MurphyA/hacker-news huggingface dataset:
by Spooky23 | 2025-08-21 00:29:45+00:00
Big commercial is ~$23/mo for pooled data and a 13-month subsidy. At one point we were running it like a revenue center and getting $250-350 for used iPhones. They balked because we have our shit together and dump phones quickly (most large customers don't), so we moved away from that for other concessions.
by zeroblind | 2025-08-21 00:29:47+00:00
Over the past ~3 months we’ve been building PrivGuard, an AI prompt & data leakage scanner. The goal is simple: catch sensitive data leaks, injection attempts, and bad patterns before they hit production.

Stack is Prisma + Supabase, quad-LLM orchestration, Vercel Pro hosting — so it’s already closer to production-grade than MVP scaffolding.

To keep the demo useful but not abusable, we limited it to 5 prompts unless you “reserve your place” (early access list).

https://privguard.io

I’d love feedback from this community on: • Whether you see this type of tool becoming part of the LLM security stack. • What features/reporting you’d expect beyond just flagging prompts. • And of course — if you find ways to break/bypass it, that’s even better.
by nikisweeting | 2025-08-21 00:30:13+00:00
Yes the key is we don't intercept requests and responses, that saves 60% of the headache of lifecycle management.

We do exactly what you described with a 1+1 check in a loop for every target, it pops any crashed sessions from the pool, and we don't keep any state beyond that about what tabs are alive. We really try to derive everything fresh from the browser on every call, with minimal in-memory state.

https://github.com/browser-use/browser-use/blob/2a0f4bd93a43...
by TuringNYC | 2025-08-21 00:32:54+00:00
The Bus Factor was an issue long before LLM-generated code. Very few companies structure work to allow a pool of >1 individuals to understand/contribute to it. What I found is -- when companies are well structured with multiple smart individuals per area, the output expectation just ends up creeping up until again there is too much to really know. You can only get away from this with really good engineering management that specifically tries to move people around the codebase and trade-off speed in the process. I have tried to do this, but sometimes pressure from the stakeholders for speed is just too great to do it perfectly.

Shameful plug, i've been writing a book on this with my retrospective as a CTO building like this. I just updated it so you can choose your price (even $0) to make this a less shameful plug on HN: https://ctoretrospective.gumroad.com/l/own-your-system

I dont think anyone has the perfect answer, yet, but LLM-built systems arent that different from having the system built by 10 diff people on eLance/Upwork/Fiverr...so the principles are the same.
by appease7727 | 2025-08-21 00:32:56+00:00
Most of these cases don't require "review". It either works or it doesn't.

If you have an LLM transform a big pile of structs, you plug them into your program and it will either compile or it won't.

All programmers write countless one-off throwaway scripts. I can't tell you how many times I've written scripts to generate boring boilerplate code.

How many hours do you spend reviewing such tools and their output? I'll bet anything it's just about zero.
by shusaku | 2025-08-21 00:33:16+00:00
I’ve got a new project I’ve been handling with Claude code. Up until now I’ve always pair coded with AIs, so I would know (and usually tweak) every bit of code generated. Now with the agent, it’s easy to miss what’s being made.

Ive been trying to resolve this with things like “make a notebook that walks through this modules functions”, etc, to make it easier for me to review.

In the spirit of literate riding though, why but have these agents spend more time (tokens…money) walking you through what they made.

Likewise, if dev A vibe codes something and leaves it to dev B to maintain, we should think about what AI workflows can get B up to speed fast. “Give me a tour of the code”
by privacyking | 2025-08-21 00:33:23+00:00
> 3) once that I forgot my password to the MacBook, all one needed to do to access my data was to enter recovery mode and reset the password. Sure it logged me off from browser sessions, but all my files where there available to anybody

Do you not know how computers work? That how it works on every computer without encryption.

You wouldn't have been able to access to the data passwordless if you had enabled Filevault encryption
by simfree | 2025-08-21 00:33:27+00:00
The new Intel NUCs are only like a hundred something dollars for an N150 CPU and come with 16 gigs of RAM and a SSD.

Why pay so much more to fight an uphill battle?

Unless you desperately need the hot garbage that is Xcode there isn't much reason to deal with Mac Minis running MacOS as a server. One update and it will suspend and be unwakeable without physical interaction.
by Spooky23 | 2025-08-21 00:33:28+00:00
People don't realize this. At the State level, policy lobbying can yield concrete legislation for <$250k. For companies selling stuff, ~$60k/year gets you intros to civil service and some administration leadership.

In my city, I gave my local alderman $750 when he first ran. I have the guy's cell phone and the dude will fill potholes himself if I text him.
by ants_everywhere | 2025-08-21 00:34:09+00:00
That is one anecdote, but it doesn't really have any information in it. To debug the process we'd need to know which LLM, the developer's backgrounds, what prompts they used etc.

I've used a variety of LLMs to ask questions about probably dozens of unfamiliar code bases many of which are very complicated technically.

At this point I think LLMs are indispensable to understanding unfamiliar code bases. Nearly always much better than documentation and search engines combined.
by csense | 2025-08-21 00:34:13+00:00
I'm willing to accept this claim:

- You can make money when your product is a text editor.

I am very skeptical of these claims:

- When your product is a text editor, $42 million in capital can be effectively deployed to make meaningful improvements to your product.

- When your product is a text editor, your lifetime inflation-adjusted profit will eventually exceed $42 million.

Sequoia is apparently not so skeptical, and willing to put the money on the table. That must have been a truly extraordinary pitch deck...
by xena | 2025-08-21 00:35:22+00:00
For what it's worth, kernel.org seems to be running an old version of Anubis that predates the current challenge generation method. Previously it took information about the user request, hashed it, and then relied on that being idempotent to avoid having to store state. This didn't scale and was prone to issues like in the OP.

The modern version of Anubis as of PR https://github.com/TecharoHQ/anubis/pull/749 uses a different flow. Minting a challenge generates state including 64 bytes of random data. This random data is sent to the client and used on the server side in order to validate challenge solutions.

The core problem here is that kernel.org isn't upgrading their version of Anubis as it's released. I suspect this means they're also vulnerable to GHSA-jhjj-2g64-px7c.
by hobs | 2025-08-21 00:36:12+00:00
Yes, its very much a goldfish problem, where work needed grows to fill what is possible, not what is advisable or good. The only way I have seen people "solve" this is by putting a bunch of speed bumps in a process, and generally it just makes everyone lazy and deliver stuff at the last second anyway, not use the additional time to make something polished.
by Twisol | 2025-08-21 00:36:30+00:00
Yes, Anubis is a dog-headed or jackal-headed god. I actually can't find anywhere on the Anubis website where they talk about their mascot; they just refer to her neutrally as the "default branding".

Since dog girls and cat girls in anime can look rather similar (both being mostly human + ears/tail), and the project doesn't address the point outright, we can probably forgive Tavis for assuming catgirl.
by tptacek | 2025-08-21 00:37:20+00:00
Right, I get that. I'm just saying that over the long term, you're going to have to find asymmetric costs to apply to scrapers, or it's not going to work. I'm not criticizing any specific implementation detail of your current system. It's good to have a place to take it!

I think that's the valuable observation in this post. Tavis can tell me I'm wrong. :)
by oftenwrong | 2025-08-21 00:40:00+00:00
There are some very basic tools that can help with portability, such as https://github.com/milesj/rust-cicd-env , but I agree that there is a lot of proprietary, vendor-specific, valuable functionality available in the average "CI" system that you cannot make effective use of with this approach. Still, it's the approach I generally favor for a number of reasons.
by openasocket | 2025-08-21 00:41:42+00:00
You can think of the formal proofs that mathematicians write as essentially pseudocode, as compared to Lean which is actual code that can be compiled. As an example, it would be common to say “2*x + 4 = 0, therefore x is -2”, in a mathematical proof. But in a computer-readable proof, you have to actually go through the algebraic manipulations, citing what you are doing and what theorem/lemma/rule you are applying. Modern systems like Lean make that much easier, but that’s the essential difference.

Advanced proofs essentially just consist of a series of assertions “X, therefore Y, therefore Z, …” and the justification for that isn’t always laid out explicitly. As a result, when you read a formal proof, it often takes some work to “convince yourself” the proof is valid. And if a proof has a mistake, it’s probably not is one of those assertions, but rather in how you get from assertion X to assertion Y. It can often be really subtle.

Disclaimer: I have a math undergraduate, and have played around with the theorem proving language Coq, but haven’t worked with Lean
by promiseofbeans | 2025-08-21 00:42:02+00:00
This demo is a lot more useful for comparing word embeddings: https://www.cs.cmu.edu/~dst/WordEmbeddingDemo/index.html

You can choose which dimensions to show, pick which embeddings to show, and play with vector maths between them in a visual way

It doesn't show the whole set of embeddings, though I am sure someone could fix that, as well as adapting it to use the gpt-oss model instead of the custom (?) mini set it uses.
by appease7727 | 2025-08-21 00:42:13+00:00
LLMs aren't bad for programming in general.

LLMs are bad for bad programmers. LLMs will make a bad programmer worse and make a layperson think they're a prodigy.

Meanwhile, the truly skilled programmers are using LLMs to great success. You can get a huge amount of value and productivity from an LLM if and only if you have the skill to do it yourself in the first place.

LLMs are not a tool that magically makes anyone a good programmer. Expecting that to be the case is exactly why they don't work for you. You must already be a good programmer to use these tools effectively.

I have no idea what this will do to the rising generation of programmers and engineers. Frankly I'm terrified for them.
by Aurornis | 2025-08-21 00:42:21+00:00
> This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis.

This is a confusing comment because it appears you don’t understand the well-written critique in the linked blog post.

> This is like those simple things on submission forms that ask you what 7 + 2 is. Of course everyone knows that a crawler can calculate that! But it takes a human some time and work to tell the crawler HOW.

The key point in the blog post is that it’s the inverse of a CAPTCHA: The proof of work requirement is solved by the computer automatically.

You don’t have to teach a computer how to solve this proof of work because it’s designed for the computer to solve the proof of work.

It makes the crawling process more expensive because it has to actually run scripts on the page (or hardcode a workaround for specific versions) but from a computational perspective that’s actually easier and far more deterministic than trying to have AI solve visual CAPTCHA challenges.
by dumbfoundded | 2025-08-21 00:42:33+00:00
It's definitely a middle ground, but PR reviews, are not perfect. So it's easy to miss a lot of things and to have a lot of extra baggage. From reviewing code it's not always easy to tell exactly what's necessary or duplicate. So I agree, this is a middle ground of using LLMs to be more productive. Removing one bad line of code is worth adding a hundred good lines of code.
by lotsoweiners | 2025-08-21 00:42:53+00:00
Last week I went to Walmart and went through self checkout. Probably about $100 of groceries. After paying and clicking to print the receipt there was an error with the receipt printer. They changed the paper but the error remained. They gave me a “trust me bro” you won’t get stopped and sent me on my way. I could have made a fuss but didn’t have anything I would have returned anyways. A bit off putting in how they handled it though.
by interstice | 2025-08-21 00:42:54+00:00
> The only thing you can rely on is on your ability to decipher what a highly imperfect system generated, and maybe ask explanations to that same imperfect system about your code its code (oh, and it has forgotten everything about the initial writing process by then).

This just sounds like every other story I hear about working on ossified code bases as it is. At least AI can ingest large amounts of code quickly, even if as of today it can't be trusted to actually decipher it all.
by tracker1 | 2025-08-21 00:43:43+00:00
I can largely relate... that said, I rarely rely on my phone for remembering routes to places I've been before. It does help that I've lived in different areas of my city and suburbs (Phoenix) so I'm generally familiar with most of the main streets, even if I haven't lived on a given side of town in decades.

The worst is when I get inclined to go to a specific restaurant I haven't been to in years and it's completely gone. I've started to look online to confirm before driving half an hour or more.
by seba_dos1 | 2025-08-21 00:43:44+00:00
...unless you're sus, then the difficulty increases. And if you unleash a single scrapping bot, you're not a problem anyway. It's for botnets of thousands, mimicking browsers on residual connections to make them hard to filter out or rate limit, effectively DDoSing the server.

Perhaps you just don't realize how much did the scraping load increase in the last 2 years or so. If your server can stay up after deploying Anubis, you've already won.
by overfeed | 2025-08-21 00:45:06+00:00
> The bots will eventually be indistinguishable from humans

Not until they get issued government IDs they won't!

Extrapolating from current trends, some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade, and naturally, this will be included in the anti-bot arsenal. It will be up to the site operator to trust identities signed by the Russian government.

1. Despite what Sam Altman's eyeball company will try to sell you, government registers will always be the anchor of trust for proof-of-identity, they've been doing it for centuries and have become good at it and have earned the goodwill.
by biimugan | 2025-08-21 00:46:03+00:00
> You don’t have to randomize the first part of your object keys to ensure they get spread around and avoid hotspots.

From my understanding, I don't think this is completely accurate. But, to be fair, AWS doesn't really document this very well.

From my (informal) conversations with AWS engineers a few months ago, it works approximately like this (modulo some details I'm sure the engineers didn't really want to share):

S3 requests scale based on something called a 'partition'. Partitions form automatically based on the smallest common prefixes among objects in your bucket, and how many requests objects with that prefix receive. And the bucket starts out with a single partition.

So as an example, if you have a bucket with objects "2025-08-20/foo.txt" and "2025-08-19/foo.txt", the smallest common prefix is "2" (or maybe it considers the root as the generator partition, I don't actually know). (As a reminder, a / in an object key has no special significance in S3 -- it's just another character. There are no "sub-directories"). Therefore a partition forms based on that prefix. You start with a single partition.

Now if the object "2025-08-20/foo.txt" suddenly receives a ton of requests, what you'll see happen is S3 throttle those requests for approximately 30-60 minutes. That's the amount of time it takes for a new partition to form. In this case, the smallest common prefix for "2025-08-20/foo.txt" is "2025-08-2". So a 2nd partition forms for that prefix. (Again, the details here may not be fully accurate, but this is the example conveyed to me). Once the partition forms, you're good to go.

But the key issue here with the above situation is you have to wait for that warm up time. So if you have some workload generating or reading a ton of small objects, that workload may get throttled for a non-trivial amount of time until partitions can form. If the workload is sensitive to multi-minute latency, then that's basically an outage condition.

The way around this is that you can submit an AWS support ticket and have them pre-generate partitions for you before your workload actually goes live. Or you could simulate load to generate the partitions. But obviously, neither of these is ideal. Ideally, you should just really not try and store billions of tiny objects and expect unlimited scalability and no latency. For example, you could use some kind of caching layer in front of S3.
by culi | 2025-08-21 00:48:07+00:00
> 3: On Android I can use Chrome. Which means web apps can use the File System Access API. This makes web apps first class productivity applications I can use to work on my local files. Impossible on iPhones.

Safari has support File System Access API since 2022. Maybe you haven't kept up but Apple has done a 180° on PWAs in the past few years
by ants_everywhere | 2025-08-21 00:49:11+00:00
This is actually way false. Rigorous mathematical proof goes back to at least 300 BCE with Euclid's elements.

Fermat lived before the synthesis of calculus. People often talk about the period between the initial synthesis of calculus (around the time Fermat died) and the arrival of epsilon-delta proofs (around 200 years later) as being a kind of rigor gap in calculus.

But the infinitesimal methods used before epsilon-delta have been redeemed by the work on nonstandard analysis. And you occasionally hear other stories that can often be attributed to older mathematicians using a different definition of limit or integral etc than we typically use.

There were some periods and schools where rigor was taken more seriously than others, but the 1600s definitely do not predate the existence of mathematical rigor.
by pratikshelar871 | 2025-08-21 00:51:09+00:00
I recently joined a team with a very messy codebase. The devs were long gone, and even the ones maintaining it didn’t really understand large parts of the code. The bus factor was effectively zero.

What surprised me was how useful AI was. It helped me not only understand the code but also infer the probable intent behind it, which made debugging much faster. I started generating documentation directly from the code itself.

For me, this was a big win. Code is the source of truth. Developer documentation and even shared knowledge are often full of bias, selective memory, or the “Chinese whispers” problem where the story shifts every time it’s retold and never documented. Code doesn’t lie, it just needs interpretation. Using AI to cut through the noise and let the code explain itself felt like a net positive.
by sugarpimpdorsey | 2025-08-21 00:53:30+00:00
A lot of these passive types of anti-abuse systems rely on the rather bold assumption that making a bot perform a computation is expensive, but isn't for me as an ordinary user.

According to whom or what data exactly?

AI operators are clearly well-funded operations and the amount of electricity and CPU power is negligible. Software like Anubis and nearly all its identical predecessors grant you access after a single "proof". So you then have free reign to scrape the whole site.

The best physical analogy are those shopping cart things where you have to insert a quarter to unlock the cart, and you presumably get it back when you return the cart.

The group of people this doesn't affect are the well-funded, a quarter is a small price to pay for leaving your cart in the middle of the parking lot.

Those that suffer the most are the ones that can't find a quarter in the cupholder so you're stuck filling your arms with groceries.

Would you be richer if they didn't charge you a quarter? (For these anti-bot tools you're paying the electric company, not the site owner.). Maybe. But if you're Scrooge McDuck who is counting?
by weddpros | 2025-08-21 00:53:39+00:00
You could see expiring certificates as a chance to examine your security regularly: protocols and ciphers change, bugs are fixed, vulnerabilities are discovered and fixed.

Setup and forget is never good for security. From what I see with sslboard.com (I'm the founder), all hosts serving old expired certificates also have bad TLS versions and ciphers (RC4, DES) and vulnerabilities.
by appease7727 | 2025-08-21 00:56:29+00:00
That's literally what VPNs are for.

If you aren't aware: a Virtual Private Network creates a fully encrypted link between you and a remote node. So long as your encryption keys are secure, there's no way for anyone (even a global superpower) to listen to or intrude on that connection. There is no possible way to break into this connection, even with the entire planet's computing resources.

From the outside, all you can see is a stream of encrypted data between two nodes. You cannot tell where the traffic goes once it exits the VPN server or what it contains.

The only way to compromise a VPN connection is the most straightforward and pedestrian: compromise the VPN host and directly spy on their clients with their own hardware.

The GFW certainly can and has detected such encrypted streams and blocked them for being un-inspectable. With a VPN you can perfectly hide what you're doing and you can perfectly prevent intrusion. You cannot prevent someone noticing you're using a VPN. China can simply blanket ban connections that look like VPN traffic. But they cannot tell what you're doing with that VPN.
by cmcarthur | 2025-08-21 00:58:28+00:00
This is my understanding too, and this is particularly problematic for workloads that are read/write heavy on very recent data. When partitioning by a date or by an auto-incrementing id, you still run into the same issue.

Ex: your prefix is /id=12345. S3, under the hood, generates partitions named `/id=` and `/id=1`. Now, your id rolls over to `/id=20000`. All read/write activity on `/id=2xxxx` falls back to the original partition. Now, on rollover, you end up with read contention.

For any high-throughput workloads with unevenly distributed reads, you are best off using some element of randomness, or some evenly distributed partition key, at the root of your path.