Show HN: PMG, open source package firewall https://ift.tt/x0E7eDC

Show HN: PMG, open source package firewall Hi HN I am the founder of SafeDep. We have been detecting malicious packages for a while. Coming from DevSecOps background, I always considered malicious package detection & protection to be a build stage problem. But I was wrong since the S1ngularity and early Shai-Hulud days. In 2026, we pretty much started worrying more about our own dev machines than CI/CD environment. Depending only on threat intelligence data (OSV / SafeDep / Socket / any other source) to protect our own dev machines did not feel right. We wanted to build a multi-layered protection that can get 100% visibility of OSS packages coming in, and can protect against known and “hopefully” unknown threats. That’s how Package Manager Guard (PMG) started. Core idea was simple: - Start a local proxy (localhost) - Make sure supported package managers like npm, pnpm, pip etc. goes through it - Use threat intelligence data to fail fast on known malicious packages - Apply policies like dependency cooldown as additional guardrails - Adopt a policy language like CEL to support custom policies (roadmap) - Everything stays local with stackable policies and audit log - Threat model - Protect “willing” developers against malicious open source packages Note: PMG does not consider a malicious developer as part of its threat model. So no real effort has been put to “enforce”, rather the goal is reduced friction while being effective. Then came across Anthropic’s SRT and suddenly realized that in-process OS-native sandboxing is a good solution for limiting blast radius against unknown threats, especially since package managers have predictable runtime behaviour that can be allowed via. a sandbox while denying larger user permissions. Adopted seatbealt on MacOS and Landlock + Seccomp BPF for Linux. Seccomp BPF with Go was a battle of its own due to lack of control on OS threads, but finally managed to get it working without major performance cost. To summarize, PMG does not only depend’s on SafeDep’s ability to find malicious packages. It enforces dependency cooldown (useful if you are stuck with older npm/pnpm), sandbox to protect against malicious packages. Our near term goal is to support CEL as a policy language and improve tooling around sandbox rules to make adoption easier. Any feedback is welcome. https://ift.tt/96mhksw July 21, 2026 at 11:58PM

Show HN: Cross-Harness self hosted registry and analytics for AI Agents https://ift.tt/BfU5qus

Show HN: Cross-Harness self hosted registry and analytics for AI Agents https://ift.tt/6AuUPji July 21, 2026 at 11:57PM

Show HN: LectureToBook – Turn Videos into a PDF/ePub https://ift.tt/EdlDuLz

Show HN: LectureToBook – Turn Videos into a PDF/ePub Lecturetobook takes a video presentation and turns it into an editable document, with photos, diagrams, etc. extracted from your slides. I came up with this idea because I was enrolled in an online course and it was all videos. I spend all day long on the computer for work, so the last thing I want to do after work is spend more time staring at a screen. I wanted something that could take those videos and turn them into a readable format. The most difficult part was detecting what frames in the video are slides, and extracting from those what is useful content to add to the document. I didn't want to just stick a screengrab of the slides in the text, I wanted it to read like an actual book, so it uses an AI model to take from the slides what is useful and ignores what is just repeated in the transcript. Here is an output sample from an NIH video: https://ift.tt/ePIyLsp Feedback welcome! This is my first side-project that has made it to launch. https://ift.tt/kLps0dM July 20, 2026 at 10:36PM

Show HN: Bribes.fyi – Built something to report bribes https://ift.tt/m3Dfqvc

Show HN: Bribes.fyi – Built something to report bribes https://bribes.fyi/ July 19, 2026 at 10:31PM

Show HN: PostgreSQL course with database running in your browser https://ift.tt/SnWBAEe

Show HN: PostgreSQL course with database running in your browser I wanted to brush up my SQL skills and was looking for an online course that included a live DB. Most PostgreSQL courses require you to create an account or pay. This is probably because they have to bear the costs of running a full server-side database. So I created learnpg.xyz, a collection of PostgreSQL SQL exercises that run client side. Sharing here because it might be of use to people! https://learnpg.xyz July 19, 2026 at 08:58PM

Show HN: Peek-CLI: Let Claude Code iterate on front end designs https://ift.tt/snk1gt7

Show HN: Peek-CLI: Let Claude Code iterate on front end designs https://ift.tt/xdANB0X July 19, 2026 at 02:02AM

Show HN: SDF Pelicans on Bicycle https://ift.tt/VQpl45f

Show HN: SDF Pelicans on Bicycle https://ift.tt/u9Z7UQT July 19, 2026 at 02:17AM

Show HN: Get alerts for good seats at 70mm IMAX showings of The Odyssey https://ift.tt/ei6bNBj

Show HN: Get alerts for good seats at 70mm IMAX showings of The Odyssey https://imaxxing.io/ July 19, 2026 at 01:06AM

Show HN: Randomly Generated ASCII Trees https://ift.tt/eNwshuZ

Show HN: Randomly Generated ASCII Trees Code : https://gist.github.com/Soham-Saha/12296c059cea074b2fed5e97a... https://ift.tt/hlPi9KQ July 18, 2026 at 10:57PM

Show HN: Lific: Issue trackers should be simple, right? https://ift.tt/2wpNzWv

Show HN: Lific: Issue trackers should be simple, right? I built Lific because I direct AI coding agents on largish projects and needed somewhere for project state to live that isn't markdown files in the repo. When I was begging to work on long horizon ideas, I started on Linear, but my agent files issues faster than a human does, and I hit their limits and pricing wall almost immediately. Then I self-hosted a popular open source tracker which meant running its 13 containers, and its MCP integration was 30k tokens and I got so fed up that I eventually removed it and went back to .md files for a few weeks. Lific is the opposite shape of most of your self hosted server issue trackers: It's a single Rust binary that uses SQLite, and it has an optimized MCP server built in. Web UI is also included integrated directly into the binary. The simplicity is meant to only apply to the size and the ease of installation. The web UI is fully fleshed out with all of the UX you would expect from an issue tracker like linear. Since I started using lific, my agent flow is that I open the web UI, find a few issues I want to work on, then tell the agent "work on LIF-298, 299 and 301, and if you find bugs, file them as new issues." At the end of the day the project has tracked itself. Issues have statuses, blockers, and comment threads, so "what's workable right now" is a query instead of the agent guessing. Plans are persisted step trees, so a session tomorrow resumes with the same understanding of the goal and the path as the session that made the plan. My largest project has 300+ issues and 100+ docs and agents search it fast. Everything exports to markdown in one click, and the database is just a file on your machine. Setup is ` cargo install ` ` lific init ` ` lific connect ` then pick your harness (OpenCode, Cursor, Claude Code, etc). One honest caveat: on Windows there's no service install yet, so the binary has to be actively running for MCP or Web UI to work on windows. The biggest reason I think Lific is different than a lot of the other options is the lightweight nature of it alongside still having a fully featured web UI. It's meant for self hosters to work on big projects with agents, without sacrificing the other benefits of an issue tracker like a nice management UI or authentication for teams using it. Would genuinely love feedback and bug reports either here or on the discord! https://lific.dev July 18, 2026 at 12:52AM

Show HN: A zoomable timeline of 4M Wikipedia events https://ift.tt/owHUOyc

Show HN: A zoomable timeline of 4M Wikipedia events I'm building a journal app in Kotlin Multiplatform and for this purpose I have created a zoomable timeline interface. This is a side-project where I reuse the timeline interface to display 4 million events imported from Wikipedia / Wikidata, scored using PageRank. There is more information on the about page. If you're interested in the stack: I use Kotlin Multiplatform extensively, with Compose Multiplatform for the UI, communicates with the backend using Kotlinx-RPC and behind the hood a simple Postgres database on a Hetzner machine. https://ift.tt/XFnBLZ2 July 18, 2026 at 01:37AM

Show HN: Proton – A Pure Go, Immediate-Mode GUI Library (Zero CGO) https://ift.tt/JV0cit8

Show HN: Proton – A Pure Go, Immediate-Mode GUI Library (Zero CGO) Hi everyone, I’ve been building Proton to solve a specific pain point in the Go ecosystem: building native GUIs without the "web dev" trade-offs or CGO complexity. If you’ve tried to build desktop apps in Go, you’ve likely dealt with the frustration of CGO dependencies, bloated build pipelines, or feeling like you’re just writing a thin wrapper around a browser. Proton aims to fix this with a clean, pure-Go approach: Zero CGO: Cross-compile to Windows and macOS seamlessly from any machine. Immediate-Mode API: No setState, no complex component trees, and no XML. You just write your draw function, and it runs every frame. API Immunity: The public API is shielded from the underlying rendering engine (built on top of Gio). If the backend changes, your code remains untouched. Full Feature Set: Includes inputs, lists, overlays, alerts, and 46 built-in themes (or easy custom hex-code styling). It’s currently in development for v0.4.0, but it’s stable enough for cross-platform apps and even supports Android deployment out of the box. I’d love to hear what you think, especially if you’ve been looking for a more "Go-native" way to handle GUIs. Repo: https://ift.tt/miVGnjr July 17, 2026 at 10:20PM

Show HN: QBasic Gorillas (Repeeled) https://ift.tt/Nj7F5ca

Show HN: QBasic Gorillas (Repeeled) I've found the most engaging way to practice techniques for AI-assisted development and test models is to build fun side projects in vanilla JS. I spent many hours playing (and studying and editing) QBasic Gorillas, and this is a vanilla JS implementation using Fable and Opus. Play 1-on-1 hotseat or against the computer. A bit of extra camera snazz as well. https://ift.tt/XNgrpGE July 16, 2026 at 09:34PM