MurphyA/hacker-news huggingface dataset:
Launch HN: Jazzberry (YC X25) – AI agent for finding bugs
by MarcoDewey | 2025-05-14 15:52:21+00:00
Hey HN! We are building Jazzberry (https://jazzberry.ai), an AI bug finder that automatically tests your code when a pull request occurs to find and flag real bugs before they are merged.

Here’s a demo video: https://www.youtube.com/watch?v=L6ZTu86qK8U#t=7

We are building Jazzberry to help you find bugs in your code base. Here’s how it works:

When a PR is made, Jazzberry clones the repo into a secure sandbox. The diff from the PR is provided to the AI agent in its context window. In order to interact with the rest of the code base, the AI agent has the ability to execute bash commands within the sandbox. The output from those commands is fed back into the agent. This means that the agent can do things like read/write files, search, install packages, run interpreters, execute code, and so on. It observes the outcomes and iteratively tests to pinpoint bugs, which are then reported back in the PR as a markdown table.

Jazzberry is focused on dynamically testing your code in a sandbox to confirm the presence of real bugs. We are not a general code review tool, our only aim is to provide concrete evidence of what's broken and how.

Here are some real examples of bugs that we have found so far.

“Authentication Bypass (Critical)” - When `AUTH_ENABLED` is `False`, the `get_user` dependency in `home/api/deps.py` always returns the first superuser, bypassing authentication and potentially leading to unauthorized access. Additionally, it defaults to superuser when the authenticated auth0 user is not present in the database.

“Insecure Header Handling (High)” - The server doesn't validate header names/values, allowing injection of malicious headers, potentially leading to security issues.

“API Key Leakage (High)” - Different error messages in browser console logs revealed whether API keys were valid, allowing attackers to brute force valid credentials by distinguishing between format errors and authorization errors.

Working on this, we've realized just how much the rise of LLM-generated code is amplifying the need for better automated testing solutions. Traditional code coverage metrics and manual code review are already becoming less effective when dealing with thousands of lines of LLM-generated code. We think this is going to get more so over time—the complexity of AI-authored systems will ultimately require even more sophisticated AI tooling for effective validation.

Our backgrounds: Mateo has a PhD in reinforcement learning and formal methods with over 20 publications and 350 citations. Marco holds an MSc in software testing, specializing in LLMs for automated test generation.

We are actively building and would love your honest feedback!
by skydhash | 2025-05-14 15:52:23+00:00
> A staff engineer won’t replace 2-4 junior devs with LLM. He will focus on the design and architecture and then get 2-4 engineers to execute it with LLMs.

That's already tried (not with LLMs). Especially with CASE tools, UML, and before those, the waterfall process. Building a software is like writing. Only once it's done, you can be really sure you understand the subject. The skill part is to make sure someone else can.

Doing design and architecture is like drafting plans before a war campaign. It helps with planning, but it does not help in winning the battle. There are pocket of complexity that no design can touch, because you would just be writing the software already.
by everfrustrated | 2025-05-14 15:52:27+00:00
From the actual article

>As Neon became GA last year, they noticed an interesting stat: 30% of the databases were created by AI agents, not humans. When they looked at their stats again recently, the number went from 30% to over 80%. That is, AI agents were creating 4 times more databases versus humans.

For me this has alarm bells all over it. Databricks is trying to pump postgres as some sort of AI solution. We do live in weird times.
by TheNewsIsHere | 2025-05-14 15:52:28+00:00
I’ve almost completed the move of my business from GitHub’s corporate offering to self-hosted Forgejo.

Almost went with Gitea, but the ownership structure is murky, feature development seems to have plateaued, and they haven’t even figured out how to host their own code. It’s still all on GitHub.

I’ve been impressed by Forgejo. It’s so much faster than Github to perform operations, I can actually backup my entire corpus of data in a format that’s restorable/usable, and there aren’t useless (AI) upsells cluttering my UX.
by steveklabnik | 2025-05-14 15:52:37+00:00
Hilariously, due to Oxide, my salary is public knowledge: I make $207,264.

https://news.ycombinator.com/item?id=43862487

(also, to take your joke way too seriously: I lived in NYC so long my drivers' license expired, so I'm not driving my non-existent Mercedes anywhere!)
by cptcobalt | 2025-05-14 15:53:01+00:00
I think the point of BlastDoor, as covered in the post, is that Apple is indeed working to prevent injection at the cost of silently failing & poorly handling legitimate messages.

> By being pedantic about the formatting, BlastDoor is protecting the recipient from an exploit that would abuse that type of issue.

So, not impossible, but less likely than you think
by drguthals | 2025-05-14 15:53:03+00:00
PDF -> Useful Information is what Tensorlake does (https://tensorlake.ai)

Because PDFs are so dominate and yet each one has information in more than just text (tables, images, formulas, hand-writing, strike-throughs even), we (as devs) need to be able have tools that understand the contents, not just "read" them.

Full disclosure...I work there
by layer8 | 2025-05-14 15:53:12+00:00
> Light outside is supposed to reach up to tens of thousands of nits, yet even 1000 nits is searing on a display.

That’s a consequence of https://en.wikipedia.org/wiki/Adaptation_(eye). If you look at 1000 nits on a display in bright sunlight, with your eyes adapted to the bright surroundings, the display would look rather dim.
by aidenn0 | 2025-05-14 15:53:27+00:00
> Wouldn't it be nice if policy changes were accompanied by an A/B testing plan to evaluate their impact? I have always thought so. I have also seen a major pitfall of A/B testing that real humans can hand-pick and slice data to make it sound as positive or negative as wanted. Nonetheless, the more data the better.

Policies have different effects depending on how likely people judge them to be long-term changes. Construction along a route will cause people to temporarily use alternative forms of transportation, but not e.g. sell their car or buy a long-term bus pass.

Yes, the inability to know counterfactuals will make judging policies more subjective than we might like. The closest we get to A/B testing is when different jurisdictions adopt substantially similar policies at different times. For example, this was done to judge improvements from phasing out leaded-gasoline, since it was done at different times and rates in different areas.
by jqpabc123 | 2025-05-14 15:53:27+00:00
Most cars don't need an instructional video on how to open the doors after an accident. I'm surprised this ignorant design is even legal.

https://www.dsf.my/2024/11/electronic-door-handles-are-a-saf...

https://www.youtube.com/watch?v=Wp4V9QpxAbI
by throw7 | 2025-05-14 15:53:55+00:00
Are you able to use rcs and "messages for web"?

The last time I checked if you wanted "cellphone is off" texting/voice (basically the old hangouts), you had to enable "fi syncing" which disabled rcs features. Is that still true? What url do you goto to do texts/voice? (i see hangouts.google.com redirects to google chat).
by aaronbaugher | 2025-05-14 15:54:21+00:00
It's probably good if the book requires you to stretch a bit, and even if you don't totally get it yet. My parents never put any limits on what I could read, so I stumbled over the Poe shelf at the library at a fairly young age. There was plenty I didn't understand, but plenty that I could, and some stories still stick with me.

But I remember when my niece told us they had them reading Nietzsche. Her main takeaway seemed to be that they were Very Smart because they were reading Nietzsche. She didn't have a clue what she was reading, so if any of it stuck with her, it was probably as likely to be misunderstood as understood.
by scarface_74 | 2025-05-14 15:54:23+00:00
Yes. But why would a company today hire a junior dev? If I have limited budget, why hire a junior dev instead of poaching a mid level developer from somewhere else?

A junior dev does negative work. And with corp dev/enterprise dev the difference in price between a junior and a “senior” dev is only about $70K. The gap is even smaller with remote work even if you hire in the US. There are plenty of developers in low cost of living areas who would be glad to work for relative peanuts.

As far as where will the next generation of developers come from? That’s a collection action problem
by jdietrich | 2025-05-14 15:54:28+00:00
>Why didn’t the service personnel have access to their e-mail?

Because they weren't in one of the larger bases that had satellite internet. Combat troops in the wilds of Helmand might go weeks without seeing a fresh egg or a slice of bread. Satellite terminals circa 2002 were bulky, expensive bits of kit that just weren't that widely distributed, at least in the British armed forces.
by TechDebtDevin | 2025-05-14 15:54:29+00:00
Most things are verifiable, just not with code. I'm not particularly excited for a world where everything is predictable. This is coming from a guy who loves forecasting/prediction modeling too, but one thing I hate about prediction modeling, especially from a hobbyist standpoint is data. Its very hard to get useful data. Investors will literally buy into hospital groups to get medical data for example.

There are monopolies on the coolest sets of data in almost all industries, all the RL in the world won't do us any good if those companies doing the data hoarding are only using it to forecast outcomes that will make them more money, not what can be done to better society.
by dekhn | 2025-05-14 15:54:53+00:00
I honestly can't tell if this is truly clever, like in the way a skilled poet can combine vocabulary and meter constraints to generate wonderful phrases (Kubla Khan poem being a nice example), or just a mechanical process. I am also confused how he managed to engineer and predict the folding and functionality of a fluorescent protein (presumably by borrowing a known sequence?). Ultimately, I see this more like an incomplete quine, or something similar but not identical to a quine.
by notnullorvoid | 2025-05-14 15:55:16+00:00
Agreed. Function coloring is a solution (not a problem), one that's better than the alternatives.

The "function coloring problem" people are harming entire ecosystems. In JS for example there are very popular frameworks thay choose to wrap async in sync execution by throwing when encountering async values and re-running parts of the program when the values resolve. The crazy part with these solutions trying to remove coloring, is they don't, they hide it (poorly). So instead of knowing what parts of a program are async you have no idea.
by luke-stanley | 2025-05-14 15:55:37+00:00
In my experience, on a public bus there is reasonable chance of getting a working USB A socket. But as a private business, it's not a complete replacement of the public bus system, however apps are used by people already to book on-the-fly cheap group taxi trips in Shanghai.

For good or ill, most teens do have a smartphone on them, and even kids are often seen with smartwatches that have tracking, and probably WeChat, and every mall I've been to sells them. On the Shanghai bus and metro, people often use a Shanghai public transport card to pay, they do accept old fashioned cash though too. Powerbank rental networks are common on the street and non-returns default to purchases (~$14–$28 USD). Malls, and the Metro often has power available for free.
by danans | 2025-05-14 15:55:46+00:00
Many of the comments here talking about how phone hardware is capable enough to run a desktop - thereby obviating the need for a separate desktop/laptop - are missing the fact that consumers actually want multiple devices. Also, no consumer electronics company ever makes a successful business model on selling less stuff that does the same thing.

There are real functional/usability reasons for having a separate device (with its own compute/storage) in a laptop form factor, and furthermore if we are honest, laptops are a kind of student/professional fashion accessory (especially Macs), a social-signal that you are a "knowledge-worker". As a result, that form factor is not going away anytime soon.

What Google are doing seems less about the "desktop mode" for Android (though that's a necessary technical step) than it is about having a unified consumer OS experience between Android and ChromeOS, which according to reports, they are planning to merge.
by nolist_policy | 2025-05-14 15:55:52+00:00
> In iOS, applications can use the File Provider API to present themselves in the Files app. You can move/copy/delete data there using the normal human interface constructs native to iOS, including mouse support and keyboard shortcuts on iPadOS.

> Apps can also present the same directory internally (inside the app). Cloud-backed applications can then do useful things like materialization, eviction, and dataless file presence.

In Android apps can do all this with the SAF API.

More importantly, on Android the user can give multiple apps access to the same directory, allowing apps to work together with files. iOS doesn't allow this AFAIK.
by perrygeo | 2025-05-14 15:56:29+00:00
Astounding. I understand the desire to take Fluoride out of drinking water - involuntarily medicating citizens should be a hard sell for anyone concerned with their legal rights. Fluoride isn't "bad" or "good", it's a exogenous substance and we should have the choice to put it in our bodies or not.

But taking it off the market completely? Come on, that's undermining the entire basis of the anti-fluoride movement. That's effectively saying "fluoride is bad, government says no", which is just a mirror image of the pro-fluoride stance. Just as reactionary and anti-liberty if not more so.

Where are the rational people who want to simply choose (or not) to take a supplement on their own terms?
by torstenv | 2025-05-14 15:56:29+00:00
I don't agree that Booking.com handles customer complaints better than Airbnb. I had booked a flat through Booking.com. The host wanted a deposit of my credit card information via an untrustworthy customised Italian website for a deposit before handing over the pin to collect the key. I do not speak Italian. Giving my credit card information to a strange website whose language I don't speak was not part of the agreement. The host then refused to give me access to the flat. My complaint to Booking.com was answered with standard texts pointing out that the deposit was obligatory in the small print and therefore part of the contract. However, the small print, which I admittedly had not read before booking, stated that the deposit was to be paid in cash. It didn't say anything about credit cards. I tried over five rounds of back and forth to get a complaint and a refund via Booking, as I didn't actually receive the flat and therefore didn't get any service. Booking then simply stopped replying. When I then wanted to take legal action and claim the amount, it turned out that I would have had to sue somewhere in Holland. So all the money was gone and I had double the cost for that night because I had to book a room elsewhere. So I've had the worst experience with booking.com customer support.
by dang | 2025-05-14 15:57:05+00:00
It was on the frontpage for 23 hours (and still is!) so the submission still did unusually well.

I thought about adding the blog post link to the top text (a bit like in this thread: https://news.ycombinator.com/item?id=43936992), but https://news.ycombinator.com/item?id=43974971 was the top comment for most of the day, and that seemed sufficient.

Edit: might as well belatedly do that!
by jasonjmcghee | 2025-05-14 15:57:10+00:00
> AlphaEvolve achieved up to a 32.5% speedup for the FlashAttention kernel implementation in Transformer-based AI models

> In roughly 75% of cases, it rediscovered state-of-the-art solutions, to the best of our knowledge.

> And in 20% of cases, AlphaEvolve improved the previously best known solutions

These sound like incredible results. I'd be curious what kind of improvements were made / what the improvements were.

Like, was that "up to a 32.5% speedup" on some weird edge case and it was negligible speed up otherwise? Would love to see the benchmarks.
by toomuchtodo | 2025-05-14 15:57:17+00:00
It’s to create indentured servants for the capital class, due to structural labor shortages that will persist into the future due to compressing working age populations and a rapidly falling total fertility rate. Reducing social service spending also reduces federal expenditures that can lead to a reduction in federal income tax demand from the wealthy (this makes room for wealthy tax cuts). Roughly speaking, the top 40% of income earners have a federal tax liability and the bottom 60% don’t.

Where do profits and growth come from? Workers, in the aggregate.

https://usafacts.org/government-spending/

https://www.mckinsey.com/mgi/our-research/dependency-and-dep...

https://www.cato.org/cato-journal/spring/summer-2018/demogra...

https://www.cato.org/cato-journal/spring/summer-2018/demogra...

https://ourworldindata.org/grapher/children-born-per-woman

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
by NelsonMinar | 2025-05-14 15:57:19+00:00
Is there a consensus definition of what counts as "HDR" in a display? What is the "standard dynamic range" of a typical TV or computer monitor? Is it roughly the same for devices of the same age?

My understanding is most SDR TVs and computer screens have displays about 200-300 nits (aka cd/m²). Is that the correct measure of the range of the display? The brightest white is 300 nits brighter than the darkest black?
by Workaccount2 | 2025-05-14 15:58:24+00:00
I just want to point out that the term "A.I." gets used pretty loosely in these articles, as if A.I. is a monolithic commodity that you plugin to your software to make it do chatGPT.

The example in the article is an in house developed "A.I." to help radiologists assess images. Digging a bit deeper it seems they are using mostly old CNN type architectures with a few million parameters.[1]

I think it still remains to be seen what a 1T+ parameter transformer trained specifically for radiology will do. I think anyone would be confident that a locally run CNN will not hold a candle to it.

[1]https://mayo-radiology-informatics-lab.github.io/MIDeL/index...
by jorams | 2025-05-14 15:58:38+00:00
> These changes will apply to operations like cloning repositories over HTTPS, anonymously interacting with our REST APIs, and downloading files from raw.githubusercontent.com.

Or randomly when clicking through a repository file tree. The first time I hit a rate limit was when I was skimming through a repository on my phone, and about the 5th file I clicked I was denied and locked out. Not for a few seconds either, it lasted long enough that I gave up on waiting then refreshing every ~10 seconds.
by coolcase | 2025-05-14 15:59:04+00:00
Was thinking about this exact thing today. Where I work combining X services from their own scaling sets to pack them together into a kubernetes cluster (or similar tech) should "smooth out" the spikes relatively and reduce wastage and also need to scale. This is on cloud so no fixed hardware concern but even then it helps with reserve instances, discounts and keeping cost down generally. This was intuition but I might math the maths on it now inspired by this.
by zinekeller | 2025-05-14 15:59:49+00:00
> Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised.

I can probably illuminate some things here. This is almost certainly the SMS API they're using. Your phone, and your network by extension, does not care if the phone is technically online - so those messages get received because they're literally sending in the blind (and if the recipient is offline, the message gets temporarily stored by the receiving carrier for around 3-7 days before it is discarded).

These SMS OTP systems validate "reachability" (using APIs like https://developer.vonage.com/en/number-insight/technical-det... and https://www.twilio.com/docs/lookup/v2-api/line-status) and will not send a message if a number is 'not' reachable. Unfortunately, as implied by the air quotes, these methods are not infallible. This is done to reduce the costs of sending the message (carriers charge a lot more for commercial customers) but this is definitely stupid for a already-validated number like in this case.
by OsrsNeedsf2P | 2025-05-14 15:59:56+00:00
> I do have a substantial number of OSS work but that rarely was of interest to anyone.

This was a sad reality for me. I spent thousands of hours putting my heart and soul into OSS projects that people loved and used.. and for what? When I graduated university, recruiters never clicked the links. The companies I joined treated me like a baby who never worked on anything. I switched gears and grinded Leetcode to land a FAANG job instead, but I can't help but feel my engineering craft regressed in all this time.
by _ache_ | 2025-05-14 16:00:08+00:00
Absolutely. If you don't know dav1d, it's easy to overlook the complexity here.

There is a reason for this sentence: > « The dav1d and rav1d decoders share the exact same low-level assembly code optimizations—you cannot modify this assembly ».

So, it, kind of, makes the work easier, but it stills very complex I think.
by ahofmann | 2025-05-14 16:00:24+00:00
This is spam.

At least the visuals are somehow ai generated, because they're full of strange errors like broken characters.

The content is also trivial: change your login password, change your SSID, change your WLAN password, update your firmware.

This is it. There is no explanation on how to do those steps. So the content is for people, who are below average technical knowledge, but is totally useless for them.
by monegator | 2025-05-14 16:00:25+00:00
Why would they have to be shipped by different accounts? Again: see the loads of very popular free/pro apps that look exactly the same on the surface, but with different icon/name/screenshots/text on the store page (all things we did) and given the wording that the bots kept writing us back, they are all breaking the rules. And when i made that point the answer was that if i wanted i could report them for a takedown, instead of having an explanation why they are allowed so we can do what they did.

They just don't care, if you receive enough reports you get taken down with virtually no appeal. Have you ever been flagged for using your own logos and copyrights without permissions? because we have, on our company store, verified by legal mail, dusn number, bank account and whatever other bullshittery they require next. Yet from time to time we get flagged
Ask HN: Should I implement my own integrity checks on my fileserver?
by jacobwilliamroy | 2025-05-14 16:00:51+00:00
So I have an SFTP server [Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-55-generic x86_64)] and an SFTP client (Windows 11): the client downloads files from the SFTP server. I had an idea to implement integrity checks by hashing the file on server side and also hashing the client's copy of the file after it is downloaded, then comparing the hashes to ensure the data was downloaded correctly. My question is: should I spend time implementing this? Does the OS already do this? This seems like something an OS should do.