1646391493,"num_comments":3,"objectID":"30553086","points":4,"story_id":30553086,"story_text":"We are constantly bothered by buying departments doing what they think is "due diligence" by asking a tonne of abstract open-ended questions about security with no context, like,
"How do you manage security keys?"
"What encryption do you use?"
Unless you are self-employed, they are massive questions full of nuance and probably have 50 different answers on 50 different systems but these companies believe they have the right to ask.
I know we can use a Security-as-a-service company to answer these on our behalf but I wondered what more established companies do? Do you just say, "here is the standard security page and that's all you're getting", or do you also spend many hours answering "what backups do you take?"","title":"Ask HN: How do you deal with security questionnaires?","updated_at":"2024-09-20T10:37:37Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"kgrin"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"My consulting company is working with a client to make some changes to their webapp (it's a health-care-related app - details aren't super-relevant). One of the items on their wishlist is \"make it HIPAA-compliant\". We're working with the client's lawyer to determine exactly what that means in practice, but it's clear that one of the items will be \"host it on infrastructure other than the $10/mo. WebFaction plan\".
The app itself is (relatively) simple systems-wise, so we don't really need a dedicated box and all the sysadmin and security headaches that come with it. But from my basic read of the HIPAA Security Rule, shared hosting (which abstracts away a lot of the sysadmin issues) won't cut it. We're primarily developers, not sysadmins, and certainly don't want to get into the server admin business on something with regulatory requirements.
Does anyone here have suggestions for either a host that can make this less painful (not even sure what that would entail), or a firm that specializes in the sysadmin side of things? (Preferably with HIPAA experience)."},"title":{"matchLevel":"none","matchedWords":[],"value":"Ask HN: HIPAA Hosting?"},"url":{"matchLevel":"none","matchedWords":[],"value":""}},"_tags":["story","author_kgrin","story_1780722","ask_hn"],"author":"kgrin","children":[1780780,1780833,1780986,1780987,1781004,1781252,1781345,1781618],"created_at":"2010-10-11T18:45:00Z","created_at_i":1286822700,"num_comments":31,"objectID":"1780722","points":14,"story_id":1780722,"story_text":"My consulting company is working with a client to make some changes to their webapp (it's a health-care-related app - details aren't super-relevant). One of the items on their wishlist is \"make it HIPAA-compliant\". We're working with the client's lawyer to determine exactly what that means in practice, but it's clear that one of the items will be \"host it on infrastructure other than the $10/mo. WebFaction plan\".
The app itself is (relatively) simple systems-wise, so we don't really need a dedicated box and all the sysadmin and security headaches that come with it. But from my basic read of the HIPAA Security Rule, shared hosting (which abstracts away a lot of the sysadmin issues) won't cut it. We're primarily developers, not sysadmins, and certainly don't want to get into the server admin business on something with regulatory requirements.
Does anyone here have suggestions for either a host that can make this less painful (not even sure what that would entail), or a firm that specializes in the sysadmin side of things? (Preferably with HIPAA experience).","title":"Ask HN: HIPAA Hosting?","updated_at":"2023-09-06T20:07:37Z","url":""},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"jyunwai"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Authy, a software application that provides two-factor authentication codes for logging into online accounts, previously discontinued its desktop app for MacOS and Windows in March 2024. However, Twilio previously kept its iOS app opted in to let users download it onto Mac computers with Apple Silicon. But recently, Twilio has opted out the iOS Authy app from downloads by Mac computers.
If the Authy iOS app has already been installed on a Mac computer, the app continues to work. However, the app is already out-of-date, and users cannot download the app's latest updates from the App Store available for Macs. There is also no notice to users that the app is outdated.
The removal of updates for Mac users means that many Authy iOS users on Mac computers are unaware that they are running out-of-date software, which leaves these users exposed to security vulnerabilities that would be patched for iPad and iPhone users. The security concern is far from abstract and theoretical, as a wide-scale hack of Authy already broke news just a couple months ago in July.
Some discussion, but not much, has taken place on the r/Authy forum:
- https://old.reddit.com/r/Authy/comments/1e67y2g/app_not_available_in_macos_app_store/
- https://old.reddit.com/r/Authy/comments/1feivdl/is_running_the_ipad_on_macos_no_longer_an_option/"},"title":{"matchLevel":"none","matchedWords":[],"value":"Tell HN: Twilio quietly removes Authy iOS app from Mac App Store, stops updates"}},"_tags":["story","author_jyunwai","story_41525820","ask_hn"],"author":"jyunwai","children":[41525995,41526656,41526862,41527734,41529658],"created_at":"2024-09-12T21:33:42Z","created_at_i":1726176822,"num_comments":5,"objectID":"41525820","points":11,"story_id":41525820,"story_text":"Authy, a software application that provides two-factor authentication codes for logging into online accounts, previously discontinued its desktop app for MacOS and Windows in March 2024. However, Twilio previously kept its iOS app opted in to let users download it onto Mac computers with Apple Silicon. But recently, Twilio has opted out the iOS Authy app from downloads by Mac computers.
If the Authy iOS app has already been installed on a Mac computer, the app continues to work. However, the app is already out-of-date, and users cannot download the app's latest updates from the App Store available for Macs. There is also no notice to users that the app is outdated.
The removal of updates for Mac users means that many Authy iOS users on Mac computers are unaware that they are running out-of-date software, which leaves these users exposed to security vulnerabilities that would be patched for iPad and iPhone users. The security concern is far from abstract and theoretical, as a wide-scale hack of Authy already broke news just a couple months ago in July.
Some discussion, but not much, has taken place on the r/Authy forum:
- https://old.reddit.com/r/Authy/comments/1e67y2g/app_not_available_in_macos_app_store/
- https://old.reddit.com/r/Authy/comments/1feivdl/is_running_the_ipad_on_macos_no_longer_an_option/","title":"Tell HN: Twilio quietly removes Authy iOS app from Mac App Store, stops updates","updated_at":"2025-02-07T20:31:53Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"trust1connector"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Everybody that has/had to handle PKI knows the pain it is to manage and maintain such complexity.\nWe have developed a tooling that abstracts all complexity while guaranteeing the security, letting you focus on building awesome products.\nThis API allows you to validate certificates during strong authentication or signing processes, by providing endpoints to generate challenges, validate data signature and PKI certificate chains.\nYou can check out the European Trusted List Validation API using the Mashape and Rapid API marketplace online.
https://market.mashape.com/Trust1Team/eu-lotl-certificate-validation"},"title":{"matchLevel":"none","matchedWords":[],"value":"Stop worrying about PKI"}},"_tags":["story","author_trust1connector","story_14968162","ask_hn"],"author":"trust1connector","created_at":"2017-08-09T12:54:53Z","created_at_i":1502283293,"num_comments":0,"objectID":"14968162","points":2,"story_id":14968162,"story_text":"Everybody that has/had to handle PKI knows the pain it is to manage and maintain such complexity.\nWe have developed a tooling that abstracts all complexity while guaranteeing the security, letting you focus on building awesome products.\nThis API allows you to validate certificates during strong authentication or signing processes, by providing endpoints to generate challenges, validate data signature and PKI certificate chains.\nYou can check out the European Trusted List Validation API using the Mashape and Rapid API marketplace online.
https://market.mashape.com/Trust1Team/eu-lotl-certificate-validation","title":"Stop worrying about PKI","updated_at":"2024-09-20T01:12:02Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"ctkrohn"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"For those of you who are interested in learning what REALLY went on with the subprime mortgage crisis, the NY Fed has provided the best description yet. It's long (82 pages), but not too technical. You don't need to be familiar with securitization or the mortgage-backed securities markets to understand it.
Abstract: \"In this paper, we provide an overview of the subprime mortgage securitization process\nand the seven key informational frictions that arise. We discuss the ways that market\nparticipants work to minimize these frictions and speculate on how this process broke\ndown. We continue with a complete picture of the subprime borrower and the subprime\nloan, discussing both predatory borrowing and predatory lending. We present the key\nstructural features of a typical subprime securitization, document how rating agencies\nassign credit ratings to mortgage-backed securities, and outline how these agencies\nmonitor the performance of mortgage pools over time. Throughout the paper, we draw\nupon the example of a mortgage pool securitized by New Century Financial during 2006.\""},"title":{"matchLevel":"none","matchedWords":[],"value":"New York Fed research paper: \"Understanding the Securitization of Subprime Mortgage Credit\" [PDF]"},"url":{"matchLevel":"none","matchedWords":[],"value":"http://www.scribd.com/vacuum?url=http://www.ny.frb.org/research/staff_reports/sr318.pdf"}},"_tags":["story","author_ctkrohn","story_148183"],"author":"ctkrohn","children":[148194],"created_at":"2008-03-27T23:14:53Z","created_at_i":1206659693,"num_comments":1,"objectID":"148183","points":3,"story_id":148183,"story_text":"For those of you who are interested in learning what REALLY went on with the subprime mortgage crisis, the NY Fed has provided the best description yet. It's long (82 pages), but not too technical. You don't need to be familiar with securitization or the mortgage-backed securities markets to understand it.
Abstract: \"In this paper, we provide an overview of the subprime mortgage securitization process\nand the seven key informational frictions that arise. We discuss the ways that market\nparticipants work to minimize these frictions and speculate on how this process broke\ndown. We continue with a complete picture of the subprime borrower and the subprime\nloan, discussing both predatory borrowing and predatory lending. We present the key\nstructural features of a typical subprime securitization, document how rating agencies\nassign credit ratings to mortgage-backed securities, and outline how these agencies\nmonitor the performance of mortgage pools over time. Throughout the paper, we draw\nupon the example of a mortgage pool securitized by New Century Financial during 2006.\"","title":"New York Fed research paper: \"Understanding the Securitization of Subprime Mortgage Credit\" [PDF]","updated_at":"2023-09-06T19:11:32Z","url":"http://www.scribd.com/vacuum?url=http://www.ny.frb.org/research/staff_reports/sr318.pdf"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"transpute"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"We can end this new Cold War that\u2019s playing out via IT security"},"url":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"http://www.idgconnect.com/blog-abstract/9563/we-cold-war-playing-it-security"}},"_tags":["story","author_transpute","story_9162942"],"author":"transpute","created_at":"2015-03-07T20:08:55Z","created_at_i":1425758935,"num_comments":0,"objectID":"9162942","points":1,"story_id":9162942,"story_text":"","title":"We can end this new Cold War that\u2019s playing out via IT security","updated_at":"2023-09-07T02:15:04Z","url":"http://www.idgconnect.com/blog-abstract/9563/we-cold-war-playing-it-security"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"Tomte"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Is Everything Securities Fraud?"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3664132"}},"_tags":["story","author_Tomte","story_25649091"],"author":"Tomte","children":[25649272,25650272,25651219,25651737,25653633,25653717,25654997,25657073,25657750,25672160],"created_at":"2021-01-05T18:36:05Z","created_at_i":1609871765,"num_comments":109,"objectID":"25649091","points":199,"story_id":25649091,"title":"Is Everything Securities Fraud?","updated_at":"2024-09-20T07:40:00Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3664132"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"jsnell"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"Beyond the PDP-11: Processor support for a memory-safe C abstract machine [pdf]"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"http://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201503-asplos2015-cheri-cmachine.pdf"}},"_tags":["story","author_jsnell","story_9519812"],"author":"jsnell","children":[9520254,9520882,9521123,9521138],"created_at":"2015-05-10T13:11:22Z","created_at_i":1431263482,"num_comments":12,"objectID":"9519812","points":51,"story_id":9519812,"story_text":"","title":"Beyond the PDP-11: Processor support for a memory-safe C abstract machine [pdf]","updated_at":"2023-09-07T02:43:15Z","url":"http://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201503-asplos2015-cheri-cmachine.pdf"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"danbjson"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Security researcher John Wilander makes a case that String should be an abstract class. His analysis comes from a cross road of Domain Driven Design and Application Security. Also, he is not only doing research, he actually writes production code on every-day basis, so he knows what he is talking about."},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"Should String Be An Abstract Class?"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"http://appsandsecurity.blogspot.com/2013/05/should-string-be-abstract-class.html"}},"_tags":["story","author_danbjson","story_5767083"],"author":"danbjson","children":[5767175,5767195,5767207,5767224,5767233,5767282,5767298,5767335,5767356,5767431,5767437,5767499,5767576,5767596,5767597,5767619,5767644,5767671,5767694,5767706,5767721,5767777,5768066,5768152,5768653,5768991],"created_at":"2013-05-25T12:40:32Z","created_at_i":1369485632,"num_comments":52,"objectID":"5767083","points":48,"story_id":5767083,"story_text":"Security researcher John Wilander makes a case that String should be an abstract class. His analysis comes from a cross road of Domain Driven Design and Application Security. Also, he is not only doing research, he actually writes production code on every-day basis, so he knows what he is talking about.","title":"Should String Be An Abstract Class?","updated_at":"2023-09-06T21:35:49Z","url":"http://appsandsecurity.blogspot.com/2013/05/should-string-be-abstract-class.html"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"rinze"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3213954"}},"_tags":["story","author_rinze","story_17654838"],"author":"rinze","children":[17655042,17655382],"created_at":"2018-07-31T16:59:02Z","created_at_i":1533056342,"num_comments":3,"objectID":"17654838","points":9,"story_id":17654838,"title":"Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security","updated_at":"2024-09-20T02:48:55Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3213954"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"travismcpeak"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"We built Fraim to help security teams harness the power of LLMs without having to worry about all the complex glue and infrastructure.
Fraim is an open-source project that provides a modular, extensible framework for easily integrating LLM-driven workflows into common security processes such as vulnerability triage, misconfiguration detection, and automated remediation suggestions.
Security teams often want the productivity boost of LLMs, but find themselves bogged down by handling API integrations, structured data management, error handling, workflow chaining, and tool integrations.
Fraim abstracts all these challenges away, enabling teams to quickly create powerful, custom workflows that output standardized SARIF reports.
Currently, Fraim supports code repositories as input, but we're actively working on additional integrations such as GitHub PRs, VSCode integration, and more. It's modular by design, so extending it with new workflows or integrations is straightforward.
We're excited to share our initial release and would welcome your feedback, bug reports, and contributions.
Check out Fraim on GitHub: https://github.com/fraim-dev/fraim"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Show HN: Fraim \u2013 A framework for using LLMs in security workflows"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://github.com/fraim-dev/fraim"}},"_tags":["story","author_travismcpeak","story_44389536","show_hn"],"author":"travismcpeak","created_at":"2025-06-26T17:39:25Z","created_at_i":1750959565,"num_comments":0,"objectID":"44389536","points":4,"story_id":44389536,"story_text":"We built Fraim to help security teams harness the power of LLMs without having to worry about all the complex glue and infrastructure.
Fraim is an open-source project that provides a modular, extensible framework for easily integrating LLM-driven workflows into common security processes such as vulnerability triage, misconfiguration detection, and automated remediation suggestions.
Security teams often want the productivity boost of LLMs, but find themselves bogged down by handling API integrations, structured data management, error handling, workflow chaining, and tool integrations.
Fraim abstracts all these challenges away, enabling teams to quickly create powerful, custom workflows that output standardized SARIF reports.
Currently, Fraim supports code repositories as input, but we're actively working on additional integrations such as GitHub PRs, VSCode integration, and more. It's modular by design, so extending it with new workflows or integrations is straightforward.
We're excited to share our initial release and would welcome your feedback, bug reports, and contributions.
Check out Fraim on GitHub: https://github.com/fraim-dev/fraim","title":"Show HN: Fraim \u2013 A framework for using LLMs in security workflows","updated_at":"2025-06-28T00:31:03Z","url":"https://github.com/fraim-dev/fraim"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"DanBC"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Usability of Security: A Case Study of PGP 5.0 User Interface"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"http://reports-archive.adm.cs.cmu.edu/anon/1998/abstracts/98-155.html"}},"_tags":["story","author_DanBC","story_5018897"],"author":"DanBC","children":[5019017],"created_at":"2013-01-07T02:24:00Z","created_at_i":1357525440,"num_comments":1,"objectID":"5018897","points":3,"story_id":5018897,"title":"Usability of Security: A Case Study of PGP 5.0 User Interface","updated_at":"2024-09-19T19:06:41Z","url":"http://reports-archive.adm.cs.cmu.edu/anon/1998/abstracts/98-155.html"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"ingler"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"National Security and Double Government"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2376272"}},"_tags":["story","author_ingler","story_8893844"],"author":"ingler","created_at":"2015-01-15T17:25:37Z","created_at_i":1421342737,"num_comments":0,"objectID":"8893844","points":3,"story_id":8893844,"story_text":"","title":"National Security and Double Government","updated_at":"2023-09-06T23:17:03Z","url":"http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2376272"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"sandhyavinjam"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"My accepted research work on 'Failure-Aware Security Framework'"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6122687"}},"_tags":["story","author_sandhyavinjam","story_47170116"],"author":"sandhyavinjam","children":[47170117],"created_at":"2026-02-26T18:34:54Z","created_at_i":1772130894,"num_comments":0,"objectID":"47170116","points":3,"story_id":47170116,"title":"My accepted research work on 'Failure-Aware Security Framework'","updated_at":"2026-03-05T23:38:02Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6122687"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"isnotchicago"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Security rookies significantly improve by using Microsoft Copilot AI"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4648700"}},"_tags":["story","author_isnotchicago","story_38826582"],"author":"isnotchicago","created_at":"2023-12-31T19:10:04Z","created_at_i":1704049804,"num_comments":0,"objectID":"38826582","points":3,"story_id":38826582,"title":"Security rookies significantly improve by using Microsoft Copilot AI","updated_at":"2024-09-20T16:00:24Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4648700"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"bhupy"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Social Security and Trends in Inequality"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3546668"}},"_tags":["story","author_bhupy","story_22475673"],"author":"bhupy","created_at":"2020-03-03T16:07:58Z","created_at_i":1583251678,"num_comments":0,"objectID":"22475673","points":3,"story_id":22475673,"title":"Social Security and Trends in Inequality","updated_at":"2024-09-20T05:45:15Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3546668"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"grac3"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Open Sesame on the Security and Memorability of Verbal Passwords"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://ieeexplore.ieee.org/abstract/document/11023353"}},"_tags":["story","author_grac3","story_44352953"],"author":"grac3","created_at":"2025-06-23T06:19:00Z","created_at_i":1750659540,"num_comments":0,"objectID":"44352953","points":2,"story_id":44352953,"title":"Open Sesame on the Security and Memorability of Verbal Passwords","updated_at":"2025-06-23T12:13:48Z","url":"https://ieeexplore.ieee.org/abstract/document/11023353"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"toomuchtodo"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Securities Fraud and the Market for Individual Stocks"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4979274"}},"_tags":["story","author_toomuchtodo","story_43395521"],"author":"toomuchtodo","created_at":"2025-03-18T03:38:07Z","created_at_i":1742269087,"num_comments":0,"objectID":"43395521","points":2,"story_id":43395521,"title":"Securities Fraud and the Market for Individual Stocks","updated_at":"2025-03-18T04:23:32Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4979274"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"shiplives"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Security Researchers Launch Android Malware Genome Project"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"http://web.ncsu.edu/abstract/technology/wms-android-genome/"}},"_tags":["story","author_shiplives","story_4008168"],"author":"shiplives","created_at":"2012-05-22T15:09:04Z","created_at_i":1337699344,"num_comments":0,"objectID":"4008168","points":2,"story_id":4008168,"story_text":"","title":"Security Researchers Launch Android Malware Genome Project","updated_at":"2024-09-19T18:31:41Z","url":"http://web.ncsu.edu/abstract/technology/wms-android-genome/"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"paulpauper"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Private Security and Public Police"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4737135"}},"_tags":["story","author_paulpauper","story_40055995"],"author":"paulpauper","created_at":"2024-04-16T19:10:53Z","created_at_i":1713294653,"num_comments":0,"objectID":"40055995","points":2,"story_id":40055995,"title":"Private Security and Public Police","updated_at":"2024-09-20T16:50:04Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4737135"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"anigbrowl"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Chinese Open Source Data Collection for State Intelligence and Security"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3691999"}},"_tags":["story","author_anigbrowl","story_24467289"],"author":"anigbrowl","created_at":"2020-09-14T06:07:52Z","created_at_i":1600063672,"num_comments":0,"objectID":"24467289","points":2,"story_id":24467289,"title":"Chinese Open Source Data Collection for State Intelligence and Security","updated_at":"2024-09-20T06:59:08Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3691999"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"octosphere"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Huawei Technologies\u2019 Links to Chinese State Security Services"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3415726"}},"_tags":["story","author_octosphere","story_20383090"],"author":"octosphere","created_at":"2019-07-08T14:39:12Z","created_at_i":1562596752,"num_comments":0,"objectID":"20383090","points":2,"story_id":20383090,"title":"Huawei Technologies\u2019 Links to Chinese State Security Services","updated_at":"2024-09-20T04:31:08Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3415726"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"octosphere"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3213954"}},"_tags":["story","author_octosphere","story_17608541"],"author":"octosphere","created_at":"2018-07-25T11:52:40Z","created_at_i":1532519560,"num_comments":0,"objectID":"17608541","points":2,"story_id":17608541,"title":"Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security","updated_at":"2024-09-20T02:43:25Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3213954"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"Harperdog"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"The security of undersea fiber optic cables: Improved submarine tech is a threat"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"http://www.tandfonline.com/doi/full/10.1080/00963402.2016.1195636#abstract"}},"_tags":["story","author_Harperdog","story_11910553"],"author":"Harperdog","created_at":"2016-06-15T17:09:58Z","created_at_i":1466010598,"num_comments":0,"objectID":"11910553","points":2,"story_id":11910553,"title":"The security of undersea fiber optic cables: Improved submarine tech is a threat","updated_at":"2024-09-19T23:17:49Z","url":"http://www.tandfonline.com/doi/full/10.1080/00963402.2016.1195636#abstract"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"samayaranjan"},"story_text":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"The service-oriented automated negotiation system includes the following four participants: service registration centre, negotiation service requester, negotiation service provider, and protocol.\nService registration centre is a database of service providers\u201f information. The negotiation service provider follows a standard service API so that customers can use negotiation services from different service providers. Registration service centre supports all customers and services in the open system, of which negotiation is just one. Service registration centre provides customers with other services such as security and auditing in addition to negotiation service registration"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"Abstract Architecture for Service-oriented Automated Negotiation System"},"url":{"matchLevel":"none","matchedWords":[],"value":"http://blog.protogenist.com/?p=788"}},"_tags":["story","author_samayaranjan","story_4411785"],"author":"samayaranjan","created_at":"2012-08-21T08:52:12Z","created_at_i":1345539132,"num_comments":0,"objectID":"4411785","points":1,"story_id":4411785,"story_text":"The service-oriented automated negotiation system includes the following four participants: service registration centre, negotiation service requester, negotiation service provider, and protocol.\nService registration centre is a database of service providers\u201f information. The negotiation service provider follows a standard service API so that customers can use negotiation services from different service providers. Registration service centre supports all customers and services in the open system, of which negotiation is just one. Service registration centre provides customers with other services such as security and auditing in addition to negotiation service registration","title":"Abstract Architecture for Service-oriented Automated Negotiation System","updated_at":"2024-09-19T18:45:10Z","url":"http://blog.protogenist.com/?p=788"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"commoner"},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Work-from-Home and the Risk of Securities Misconduct"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4428145"}},"_tags":["story","author_commoner","story_36025065"],"author":"commoner","created_at":"2023-05-21T22:02:11Z","created_at_i":1684706531,"num_comments":0,"objectID":"36025065","points":1,"story_id":36025065,"title":"Work-from-Home and the Risk of Securities Misconduct","updated_at":"2024-09-20T14:09:22Z","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4428145"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"skygear"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Abstract: Multiple key agreement protocols produce several session keys instead of one session key. Most of the multiple key agreement protocols do not utilize the hash functions in the signature schemes used for identification. Not using hash function in these protocols causes that the protocols do not satisfy some requirement security properties. In this paper we review the multiple key agreement protocols and perform attacks on some of them. Then we introduce a new multiple key agreement protocol and show that the proposed protocol is more secure than the existent multiple key agreement protocols.
Introduction\nCryptography helps us to make a secure communication in public networks. The secret key plays an essential role in the cryptosystems such that revealing the secret key causes the cryptographic system to be compromised. Therefore how to exchange the secret key is very important in cryptographic applications. One of the considerable methods for secret key exchanging is key agreement protocols. These protocols enable two or more users of any public\nnetworks to share a secret common key together."},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Security of Multiple-Key Protocol #cryptography protocols"},"url":{"matchLevel":"none","matchedWords":[],"value":"http://seclist.files.wordpress.com/2011/11/protocols-and-propose.pdf"}},"_tags":["story","author_skygear","story_3293484"],"author":"skygear","created_at":"2011-11-30T03:04:25Z","created_at_i":1322622265,"num_comments":0,"objectID":"3293484","points":1,"story_id":3293484,"story_text":"Abstract: Multiple key agreement protocols produce several session keys instead of one session key. Most of the multiple key agreement protocols do not utilize the hash functions in the signature schemes used for identification. Not using hash function in these protocols causes that the protocols do not satisfy some requirement security properties. In this paper we review the multiple key agreement protocols and perform attacks on some of them. Then we introduce a new multiple key agreement protocol and show that the proposed protocol is more secure than the existent multiple key agreement protocols.<p>Introduction\nCryptography helps us to make a secure communication in public networks. The secret key plays an essential role in the cryptosystems such that revealing the secret key causes the cryptographic system to be compromised. Therefore how to exchange the secret key is very important in cryptographic applications. One of the considerable methods for secret key exchanging is key agreement protocols. These protocols enable two or more users of any public\nnetworks to share a secret common key together.","title":"Security of Multiple-Key Protocol #cryptography protocols","updated_at":"2023-09-06T20:43:51Z","url":"http://seclist.files.wordpress.com/2011/11/protocols-and-propose.pdf"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"jed_s"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"Control System (SCADA) Cyber Security - State of the State"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"http://www.stanford.edu/class/ee380/Abstracts/111012.html"}},"_tags":["story","author_jed_s","story_3254259"],"author":"jed_s","created_at":"2011-11-19T01:18:41Z","created_at_i":1321665521,"num_comments":0,"objectID":"3254259","points":1,"story_id":3254259,"story_text":"","title":"Control System (SCADA) Cyber Security - State of the State","updated_at":"2024-09-19T18:07:02Z","url":"http://www.stanford.edu/class/ee380/Abstracts/111012.html"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"anigbrowl"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["security"],"value":"A legal framework to safeguard security researchers"},"url":{"fullyHighlighted":false,"matchLevel":"partial","matchedWords":["abstract"],"value":"http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1561845"}},"_tags":["story","author_anigbrowl","story_2871106"],"author":"anigbrowl","created_at":"2011-08-11T02:37:58Z","created_at_i":1313030278,"num_comments":0,"objectID":"2871106","points":1,"story_id":2871106,"story_text":"","title":"A legal framework to safeguard security researchers","updated_at":"2023-09-06T20:19:03Z","url":"http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1561845"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"vmatsiiako"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Hi HN, we\u2019re the co-founders of Infisical (https://infisical.com), an open-source platform to sync application secrets and configs across your engineering team and infrastructure. We enable teams to store their secrets in a centralized location and distribute them anywhere from local development processes to staging/production environments.
Our Github is at https://github.com/infisical/infisical.
We previously worked at AWS, Figma, and another startup, where we frequently ran into problems dealing with secret management. For example, many companies used .env files to maintain their development secrets and struggled to keep secrets in sync amongst their teams (this routinely posed security and efficiency issues \u2014 secrets can get leaked or go missing). Some companies (especially bigger ones) used solutions like Vault which can be difficult to set up, maintain, and afford.
While secret managers exist, they\u2019re imperfect for many reasons: open-source solutions are either too complicated, not comprehensive, not user-friendly, or a mix of all three; there are nicer closed-source solutions but with no self-hosted options available. The gap we see is to make something that\u2019s simple, open-source, and powerful.
On the open-source front, our goal is to provide full transparency of our codebase and enable anyone in the community to build anything they want in an optimal secret management solution. If you need any feature or integration that we don\u2019t yet support, you can post an issue about it or directly send in a PR to be reviewed immediately.
You can inject the right set of secrets for any environment into your application by using the Infisical CLI together with your application start command (e.g. infisical run -- npm run dev). This removes the need to use a .env file. Everything stays encrypted with encryption/decryption operations occurring on the client-side \u2014 under the hood, secrets are encrypted by vault keys for which there are multiple copies of vault keys encrypted under the public key of each member of a vault (ensuring only members of vaults can decrypt secrets pertaining to that vault locally). An alternative way is to use our Open API - though it\u2019s a little complicated, and we\u2019re working on adding SDKs to abstract away the cryptography.
Infisical integrates with staging and production cloud services like AWS, Vercel, GitHub Actions, and Circle CI. We also added support for integrations with Docker, Kubernetes, and Terraform. Infisical is now a central source of truth for secrets across the entire development cycle from development to production with new integration releases every week.\nOne interesting thing is that, by default, our platform is end-to-end encrypted but users can opt out of that if they need to integrate with cloud platforms that require secrets to be sent in decrypted format (e.g. GitHub Actions, Vercel, Render). We\u2019re the only solution that we know of that offers this E2EE-with opt-out ability.
Since our last Show HN (https://news.ycombinator.com/item?id=34510516), we\u2019ve layered authentication with 2FA (more MFA options coming soon) and upgraded all private key encryption/decryption steps to involve a 256-bit protected key decrypted by another key generated via Argon2id KDF from the user\u2019s password. We are starting the process of obtaining SOC2 and other security and compliance certifications. You can read more about our security here: https://infisical.com/docs/security/overview
Beyond this, we\u2019ve added integrations with PM2, AWS Secrets Manager, AWS Parameter Store, Circle CI, Travis CI, GitLab CI/CD, Terraform and more. We\u2019ve also redesigned the main dashboard and added more advanced organizational structure for secrets. Lastly, we have added role-based access control, and improved our Kubernetes operator: your clusters are now auto-redeployed when secrets in Infisical change. In the coming weeks and months, we plan to add features like secret rotation, improved audit logs, SDKs and alerts; as well as increase the range of our integrations; and continue fortifying platform security and stability.
We\u2019ve launched this repo under the MIT license so any developer can use the platform. We don\u2019t charge individual developers or small teams\u2014all the integrations are fully available to everyone. We make money by charging a license fee for enterprise features as well as providing a hosted version and support.
If you found it interesting, you can see a demo video here: https://www.loom.com/share/9a8904c6ecc84d0899d53ee1f7a36385
We\u2019d love for you to give Infisical a try (https://infisical.com) and provide any feedback. If you're interested, our code is available here: https://github.com/infisical/infisical. If we don\u2019t have something, let us know and we\u2019d be happy to build it for you. We look forward to your comments!"},"title":{"matchLevel":"none","matchedWords":[],"value":"Launch HN: Infisical (YC W23) \u2013 Open-source secrets manager for developers"}},"_tags":["story","author_vmatsiiako","story_34955699","launch_hn"],"author":"vmatsiiako","children":[34955766,34956280,34956303,34956309,34956386,34956484,34956666,34956694,34956746,34956759,34956928,34957054,34957380,34957529,34957673,34957748,34958009,34958209,34958403,34959016,34959650,34961850,34962065,34963142,34963683,34964525,34964797,34967332,34967354],"created_at":"2023-02-27T12:39:29Z","created_at_i":1677501569,"num_comments":121,"objectID":"34955699","points":231,"story_id":34955699,"story_text":"Hi HN, we\u2019re the co-founders of Infisical (https://infisical.com), an open-source platform to sync application secrets and configs across your engineering team and infrastructure. We enable teams to store their secrets in a centralized location and distribute them anywhere from local development processes to staging/production environments.
Our Github is at https://github.com/infisical/infisical.
We previously worked at AWS, Figma, and another startup, where we frequently ran into problems dealing with secret management. For example, many companies used .env files to maintain their development secrets and struggled to keep secrets in sync amongst their teams (this routinely posed security and efficiency issues \u2014 secrets can get leaked or go missing). Some companies (especially bigger ones) used solutions like Vault which can be difficult to set up, maintain, and afford.
While secret managers exist, they\u2019re imperfect for many reasons: open-source solutions are either too complicated, not comprehensive, not user-friendly, or a mix of all three; there are nicer closed-source solutions but with no self-hosted options available. The gap we see is to make something that\u2019s simple, open-source, and powerful.
On the open-source front, our goal is to provide full transparency of our codebase and enable anyone in the community to build anything they want in an optimal secret management solution. If you need any feature or integration that we don\u2019t yet support, you can post an issue about it or directly send in a PR to be reviewed immediately.
You can inject the right set of secrets for any environment into your application by using the Infisical CLI together with your application start command (e.g. infisical run -- npm run dev). This removes the need to use a .env file. Everything stays encrypted with encryption/decryption operations occurring on the client-side \u2014 under the hood, secrets are encrypted by vault keys for which there are multiple copies of vault keys encrypted under the public key of each member of a vault (ensuring only members of vaults can decrypt secrets pertaining to that vault locally). An alternative way is to use our Open API - though it\u2019s a little complicated, and we\u2019re working on adding SDKs to abstract away the cryptography.
Infisical integrates with staging and production cloud services like AWS, Vercel, GitHub Actions, and Circle CI. We also added support for integrations with Docker, Kubernetes, and Terraform. Infisical is now a central source of truth for secrets across the entire development cycle from development to production with new integration releases every week.\nOne interesting thing is that, by default, our platform is end-to-end encrypted but users can opt out of that if they need to integrate with cloud platforms that require secrets to be sent in decrypted format (e.g. GitHub Actions, Vercel, Render). We\u2019re the only solution that we know of that offers this E2EE-with opt-out ability.
Since our last Show HN (https://news.ycombinator.com/item?id=34510516), we\u2019ve layered authentication with 2FA (more MFA options coming soon) and upgraded all private key encryption/decryption steps to involve a 256-bit protected key decrypted by another key generated via Argon2id KDF from the user\u2019s password. We are starting the process of obtaining SOC2 and other security and compliance certifications. You can read more about our security here: https://infisical.com/docs/security/overview
Beyond this, we\u2019ve added integrations with PM2, AWS Secrets Manager, AWS Parameter Store, Circle CI, Travis CI, GitLab CI/CD, Terraform and more. We\u2019ve also redesigned the main dashboard and added more advanced organizational structure for secrets. Lastly, we have added role-based access control, and improved our Kubernetes operator: your clusters are now auto-redeployed when secrets in Infisical change. In the coming weeks and months, we plan to add features like secret rotation, improved audit logs, SDKs and alerts; as well as increase the range of our integrations; and continue fortifying platform security and stability.
We\u2019ve launched this repo under the MIT license so any developer can use the platform. We don\u2019t charge individual developers or small teams\u2014all the integrations are fully available to everyone. We make money by charging a license fee for enterprise features as well as providing a hosted version and support.
If you found it interesting, you can see a demo video here: https://www.loom.com/share/9a8904c6ecc84d0899d53ee1f7a36385
We\u2019d love for you to give Infisical a try (https://infisical.com) and provide any feedback. If you're interested, our code is available here: https://github.com/infisical/infisical. If we don\u2019t have something, let us know and we\u2019d be happy to build it for you. We look forward to your comments!","title":"Launch HN: Infisical (YC W23) \u2013 Open-source secrets manager for developers","updated_at":"2025-07-30T03:53:08Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"dolftax"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Hi HN! We're Jai and Sanket \u2014 founders of DeepSource (https://deepsource.io). We\u2019re automating objective parts of code review using static analysis to ensure the code is free of common issues (anti-patterns, bug risks, performance bottlenecks, and security flaws) before a reviewer looks at it. This prevents the reviewer from having to manually point out objective issues and ensures they don\u2019t make it to production.
After college, Sanket co-founded DoSelect where I joined as the first engineer. Both of us have been contributing to open-source projects for a few years then. In the beginning, we didn\u2019t have any processes setup around code reviews. We had some IDE plugins to run the linters, and some team members used them as pre-commit hooks. We didn\u2019t have any tests back then and used to spend too much time on some pull requests pointing out improvements and if the pull request was very large, we never reviewed it \u2014 direct merge. Then the engineering team started to grow, multiple folks started contributing to the same repositories and pull requests were often stuck for 5-7 days without any activity. To make sure the new commits are free of the common issues, we added multiple static analysis tools as part of our CI jobs. This became a pain sooner than expected as they were throwing hundreds of lines of logs in the CI and we had to fight through duplicate issues. Critical issues were hidden amongst other minor issues and false-positives, and often missed. Once a while, we tweaked the linter config files with the issues that didn\u2019t make sense to us \u2014 to reduce noise in the CI logs. It didn\u2019t work out after a while and we invested in a couple of commercial code quality tools but ended up disabling them as well. Their issues weren\u2019t categorized or prioritized, analyzers were never updated with new rules, didn\u2019t have any way to report false-positives.
We came across a paper \u2014 Lessons from building static analysis at Google [1]. It is a beautiful paper with the following insights: 1) Static analysis authors should focus on the developer and listen to their feedback 2) Careful developer workflow integration is key for static analysis tool adoption 3) Static analysis tools can scale by crowdsourcing analysis development.
We started building DeepSource in December 2018. The initial release supported Python and integrated with GitHub. Our approach was to first curate all the issues available from open-source static analysis tools, de-duplicate them, add better descriptions with external reference links \u2014 so you just add python analyzer to the `.deepsource.toml` file with some metadata (version, test patterns, exclude patterns,.) and analysis will run on every commit and pull request. To cut down the noise, we only show you newly introduced issues in the pull-request by default, based on the changeset \u2014 and not all the issues present in the changed files. We also provide a way for you to report false-positive issues directly from the dashboard. If the report is valid, we update the analyzers to resolve it within 48 - 72 hours. After this release, we started writing our own rules by walking through the Abstract Syntax Tree to find patterns. So far, we\u2019ve 520+ types of issues in the Python analyzer. Some of the custom issues we added recently are: File opened without the `with` statement, using `yield` in comprehension instead of a generator expression, use items() to iterate over a dictionary.
A few months back, we released the Go analyzer and also added support for GitLab. We\u2019re working on supporting Ruby and JavaScript and integrations for Bitbucket and Azure DevOps. The analyzers are not limited to programming languages, and we added one for Dockerfile and Terraform as well. DeepSource is free to use for open-source repositories and we make money from private repositories based on a per developer per month/year subscription.
Lately, we realized some of the issues were occurring in tens of files. Though DeepSource reports them, one had to manually fix all the occurrences. We just released autofix support in Python for 15 most commonly occurring issues to start with. Autofix uses Concrete Syntax Tree to visit the issue location and make modifications in the code for which the issue is raised, and then generate a patch for that modification. When an autofix is available for an issue, you can view the suggested patch and on approval, a pull request will be created with the fixes. We're working on improving the coverage of issues we can autofix across the analyzers we support.
Give us a try: https://deepsource.io/\nHere is the documentation: https://deepsource.io/docs/
We would love to hear your experience using these tools and feedback/suggestions on how can we improve! Please let us know in the comments. We\u2019re also at founders [at] deepsource.io.
[1] https://research.google/pubs/pub46576/"},"title":{"matchLevel":"none","matchedWords":[],"value":"Launch HN: DeepSource (YC W20) \u2013 Find and fix issues during code reviews"}},"_tags":["story","author_dolftax","story_22547183","launch_hn"],"author":"dolftax","children":[22547544,22547615,22547769,22547847,22547878,22548767,22549510,22552009,22552422,22553054,22554766,22565515,22578438],"created_at":"2020-03-11T16:38:02Z","created_at_i":1583944682,"num_comments":27,"objectID":"22547183","points":105,"story_id":22547183,"story_text":"Hi HN! We're Jai and Sanket \u2014 founders of DeepSource (https://deepsource.io). We\u2019re automating objective parts of code review using static analysis to ensure the code is free of common issues (anti-patterns, bug risks, performance bottlenecks, and security flaws) before a reviewer looks at it. This prevents the reviewer from having to manually point out objective issues and ensures they don\u2019t make it to production.
After college, Sanket co-founded DoSelect where I joined as the first engineer. Both of us have been contributing to open-source projects for a few years then. In the beginning, we didn\u2019t have any processes setup around code reviews. We had some IDE plugins to run the linters, and some team members used them as pre-commit hooks. We didn\u2019t have any tests back then and used to spend too much time on some pull requests pointing out improvements and if the pull request was very large, we never reviewed it \u2014 direct merge. Then the engineering team started to grow, multiple folks started contributing to the same repositories and pull requests were often stuck for 5-7 days without any activity. To make sure the new commits are free of the common issues, we added multiple static analysis tools as part of our CI jobs. This became a pain sooner than expected as they were throwing hundreds of lines of logs in the CI and we had to fight through duplicate issues. Critical issues were hidden amongst other minor issues and false-positives, and often missed. Once a while, we tweaked the linter config files with the issues that didn\u2019t make sense to us \u2014 to reduce noise in the CI logs. It didn\u2019t work out after a while and we invested in a couple of commercial code quality tools but ended up disabling them as well. Their issues weren\u2019t categorized or prioritized, analyzers were never updated with new rules, didn\u2019t have any way to report false-positives.
We came across a paper \u2014 Lessons from building static analysis at Google [1]. It is a beautiful paper with the following insights: 1) Static analysis authors should focus on the developer and listen to their feedback 2) Careful developer workflow integration is key for static analysis tool adoption 3) Static analysis tools can scale by crowdsourcing analysis development.
We started building DeepSource in December 2018. The initial release supported Python and integrated with GitHub. Our approach was to first curate all the issues available from open-source static analysis tools, de-duplicate them, add better descriptions with external reference links \u2014 so you just add python analyzer to the `.deepsource.toml` file with some metadata (version, test patterns, exclude patterns,.) and analysis will run on every commit and pull request. To cut down the noise, we only show you newly introduced issues in the pull-request by default, based on the changeset \u2014 and not all the issues present in the changed files. We also provide a way for you to report false-positive issues directly from the dashboard. If the report is valid, we update the analyzers to resolve it within 48 - 72 hours. After this release, we started writing our own rules by walking through the Abstract Syntax Tree to find patterns. So far, we\u2019ve 520+ types of issues in the Python analyzer. Some of the custom issues we added recently are: File opened without the `with` statement, using `yield` in comprehension instead of a generator expression, use items() to iterate over a dictionary.
A few months back, we released the Go analyzer and also added support for GitLab. We\u2019re working on supporting Ruby and JavaScript and integrations for Bitbucket and Azure DevOps. The analyzers are not limited to programming languages, and we added one for Dockerfile and Terraform as well. DeepSource is free to use for open-source repositories and we make money from private repositories based on a per developer per month/year subscription.
Lately, we realized some of the issues were occurring in tens of files. Though DeepSource reports them, one had to manually fix all the occurrences. We just released autofix support in Python for 15 most commonly occurring issues to start with. Autofix uses Concrete Syntax Tree to visit the issue location and make modifications in the code for which the issue is raised, and then generate a patch for that modification. When an autofix is available for an issue, you can view the suggested patch and on approval, a pull request will be created with the fixes. We're working on improving the coverage of issues we can autofix across the analyzers we support.
Give us a try: https://deepsource.io/\nHere is the documentation: https://deepsource.io/docs/
We would love to hear your experience using these tools and feedback/suggestions on how can we improve! Please let us know in the comments. We\u2019re also at founders [at] deepsource.io.
[1] https://research.google/pubs/pub46576/","title":"Launch HN: DeepSource (YC W20) \u2013 Find and fix issues during code reviews","updated_at":"2024-09-20T05:51:18Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"kole78"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Hey HN, we are Remen, Ben, and Nick, the founders of Propify (https://getpropify.com), an API aggregator for residential property management. We abstract over archaic APIs and merge them into a single modern API for the real estate industry, giving companies access to multiple property management systems (PMSs) via a REST API. Think merge.dev or Plaid for real estate.
Property managers nowadays use software to operate residential rental properties. Our customers are not these property managers directly, but companies who provide services to both property managers and renters. Our customers are solving problems around resident screening, security, parking, maintenance, etc., which property managers typically outsource.
Compared to most other industries in 2023, property management still runs on old tech with bad/wrong/absent API documentation. Creating and maintaining integrations with these systems is incredibly painful (1999 called and wants to tell you about its cool new SOAP technology!)
As an example of what we\u2019re solving for, one prospective customer told us they regularly get 503 (service unavailable) errors from one of these PMSs at the beginning of each month because the system can\u2019t process rent payments and other requests at the same time. We address challenges like this using an exponential backoff retry strategy.
We abstract over all these APIs to give our customers software they can reasonably use. Our goal is to eliminate old tech, poor docs, and unreliable infra for our customers so they can focus on delivering value instead of fighting with integrations.
We offer a tested RESTful API with accurate documentation and modern architecture that we can scale. In addition, we want to make the developer experience as good as possible with things like webhooks, SDKs, websockets, and even a GraphQL API (coming later this year).
Before Propify, we built a rent payment app to bridge the technology gap between renters and landlords. Then we encountered the pain of PMS integrations and decided to pivot and solve that problem instead.
dang suggested that we include a product demo or video but since our core product is an API, there\u2019s not that much to show\u2014sorry! But our docs are here: https://docs.getpropify.com/, and if you\u2019re working/interested in this space and have your own credentials for one of our supported integrations, we\u2019ll be happy to get you a sandbox account and a demo.
This industry has been stagnant because of the barrier to entry for integrating with these vital PM systems. Our goal is to unlock innovation by pulling real estate tech into the modern world. Developer experience is incredibly important to us, and we are actively looking for areas where we can improve. We welcome your feedback, questions, and comments!"},"title":{"matchLevel":"none","matchedWords":[],"value":"Launch HN: Propify (YC W23) \u2013 Property Management System API Aggregator"}},"_tags":["story","author_kole78","story_35170955","launch_hn"],"author":"kole78","children":[35171222,35171232,35171276,35171296,35171540,35171584,35171792,35173057,35173184,35173355,35173494,35173599,35173758,35173904,35174244,35175159,35175945,35176499,35176502,35179781,35181920,35182632,35185601],"created_at":"2023-03-15T16:40:25Z","created_at_i":1678898425,"num_comments":56,"objectID":"35170955","points":95,"story_id":35170955,"story_text":"Hey HN, we are Remen, Ben, and Nick, the founders of Propify (https://getpropify.com), an API aggregator for residential property management. We abstract over archaic APIs and merge them into a single modern API for the real estate industry, giving companies access to multiple property management systems (PMSs) via a REST API. Think merge.dev or Plaid for real estate.
Property managers nowadays use software to operate residential rental properties. Our customers are not these property managers directly, but companies who provide services to both property managers and renters. Our customers are solving problems around resident screening, security, parking, maintenance, etc., which property managers typically outsource.
Compared to most other industries in 2023, property management still runs on old tech with bad/wrong/absent API documentation. Creating and maintaining integrations with these systems is incredibly painful (1999 called and wants to tell you about its cool new SOAP technology!)
As an example of what we\u2019re solving for, one prospective customer told us they regularly get 503 (service unavailable) errors from one of these PMSs at the beginning of each month because the system can\u2019t process rent payments and other requests at the same time. We address challenges like this using an exponential backoff retry strategy.
We abstract over all these APIs to give our customers software they can reasonably use. Our goal is to eliminate old tech, poor docs, and unreliable infra for our customers so they can focus on delivering value instead of fighting with integrations.
We offer a tested RESTful API with accurate documentation and modern architecture that we can scale. In addition, we want to make the developer experience as good as possible with things like webhooks, SDKs, websockets, and even a GraphQL API (coming later this year).
Before Propify, we built a rent payment app to bridge the technology gap between renters and landlords. Then we encountered the pain of PMS integrations and decided to pivot and solve that problem instead.
dang suggested that we include a product demo or video but since our core product is an API, there\u2019s not that much to show\u2014sorry! But our docs are here: https://docs.getpropify.com/, and if you\u2019re working/interested in this space and have your own credentials for one of our supported integrations, we\u2019ll be happy to get you a sandbox account and a demo.
This industry has been stagnant because of the barrier to entry for integrating with these vital PM systems. Our goal is to unlock innovation by pulling real estate tech into the modern world. Developer experience is incredibly important to us, and we are actively looking for areas where we can improve. We welcome your feedback, questions, and comments!","title":"Launch HN: Propify (YC W23) \u2013 Property Management System API Aggregator","updated_at":"2024-09-20T13:38:35Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"advaitruia"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Hi everyone! My name is Advait and I co-founded SuperTokens along with\n@rishabhpoddar (https://supertokens.io/). SuperTokens helps companies\nsecurely manage their session tokens, saving developer time and\npreventing identity theft.
We started SuperTokens 1.5 years ago when we were building a consumer\napp and wanted our users to be logged in for a long time in a secure\nway. When it came to managing user sessions, there was a lot of\nambiguity. We read many forums (Reddit, Stackoverflow) and blogs, and\nfound that developers were arguing about best practices, such as using\nlocal storage vs cookies, implementing JWTs, etc. We had to do a lot\nof the first principles thinking ourselves to understand the\ntradeoffs. Around the same time, Facebook, Docker, Gitlab, Youtube,\nUber were in the news for session vulnerabilities.
Stealing a user\u2019s session allows you to access their account as if you\nhad their username and password. Hence being able to mitigate against\nthis is important. We\u2019ve audited companies and found large session\nvulnerabilities that they were not aware of. For a YC company, we were\nable to pull information on users that we shouldn\u2019t have had access to.
Through our research, we built something internally and decided to\nwrite a blog post [1] explaining how our system works. While\nSuperTokens is not currently open source, you can see the original\ncodebase on Github [2].
Building a good solution for sessions requires a lot of specialised\nknowledge and time that could otherwise be spent on building your core\nbusiness logic. Detecting session theft reliably is difficult. There\nare multiple race conditions, edge cases and network issues that need\nto be thought about. In fact, one of our libraries that solves a\ndifficult race condition has 100K downloads / week and is even used by\nAuth0 [3]
SuperToken mitigates against all session attacks (XSS, CSRF, etc) by\nimplementing best practices. For a full list of types of attacks with\nreal life examples please see [4]. However, it is not possible to\nmitigate against all attacks (for eg: social engineering) and hence,\nSuperTokens is also able to detect session theft. We use rotating\nrefresh tokens as per the official OAuth specifications in RFC 6819\n[5]. Auth0 has also started offering this, but due to their setup,\nthey cannot use httpOnly cookies to store these tokens and this goes\nagainst popular compliance recommendations.
Besides security, SuperTokens also offers improved API performance and\ndeveloper convenience. For clustered and distributed environments,\nsession verification for each API takes < 1 millisecond. You can get a\nuser\u2019s ID and access role without any database lookup. SuperTokens can\nbe implemented in 15 minutes, provides a simple API and has clear\ndocumentation. We abstract away complexities of token management by\nproviding frontend and backend SDKs.
In the coming months we plan to offer Access Control, Internal Auth\nbetween services and for internal tools (i.e. recent Twitter hack was\nthrough unauthorized access to an internal tool), and more! We're\nstill experimenting with pricing, so you won't find this on our\nwebsite, but we'd love to hear your thoughts about it.
Thank you for reading! We\u2019d love to hear what this community\nspecifically has to say and if you have any experience dealing with\nthis. We\u2019d appreciate any feedback!
----------
Footnotes:
[1] - Blog post: https://medium.com/hackernoon/all-you-need-to-know-about-use...
[2] - Github: https://github.com/supertokens/supertokens-core
[3] - Library used by Auth0: https://www.npmjs.com/package/browser-tabs-lock
[4] - List of attacks: https://supertokens.io/pdf/attackshomepagev1
[5] - OAuth RFC 6819: https://tools.ietf.org/html/rfc6819#section-5.2.2.3"},"title":{"matchLevel":"none","matchedWords":[],"value":"Launch HN: SuperTokens (YC S20) \u2013 Securely manage session tokens"}},"_tags":["story","author_advaitruia","story_24306572","launch_hn"],"author":"advaitruia","children":[24306772,24306909,24306923,24307175,24307542,24307575,24309025,24309084,24309302,24309549,24309595,24310077,24313999,24314164,24314652],"created_at":"2020-08-28T16:08:07Z","created_at_i":1598630887,"num_comments":61,"objectID":"24306572","points":84,"story_id":24306572,"story_text":"Hi everyone! My name is Advait and I co-founded SuperTokens along with\n@rishabhpoddar (https://supertokens.io/). SuperTokens helps companies\nsecurely manage their session tokens, saving developer time and\npreventing identity theft.
We started SuperTokens 1.5 years ago when we were building a consumer\napp and wanted our users to be logged in for a long time in a secure\nway. When it came to managing user sessions, there was a lot of\nambiguity. We read many forums (Reddit, Stackoverflow) and blogs, and\nfound that developers were arguing about best practices, such as using\nlocal storage vs cookies, implementing JWTs, etc. We had to do a lot\nof the first principles thinking ourselves to understand the\ntradeoffs. Around the same time, Facebook, Docker, Gitlab, Youtube,\nUber were in the news for session vulnerabilities.
Stealing a user\u2019s session allows you to access their account as if you\nhad their username and password. Hence being able to mitigate against\nthis is important. We\u2019ve audited companies and found large session\nvulnerabilities that they were not aware of. For a YC company, we were\nable to pull information on users that we shouldn\u2019t have had access to.
Through our research, we built something internally and decided to\nwrite a blog post [1] explaining how our system works. While\nSuperTokens is not currently open source, you can see the original\ncodebase on Github [2].
Building a good solution for sessions requires a lot of specialised\nknowledge and time that could otherwise be spent on building your core\nbusiness logic. Detecting session theft reliably is difficult. There\nare multiple race conditions, edge cases and network issues that need\nto be thought about. In fact, one of our libraries that solves a\ndifficult race condition has 100K downloads / week and is even used by\nAuth0 [3]
SuperToken mitigates against all session attacks (XSS, CSRF, etc) by\nimplementing best practices. For a full list of types of attacks with\nreal life examples please see [4]. However, it is not possible to\nmitigate against all attacks (for eg: social engineering) and hence,\nSuperTokens is also able to detect session theft. We use rotating\nrefresh tokens as per the official OAuth specifications in RFC 6819\n[5]. Auth0 has also started offering this, but due to their setup,\nthey cannot use httpOnly cookies to store these tokens and this goes\nagainst popular compliance recommendations.
Besides security, SuperTokens also offers improved API performance and\ndeveloper convenience. For clustered and distributed environments,\nsession verification for each API takes < 1 millisecond. You can get a\nuser\u2019s ID and access role without any database lookup. SuperTokens can\nbe implemented in 15 minutes, provides a simple API and has clear\ndocumentation. We abstract away complexities of token management by\nproviding frontend and backend SDKs.
In the coming months we plan to offer Access Control, Internal Auth\nbetween services and for internal tools (i.e. recent Twitter hack was\nthrough unauthorized access to an internal tool), and more! We're\nstill experimenting with pricing, so you won't find this on our\nwebsite, but we'd love to hear your thoughts about it.
Thank you for reading! We\u2019d love to hear what this community\nspecifically has to say and if you have any experience dealing with\nthis. We\u2019d appreciate any feedback!
----------
Footnotes:
[1] - Blog post: https://medium.com/hackernoon/all-you-need-to-know-about-use...
[2] - Github: https://github.com/supertokens/supertokens-core
[3] - Library used by Auth0: https://www.npmjs.com/package/browser-tabs-lock
[4] - List of attacks: https://supertokens.io/pdf/attackshomepagev1
[5] - OAuth RFC 6819: https://tools.ietf.org/html/rfc6819#section-5.2.2.3","title":"Launch HN: SuperTokens (YC S20) \u2013 Securely manage session tokens","updated_at":"2024-10-14T18:31:32Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"jag729"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Hi HN! We\u2019re Jagath and Vignesh, co-founders of Gallery (usegallery.com). We provision on-demand pre-prod environments on your own cloud account so you can do manual QA, share feature previews with team members/clients, and parallelize automated testing & CI processes, all without bottlenecking on your staging environment.
Engineers typically have a fixed number of cloud environments, including production, staging, and maybe some additional pre-production environments. They use these to preview features, share work with other team members, do manual QA/automated testing, and more. As the number of engineers grows, having a fixed number of cloud environments becomes a bottleneck. Teams end up queuing for access to staging and so on. Creating additional environments and keeping them in sync, though, is a major headache, especially when the environments are reasonably complex.
When this problem reaches a boiling point, teams either have to slow down feature development, test on production, or deal with building their own on-demand platform internally. That\u2019s where we come in. We enable on-demand spinup of unlimited environments for quicker development. Engineers use these as environments-per-feature\u2014in parallel\u2014to share previews with QA/other engineers/product people, to create demo environments for clients with features that aren't in production, to run automated testing on ephemeral environments as part of their CI processes, and more.
Vignesh and I are engineers with experience in infra/research at Facebook/Apple/Microsoft. We met as roommates at Caltech. We got into YC with a very different idea (a way for stores to ask customers questions and offer instant recommendations/promotions based on their responses) but soon abandoned it (it was more exciting to us as a technical challenge than to stores as a practical solution) and found ourselves testing different ideas as quickly as we could.
During this period, right before every launch without fail, Vignesh and I would collide on staging: features that worked locally would break on prod infra. We tried to provision our own individual staging environments, but setting them up and keeping them in sync sucked up valuable bandwidth. The gold-standard workflow, in my mind, was the one-click \u201cOn-Demand\u201d environment provisioning I\u2019d had at Facebook, wherein I could click a button and instantiate a live feature preview. We found solutions that promised on-demand environment spin-up, but none of them worked for us; they were either incompatible with our stack (mostly built around App Engine), didn't interface with our cloud provider, or required too much overhead and finessing to set up.
This was the seed for our idea. Talking to larger startups, we realized that the inconveniences we faced were just a few of the major pains faced by bigger engineering teams with nascent DevOps; they often had brittle, scattered workflows around managing their environments and growing queues for features. They needed a solution to flexibly create, destroy, and replicate environments, through both ad-hoc and developer triggers like PR\u2019s and CI builds. While there are a number of existing services that aim to simplify DevOps and/or provide easier workflows around environments, engineering teams we spoke to were either unable or unwilling to use them due to incompatibility with their specific setups.
We realized that a better approach would be to abstract away the specifics of each environment by using infra-as-code as middleware. Infra-as-code solutions like Terraform, CloudFormation, etc. can represent infrastructure thoroughly in a standardized fashion. The majority of people we talked to were maintaining their infrastructure using Terraform or something similar, and it was easy to build out pipelines for those who didn't by using Terraform under the hood. This was the key to what became Gallery.
Since every company manages their environments differently (cloud provider, use of K8s or infra-as-code, cloud-managed services, security/privacy layers), creating a product that can work with them all out-of-the-box is a challenge. Unlike other solutions on the market, Gallery isn't a Kubernetes orchestrator that replicates containerized environments; rather, we can represent entire cloud projects, including managed services (e.g. App Engine, Elastic Beanstalk, etc.), spin them up in sandboxed cloud projects, and automate their teardown as well.
To create cloud resources on your GCP/AWS accounts, we use Terraform as a middleware. For select cloud services, we can understand an existing project, generate the Terraform corresponding to it, and use it to spin up your resources. We allow users to link their own Terraform code to allow spin-up of more complex environments as well. When you trigger the creation of a new environment, we spin up a worker that applies the Terraform template and performs any post-deploy actions to seed the newly generated infrastructure (for example, copying over initialization data into databases). We store your Terraform state file and manage tearing down environments when they outlive their TTL, or deletion is triggered by a specific action (e.g. merging a pull request).
Once we spin up infrastructure, we pull application code from your app repositories, and allow you to specify build and deployment commands that target the newly created environment. This lets you use your current deployment scripts on Gallery almost as-is, for fast and straightforward onboarding. We have integrations with Github/Gitlab around the Pull Request/Merge Request flow, letting you create environments that track a branch whenever a PR is created.
We're a SaaS product, and we have pricing tiers based on the number of concurrent environments. We\u2019ve prepared a live demo account that you can play around with as a read-only team member here: http://a.getgallery.co/teams/14. I've also prepared a demo video of how to set up ephemeral environments per-PR in just a couple of minutes (https://www.loom.com/share/26165ea69f0d4b7b974019bdf72e5d11). You can see our docs here: docs.usegallery.com.
Thank you so much for reading! We\u2019d love to hear your thoughts, ideas, and experiences around the problem we\u2019re tackling and the solution we\u2019re proposing!"},"title":{"matchLevel":"none","matchedWords":[],"value":"Launch HN: Gallery (YC S21) \u2013 On-demand environments on any cloud provider"}},"_tags":["story","author_jag729","story_29164556","launch_hn"],"author":"jag729","children":[29164927,29166384,29166416,29166531,29167229,29167255,29168841,29187402],"created_at":"2021-11-09T17:28:24Z","created_at_i":1636478904,"num_comments":22,"objectID":"29164556","points":58,"story_id":29164556,"story_text":"Hi HN! We\u2019re Jagath and Vignesh, co-founders of Gallery (usegallery.com). We provision on-demand pre-prod environments on your own cloud account so you can do manual QA, share feature previews with team members/clients, and parallelize automated testing & CI processes, all without bottlenecking on your staging environment.
Engineers typically have a fixed number of cloud environments, including production, staging, and maybe some additional pre-production environments. They use these to preview features, share work with other team members, do manual QA/automated testing, and more. As the number of engineers grows, having a fixed number of cloud environments becomes a bottleneck. Teams end up queuing for access to staging and so on. Creating additional environments and keeping them in sync, though, is a major headache, especially when the environments are reasonably complex.
When this problem reaches a boiling point, teams either have to slow down feature development, test on production, or deal with building their own on-demand platform internally. That\u2019s where we come in. We enable on-demand spinup of unlimited environments for quicker development. Engineers use these as environments-per-feature\u2014in parallel\u2014to share previews with QA/other engineers/product people, to create demo environments for clients with features that aren't in production, to run automated testing on ephemeral environments as part of their CI processes, and more.
Vignesh and I are engineers with experience in infra/research at Facebook/Apple/Microsoft. We met as roommates at Caltech. We got into YC with a very different idea (a way for stores to ask customers questions and offer instant recommendations/promotions based on their responses) but soon abandoned it (it was more exciting to us as a technical challenge than to stores as a practical solution) and found ourselves testing different ideas as quickly as we could.
During this period, right before every launch without fail, Vignesh and I would collide on staging: features that worked locally would break on prod infra. We tried to provision our own individual staging environments, but setting them up and keeping them in sync sucked up valuable bandwidth. The gold-standard workflow, in my mind, was the one-click \u201cOn-Demand\u201d environment provisioning I\u2019d had at Facebook, wherein I could click a button and instantiate a live feature preview. We found solutions that promised on-demand environment spin-up, but none of them worked for us; they were either incompatible with our stack (mostly built around App Engine), didn't interface with our cloud provider, or required too much overhead and finessing to set up.
This was the seed for our idea. Talking to larger startups, we realized that the inconveniences we faced were just a few of the major pains faced by bigger engineering teams with nascent DevOps; they often had brittle, scattered workflows around managing their environments and growing queues for features. They needed a solution to flexibly create, destroy, and replicate environments, through both ad-hoc and developer triggers like PR\u2019s and CI builds. While there are a number of existing services that aim to simplify DevOps and/or provide easier workflows around environments, engineering teams we spoke to were either unable or unwilling to use them due to incompatibility with their specific setups.
We realized that a better approach would be to abstract away the specifics of each environment by using infra-as-code as middleware. Infra-as-code solutions like Terraform, CloudFormation, etc. can represent infrastructure thoroughly in a standardized fashion. The majority of people we talked to were maintaining their infrastructure using Terraform or something similar, and it was easy to build out pipelines for those who didn't by using Terraform under the hood. This was the key to what became Gallery.
Since every company manages their environments differently (cloud provider, use of K8s or infra-as-code, cloud-managed services, security/privacy layers), creating a product that can work with them all out-of-the-box is a challenge. Unlike other solutions on the market, Gallery isn't a Kubernetes orchestrator that replicates containerized environments; rather, we can represent entire cloud projects, including managed services (e.g. App Engine, Elastic Beanstalk, etc.), spin them up in sandboxed cloud projects, and automate their teardown as well.
To create cloud resources on your GCP/AWS accounts, we use Terraform as a middleware. For select cloud services, we can understand an existing project, generate the Terraform corresponding to it, and use it to spin up your resources. We allow users to link their own Terraform code to allow spin-up of more complex environments as well. When you trigger the creation of a new environment, we spin up a worker that applies the Terraform template and performs any post-deploy actions to seed the newly generated infrastructure (for example, copying over initialization data into databases). We store your Terraform state file and manage tearing down environments when they outlive their TTL, or deletion is triggered by a specific action (e.g. merging a pull request).
Once we spin up infrastructure, we pull application code from your app repositories, and allow you to specify build and deployment commands that target the newly created environment. This lets you use your current deployment scripts on Gallery almost as-is, for fast and straightforward onboarding. We have integrations with Github/Gitlab around the Pull Request/Merge Request flow, letting you create environments that track a branch whenever a PR is created.
We're a SaaS product, and we have pricing tiers based on the number of concurrent environments. We\u2019ve prepared a live demo account that you can play around with as a read-only team member here: http://a.getgallery.co/teams/14. I've also prepared a demo video of how to set up ephemeral environments per-PR in just a couple of minutes (https://www.loom.com/share/26165ea69f0d4b7b974019bdf72e5d11). You can see our docs here: docs.usegallery.com.
Thank you so much for reading! We\u2019d love to hear your thoughts, ideas, and experiences around the problem we\u2019re tackling and the solution we\u2019re proposing!","title":"Launch HN: Gallery (YC S21) \u2013 On-demand environments on any cloud provider","updated_at":"2024-09-20T09:49:27Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"acorn221"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"I'm not super experienced with cryptography but I had some spare time on my hands so I decided to make CubeAuthn and turn it into a paper.
Repo here: https://github.com/Acorn221/CubeAuthn. Feel free to ask questions!
---
Abstract:
We present a novel authentication system that transforms a Rubik's cube into a physical key for digital authentication. By reading the cube's specific arrangement among 43 quintillion possible configurations, our system generates FIDO2-compatible credentials on-demand. Unlike traditional security tokens that store credentials, the cube itself becomes part of the key with its physical state forming a deterministic seed for keypair generation. Our proof-of-concept, CubeAuthn, demonstrates this concept with a browser extension that authenticates users on WebAuthn-enabled sites using the cube's physical state as the cryptographic seed."},"title":{"matchLevel":"none","matchedWords":[],"value":"My first paper: A practical implementation of Rubiks cube based passkeys"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://ieeexplore.ieee.org/document/11280260"}},"_tags":["story","author_acorn221","story_46533315"],"author":"acorn221","children":[46533316,46533743,46534044,46534620,46534963,46535810,46535852,46535952,46611532],"created_at":"2026-01-07T21:38:56Z","created_at_i":1767821936,"num_comments":22,"objectID":"46533315","points":55,"story_id":46533315,"story_text":"I'm not super experienced with cryptography but I had some spare time on my hands so I decided to make CubeAuthn and turn it into a paper.
Repo here: https://github.com/Acorn221/CubeAuthn. Feel free to ask questions!
---
Abstract:
We present a novel authentication system that transforms a Rubik's cube into a physical key for digital authentication. By reading the cube's specific arrangement among 43 quintillion possible configurations, our system generates FIDO2-compatible credentials on-demand. Unlike traditional security tokens that store credentials, the cube itself becomes part of the key with its physical state forming a deterministic seed for keypair generation. Our proof-of-concept, CubeAuthn, demonstrates this concept with a browser extension that authenticates users on WebAuthn-enabled sites using the cube's physical state as the cryptographic seed.","title":"My first paper: A practical implementation of Rubiks cube based passkeys","updated_at":"2026-08-01T03:12:35Z","url":"https://ieeexplore.ieee.org/document/11280260"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"nikTheo"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Hi HN community,
We are Nikolas and Giannis, founders of Appteum. For the last few months we've been building Appteum and can now share our public Beta with you. Appteum is a low-code Backend development platform that makes it easy for developers to configure the backend for their apps. You can configure your backend in our web app and then using our Typescript SDK you can interact with your backend in your code.
Why we built this:
- We couldn\u2019t find a low code tool that provides the backend abstractions we needed but at the same time retain the flexibility of dropping down into code.
- We found current low-code tools like Bubble and Retool don\u2019t offer a great experience for developers. We prefer using our own IDEs, version control etc.
- Sometimes, you need to use a service that is not supported by the low-code platform. It would be great if you could write a few lines of code that would make it easy to integrate into your app.
- From our experience, the traditional way of building APIs is time consuming and repetitive. It would be great if the API would reflect any change on data or security definitions automatically.
Our beta version lets you:
- Create Objects, Fields and Relationships (Objects are equivalent to tables in relational databases).
- Define object-level and field-level security for your users.
- Query your data over our API using a simple SQL syntax.
- Get access to your objects data instantly with our APIs.
- Import our Typescript SDK in your app and conveniently access your backend configuration.
Our business model is to give developers and their companies a development platform that abstracts away the backend development of an app.
While it is a beta, we believe that even today the experience is meaningful. We are working everyday to make Appteum better for our users. Please give it a shot at appteum.com and let us know how it goes. You will notice that a log-in is required, we don\u2019t collect any telemetry data of our users!
- Main website: [https://appteum.com]
- Portal: [https://admin.appteum.com]
- Docs: [https://docs.appteum.com]
Join our community on Discord [https://discord.gg/8ETmPedepG]
Follow us on LinkedIn [https://www.linkedin.com/company/appteum]
Let us know what you think! Ask us anything!"},"title":{"matchLevel":"none","matchedWords":[],"value":"Show HN: Appteum, a low-code backend development platform build for developers"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://www.appteum.com//"}},"_tags":["story","author_nikTheo","story_35654613","show_hn"],"author":"nikTheo","children":[35665787,35665858,35666217,35666323,35679419],"created_at":"2023-04-21T14:50:18Z","created_at_i":1682088618,"num_comments":11,"objectID":"35654613","points":7,"story_id":35654613,"story_text":"Hi HN community,
We are Nikolas and Giannis, founders of Appteum. For the last few months we've been building Appteum and can now share our public Beta with you. Appteum is a low-code Backend development platform that makes it easy for developers to configure the backend for their apps. You can configure your backend in our web app and then using our Typescript SDK you can interact with your backend in your code.
Why we built this:
- We couldn\u2019t find a low code tool that provides the backend abstractions we needed but at the same time retain the flexibility of dropping down into code.
- We found current low-code tools like Bubble and Retool don\u2019t offer a great experience for developers. We prefer using our own IDEs, version control etc.
- Sometimes, you need to use a service that is not supported by the low-code platform. It would be great if you could write a few lines of code that would make it easy to integrate into your app.
- From our experience, the traditional way of building APIs is time consuming and repetitive. It would be great if the API would reflect any change on data or security definitions automatically.
Our beta version lets you:
- Create Objects, Fields and Relationships (Objects are equivalent to tables in relational databases).
- Define object-level and field-level security for your users.
- Query your data over our API using a simple SQL syntax.
- Get access to your objects data instantly with our APIs.
- Import our Typescript SDK in your app and conveniently access your backend configuration.
Our business model is to give developers and their companies a development platform that abstracts away the backend development of an app.
While it is a beta, we believe that even today the experience is meaningful. We are working everyday to make Appteum better for our users. Please give it a shot at appteum.com and let us know how it goes. You will notice that a log-in is required, we don\u2019t collect any telemetry data of our users!
- Main website: [https://appteum.com]
- Portal: [https://admin.appteum.com]
- Docs: [https://docs.appteum.com]
Join our community on Discord [https://discord.gg/8ETmPedepG]
Follow us on LinkedIn [https://www.linkedin.com/company/appteum]
Let us know what you think! Ask us anything!","title":"Show HN: Appteum, a low-code backend development platform build for developers","updated_at":"2024-09-20T13:51:07Z","url":"https://www.appteum.com//"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"karlosh"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"If coding gets faster, where should architecture happen?
A feature works. The tests pass. The PR is not huge. The business wants to test it live. Nobody wants to block value delivery because of an architecture concern that may sound abstract in the moment.
But this seems to be getting harder.
AI-assisted development, vibe coding, internal tooling, and better frameworks all reduce the friction of producing code. That is useful. Teams can prototype faster and ship experiments sooner.
The problem is that architectural judgment has not become equally cheap.
The code may work and still make the system worse: duplicated logic, unclear ownership, inconsistent patterns, security gaps, bad boundaries, one-off components that should have been reusable, or features that are hard to remove later.
One option is to force more architecture into code review. But then PRs become slow, frustrating, and full of design debates that are difficult to resolve after the code already exists.
Another option is to merge faster, while making the architecture feedback loop after merge much more explicit. Architecture should already be continuous, but faster code creation may require stronger post-merge mechanisms: reviewing what changed at the system level, checking reuse opportunities, reassessing security assumptions, scheduling refactors, keeping features behind flags, and being willing to disable or rewrite things.
That only works if \u201crefactor later\u201d is an actual process, not a wish.
Has your team changed how it handles architecture as code has become easier to produce? Do you handle this before merge, after merge, or through some continuous review process?"},"title":{"matchLevel":"none","matchedWords":[],"value":"Ask HN: If coding gets faster, where should architecture happen?"}},"_tags":["story","author_karlosh","story_47946850","ask_hn"],"author":"karlosh","children":[47947258,47947501,47949080,47950814,47951414,47953833,47958601,47961805,47969335,47977570],"created_at":"2026-04-29T11:30:02Z","created_at_i":1777462202,"num_comments":7,"objectID":"47946850","points":7,"story_id":47946850,"story_text":"If coding gets faster, where should architecture happen?
A feature works. The tests pass. The PR is not huge. The business wants to test it live. Nobody wants to block value delivery because of an architecture concern that may sound abstract in the moment.
But this seems to be getting harder.
AI-assisted development, vibe coding, internal tooling, and better frameworks all reduce the friction of producing code. That is useful. Teams can prototype faster and ship experiments sooner.
The problem is that architectural judgment has not become equally cheap.
The code may work and still make the system worse: duplicated logic, unclear ownership, inconsistent patterns, security gaps, bad boundaries, one-off components that should have been reusable, or features that are hard to remove later.
One option is to force more architecture into code review. But then PRs become slow, frustrating, and full of design debates that are difficult to resolve after the code already exists.
Another option is to merge faster, while making the architecture feedback loop after merge much more explicit. Architecture should already be continuous, but faster code creation may require stronger post-merge mechanisms: reviewing what changed at the system level, checking reuse opportunities, reassessing security assumptions, scheduling refactors, keeping features behind flags, and being willing to disable or rewrite things.
That only works if \u201crefactor later\u201d is an actual process, not a wish.
Has your team changed how it handles architecture as code has become easier to produce? Do you handle this before merge, after merge, or through some continuous review process?","title":"Ask HN: If coding gets faster, where should architecture happen?","updated_at":"2026-05-12T11:42:47Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"Amyang"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Built a blockchain where you mine blocks by accomplishing real-world goals instead of solving computational puzzles. AI verifies your achievements, peers review them, and successful ones become permanent blockchain records.
Demo: https://proof-of-awesome.app
How it works:
Submit achievements like "ran 5km today" or "learned a new song" with photo evidence\nAI validates achievement authenticity and difficulty\nCommunity peer review for quality control\nAccepted achievements earn you the right to mine the next block\nEarn AwesomeCoins as rewards, permanently recorded on-chain
Technical implementation:
React + MUI frontend with real-time updates via Socket.io\nNode.js + MongoDB backend with simplified blockchain data structure\nDeterministic phase transitions synchronized across network nodes\nBuilt-in achievement categories (fitness, gaming, lifestyle, general)
Why this matters: Traditional proof-of-work wastes energy on abstract math. This creates value through actual human accomplishment while maintaining blockchain security properties. Every block represents someone doing something genuinely awesome in the real world.\nNo crypto speculation, no fees - just a permanent record of human achievement.\nGitHub: https://github.com/AmyangXYZ/proof-of-awesome"},"title":{"matchLevel":"none","matchedWords":[],"value":"Show HN: Blockchain that mines blocks with real achievements, not math puzzles"}},"_tags":["story","author_Amyang","story_45154127","show_hn"],"author":"Amyang","children":[45164825,45180232],"created_at":"2025-09-07T00:22:39Z","created_at_i":1757204559,"num_comments":2,"objectID":"45154127","points":5,"story_id":45154127,"story_text":"Built a blockchain where you mine blocks by accomplishing real-world goals instead of solving computational puzzles. AI verifies your achievements, peers review them, and successful ones become permanent blockchain records.
Demo: https://proof-of-awesome.app
How it works:
Submit achievements like "ran 5km today" or "learned a new song" with photo evidence\nAI validates achievement authenticity and difficulty\nCommunity peer review for quality control\nAccepted achievements earn you the right to mine the next block\nEarn AwesomeCoins as rewards, permanently recorded on-chain
Technical implementation:
React + MUI frontend with real-time updates via Socket.io\nNode.js + MongoDB backend with simplified blockchain data structure\nDeterministic phase transitions synchronized across network nodes\nBuilt-in achievement categories (fitness, gaming, lifestyle, general)
Why this matters: Traditional proof-of-work wastes energy on abstract math. This creates value through actual human accomplishment while maintaining blockchain security properties. Every block represents someone doing something genuinely awesome in the real world.\nNo crypto speculation, no fees - just a permanent record of human achievement.\nGitHub: https://github.com/AmyangXYZ/proof-of-awesome","title":"Show HN: Blockchain that mines blocks with real achievements, not math puzzles","updated_at":"2026-03-05T22:40:17Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"david_"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"I assume this has been done before: Does anyone know good presentations on how to convince a CTO to adopt more of a DevOps culture? Main worries will be around security (separation of duties, ...) and risking reliability (we are talking getting in trouble for deviating from 99.999% here).
Some background: Imagine you work in a company, you live your life happily with your ops friends: You are in the cloud, your rolling out more and more resources in terraform, your build pipeline is automated, tools are not bleeding edge but quite modern, you put hard work into automating as much as possible for your developer friends. You have all this with a few restrictions as you have quite sensitive data (that's also why you have a few security related certifications as an organization).
Then this very happy day comes along and you get rewarded for all the hard work and get acquired. The cool thing is you now have the chance to convince a much larger organisation about DevOps culture etc.
Pointers are appreciated!
Just to add maybe: The people working there are very smart and have successfully built a system which is above 99,999% in availability. They understand the benefits in an abstract way but are not sure how they can keep their reliability and security if they try to do things differently. I assume the goal of the presentation needs to be two things:
1. Showing that there is a way to get security and reliability even with DevOps
2. The hidden costs and risks to the business of not improving your processes and being able to introduce changes quickly and innovate"},"title":{"matchLevel":"none","matchedWords":[],"value":"Ask HN: How to Sell the DevOps Mindset"}},"_tags":["story","author_david_","story_21217964","ask_hn"],"author":"david_","children":[21218021,21218081,21218558,21228695],"created_at":"2019-10-10T18:55:53Z","created_at_i":1570733753,"num_comments":4,"objectID":"21217964","points":4,"story_id":21217964,"story_text":"I assume this has been done before: Does anyone know good presentations on how to convince a CTO to adopt more of a DevOps culture? Main worries will be around security (separation of duties, ...) and risking reliability (we are talking getting in trouble for deviating from 99.999% here).
Some background: Imagine you work in a company, you live your life happily with your ops friends: You are in the cloud, your rolling out more and more resources in terraform, your build pipeline is automated, tools are not bleeding edge but quite modern, you put hard work into automating as much as possible for your developer friends. You have all this with a few restrictions as you have quite sensitive data (that's also why you have a few security related certifications as an organization).
Then this very happy day comes along and you get rewarded for all the hard work and get acquired. The cool thing is you now have the chance to convince a much larger organisation about DevOps culture etc.
Pointers are appreciated!
Just to add maybe: The people working there are very smart and have successfully built a system which is above 99,999% in availability. They understand the benefits in an abstract way but are not sure how they can keep their reliability and security if they try to do things differently. I assume the goal of the presentation needs to be two things:
1. Showing that there is a way to get security and reliability even with DevOps
2. The hidden costs and risks to the business of not improving your processes and being able to introduce changes quickly and innovate","title":"Ask HN: How to Sell the DevOps Mindset","updated_at":"2024-09-20T04:56:13Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"sys-ronin"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"I am a 40 years old jobless sys-admin with no cs degree and no development experience and 25 yeras of system knowledge. I built a fully encrypted writing environment where I can write with focus forgetting about the application. Here ai was my code translator while I strictly was the architect and instructor. It all started when i asked myself that "why and how i remember any past memory instantly without searching inside my head". This became the design principle of my app. Thus I solved a fundamental git problem of tracking a single note throughout the history by embedding uuid in every commit.
Its responsive data-as-UI based interface keeps the app (nearly) learning curve free. Navigating deep hierarchies is easy using numbered fisheye jump system without forward button. Every operation is in one or two keystroke like v(view), c(create), d(delete), r(rename), (j)ump s(sync), (s)earch, b(back) or v1, d1, j1, jb etc. It is built using python standard library (no other dependency), Git, cryptography standard primitive (embedded). I used git-filter-repo programaically for permanent item erasure using uuid from inside the application. It has full timeline for each item (note, file, subnotebook) to see the entire life cycle from create to erase with tombstone. Its subnotebook hierarchy can be upto any depth. It supports 80 file types with syntax highlighted editing with export feature for files. It has activity viewer inside every notebook or subnotebook. It shows your last 50 activities in the notebook. Searching is easy like "s files* file.md date* 02-04-2026 in* notebook/subnotebook_name", "s note_name date* 01-04-2026 05-04-2026", "s edited* any_text thisweek" "s in notebook/subnotebook_name" or just "s anytext".
Notebook can be encrypted using 8-24 words BIP-39 phrases and use password for regular lock/unlock. It is encrypted using standard AES-GCM and also portable. It can show password change log in each notebook management screen. Key vaults are hardware bound yet portable and a usb drive can act as TPM like security. It means when the keys are not reachable, notebooks can't be accessed. The application architecture and data structure is decoupled. Where app architecture allows the app, notebook and key vault can be in three different locations or even in different systems and data architecture allows metadata and content remain separated in different files inside each notebook folder linked via UUID. Git is implemented for doing item level (not file level) versioning and temporal search with uuid based commit metadata. Here commit metadata is not encrypted, though doable modifying the existing code if required. Every notebook is self contained in just a movable single folder. The architectur also enables optional e2ee conflict free sync using github and other platforms. It does not need someone to be a git expert to use the application and cloud vendor cannot see the data even with public visibility.
I will request respected HN people to go through the documents and the story_n_constraint.md file, that will explain the what, how, why in details. I also put a couple of abstract ideas inside the repo (what_can_be_done files). I want to thank the creators of Python, Git, cryptography, nvim, micro and git-filter-repo. Their tools came together and turned a concept into a working application.
The post, the GitHub repository, and all source code and documentation are part of the prior art with appropriete license (Public + timestamped + enabling)
repo:\n* https://github.com/sys-ronin/terminal-notes *
requirement:\nlinux/mac/win/docker, python 3.13, git, nvim/micro or any terminal based editor (can be configured from config.json inside root folder),internet for using github sync\nexample - python3 terminal_notes_ui.py (from linux)\n* tested on debian 13 only
git clone https://github.com/sys-ronin/terminal-notes.git && cd terminal-notes && python3 terminal_notes_ui.py
sys-ronin"},"title":{"matchLevel":"none","matchedWords":[],"value":"Show HN: A terminal writing environment with Git, E2EE sync and temporal search"}},"_tags":["story","author_sys-ronin","story_48462046","show_hn"],"author":"sys-ronin","children":[48462065,48473087],"created_at":"2026-06-09T14:59:54Z","created_at_i":1781017194,"num_comments":1,"objectID":"48462046","points":4,"story_id":48462046,"story_text":"I am a 40 years old jobless sys-admin with no cs degree and no development experience and 25 yeras of system knowledge. I built a fully encrypted writing environment where I can write with focus forgetting about the application. Here ai was my code translator while I strictly was the architect and instructor. It all started when i asked myself that "why and how i remember any past memory instantly without searching inside my head". This became the design principle of my app. Thus I solved a fundamental git problem of tracking a single note throughout the history by embedding uuid in every commit.
Its responsive data-as-UI based interface keeps the app (nearly) learning curve free. Navigating deep hierarchies is easy using numbered fisheye jump system without forward button. Every operation is in one or two keystroke like v(view), c(create), d(delete), r(rename), (j)ump s(sync), (s)earch, b(back) or v1, d1, j1, jb etc. It is built using python standard library (no other dependency), Git, cryptography standard primitive (embedded). I used git-filter-repo programaically for permanent item erasure using uuid from inside the application. It has full timeline for each item (note, file, subnotebook) to see the entire life cycle from create to erase with tombstone. Its subnotebook hierarchy can be upto any depth. It supports 80 file types with syntax highlighted editing with export feature for files. It has activity viewer inside every notebook or subnotebook. It shows your last 50 activities in the notebook. Searching is easy like "s files* file.md date* 02-04-2026 in* notebook/subnotebook_name", "s note_name date* 01-04-2026 05-04-2026", "s edited* any_text thisweek" "s in notebook/subnotebook_name" or just "s anytext".
Notebook can be encrypted using 8-24 words BIP-39 phrases and use password for regular lock/unlock. It is encrypted using standard AES-GCM and also portable. It can show password change log in each notebook management screen. Key vaults are hardware bound yet portable and a usb drive can act as TPM like security. It means when the keys are not reachable, notebooks can't be accessed. The application architecture and data structure is decoupled. Where app architecture allows the app, notebook and key vault can be in three different locations or even in different systems and data architecture allows metadata and content remain separated in different files inside each notebook folder linked via UUID. Git is implemented for doing item level (not file level) versioning and temporal search with uuid based commit metadata. Here commit metadata is not encrypted, though doable modifying the existing code if required. Every notebook is self contained in just a movable single folder. The architectur also enables optional e2ee conflict free sync using github and other platforms. It does not need someone to be a git expert to use the application and cloud vendor cannot see the data even with public visibility.
I will request respected HN people to go through the documents and the story_n_constraint.md file, that will explain the what, how, why in details. I also put a couple of abstract ideas inside the repo (what_can_be_done files). I want to thank the creators of Python, Git, cryptography, nvim, micro and git-filter-repo. Their tools came together and turned a concept into a working application.
The post, the GitHub repository, and all source code and documentation are part of the prior art with appropriete license (Public + timestamped + enabling)
repo:\n* https://github.com/sys-ronin/terminal-notes *
requirement:\nlinux/mac/win/docker, python 3.13, git, nvim/micro or any terminal based editor (can be configured from config.json inside root folder),internet for using github sync\nexample - python3 terminal_notes_ui.py (from linux)\n* tested on debian 13 only
git clone https://github.com/sys-ronin/terminal-notes.git && cd terminal-notes && python3 terminal_notes_ui.py
sys-ronin","title":"Show HN: A terminal writing environment with Git, E2EE sync and temporal search","updated_at":"2026-06-10T08:11:53Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"novitzmann"},"story_text":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["abstract","security"],"value":"Introducing Docwire SDK, an advanced C++20 data processing library. Our SDK is a powerful tool built for developers who need a reliable and fast way to process various file types in their applications. It supports a wide range of formats (PDF, XML, DOCX, PST, RTF, and almost 100 more) and allows to perform tasks such as document parsing, metadata extraction, and data export, all while maintaining a focus on security and performance.\nIf you\u2019ve ever had to write your own file processing logic, you\u2019ll appreciate how Docwire SDK abstracts away the complexities and provides a streamlined API for handling these tasks\u2014so you can focus on building awesome features instead of reinventing the wheel!\nWhy Docwire SDK Stands Out:\n Full C++20 Support\nDocwire SDK is written in modern C++20, leveraging features like move semantics, smart pointers, and lambdas to optimize performance and make the codebase more robust. This ensures better memory management, higher efficiency, and a cleaner API for developers.\n Powerful Document Parsing and Exporting\nWith Docwire SDK, you get out-of-the-box support for handling a variety of document formats. Whether it\u2019s extracting metadata from PDFs, parsing complex XML structures, or exporting documents to HTML or EML, the SDK handles these operations with ease. Plus, with a flexible architecture, you can extend and customize the functionality to suit your specific needs.\n Performance Optimizations\nWe've put a strong focus on optimizing performance, especially when handling large datasets or nested documents. Docwire SDK uses techniques like caching, memory buffers, and efficient data streams to ensure your applications run smoothly, even when working with massive files.\n Local AI-Driven Processing\nOne of the standout features of Docwire SDK is its integration with locally run AI models. You can perform natural language processing tasks (like sentiment analysis, document classification, and entity recognition) without sending data to external servers. This not only enhances performance but also ensures your sensitive data stays private.\nCross-Platform and CI-Ready\nDocwire SDK is designed for cross-platform use, with built-in support for macOS, Linux, and Windows. We also offer seamless integration with CI pipelines, allowing you to automate builds and run tests on multiple platforms (including macOS 13, macOS 14, Ubuntu 24.04, etc.).\nEasy Integration and Customization\nWe\u2019ve made sure that integrating Docwire SDK into your project is straightforward, with detailed documentation and examples to guide you through. Plus, with built-in support for dependency management tools like vcpkg, getting started is as simple as a few commands.\nModular Architecture\nDocwire SDK is split into multiple libraries, allowing you to only include the features you need for your specific project. This approach makes the SDK highly customizable and lightweight, so you can build efficient applications without unnecessary overhead.\nSecurity and Privacy\nIn a world where data privacy is paramount, we\u2019ve made it a priority to offer features that ensure secure document processing. Since our SDK runs locally, your data never leaves your environment, and you can avoid potential data leaks or security breaches associated with cloud-based solutions.\n Who Can Benefit from Docwire SDK?\nDocwire SDK is perfect for:\nEnterprise developers working with complex data formats and large documents.\nAI-ML developers looking to integrate locally run NLP models into C++ applications.\nSecurity-conscious teams who want to ensure their data never leaves their internal infrastructure.\nAny C++ developer who needs a robust, high-performance document processing solution that doesn\u2019t require reinventing the wheel.\n How to Get Started?\nHead over to our GitHub repo, where you\u2019ll find everything you need\u2014from installation instructions to code examples and detailed documentation.\nWe\u2019d Love Your Feedback\u2014don\u2019t hesitate to reach out."},"title":{"matchLevel":"none","matchedWords":[],"value":"Docwire SDK \u2013 C++20 library for advanced data processing"}},"_tags":["story","author_novitzmann","story_41801218","ask_hn"],"author":"novitzmann","created_at":"2024-10-10T17:36:47Z","created_at_i":1728581807,"num_comments":0,"objectID":"41801218","points":4,"story_id":41801218,"story_text":"Introducing Docwire SDK, an advanced C++20 data processing library. Our SDK is a powerful tool built for developers who need a reliable and fast way to process various file types in their applications. It supports a wide range of formats (PDF, XML, DOCX, PST, RTF, and almost 100 more) and allows to perform tasks such as document parsing, metadata extraction, and data export, all while maintaining a focus on security and performance.\nIf you\u2019ve ever had to write your own file processing logic, you\u2019ll appreciate how Docwire SDK abstracts away the complexities and provides a streamlined API for handling these tasks\u2014so you can focus on building awesome features instead of reinventing the wheel!\nWhy Docwire SDK Stands Out:\n Full C++20 Support\nDocwire SDK is written in modern C++20, leveraging features like move semantics, smart pointers, and lambdas to optimize performance and make the codebase more robust. This ensures better memory management, higher efficiency, and a cleaner API for developers.\n Powerful Document Parsing and Exporting\nWith Docwire SDK, you get out-of-the-box support for handling a variety of document formats. Whether it\u2019s extracting metadata from PDFs, parsing complex XML structures, or exporting documents to HTML or EML, the SDK handles these operations with ease. Plus, with a flexible architecture, you can extend and customize the functionality to suit your specific needs.\n Performance Optimizations\nWe've put a strong focus on optimizing performance, especially when handling large datasets or nested documents. Docwire SDK uses techniques like caching, memory buffers, and efficient data streams to ensure your applications run smoothly, even when working with massive files.\n Local AI-Driven Processing\nOne of the standout features of Docwire SDK is its integration with locally run AI models. You can perform natural language processing tasks (like sentiment analysis, document classification, and entity recognition) without sending data to external servers. This not only enhances performance but also ensures your sensitive data stays private.\nCross-Platform and CI-Ready\nDocwire SDK is designed for cross-platform use, with built-in support for macOS, Linux, and Windows. We also offer seamless integration with CI pipelines, allowing you to automate builds and run tests on multiple platforms (including macOS 13, macOS 14, Ubuntu 24.04, etc.).\nEasy Integration and Customization\nWe\u2019ve made sure that integrating Docwire SDK into your project is straightforward, with detailed documentation and examples to guide you through. Plus, with built-in support for dependency management tools like vcpkg, getting started is as simple as a few commands.\nModular Architecture\nDocwire SDK is split into multiple libraries, allowing you to only include the features you need for your specific project. This approach makes the SDK highly customizable and lightweight, so you can build efficient applications without unnecessary overhead.\nSecurity and Privacy\nIn a world where data privacy is paramount, we\u2019ve made it a priority to offer features that ensure secure document processing. Since our SDK runs locally, your data never leaves your environment, and you can avoid potential data leaks or security breaches associated with cloud-based solutions.\n Who Can Benefit from Docwire SDK?\nDocwire SDK is perfect for:\nEnterprise developers working with complex data formats and large documents.\nAI-ML developers looking to integrate locally run NLP models into C++ applications.\nSecurity-conscious teams who want to ensure their data never leaves their internal infrastructure.\nAny C++ developer who needs a robust, high-performance document processing solution that doesn\u2019t require reinventing the wheel.\n How to Get Started?\nHead over to our GitHub repo, where you\u2019ll find everything you need\u2014from installation instructions to code examples and detailed documentation.\nWe\u2019d Love Your Feedback\u2014don\u2019t hesitate to reach out.","title":"Docwire SDK \u2013 C++20 library for advanced data processing","updated_at":"2024-10-11T15:33:35Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"Gns89"},"story_text":{"matchLevel":"none","matchedWords":[],"value":"Hey HN!\nWe are Nikolas and Giannis, founders of Appteum, and we are excited to announce Appteum.com to HN community.\nFor the last few months we've been building Appteum and can now share our public Beta with you. Appteum is a backend development platform that makes it easy for developers to configure serverless ready backends for their apps. You can configure your backend and then interact with your data using our Typescript SDK.
Why we built this:
- We couldn\u2019t find a low code tool that provides the backend abstractions we needed but at the same time retain the flexibility of dropping down into code.
- Serverless/Edge computing is affected by cold-starts which requires to control the size of your code dependencies and handle concurrent connection pooling with your database.
- We found current low-code tools like Bubble and Retool don\u2019t offer a great experience for developers. We prefer using our own IDEs, version control etc.
- Sometimes, you need to use a service that is not supported by the low-code platform. It would be great if you could write a few lines of code that would make it easy to integrate into your app.
- From our experience, the traditional way of building APIs is time consuming and repetitive. It would be great if the API would reflect any change on data or security definitions automatically.
Our beta version lets you:
- Create Objects, Fields and Relationships (Objects are equivalent to tables in relational databases).
- Define object-level and field-level security for your users.
- Query your data over our API using a simple SQL syntax.
- Get access to your objects data instantly with our APIs.
- Consume your data over HTTP without requiring managing db connections.
- Import our Typescript SDK in your app and conveniently access your backend configuration.
Our business model is to give developers and their companies a development platform that abstracts away the backend development of an app.
While it is a beta, we believe that even today the experience is meaningful. We are working everyday to make Appteum better for our users. Please give it a shot at appteum.com and let us know how it goes. You will notice that a log-in is required, we don\u2019t collect any telemetry data of our users!
- Main website: [https://appteum.com]
- Portal: [https://admin.appteum.com]
- Docs: [https://docs.appteum.com]
Join our community on Discord [https://discord.gg/8ETmPedepG]
Follow us on LinkedIn [https://www.linkedin.com/company/appteum]
Let us know what you think!
p.s. We have a very generous free plan!"},"title":{"matchLevel":"none","matchedWords":[],"value":"Show HN: Appteum \u2013 Serverless ready back end"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://www.appteum.com//"}},"_tags":["story","author_Gns89","story_35826763","show_hn"],"author":"Gns89","created_at":"2023-05-05T08:44:04Z","created_at_i":1683276244,"num_comments":0,"objectID":"35826763","points":4,"story_id":35826763,"story_text":"Hey HN!\nWe are Nikolas and Giannis, founders of Appteum, and we are excited to announce Appteum.com to HN community.\nFor the last few months we've been building Appteum and can now share our public Beta with you. Appteum is a backend development platform that makes it easy for developers to configure serverless ready backends for their apps. You can configure your backend and then interact with your data using our Typescript SDK.
Why we built this:
- We couldn\u2019t find a low code tool that provides the backend abstractions we needed but at the same time retain the flexibility of dropping down into code.
- Serverless/Edge computing is affected by cold-starts which requires to control the size of your code dependencies and handle concurrent connection pooling with your database.
- We found current low-code tools like Bubble and Retool don\u2019t offer a great experience for developers. We prefer using our own IDEs, version control etc.
- Sometimes, you need to use a service that is not supported by the low-code platform. It would be great if you could write a few lines of code that would make it easy to integrate into your app.
- From our experience, the traditional way of building APIs is time consuming and repetitive. It would be great if the API would reflect any change on data or security definitions automatically.
Our beta version lets you:
- Create Objects, Fields and Relationships (Objects are equivalent to tables in relational databases).
- Define object-level and field-level security for your users.
- Query your data over our API using a simple SQL syntax.
- Get access to your objects data instantly with our APIs.
- Consume your data over HTTP without requiring managing db connections.
- Import our Typescript SDK in your app and conveniently access your backend configuration.
Our business model is to give developers and their companies a development platform that abstracts away the backend development of an app.
While it is a beta, we believe that even today the experience is meaningful. We are working everyday to make Appteum better for our users. Please give it a shot at appteum.com and let us know how it goes. You will notice that a log-in is required, we don\u2019t collect any telemetry data of our users!
- Main website: [https://appteum.com]
- Portal: [https://admin.appteum.com]
- Docs: [https://docs.appteum.com]
Join our community on Discord [https://discord.gg/8ETmPedepG]
Follow us on LinkedIn [https://www.linkedin.com/company/appteum]
Let us know what you think!
p.s. We have a very generous free plan!","title":"Show HN: Appteum \u2013 Serverless ready back end","updated_at":"2024-09-20T13:59:52Z","url":"https://www.appteum.com//"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"speedplane"},"story_text":{"matchLevel":"none","matchedWords":[],"value":"Reading the recent Facebook reporting is troubling: https://www.nytimes.com/2018/12/05/technology/facebook-emails-privacy-data.html
As founder of a startup, I know that at the start, you do whatever it takes to get initial traction, then find ways to replicate that via aggressive growth.
But almost immediately, you run into difficult ethical and practical issues. They aren't abstract like "don't be evil", it's far more practical:\n1. Treat co-workers and employees with respect, and foster an environment of professionalism and empathy;\n2. Don't raise customer prices or add fees without notice and consent;\n3. Be precise in marketing, don't say "we do X comprehensively" when we really do 99% of X; \n4. Don't over-inflate your security. Don't say "bank grade" security unless you know exactly what that means.\n5. Don't offer services solely based on advertising. It suggests that you have the user's interests in mind, when you really have the advertiser's (this is a tough one, but necessary; even paying a portion of the cost would be a huge improvement).\n6. Do not subvert the intent of your users. A photo sharing app should not analyze faces to build social graphs for another site. A VPN app should not analyze network usage for competitive intelligence.\n7. Everyone spams, you shouldn't, but if you must, be obvious, and precise, and try to provide value in the email rather than just click-bait.
The list above is not terribly noteworthy, I know many small startups that adhere to it, but at least one big tech company that was in the news this week seems to have broken every single one. I used to think startups were scrappy little sketchy business-problem-solvers, and would happily cut corners. However If you're a multi-billion dollar company, it seems that you can cut corners without retribution."},"title":{"matchLevel":"none","matchedWords":[],"value":"How ethical are startup founders?"}},"_tags":["story","author_speedplane","story_18626295","ask_hn"],"author":"speedplane","created_at":"2018-12-07T09:46:31Z","created_at_i":1544175991,"num_comments":0,"objectID":"18626295","points":4,"story_id":18626295,"story_text":"Reading the recent Facebook reporting is troubling: https://www.nytimes.com/2018/12/05/technology/facebook-emails-privacy-data.html
As founder of a startup, I know that at the start, you do whatever it takes to get initial traction, then find ways to replicate that via aggressive growth.
But almost immediately, you run into difficult ethical and practical issues. They aren't abstract like "don't be evil", it's far more practical:\n1. Treat co-workers and employees with respect, and foster an environment of professionalism and empathy;\n2. Don't raise customer prices or add fees without notice and consent;\n3. Be precise in marketing, don't say "we do X comprehensively" when we really do 99% of X; \n4. Don't over-inflate your security. Don't say "bank grade" security unless you know exactly what that means.\n5. Don't offer services solely based on advertising. It suggests that you have the user's interests in mind, when you really have the advertiser's (this is a tough one, but necessary; even paying a portion of the cost would be a huge improvement).\n6. Do not subvert the intent of your users. A photo sharing app should not analyze faces to build social graphs for another site. A VPN app should not analyze network usage for competitive intelligence.\n7. Everyone spams, you shouldn't, but if you must, be obvious, and precise, and try to provide value in the email rather than just click-bait.
The list above is not terribly noteworthy, I know many small startups that adhere to it, but at least one big tech company that was in the news this week seems to have broken every single one. I used to think startups were scrappy little sketchy business-problem-solvers, and would happily cut corners. However If you're a multi-billion dollar company, it seems that you can cut corners without retribution.","title":"How ethical are startup founders?","updated_at":"2024-09-20T03:28:25Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"pbhjpbhj"},"story_text":{"matchLevel":"none","matchedWords":[],"value":"A friend is looking for a simple document management tool. (I searched here and found a similar question with no answers a little while back?). Docley (http://docley.com/) looks good but isn't released and thus well tested as yet. A full CMS like Joomla might work, but seems poorly focussed. KnowledgeTree is definitely overkill and the MS integration wouldn't be suitable. The community (free-gratis) versions of Magnolia-cms (http://www.magnolia-cms.com/home/magnolia-cms.html) and Alfresco (http://www.alfresco.com/community/) look like possibilities.
He requires versioning, notes to accompany the docs (eg abstract), limited checkout (it's a small firm so just a note of the \"owner\" is fine), ability to make files available to clients via the web. It would be used for legal and financial docs so it needs to be self-hosted with good security.
There is a low level of technical ability amongst his 5 workers.
Google Docs/Zoho Office would probably be fine if it were privately hosted and readily shareable. There is very little budget available.
We're both in the UK.
So, suggestions? What do you use?"},"title":{"matchLevel":"none","matchedWords":[],"value":"Ask HN: what document management tools to use?"},"url":{"matchLevel":"none","matchedWords":[],"value":""}},"_tags":["story","author_pbhjpbhj","story_1221341","ask_hn"],"author":"pbhjpbhj","children":[1221369,1221424,1223035,1223087],"created_at":"2010-03-26T16:06:47Z","created_at_i":1269619607,"num_comments":7,"objectID":"1221341","points":3,"story_id":1221341,"story_text":"A friend is looking for a simple document management tool. (I searched here and found a similar question with no answers a little while back?). Docley (http://docley.com/) looks good but isn't released and thus well tested as yet. A full CMS like Joomla might work, but seems poorly focussed. KnowledgeTree is definitely overkill and the MS integration wouldn't be suitable. The community (free-gratis) versions of Magnolia-cms (http://www.magnolia-cms.com/home/magnolia-cms.html) and Alfresco (http://www.alfresco.com/community/) look like possibilities.
He requires versioning, notes to accompany the docs (eg abstract), limited checkout (it's a small firm so just a note of the \"owner\" is fine), ability to make files available to clients via the web. It would be used for legal and financial docs so it needs to be self-hosted with good security.
There is a low level of technical ability amongst his 5 workers.
Google Docs/Zoho Office would probably be fine if it were privately hosted and readily shareable. There is very little budget available.
We're both in the UK.
So, suggestions? What do you use?","title":"Ask HN: what document management tools to use?","updated_at":"2024-09-19T16:56:27Z","url":""},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"bear_child"},"story_text":{"matchLevel":"none","matchedWords":[],"value":"hi HN,
over the past few years, I have developed an interest in the technical details of how modern computer systems actually work. I mostly satisfy my curiosity by reading about computer security, reverse engineering, systems programming, embedded programming and stuff like that. Over the past few months, some of the basic skills have really started clicking for me^^ and to go further, I would really like to find a mentor to guide me and maybe work on some larger projects, preferably someone who has a background in computer security/systems programming.
In return, I would love to teach you some mathematics! I currently work as a postdoctoral researcher in mathematics if you care about that kind of thing. I would be happy to try and teach you about any subject at any pace. I have a deep working knowledge of linear algebra, abstract algebra and calculus because I have been using these tools daily for the past 10 years. I also have a good understanding of more advanced subjects like representation theory and differential geometry if you are interested in that kind of thing.
Here is what I am envisioning: We can have 2, 1 hour sessions a week, one for mathematics and one for computers. Obviously, we will keep things casual, but hopefully we can dream up some small homework exercises based on what we discuss during the sessions.
My email is on my website, which you can find in my profile. hit me up if you are interested!
^^ For example, I am now somewhere between a beginner and an intermediate C programmer. Given a C procedure, I can translate it to assembly by hand, and given an assembly procedure which follows standard calling conventions and isn't too heavily optimized, I can figure out what it does."},"title":{"matchLevel":"none","matchedWords":[],"value":"Ask HN: Anyone interested in a systems programming/math knowledge exchange?"}},"_tags":["story","author_bear_child","story_17123160","ask_hn"],"author":"bear_child","children":[17123531],"created_at":"2018-05-22T01:30:12Z","created_at_i":1526952612,"num_comments":3,"objectID":"17123160","points":3,"story_id":17123160,"story_text":"hi HN,
over the past few years, I have developed an interest in the technical details of how modern computer systems actually work. I mostly satisfy my curiosity by reading about computer security, reverse engineering, systems programming, embedded programming and stuff like that. Over the past few months, some of the basic skills have really started clicking for me^^ and to go further, I would really like to find a mentor to guide me and maybe work on some larger projects, preferably someone who has a background in computer security/systems programming.
In return, I would love to teach you some mathematics! I currently work as a postdoctoral researcher in mathematics if you care about that kind of thing. I would be happy to try and teach you about any subject at any pace. I have a deep working knowledge of linear algebra, abstract algebra and calculus because I have been using these tools daily for the past 10 years. I also have a good understanding of more advanced subjects like representation theory and differential geometry if you are interested in that kind of thing.
Here is what I am envisioning: We can have 2, 1 hour sessions a week, one for mathematics and one for computers. Obviously, we will keep things casual, but hopefully we can dream up some small homework exercises based on what we discuss during the sessions.
My email is on my website, which you can find in my profile. hit me up if you are interested!
^^ For example, I am now somewhere between a beginner and an intermediate C programmer. Given a C procedure, I can translate it to assembly by hand, and given an assembly procedure which follows standard calling conventions and isn't too heavily optimized, I can figure out what it does.","title":"Ask HN: Anyone interested in a systems programming/math knowledge exchange?","updated_at":"2024-09-20T02:29:01Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"thejarren"},"story_text":{"matchLevel":"none","matchedWords":[],"value":"Hey HN, I'm really excited to share Emra with you. The yc description would be: It's like "Notion meets Lovable". It's a workspace where you build full apps using AI and every app sits on one shared database and service layer. Generated apps are always editable, and (coming soon:) can interact with each other in the workspace.
I'm of the opinion that the cost of software will go rapidly to zero (I don't think that's too surprising to any of you), but there will always be room for effort and creativity. Emra is essentially built for the future where every person is a developer. Essentially personal software for everyone.
So far I've built notes apps with a 3d graph view to see connections, a video editing app and a canvas design tool (figma clone) with export capabilities, as well as a collection of project management tools and games. Right now the most satisfying thing is being able to fix a bug I run into in around the same amount of time that it takes to send a bug report in any traditional app.
We're using the best models to make this work at the moment. Basically anything Opus 4.6 or later, as far as I'm concerned is the baseline of what we can use to make this happen. Our agent is currently only capable of building, though that will change rapidly, and we are pretty proud that our build loop is more token efficient than using Claude Code or other harnesses.
Arguably we are in the same category as Dreamer (Meta acquired) or Wabi (raised $20m), but at the moment we're bootstrapped and working to deliver as much value to users as possible. Users will be soon be able to download their data and apps at any time (I like to think of it as extending obsidians "file over app" philosophy to file+app). In general, I think for a platform like this to exist, we want to be as value aligned with users as possible. So our focus is on providing a solid service layer that abstracts away the complexity of most modern full stack applications. Ideally, people using Emra pay for hosting or usage and we earn our spot rather than locking you in.
On the technical side, we feel good right now. We know there will be some scaling + security challenges, but honestly, our biggest hurdle at the moment is rebuilding existing applications in a way that makes them actually worth using inside of Emra, basically solving that blank page problem.
We are building apps on an SDK that we plan on open sourcing over the next month or so, and will also provide a CLI tool so people can build Emra apps inside of Claude Code or other agents (this is how we are actually building many of our app store apps). I'm also still trying to nail down the messaging. Initially I had planned on aggressively focusing on consumer, but the cost to build an app is still prohibitive, so we're going to keep testing different approaches.
We're still very early, so I'd really appreciate any honest feedback. And I'm happy to answer any questions you might have."},"title":{"matchLevel":"none","matchedWords":[],"value":"Show HN: Emra \u2013 A workspace where every app you build shares one db"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://emra.app"}},"_tags":["story","author_thejarren","story_48778145","show_hn"],"author":"thejarren","children":[48778362],"created_at":"2026-07-03T18:21:41Z","created_at_i":1783102901,"num_comments":2,"objectID":"48778145","points":3,"story_id":48778145,"story_text":"Hey HN, I'm really excited to share Emra with you. The yc description would be: It's like "Notion meets Lovable". It's a workspace where you build full apps using AI and every app sits on one shared database and service layer. Generated apps are always editable, and (coming soon:) can interact with each other in the workspace.
I'm of the opinion that the cost of software will go rapidly to zero (I don't think that's too surprising to any of you), but there will always be room for effort and creativity. Emra is essentially built for the future where every person is a developer. Essentially personal software for everyone.
So far I've built notes apps with a 3d graph view to see connections, a video editing app and a canvas design tool (figma clone) with export capabilities, as well as a collection of project management tools and games. Right now the most satisfying thing is being able to fix a bug I run into in around the same amount of time that it takes to send a bug report in any traditional app.
We're using the best models to make this work at the moment. Basically anything Opus 4.6 or later, as far as I'm concerned is the baseline of what we can use to make this happen. Our agent is currently only capable of building, though that will change rapidly, and we are pretty proud that our build loop is more token efficient than using Claude Code or other harnesses.
Arguably we are in the same category as Dreamer (Meta acquired) or Wabi (raised $20m), but at the moment we're bootstrapped and working to deliver as much value to users as possible. Users will be soon be able to download their data and apps at any time (I like to think of it as extending obsidians "file over app" philosophy to file+app). In general, I think for a platform like this to exist, we want to be as value aligned with users as possible. So our focus is on providing a solid service layer that abstracts away the complexity of most modern full stack applications. Ideally, people using Emra pay for hosting or usage and we earn our spot rather than locking you in.
On the technical side, we feel good right now. We know there will be some scaling + security challenges, but honestly, our biggest hurdle at the moment is rebuilding existing applications in a way that makes them actually worth using inside of Emra, basically solving that blank page problem.
We are building apps on an SDK that we plan on open sourcing over the next month or so, and will also provide a CLI tool so people can build Emra apps inside of Claude Code or other agents (this is how we are actually building many of our app store apps). I'm also still trying to nail down the messaging. Initially I had planned on aggressively focusing on consumer, but the cost to build an app is still prohibitive, so we're going to keep testing different approaches.
We're still very early, so I'd really appreciate any honest feedback. And I'm happy to answer any questions you might have.","title":"Show HN: Emra \u2013 A workspace where every app you build shares one db","updated_at":"2026-07-03T20:26:08Z","url":"https://emra.app"}],"hitsPerPage":50,"nbHits":72,"nbPages":2,"page":0,"params":"query=Abstract+Security&tags=story&hitsPerPage=50&advancedSyntax=true&analyticsTags=backend","processingTimeMS":18,"processingTimingsMS":{"_request":{"roundTrip":14},"afterFetch":{"format":{"highlighting":6,"total":7},"merge":{"mergeLoop":{"prepareNextHit":2,"total":2},"total":2},"total":2},"fetch":{"query":10,"scanning":4,"total":15},"total":18},"query":"Abstract Security","serverTimeMS":27}