MurphyA/hacker-news huggingface dataset:
Show HN: We built an AI to review your pull requests
by gentios | 2025-05-26 12:55:25+00:00
Hey HN,

We’re two developers (co-founders) with a team of 20 who got tired of spending hours reviewing PRs, so we built Infinitcode.ai, an AI-powered code reviewer that:

- *Summarizes PRs in plain English*: No more deciphering 1,000-line diff jungles

- *Catches more than bugs*: Security holes, performance pitfalls, code smells, even typos (yes, we’ll flag “vurnerabilities” and vulnerabilities)

- *Zero onboarding*: Works instantly—no “let me learn your codebase for weeks” nonsense.

Why we’re posting: We’re in alpha and need brutal honesty. Roast our tool, mock our UI, or tell us why AI will never replace your team’s Senior Engineer.

Free alpha access for 100 teams: All we ask is feedback.

Give it a try: https://infinitcode.ai

Demo repo: https://github.com/infinitcodecom/infinitcode-ai-demo
by lifeisstillgood | 2025-05-26 12:55:45+00:00
>It would be crazy if in an auto factory people were measuring to make sure every angle is correct

They need to read “the code is the design”. When you are cutting the door for the thousandth car, you are past design and into building.

For us building is automatic - take code turn into binary.

The reason we measure the door is we are at the design stage abs you need to make sure everything fits.
by zmgsabst | 2025-05-26 12:55:48+00:00
I don’t find the same, eg, greenfield AI projects.

It can do pieces in isolation, but requires significant handholding on refactors to get things correct (ie, it’s initial version has subtle bugs) — and sometimes requires me to read the docs to find the right function because it hallucinates things from other frameworks will work in its code.
by mooreds | 2025-05-26 12:56:04+00:00
https://datatracker.ietf.org/doc/html/rfc7009 handles generic revocation without specifying implementation details.

Some auth servers implement it. Keycloak does[0]. Auth0 doesn't as far as I can tell[1]. FusionAuth (my employer) has had it listed as a possible feature for years[2] but it never has had the community feedback to bubble it up to the top of our todo list.

0: https://www.keycloak.org/securing-apps/oidc-layers#_token_re...

1: https://auth0.com/docs/secure/tokens/revoke-tokens

2: https://github.com/fusionAuth/fusionauth-issues/issues/201
by safety1st | 2025-05-26 12:56:23+00:00
Thanks for the ideas. This is indeed the web. The Lottie stuff in question is a couple of decorative, 100x100 animated line art drawings.

When I dug into the Figma file, they were extractable as 450kb, 640x640 animated GIFs.

I ran one of those through some website called ezgif which converted it to a 100x100 animated webp image at 64kb. Think it's lossy but quality looks acceptable for our purposes. Gimp didn't seem to be able to resize an animated GIF properly.

This seems like a roundabout way to get where we want to be, but a 64kb animated webp seems like a much better situation than embedding the Lottie player js.
by Brian_K_White | 2025-05-26 12:56:34+00:00
Why don't they bother traditional bank managers then?

One time long ago someone did try to get money by forcing a bank owner to open a vault, and it didn't work, and since then everyone knows it's fruitless.

It just needs to actually be fruitless. It sounds like for crypto custodians, it's not fruitless and they know that.
by ableal | 2025-05-26 12:56:49+00:00
(Not OP)

I've used LibraryThing for book boxes. Using smallish boxes (30-40 paperbacks each) so that carrying them is not a backbreaker. Scan the ISBN barcodes with phone app, fix old ones/whatever on web app, tag with box number written on at least two sides. No problems found so far.
by tormeh | 2025-05-26 12:56:53+00:00
I too did this (although on a small project), and I was incredibly impressed. My problem with it is that I first did it myself, and it was fairly quick and easy. The hard part was figuring out that there was a bug, and how exactly the bug behaved. The LLM helped with the easy part, but I don't know how to even explain the difficult part to it. There was no way to know which repo the problem is in, or that it wasn't a user error.
by jcims | 2025-05-26 12:57:03+00:00
A buddy of mine was a director in a metrology integration firm that did nothing but install lidar, structured light and other optical measurement solutions for auto assembly plants. He had a couple dozen people working full time on new model line build outs (every new model requires substantial refurb and redesign to the assembly line) and ongoing QA of vehicles as they were being manufactured at two local Honda plants. The precision they were looking for is pretty remarkable.
by tm-guimaraes | 2025-05-26 12:57:58+00:00
Network.

Sending USD from random bank from random country to another random bank from another random country is a network problem. While it’s solved by SEPA in EUR to EUR countries by pan european clearing and settlement systems, out in the big world it’s not as simple. Specially considering cross-border.

You have to somehow get the payment message across banks and decide on how to settle. It fundamentally a hard problem.

Stable cryptos put the message and settlement in the same system and it’s a global one (not just EU/wtv). The problem is then, which stable crypto? The moment the Fed has a USD crypto, our ECB has an Eur crypto, than that problem is solved. In the meanwhile, joining a big stable usd crypto might still provide you better remittance routes (and settlement) than sending messages over swift.

Tldr: stablecoins solve remittance routing “edge cases”, if the stablecoin is adopted enough
by rckt | 2025-05-26 12:58:10+00:00
My thought is why do I need a web app to track my time? If there are no functions that actually require web, then what's the point? If it's to practice your personal coding skills - ok, that's actually a good way. Especially the feedback from real users is great. Otherwise it solves an imaginary problem.

And then I can share the fact that I was doing something for some amount of time? Seems like something opposite to minimalism.

> Not monetizing it (yet)

This is amazing.
by ghaff | 2025-05-26 12:58:44+00:00
Eighth of an inch is about the limit of precision in most circumstances.

Countries that use Imperial for day to day use still do tend to use metric for a lot of purposes including many engineering tasks. (Imperial is terrible for certain types of engineering calculations--especially involving pounds and lets not get into slugs--but it's fine for cooking even if I tend to use grams for weight on my scale when baking.)

"Imperial countries" are actually pretty hybrid for the most part to greater or lesser degrees. UK is more SI than the US but they still commonly use a lot of Imperial units including some "odd" stuff like stones.
by marginalia_nu | 2025-05-26 12:58:56+00:00
> How do you rank results?

There's a ton of factors.

https://github.com/MarginaliaSearch/MarginaliaSearch/blob/ma...

> Can you give some rough indications of how many pages you index in total?

I index like 300 million documents right now, though I crawl something like 1.4 billion (and could index them all). The search engine is pretty judicious about filtering out low quality results, mostly because this improves the search results.

> How many page you crawl each day?

I don't know if I have a good answer for that. In general the crawling isn't really much of a bottleneck. I try to refresh the index completely every ~8 weeks, and also have some capabilities for discovering recent changes via RSS feeds.

> Size of the machine(s) in RAM and HDD?

It's an EPYC 7543 x2 SMP machine with 512 GB RAM and something like 90 TB disk space, all NVMe storage.
by almostdeadguy | 2025-05-26 13:00:01+00:00
Calling these "singletons" maybe created confusion here, I'm more talking about singleton in the sense of a value that is created once and shared (i.e. injecting a value as a "Singleton" via something like Guice). I'm not arguing that you need to have values in global scope, I'm arguing that parameterless constructors prevent you from using shared values (actually _unless_ you have singletons in global scope).
Ask HN: Apple not fixing their bug preventing app release for months
by yakorevivan | 2025-05-26 13:00:26+00:00
Hi, I recently signed up tp Apple developer account, and when notarizing my app for distribution, received a very well known, and persistent, and still unfixed bug: "Team isn't configured for notarization".

This is almost an year old bug on Apple's backend that Apple still hasn't resolved. Many developers are getting stuck on this (https://developer.apple.com/forums/thread/118465).

I have been personally following up on their developer support email, and it's been 3 months now and more than 15 mail exchanges since then. Neither do they fix the bug, nor do they give any timelines for the fix (not even tentative timeline), nor do they refund the developer fees.

My app is sitting ducks for months now.

My question:

Can anyone help me here in anyway? I do not want my app to be released in a way that causes gatekeeper to throw "invalid/broken app" error when starting because it is not notarized.

Thanks..
by selcuka | 2025-05-26 13:00:45+00:00
Exactly. That's why I said I'm not taking it seriously. LLMs tend to always agree with you (i.e. your prompt). I don't have the exact prompt handy but it was something like

I read the following article and found that the ideas are not novel, and the content is not insightful. What is your opinion?

If I used a more positive prompt, I'm sure it would have told me that it's a great article.
by wejick | 2025-05-26 13:01:23+00:00
Working with AI centric IDE on the mature codebase needs different skill set that I suspect related to people management. As the pattern would be describing a problem well, making a good plan, delegate and giving feedback.

On the other side, getting a good flow is not trivial. I had to tweak rules, how to describe problem, how to plan the work and how to ask the agent. It takes time to be productive.

Eg. Asking agent to create a script to do string manipulation is better than asking them to do inplace edit. As it's easier to debug and repeat.
by calrain | 2025-05-26 13:01:56+00:00
It's easy to get good productivity out of LLMs in complex apps, here are my tips: Create a directory in the root of your project called /specs Chat with a LLM to drill into ideas having it play the role of a Startup Advisor, work through problem definitions, what your approach is, and build a high level plan. If you are happy with the state of your direction, ask the LLM to build a product-strategy.md file with the sole purpose of describing to an AI Agent what the goal of the project is. Discuss with an LLM all sorts of issues like: Components of the site Mono Repo vs targeted repos Security issues and your approach to them High level map of technologies you will use Strong references to KISS rules and don't over complicate A key rule is do not build features for future use Wrap that up in a spec md file Continue this process until you have a detailed spec, with smaller .md files indexed from your main README.md spec file Continue promoting the role of AI Developer, AI Consumer, AI Advisor, End User Break all work into Phase 1 (MVP), Phase 2, and future phases, don't get more granular (only do Phase 2 if needed) Ask LLM to document best practice development standards and document in your CLAUDE.md or whatever you use. Discuss the standards, err to industry standard if you are lost Challenge the LLM while building standards, keep looping back and adjusting earlier assumptions Instruct AI Agents like Claude Code to target on specific spec files and implement only Phase 1. If you get stuck on how to do that, ask an LLM on how to prompt your coding agent to focus, you will learn how they operate. Always ask the coding agent to review any markdown files used to document your solution and update with current features, progress, and next issues. Paste all .md files back into other AI's e.g. high models of ChatGPT and ask it to review and identify missing areas / issues Don't believe everything the agents say, challenge them and refuse to let them make you happy or confirm your actions, that is not their job. Always provide context around errors that you want to solve, read the error, read the line number, paste in the whole function or focus your Cursor.ai prompt to that file. Work with all the AI's, each has their strength. Don't use the free models, pay, it's like running a business with borrowed tools, don't. Learn like crazy, there are so many tips I'm nowhere near learning. Be kind to your agent

(Edited: formatting)
by vitus | 2025-05-26 13:01:57+00:00
> It might be more interesting to discuss the median hours worked (or any of a number of other percentiles), but it's not obvious those figures are public.

Okay. It seems that the cited numbers are from https://en.wikipedia.org/wiki/List_of_countries_by_average_a... which in turn is derived from OECD data, which also allows you to view employees by bands of hours worked per week:

https://data-explorer.oecd.org/vis?lc=en&df[ds]=DisseminateF...

In particular, it looks like as mentioned, most employees in Denmark fall in the 35-39h bucket (nearly 4x the size of the next biggest bucket, 40+ hours). Meanwhile, if you look at the US, the 40+ bucket is more than 10x the size of any other. But it's not exactly a US vs Scandinavia situation -- Sweden has just under 70% of its workforce also working 40+ hour weeks, higher than the UK or Germany.
by mooreds | 2025-05-26 13:02:46+00:00
There are two in-use RFCs to make compromised tokens much harder to use by attackers. Neither use IP addresses, but both bind the token to the client using some form of cryptography.

RFC 8705 section 3[0], binds tokens by adding a signature of a client certificate presented to the server doing authentication. Then any server receiving that token can check to see that the client certificate presented is the same (strictly speaking, hashes to the same value). This works great if you have client certs everywhere and can handle provisioning and revoking them.

RFC 9449[1] is a more recent one that uses cryptographic primitives in the client to create proof of private key possessions. From the spec:

> The main data structure introduced by this specification is a DPoP proof JWT that is sent as a header in an HTTP request, as described in detail below. A client uses a DPoP proof JWT to prove the possession of a private key corresponding to a certain public key.

These standards are robust ways to ensure a client presenting a token is the client who obtained it.

Note that both depend on other secrets (client cert, private key) being kept secure.

0: https://datatracker.ietf.org/doc/html/rfc8705

1: https://datatracker.ietf.org/doc/html/rfc9449
Show HN: Scholtz – Find customers and users that want your product
by ddaniel10 | 2025-05-26 13:02:46+00:00
Hello HN!

I’m Daniel, and I’m building Scholtz (https://scholtz.ai) – an AI tool that helps founders and teams find the people who truly care about their product: customers, users, early adopters, partners, investors, and more.

Why I built this: At my previous startup, the worst job I disliked was sifting through endless lead-gen lists and CRM spam. It was always impersonal and artificial – like blind guessing. I wanted something that actually understands what your startup is about and then suggests real and genuine people who may be interested in your product or service.

What it does:

- You add your website – that's it.

- Scholtz scans it and identifies what your business is.

- Next, it finds people who actually care about your product or service – the sort of people who might indeed be interested in what you're producing.

- And finally, it shows you how to contact them directly – no spam, no filler.

Still in beta: It's a one-man project, and I appreciate your input – what's great, what's unclear, what's lacking? Here's the link if you'd like to give it a go: https://scholtz.ai/welcome

I'm providing a trial that allows you to search for up to 10 individuals to try it out. Scholtz is currently focused on LinkedIn profiles in the U.S. tech industry.

Thank you for reading, and I look forward to hearing your thoughts!

– Daniel
by specialist | 2025-05-26 13:04:12+00:00
Apologies, I don't know enough to articulate my question, which is probably nonsensical any way.

LLMs (like GPT) and grammars (like Backus–Naur Form) are two different kinds of generative (production) systems, right?

You've been (heroically) explaining Chomsky's criticism of LLMs to other noobs: grammars (theoretically) explain how humans do language, which is very different from how ChatGPT (stochastic parrots) do language. Right?

Since GPT mimics human language so convincingly, I've been wondering if there's any overlap of these two generative systems.

Especially once the (tokenized) training data for GPTs is word based instead of just snippets of characters.

Because I notice grammars everywhere and GPT is still magic to me. Maybe I'd benefit if I could understand GPTs in terms of grammars.
by almostdeadguy | 2025-05-26 13:05:10+00:00
I meant "singleton" in the sense of a single value for a type shared by anything that requires one, i.e. a Guice singleton ( https://github.com/google/guice/wiki/scopes#singleton ) not a value in global scope. Or maybe a single value by type with an annotation, the salient point is that there are values in a program that must be shared for correctness. Parameterless constructors prohibit you from using these (unless you have global variables).
by bandoti | 2025-05-26 13:05:10+00:00
It’s important to consider that JWT is a series of specs and folks can choose to use any of them to suit their needs.

In fact, it can be used to create simple tokens—even if you store them in a database in a traditional authentication sense.

But it is also helpful to be able to use OIDC, for example, with continuous delivery workflows to authenticate code for deployment. These use JWT and it works quite well I think.

Note: technically JWT is only one of the specs so it’s not exactly correct how I’m referring to it, but I think of them collectively as JWT. :)
by j7ake | 2025-05-26 13:06:04+00:00
Must be an article for westerners because the average Asian household would have 4+ different soy sauces in their kitchen eg light, dark, steamed fish, raw fish, meat marinades.

Use Lee kum Lee for cooked stuff, Japanese ones for sashimi.

For restaurants they sometimes cook their own soy sauce with different oil and herbs for extra flavour
by jwatzman | 2025-05-26 13:06:30+00:00
In Rust, it's considered a bug for any code which isn't using `unsafe` to encounter a memory error (e.g., to segfault). That bug might be in some underlying library (which is itself using `unsafe`), or more rarely in the compiler, but it's a bug and not how Rust is supposed to work.

Does Haskell have any similar line? What is the property that code must have in order for it to be a bug to segfault? Must not call `unsafePerformIO`? Must not call `unsafeCoerce`? (Must not call any function with the `unsafe` prefix?)

In other words, is the segfault here to be considered a bug in the language -- or is unwrapping IO one of the things that, if you do it, you're own your own and may segfault? (Is part of the point of the article is that it is currently considered safe but should not be? Is that a bug in the language or in peoples' expectations?)

Or is a clear line like this not a notion that Haskell has? It's been a long time since I've done any Haskell, though I don't recall any clear guideline like this!
by Qwertious | 2025-05-26 13:06:45+00:00
How should we visualize what pushes the electron goop forward? If it's like water pressure, that would make the hindmost goop bunch up with the foremost goop.

Presumably electricity has something to do with positive charge at the back of the 'pipe' and negative charge at the 'front' (or have I got those backward?), perhaps a better visualization would be that they're all rolling down an inclined plane together?
by 101011 | 2025-05-26 13:07:34+00:00
If I could offer another suggestion from what's been discussed so far - try Claude Code - they are doing something different than the other offerings around how they manage context with the LLM and the results are quite different than everything else.

Also, the big difference with this tool is that you spend more time planning, don't expect it to 1 shot, you need to think about how you go from epic to task first, THEN you let it execute.
by EFFALO | 2025-05-26 13:07:49+00:00
yay, postcard apps! this is my space, too. there's something really fun about making an API call and then postcards shoot out the other side.

i like your site and the visual design, very simple and straightforward. at $3.99 it does seem rather expensive compared to other options out there (i have an idea on how much it costs you). also, having some actual pictures of what the cards look like on the website will surely help with conversion.

the first postcard app I built is Three Kind Words (https://threekindwords.com). it’s a small vending machine on the internet where people anonymously send a friend three postcards, one word at a time. the first two cards are unsigned, and the last one reveals who sent them. it’s meant to be a slow, kind surprise in the mail. we've sent over 250 cards so far.

my latest postcard app is Slow-Mo Rainbow (https://slowmorainbow.com). this one lets you send a rainbow in the mail, one postcard at a time. i just launched it last week and am still getting the rough edges worked out, but in the spirit of the thread, i'm sharing it here.
by bayindirh | 2025-05-26 13:08:20+00:00
Complete burn is not guaranteed to be 100% clean. If you don't filter coal plants you get all the nasty up in the air.

If you could burn something at a level you don't need exhaust filters, and that even doesn't clean up all the harmful particles, we'd be building coal plants everywhere, rendering PV and renewables (and even nuclear) research unnecessary.
by a1j9o94 | 2025-05-26 13:08:35+00:00
I agree with this completely. I get the impression that a lot of people here think of software development as a craft, which is great for your own learning and development but not relevant from the company's perspective. It just has to work good enough.

Your point about management being vibe coding is spot on. I have hired people to build something and just had to hope that they built it the way I wanted. I honestly feel like AI is better than most of the outsourced code work I do.

One last piece, if anyone does have trouble getting value out of AI tools, I would encourage you to talk to/guide them like you would a junior team member. Actually "discuss" what you're trying to accomplish, lay out a plan, build your tests, and only then start working on the output. Most examples I see of people trying to get AI to do things fail because of poor communication.
by ben_w | 2025-05-26 13:08:49+00:00
> We can easily assess if a human is conscious from a medical point of view

Well, we can for *some* of the 40 different definitions of the word.

But there are people who are misdiagnosed to be in a vegetative state who later wake up and report experiences from when they appeared so: https://en.wikipedia.org/wiki/Vegetative_state#Misdiagnoses

Are you conscious when you dream, or is it just a memory replayed by your waking mind? Or only when it's a lucid dream? Or are lucid dreams themselves just the illusion of consciousness?

What about when you sleepwalk?

What about hypnopompic and hypnogogic states?

What about chemically altered consciousness like blind drunk, stoned, tripping on LSD?
by upmostly | 2025-05-26 13:09:15+00:00
We've been working on a vibe-coding platform called Hypership.

https://hypership.dev

What's different with Hypership is that your apps get user auth, page view analytics, event tracking, logging, and an admin dashboard all set up and ready to go out of the box.

It's also a much nicer platform for devs because we host VS Code in the cloud for you as you're vibe coding. That means you can manually edit the code as you go.

It's basically what web development should be in 2025.