MurphyA/hacker-news huggingface dataset:
by simonw | 2025-11-25 21:07:07+00:00
This kind of problem is present in most of the currently available crop of coding agents.

Some of them have default settings that would prevent it (though good luck figuring that out for each agent in turn - I find those security features are woefully under-documented).

And even for the ones that ARE secure by default... anyone who uses these things on a regular basis has likely found out how much more productive they are when you relax those settings and let them be more autonomous (at an enormous increase in personal risk)!

Since it's so easy to have credentials stolen, I think the best approach is to assume credentials can be stolen and design them accordingly:

- Never let a coding agent loose on a machine with credentials that can affect production environments: development/staging credentials only.

- Set budget limits on the credentials that you expose to the agents, that way if someone steals them they can't do more than $X worth of damage.

As an example: I do a lot of work with https://fly.io/ and I sometimes want Claude Code to help me figure out how best to deploy things via the Fly API. So I created a dedicated Fly "organization", separate from my production environment, set a spending limit on that organization and created an API key that could only interact with that organization and not my others.
by happytoexplain | 2025-11-25 21:07:46+00:00
Language is tricky. One of the trickiest things! There's so much tied up in it, objective and subjective. It's a simple tool. It's an academic object. It's a well-defined spec. It's a living ambiguous blob. But it's also one of the biggest pieces of one's culture. There's a reason the French are so possessive of their language where it lives in cultural exclaves. There's a reason the Irish have laws to keep their native language alive.
by KPGv2 | 2025-11-25 21:08:08+00:00
> SSDs have all but replaced hard drives when it comes to primary storage.

Really? I could have sworn that primary storage was the one place they weren't going to replace HDDs. Aren't they more of a thing for cache?

I've aged and busied myself beyond keeping track of this stuff anymore. I'm going to buy a packable NAS in the next couple months and be done with it. Hopefully ZFS since apparently that's the bee's knees and I won't have to think about RAIDs anymore.
by Veedrac | 2025-11-25 21:08:15+00:00
It's hard for me to respect the intrinsic superiority of a format whose main value-add is exclusivity, rather than fair market competition based on merits.

If theatres pivoted to competing first on format rather than exclusive access to recent releases, and managed to do well in that regime, I'm sure Netflix and other new media would be more than happy to indulge. Seems unlikely, though, doesn't it? The demand exists but I would be surprised if it was a quarter the size.
by bsimpson | 2025-11-25 21:08:26+00:00
If you'd prefer to watch a video, the author was interviewed on YouTube 5y ago:

https://www.youtube.com/watch?v=izxXGuVL21o

I thought that video included one of my favorite programming legends, and apparently a bunch of people on Reddit remembered that too. Instead, it was published on Gamasutra about a "late 90s PC title." Still very worth the quick read:

https://www.gamedeveloper.com/programming/dirty-coding-trick...
by lern_too_spel | 2025-11-25 21:08:42+00:00
I don't know how many more nails in the coffin of heritable intelligence are needed before public policy capitalizes on the opportunity here. We have seen huge shifts in intelligence in places like Korea after armistice, in China after economic and cultural reforms, and in the U.S. after COVID and smartphones. We have seen that individual tutoring reliably creates extreme outliers from the examples of Avant-garde, Williams, Tao, Polgár, the Hungarian Martians, etc. Aside from disorders, any heritable differences can be easily dwarfed by environmental effects, and some disorders, like OCD, only magnify environmental effects.
by tialaramex | 2025-11-25 21:09:11+00:00
AFAICT Although C++ now has const, constexpr. consteval and constinit, none of those mean an actual constant. In particular constexpr is largely just boilerplate left over from an earlier idea about true compile time constants, and so it means almost nothing today.

Yes, the C++ compile time execution could certainly be considered more powerful than Rust's and Zig's even more powerful than that. It is expected that Rust will some day ship compile time constant trait evaluations, which will mean you don't have to write awkward code that avoids e.g. iterators -- so with that change it's probably in the same ballpark as C++ 17 (maybe a little more powerful). However C++ 20 does compile-time dynamic allocation†, and I don't think that's on the horizon for Rust.

† In C++ 20 you must free these allocations inside the same compile-time expression, but that's still a lot of power compared to not being allowed to allocate. It is definitely possible that a future C++ language will find a way to sort of "grandfather in" these allocations so that somehow they can survive to runtime rather than needing to free them.

Rust does give you the option to break out the big guns by writing "procedural" aka "proc" macros which are essentially Rust that is run inside your compiler. Obviously these are arbitrarily powerful, but far too dangerous - there's a (serious) proc macro to run Python from inside your Rust program and (joke, in that you shouldn't use it even though it would work) proc macro which will try out different syntax until it finds which of several options results in a valid program...
by smithkl42 | 2025-11-25 21:09:19+00:00
Plausible article, but it reads like a preschooler frustrated that his new toy is broken. "Fix it! Make it work!" - without ever specifying how.

Granted, this is an exceedingly hard problem, and I suppose there's some value in reminding ourselves of it - but I'd much rather read thoughts on how to do it better, not just complaints that we're doing it poorly.
by dmbaggett | 2025-11-25 21:10:00+00:00
Sort of. While it was helpful to have the delta-compressed polygon list for each part of the level in its own 64KB chunk, the minor miracle of fitting >10MB levels into 2MB of RAM (half of which was VRAM as I recall) was down to two things: 1) Andy wrote this insane dynamic layout/loader thing that optimized the CD’s bandwidth (which was of course pathetic by today’s standards, as you point out); 2) I wrote a tool that packed the chunks into pages so that we never needed too many active at any given point in the level. This is an NP-Complete problem and we didn’t have solvers back then so the tool just tried a bunch of heuristics, including a stochastic one (think early simulated annealing). The problem with the latter was that if you “got lucky” you might never achieve the required packing again after the artist changed a turtle or something…
by lcnPylGDnU4H9OF | 2025-11-25 21:10:31+00:00
> in a simplified way, as i said:

It's overly simplified to the point of being meaningless. A .js file is a document that presents information to me when I open it using a text editor. So is a .html file, for that matter. Something different happens when they're opened in a browser and, for that reason, they both seem to be programs as well.
by wing-_-nuts | 2025-11-25 21:11:10+00:00
I mean, I don't deny that teachers are paid less compared to other fields, but that is actually pretty universal among occupations that provide the worker with a higher sense of purpose. You can see the same thing in social work, the non profit sector and elsewhere. Whether that's truly just is an entirely different question than 'is there a direct relationship between teacher pay and student achievement' and looking at all other sources I've provided, there clearly is not.
Looking for Open Source Co owners and decision makers
by deadlight | 2025-11-25 21:11:29+00:00
Hello, my name is Deadlight.

I’m looking for developers who want to build something meaningful together, people who enjoy making technical decisions, sharing ideas, and working on ambitious open-source projects. Working alone slows down progress and limits perspective, so I’m hoping to find one or two co-owners who are passionate about systems programming, networking, privacy, and innovation.

I’m currently working on two projects:

Project 1: SwiftNet (Networking Library in C)

A fast, reliable, dependency-minimal networking library written in C. Goals:

High performance Every feature optional at compile-time Zero external dependencies at release Manual Ethernet/IP header construction Currently using libpcap, will switch to raw BPF

Foundations are implemented, but the project is far from complete and not tested on real interfaces, only loopback. https://github.com/deadlightreal/SwiftNet

Project 2: SwiftCom (Self-Hosted Encrypted Messaging App)

A privacy-focused messaging platform written in C++ with wxWidgets. Planned features:

Self-hosted servers (no corporate ownership) Encrypted communication Chat rooms, DMs, and planned voice chat SQLite3 database Integrates with SwiftNet for full control over networking

The project is about one month old. https://github.com/deadlightreal/SwiftCom

Critical thinking: Someone who isn’t afraid to point out mistakes, question decisions, and challenge ideas when needed. I want a collaborator who improves the project and not someone who just agrees with everything.

Technical baseline:

Project 1: Solid understanding of sockets in C Experience with atleast TCP/UDP, packet structure (Bonus) Familiarity with raw sockets, libpcap, or BPF

Project 2: Comfortable with C++ or GUI frameworks

Creativity and new ideas: Not just implementing what exists, but proposing new features, optimizations, architectural improvements, and privacy-focused approaches.

Motivation & passion: A collaborator who genuinely enjoys building systems from the ground up.

Values: A strong belief in:

Free speech, User autonomy, Maximum privacy, Decentralization, Open source freedom. Our goal is to build technology that empowers people and not corporations.

If you are interested working on any of these projects and building something big together, please contact me at: Telegram: https://t.me/deadlightreal
by Jtsummers | 2025-11-25 21:11:31+00:00
> No but whatsapp was built by 2 guys that had previously worked at Yahoo, and they picked a very strong tech for the backend: erlang.

https://news.ycombinator.com/item?id=44911553

Started as PHP, not as Erlang.

> 1) knew what it would take, 2) chose already from the ground up a good technology to have a smoother transition to your "X millions users".

No, as above, that was a pivot. They did not start from the ground up with Erlang or ejabberd, they adopted that later.
by rlmark | 2025-11-25 21:11:32+00:00
Thank you!

Unison does diverge a bit from the mainstream in terms of its design. There's a class of problems around deploying and serializing code that involve incidental complexity and repetitive work for many dev teams (IDLs at service boundaries and at storage boundaries, provisioning resources for cloud infrastructure) and a few "everyday programming" pain points that Unison does away with completely (non-semantic merge conflicts, dependency management resolution).

We wrote up some of that here at a high level: https://www.unison-lang.org/docs/what-problems-does-unison-s...

But also, feel free to ask more about the technical specifics if you'd like.
by cultofmetatron | 2025-11-25 21:11:53+00:00
>One of the few regrets is that I didn’t learn advanced math back when my brain was primed for it. Learning calculus in mid-life is tough

in the same position. tried to get into deep learning last year and found my calculus knowledge lacking. If you're looking to get back into it efficently, checkout mathacademy.com. i'm currently doing it myself and I'm on track to make another stab at getting into deeplearning next year.
by seanmcdirmid | 2025-11-25 21:12:00+00:00
I still let my kid play a couple of hours a week, but told him no robux at all, it just wasn't something we were even going to consider. Let's see how it lasts, hopefully I can get him interested in something else but somehow his entire local social circle collapsed when we made him cut back on his play time. Its not even strangers at this point, but kids at school that have caused conflicts.
by zamadatix | 2025-11-25 21:12:03+00:00
It's relatively hard to audit a binary. You can audit the behavior of single runs, you can't nearly as easily audit the behavior of the program itself though. What if it pings only on Tuesdays, what if it does some sort of dns reach out that's a false positive for something else you didn't realize the browser was doing, what if there are platform specific differences in behavior.

The same goes for auditing the final executable. Open source gives two options on that: build it, trust it. The latter may seem 0 gain but, again, it is actually a big difference trying to audit a blackbox for every possible behavior vs seeing what the baseline behavior is supposed to be and looking if any differences occur in the premade binaries. There is a 3rd option: reproducible builds... but I doubt that's a reasonable goal in this case.

I'm not saying Kagi/Orion should necessarily care about providing that level of audibility, just that the response a pre-made binary is as trustable as a binary with its source code falls quite flat.
by ewoodrich | 2025-11-25 21:12:32+00:00
I really need something like this up for tasks I want Claude to run before handing off a task to me as "complete". It routinely ignores my instructions of checklist items that need to be satisfied to be considered successful. I have a helper script documented in CLAUDE.md that lets Claude or me get specific build/log outputs with a few one liner commands yet Claude can't be bothered to remember running them half the time.

Way too frequently Claude goes, "The task is fully implemented, error free with tests passing and no bugs or issues!" and I have to reply "did you verify server build/log outputs with run-dev per CLAUDE.md". It immediately knows the command I am referencing from the instructions buried in its context already, notices an issue and then goes back and fixes it correctly the second time. Whenever it happens it instantly makes an agentic coding session go from feeling like breezy, effortless fun to pulling teeth.

I've started to design a subagent to handle chores after every task to avoid context pollution but it sounds like hooks are the missing piece I need to deterministically guarantee it will run every time instead of just when Claude feels the vibes are right.
by agreeahmed | 2025-11-25 21:12:58+00:00
But you do have to figure out which ones are salient to you and how they map to your specific app's lifecycle.

As a very small example: would you need to handle `charge.succeeded` and `payment_intent.succeeded`? How would you dedupe processing these events vs `customer.subscription.created`? Today, there's a lot of incidental knowledge about your payment processor's specific approach to webhook events that you need to know in order to integrate them.
by pbohun | 2025-11-25 21:13:23+00:00
Not quite. Erlang uses the Actor model which delivers messages asynchronously to named processes. In Go, messages are passed between goroutines via channels, which provide a synchronization mechanism (when un-buffered). The ability to synchronize allow one to setup a "rhythm" to computation that the Actor model is explicitly not designed to do. Also, note that a process must know its consumer in the Actor model, but goroutines do not need to know their consumer in the CSP model. Channels can even be passed around to other goroutines!

Each have their own pros and cons. You can see some of the legends who invented different methods of concurrency here: https://www.youtube.com/watch?v=37wFVVVZlVU

There's also a nice talk Rob Pike gave that illustrated some very useful concurrency patterns that can be built using the CSP model: https://www.youtube.com/watch?v=f6kdp27TYZs
by throw0101c | 2025-11-25 21:13:49+00:00
See perhaps the 2006 movie:

> Who Killed the Electric Car? is a 2006 American documentary film directed by Chris Paine that explores the creation, limited commercialization and subsequent destruction of the battery electric vehicle in the United States, specifically the General Motors EV1 of the mid-1990s. The film explores the roles of automobile manufacturers, the oil industry, the federal government of the United States, the California government, batteries, hydrogen vehicles and consumers in limiting the development and adoption of this technology.

* https://en.wikipedia.org/wiki/Who_Killed_the_Electric_Car%3F

And from the same director in 2011:

* https://en.wikipedia.org/wiki/Revenge_of_the_Electric_Car
by stavros | 2025-11-25 21:13:54+00:00
This is probably unrelated, but I used to play a lot of DotA for years (at some points for 12 hours a day), then quit cold turkey, then started again last year, but maybe 30-60 minutes a day.

After I started Mounjaro, I haven't really had the urge to play at all. I played a game a few weeks ago but I was kind of "meh" about it, and haven't played since. It's striking.
by simonw | 2025-11-25 21:14:15+00:00
> We have found ways to mitigate these types of issues for regular code, so I think it's a matter of time before we solve this for LLMs.

We've been talking about prompt injection for over three years now. Right from the start the obvious fix has been to separate data from instructions (as seen in parameterized SQL queries etc)... and nobody has cracked a way to actually do that yet.
by drdaeman | 2025-11-25 21:14:58+00:00
Personally, I have some software engineering skills. For me it’s about trust in your development team and product direction.

To be at least somewhat certain of the future, I want to own critical pieces of software, not rent it from someone no matter how benevolent-looking.

While things are well, I want to be able to contribute. There are myriads of minor things that your development teams would never get time to look into. If something is a wart, I might have skills to do it myself and - hopefully - ask you to incorporate my patches. I did that to a few pieces of software I trust and use, and I consider the ability to do this as fairly important, even though I do this very rarely.

And if things go sour, it could be impossible to keep up with long-term maintenance of this complex machinery but I still want that option open too. I want to know that if you folks decide to do something unpleasant to the browser, I’ll be able to begrudgingly take over and still fully own the software at least while I’m investigating the replacement options. Not be at someone’s else’s mercy.

To be persuaded otherwise, I need to be aware about your reasons for not providing users software freedoms and agree they’re serving our mutual interests.

(Needless to say, Orion is a very different product from Kagi Search, which is why I apply different set of requirements. I can switch search engines much more easily than user agent software.)
by moritz | 2025-11-25 21:15:02+00:00
As the great Joe Armstrong used to say, “a lot of systems actually break the laws of physics”[1] — don’t program against the laws of physics.

> In distributed systems there is no real shared state (imagine one machine in the USA another in Sweden) where is the shared state? In the middle of the Atlantic? - shared state breaks laws of physics. State changes are propagated at the speed of light - we always know how things were at a remote site not how they are now. What we know is what they last told us. If you make a software abstraction that ignores this fact you’ll be in trouble.[2]

[1]: “The Mess We’re In”, 2014 https://www.youtube.com/watch?v=lKXe3HUG2l4

[2]: https://news.ycombinator.com/item?id=19708900
by sjclemmy | 2025-11-25 21:15:14+00:00
The uk government development service as you call it is not a service. It’s more of a declaration of process that is adhered to across diverse departments and organisations that make up the government. It’s usually small teams that are responsible for exploring what a service is or needs and then implementing it. They are able to deliver decent services because they start small, design and user test iteratively and only when there is a really good understanding of what’s being delivered do they scale out. The technology is the easy bit.
by symisc_devel | 2025-11-25 21:16:36+00:00
Congratulations for the launch. Actually we launched a similar product recently named Vision Workspace (https://vision.pixlab.io). The general chat niche is quite saturated and practically locked by the major players. I recommend that you focus on one core feature and pivot from there. For us it was the built-in OCR and document query interface inside the UI that initiated the traction and the app is quite popular now in Japan and Malaysia.
by zamadatix | 2025-11-25 21:16:51+00:00
One as the content provider can still use the same kinds of methods such as ToR to browse clearnet hosting sites without limiting the content consumers to only accessing the content via a .onion link.

It's the same thing as the original comment except in reverse. The only downside is you may lose the popular/easy distribution method if it gets taken down. The alternative is to just declare it lost day 1 though, so there is only a gain to be made in leeching a hosting site like GitHub while you can.
by close04 | 2025-11-25 21:16:55+00:00
Doesn't that just mean that an LLM doesn't understand consequences and will just execute the request from a carefully crafted prompt? All it needs is the access to the "red button" so to speak.

An LLM has no critical thinking, and the process of building in barriers is far less understood than the same for humans. You trust a human with particularly dangerous things after a process that takes years and even then it occasionally fails. We don't have that process nailed down for an LLM yet.

So yeah, not at all hyperbole if that LLM would do it if given the chance. The hyperbole is when the LLM is painted as some evil entity bent on destruction. It's not evil, or bent on destruction. It's probably more like a child who'll do anything for a candy no matter how many times you say "don't get in a car with strangers".
Ask HN: Hetzner asking for passport for new account? just me, or everyone?
by casenmgreen | 2025-11-25 21:17:23+00:00
Just made a Hetzner account, activated 2FA, the usual.

Then go to buy a storage box, and I get this;

> Our automated system check indicates that your account information has an increased level of risk. Please choose one of the following verification methods:

And you can pay 20 EUR up front by PayPal, or hand over your passport (fat chance!)

Is this genuine, or does everyone get this and it's a fake reason?

(I've signed up to pay by bank transfer, so I'm also wondering why they don't ask me for pre-payment by bank transfer. As it is, no way on God's clean earth they get a passport, and I'm not on Paypal, so will try to use a friend's, but seems my second try to board Hetzner train has bounced - first time I left almost immediately, when I saw spaces not permitted in passwords.)
by itake | 2025-11-25 21:17:42+00:00
> not too polluted

Are we talking about the same Bangkok? I'm talking about the Bangkok in Thailand where they literally shut down the schools due to air pollution being so bad [0].

What Bangkok are you referring to?

Malaysia is wayyy cleaner than Indonesia, both in air quality and trash on the ground.

[0] - https://www.theguardian.com/world/2025/jan/24/bangkok-pollut...
by scott_w | 2025-11-25 21:18:01+00:00
100% This. I remember joining a billing team that assumed calls to Braintree succeed or fail, so everything was just calling the API as though it was a local function call.

It was great fun debugging the twice annual incidents where the API returned a HTTP500 but charged the customer and created the recurring subscription anyway.

Not to forget we had to scream at them for 6 months to implement 3DS2 on top of their Subscriptions API. Turns out we were the only users of it!