MurphyA/hacker-news huggingface dataset:
by 0north | 2025-11-25 15:26:41+00:00
You’ve mostly got it.

The API on DigitalOcean just builds a fresh .exe and embeds a unique seed into the runtime build. After that, everything is offline.

The seed is made server-side during creation as a SHA-256 over a timestamp + jitter source, and is written as (vault-seed.txt)in the .zip.

Inside the .exe, the vault reads its own embedded seed. The KDF is thus:

key = SHA256(SHA256(password||seed))

Each encryption uses a fresh 16-byte IV and encodes ciphertexts as:

ivHex + "." + encryptedHex

So the text is encrypted and locked behind an AES key and an ivHex per click.

The result is simply: same password + different builds => different AES keys, because each .exe has a different seed baked into it.

That’s what creates the conditions where two environments can never decrypt each-other’s ciphertexts and can be generated endlessly.
by debo_ | 2025-11-25 15:26:41+00:00
The family of languages that started with ML[0] mostly look like this. Studying that language family will probably help you feel much more at home in Rust.

Many features and stylistic choices from ML derivatives have made their way into Swift, Typescript, and other non-ML languages.

I often say that if you want to be a career programmer, it is a good idea to deeply learn one Lisp-type language (which will help with stuff like Python), one ML-type language (which will help with stuff like Rust) and one C-type language (for obvious reasons.)

[0] https://en.wikipedia.org/wiki/ML_(programming_language)
by wise_young_man | 2025-11-25 15:26:45+00:00
It’s a lot more complicated financially for people. You used to not have to rely on dual incomes just to survive. Wealth inequity, housing affordability, and healthcare have all changed. This is why many are choosing to have kids later in life or not even at all because of those reasons and even the environment with climate change it’s a hard decision to make to bring new life into this world to suffer in it.
by zyxzevn | 2025-11-25 15:26:48+00:00
I used "Open Recursion" in many large (ObjectPascal / C++) projects. With simple interfaces, a large project becomes a collection of smaller components. I noticed many programmers do not understand it. Pure OOP languages (like Smalltalk or Ruby or Scala) are the best languages to understand how it could work. They usually have closures where other languages would have "patterns".

The problem is that the components are often connected to different interfaces/graphs. Components can never be fully separated due to debug, visualization and storage requirements.

In non-OOP systems the interfaces are closed or absent, so you get huge debug, visualization and storage functions that do everything. On addition to the other functionality. And these functions need to be updated for each different type of data. The complexity moves to a different part. But most importantly, any new type requires changes to many functions. This affects a team and well tested code. If your product is used by different companies with different requirements (different data types), your functions become overly complex.
by red-iron-pine | 2025-11-25 15:27:03+00:00
AI told me 7 of 9 CVEs were exploited in the wild. Copilot gave me a different 7 than ChatGPT. Both were wrong about at least one.

My intern, a goofy 20 year old EE student, got different results too, but he at least was able to tell me "i'm not sure" and give me real links to where he looked.
by iambateman | 2025-11-25 15:27:05+00:00
One of the most beautiful, amazing things about parenting a child is thinking about “where would this child be at this age if it were another animal.”

A three day old horse can walk.

A three year old tiger is often a MOTHER to her own cubs already.

But then by six years-old the human child can do things mentally which are orders of magnitude more advanced than anything another animal has ever done. It’s really amazing.
by Cthulhu_ | 2025-11-25 15:27:17+00:00
Sure, which is highly valuable information that hopefully made its way into a testing / verification suite. Which can then be used to rewrite the tool into a memory-safe language, which allows a lot of fixes and edge cases that were added over time to deal with said issues to be refactored out.

Of course there's a risk that new issues are introduced, but again, that depends a lot on the verification suite for the existing tool.

Also, just because someone did a port, doesn't mean it has to be adopted or that it should replace the original. That's open source / the UNIX mentality.
by jvanderbot | 2025-11-25 15:27:38+00:00
"Arrogant" does not mean "forceful" or "assertive" or "makes me angry".

This is forceful, assertive, and probably makes people angry.

Does the speaker have the authority to make this happen? Because if so, this is just a mandate and it's hard to find some kind of moral failing with a change in development direction communicated clearly.
by MontagFTB | 2025-11-25 15:27:49+00:00
If the Standard has anything to say about compatibility between different language versions, I doubt many developers know those details. This is breeding ground for ODR violations, as you’re likely using compilers with different output (as they are built in different eras of the language’s lifetime) especially at higher optimization settings.

This flies in the face of modern principles like building all your C++, from source, at the same time, with the same settings.

Languages like Rust include these settings in symbol names as a hash to prevent these kinds of issues by design. Unless your whole team is a moderate-level language lawyer, you must enforce this by some other means or risk some really gnarly issues.
by Weves | 2025-11-25 15:27:59+00:00
"Chat UI" can "feel" a bit thin from an eng/product when you initially think about, and that's something we've had to grapple with over time. As we've dug deeper, my worry about that has gone down over time.

For most people, the chat is the entrypoint to LLMs, and people are growing to expect more and more. So now it might be basic chat, web search, internal RAG, deep research, etc. Very soon, it will be more complex flows kicked off via this interface (e.g. cleaning up a Linear project). The same "chat UI" that is used for basic chat must (imo) support these flows to stay competitive.

On the engineering side, things like Deep Research are quite complex/open-ended, and there can be huge differences in quality between implementations (e.g. ChatGPTs vs Claude). Code interpreter as well (to do it securely) is quite a tricky task.
by surajrmal | 2025-11-25 15:28:02+00:00
The c++ features that get bolted on to replicate those in other languages tend to never reach parity because of all the legacy baggage they need to design around. Modules are not nearly as useful as one would hope. std::variant and std::optional are not nearly as ergonomic or safe to use as rust equivalents. coroutines are not exactly what anyone really wanted. If you're simply looking for checkboxes on features then I suppose you have a point.

To be clear, I like and continue to use modern c++ daily, but I also use rust daily and you cannot really make a straight faced argument that c++ is catching up. I do think both languages offer a lot that higher languages like go and Python don't offer which is why I never venture into those languages, regardless of performance needs.
by woodruffw | 2025-11-25 15:28:08+00:00
Sorry, what's the threat model in which you're giving people write access to your repository but assuming that they can't publish?

To establish a baseline here: the assumption with Trusted Publishing is that people are already using CI/CD to publish to places like PyPI. All Trusted Publishing does is replace the user-managed credential with a machine-intermediated one.

In other words: if someone had write access to your repository before, Trusted Publishing does not change their privilege, since they could always push a new CI/CD workflow that uses your manual publishing secret directly. All Trusted Publishing does is formalize the treatment of the source repository as a source of truth, and introduce some misuse-resistance properties (short-lived credentials, minimal self-scoping).

If this isn't your user model, that's perfectly fine. But in that case you shouldn't be using CI/CD to publish at all (which is also fine); it's not an issue with Trusted Publishing per se.
Show HN: I built a local fuzzing tool to red-team LLM agents (Python, SQLite)
by woozyrabbit | 2025-11-25 15:28:10+00:00
I spent the last week building a local-first security tool because I was tired of paying $500/mo for enterprise SaaS just to test my AI agents for basic vulnerabilities.

The tool is called Agent Exam Pro. It's a Python-based fuzzer that runs locally on your machine (no cloud data leaks).

How it works:

The Engine: Takes a base test case and runs it through 16 mutation strategies (Base64, Roleplay, Token Smuggling) to generate 1,000+ variations.

The Payloads: I curated 280+ real-world exploits from open-source lists (PayloadBox, PayloadsAllTheThings) to test for SQLi and XSS in agent tool calls.

The Judge: Uses a local LLM (via Ollama) or OpenAI to grade responses on safety rather than just regex matching.

The Audit: Logs everything to a local SQLite database.

I'm selling the source code as a one-time purchase (no subscriptions) because I prefer owning my tools.

You can check it out here: https://woozymint.gumroad.com/l/agent-exam-pro
by anarki8 | 2025-11-25 15:28:12+00:00
> You can't go around screaming "your code SUCKS and you need to rewrite it my way NOW"

It seems you are imagining things and hate people for the things you imagined.

In reality there are situations where during technical discussions some people stand up and with trembling voice start derailing these technical discussions with "arguments" like "you are trying to convince everyone to switch over to the religion". https://youtu.be/WiPp9YEBV0Q?t=1529
by zackmorris | 2025-11-25 15:28:15+00:00
I think of it like limits in math. The rate at which we'll be out of work is much higher than the rate at which prices will fall towards zero.

A performative/underemployment economy keeps everyone working not out of necessity, but to appease the sentiments of the wealthy. I'd argue that we passed the point at which wages were tied to productivity sometime around 1970, meaning that we're already decades into a second Gilded Age where wealth comes from inheritance, investment and connections (forms of luck) rather than hard work.

And honestly, to call UBI performative when billionaires are trying to become trillionaires as countless people die of starvation every day just doesn't make any sense.
Show HN: I wrote a book for engineers building production AI systems
by aroussi | 2025-11-25 15:28:33+00:00
I wrote this because I kept watching the same mistakes: Teams chain prompts, call it "agentic," then wonder why everything breaks under real-world pressure.

The book covers what actually works: memory systems, orchestration patterns, multi-agent coordination, observability, and real examples from systems that actually ship.

Download the first 3 chapters (no email): https://productionaibook.com/hn

I'd love to hear your production AI war stories. What's actually breaking? What patterns have you discovered?

Giving away 15 copies to the most insightful comments.
Show HN: AI Gigs Marketplace
by the_plug | 2025-11-25 15:29:01+00:00
We built a marketplace where you pick an AI agent for your task and get professional results instantly. How it works:

Browse our gig board of specialized AI agents Select the agent that fits your needs Submit your task Get professional results back immediately

What's live:

10+ writing gigs (all powered by AI agents) Instant execution and delivery

What's coming:

Image generation gigs Video gigs Audio gigs

Think of it as Fiverr but every service is an AI agent ready to execute on demand. Would love to hear what services you'd want to see.

botigigs.com
by amluto | 2025-11-25 15:29:05+00:00
The author seems to be writing about a dream language that isn’t actually C++. For example:

> In my streams I showed how RAII can thereby also be applied to database operations: a connection exists as long as it is in scope.

Only if that connection object doesn’t support move — we’re 12 years of C++ standards past the arrival of move, and it still leaves its source in an indeterminate state.

> With std::variant, C++ gained a tool that allows dynamic states without giving up type safety.

variant is not quite type-safe:

https://en.cppreference.com/w/cpp/utility/variant/valueless_...

> With C++20, std::ranges decisively extends this principle: it integrates the notions of iterator, container, and algorithm into a unified model that combines type safety and readability.

Ranges may be type-safe, but they’re not safe. Like string_view, a range is a reference, and the language does not help ensure that the referent remains valid.
by metalman | 2025-11-25 15:29:15+00:00
there is absolutly no way to prevent the intentional weaponisation of chat/ai, and as we rapidly move towards a fully juristictionless space based server network, the full potential mahem is going to be realised soon enough.

madness my droogys, the fully unhinged variety popping up like mushrooms, wheeeeee! muckers and zombies olly olly oxen freeeee!, ready or not, here they come. mix in autonomous drones and robots, and well, some days are going to be rough
by thatcks | 2025-11-25 15:29:16+00:00
The short version is that we wound up not feeling particularly enthused about OpenBSD itself. We have a much better developed framework for handling Ubuntu machines, making it simply easier to have some more Ubuntu machines instead of OpenBSD machines, and we also felt Bind on Ubuntu was likely to be better supported than a ports Bind on OpenBSD. If everything else is equal we're going to make a machine Ubuntu instead of OpenBSD.
by zwnow | 2025-11-25 15:29:31+00:00
> Realizing that going it alone is futile is definitely part of what I consider becoming an adult

Weird, for me its the complete opposite. I accepted to live alone for the rest of my life because a) I am undesired and I wont make a move. b) I barely met people I would even consider it being worth talking to, I need to feel equal on a cognitive level and not a lot of people match that requirement. I either feel lesser or above.
by solatic | 2025-11-25 15:29:34+00:00
This. I may not work with AI training workflows, but I struggle to understand why they supposedly require launching a thousand pods per second to use GPUs that need to fundamentally be installed across different baremetal machines. Once the GPUs are on different machines, if there are 1k+ such machines, just start putting them on different Kubernetes clusters. Build a scheduling layer above the Kubernetes control plane to decide which Kubernetes cluster to schedule the pod onto.

The whole thing stinks of, AI investors are throwing money at AI companies, so go to GCP and tell them to solve the problem at any price so that they can keep scaling without needing to build the scheduling layer above the Kubernetes control planes.
by lunar_mycroft | 2025-11-25 15:29:55+00:00
> How would you fix this by only editing the code inside the unsafe block?

In this case, the solution is to mark make_slice as unsafe. This should make sense if you think about it for a second, because it's a thin wrapper around an unsafe function. If it were possible to make a function which did what std::slice::from_raw_parts does safe, it wouldn't be marked as unsafe.

> It's the exact opposite. From the Rust docs.

The docs you quote say the exact opposite of what you claim. Where do you do call the unsafe function in an unsafe block? In make_slice, not main.

> So yes, as long as you change your function so much you can basically remove unsafe, you can fix it from the function.

The actual use case for std::slice::from_raw_parts is for when you control the pointer and length and thus can guarantee that they're valid (specifically, by encapsulating them and making sure no safe functions can get them into an invalid state). For example, std::Vec::as_slice uses it [1] to get a slice from the pointer to it's managed buffer and it's stored length.

> FFI

There are two possible ways FFI could cause memory safety violations despite being called from safe code:

- The safe wrapper makes incorrect assumptions about the contract of the functions it's calling (e.g. maybe it assumes that a c function returns a pointer which it's the caller's responsibility to free, but is actually freed by the c code). In this case, the bug is in the unsafe rust. - The foreign code violates it's contract (e.g. same as above, but the documentation of the c code claims otherwise). In that case, the bug is in the foreign code.

Either way, the memory safety bug is not in safe rust.

[1] https://github.com/rust-lang/rust/blob/7934bbdf84a6b9a30297c...
by thisisagooddayg | 2025-11-25 15:30:51+00:00
We’ve been building a momentum scanner and kept running into the same problem: how do you detect and rank momentum when a symbol aligns across multiple timeframes (1H, 4H, 1D, 1W) without blowing up latency or complexity?

We ended up engineering a small “multi-timeframe signal engine”:

– We aggregate EMA structure, ADX, Squeeze Momentum and trend context. – We normalize signals coming from 1H/4H/1D/1W (different providers, different formats). – We detect “fresh” setups instead of extended ones, using a scoring model (our pilot_score) that filters extended trends and keeps only early-stage momentum. – We run bulk timeframe queries in parallel (FastAPI + async + PostgreSQL). – We surface only the top aligned symbols as multi-TF highlights in the UI.

This shipped today on our platform. If you’re building something similar (ranking pipelines, multi-timeframe analysis, bulk aggregation, signal normalization, etc.), happy to discuss details or share insights.

Demo: https://getchartpilot.com
Ask HN: Are there LLMs that can do UX testing?
by edwcross | 2025-11-25 15:30:56+00:00
One of the main difficulties in testing user interfaces is that, even when you have volunteers, they can only be used once for initial testing of an interface.

After the first test, they have already learned something, and that memory will interfere with further tests.

AI could be very useful in this case: imitate human behavior (can multi-modal LLMS "read" an interface screenshot and pretend to try to interact with it? Are there tools that can interpret what the LLM responds, e.g. "I'll try to click 'Details'" and then give the LLM another image?), but then immediately forget everything when a different version of the interface is presented to them.

Bonus points if you can add "personas" to the LLM (e.g. "you are a hurried user who barely reads the text", "you are a patient beginner who patiently watches the screen before trying", etc).

Maybe all of this is already available with agents and being currently used?
by arcbyte | 2025-11-25 15:31:12+00:00
I never got very far with this idea beyond coming up with it, but whe thinking about unfakable calculable characteristics that could be used for locality verificacion, i could only come up with latency as the key characteristic. Based on some geographical threshold distance the speed of light gives a reasonable estimate of how much latency there ought to be when communicating with someone. So if you could issue a challenge and time the response, you should know someone is local to you or not.
by simonw | 2025-11-25 15:31:19+00:00
trait Handler { fn handle<'a>(&self, input: &'a str) -> Result<&'a str, HandlerError>; } fn process_handler<'a>( handler: Box<dyn Handler + 'a>, input: &'a str, ) -> Result<&'a str, HandlerError> { handler.handle(input) }
by ndiddy | 2025-11-25 15:31:34+00:00
If you look at the article, it seems like the hard dependency on Rust is being added for parsing functionality that only Canonical uses:

> David Kalnischkies, who is also a major contributor to APT, suggested that if the goal is to reduce bugs, it would be better to remove the code that is used to parse the .deb, .ar, and .tar formats that Klode mentioned from APT entirely. It is only needed for two tools, apt-ftparchive and apt-extracttemplates, he said, and the only ""serious usage"" of apt-ftparchive was by Klode's employer, Canonical, for its Launchpad software-collaboration platform. If those were taken out of the main APT code base, then it would not matter whether they were written in Rust, Python, or another language, since the tools are not directly necessary for any given port.
by Cthulhu_ | 2025-11-25 15:32:34+00:00
Or else books / online communities. I can't recommend using ChatGPT for this kind of help but it can be used to validate your experiences, provide a different experience, and if you ask it, point you in the right direction.

For example, if you explain it (or Reddit) an interpersonal situation it can break it down and e.g. point out certain behaviours or boundary crossings.

But I would be careful, as these chatbots will by default put you in the right, even when you aren't.
by jjice | 2025-11-25 15:32:57+00:00
Maybe I've Stockholm'd myself, but I think Rust's syntax is very pleasant. I also think a lot of C code looks very good (although there is some _ugly_ C code out there).

Sometimes the different sets of angle and curly brackets adding up can look ugly at first, and maybe the anonymous function syntax of || {}, but it grows on you if you spend some time with the language (as do all syntaxes, in my experience).
by jlivingood | 2025-11-25 15:33:07+00:00
For folks following this here - node and neighborhood look clean. The issue appears to be a failing cable modem (MB8611 - they seem to suffer frequent disconnects when they fail). We have suggested the customer replace the modem ASAP and we will re-run all the DOCSIS diagnostics. Suitable alternative COAM modems are listed at https://old.reddit.com/r/Comcast/comments/1kg99v3/buying_you...

- Jason (I work at Comcast)
by handwarmers | 2025-11-25 15:33:37+00:00
Are the many who disagree that it is unreadable more than the people who agree? I have been involved with the language for a while now, and while I appreciate what you and many others have done for it, the sense that the group is immune to feedback just becomes too palpable too often. That, and the really aggressive PR.

Rust is trying to solve a really important problem, and so far it might well be one of the best solutions we have for it in a general sense. I 100% support its use in as many places as possible, so that it can evolve. However, its evolution seems to be thwarted by a very vocal subset of its leadership and community who have made it a part of their identity and whatever socio-political leverage toolset they use.
by codedokode | 2025-11-25 15:33:44+00:00
> the ratio is never 1:1, there's always way more men.

Isn't it weird? There should be approximately equal number of not married men and women, so there should be some reason why there are less women on dating platforms. Is it because women work more and have less free time? Or because men are so bad? Or because they have an AI boyfriend? Or married men using dating apps shift the ratio?
by theptip | 2025-11-25 15:34:26+00:00
Yeah, these AI detector tools are bad. (They also punish ESL as this tends to result in simpler language patterns that parse as LLM.)

The great thing about AI is that with a bit of imagination it can be used to amplify teachers too.

In this case, yes, you need to do a viva voce to convince the teacher (though I suspect they should be able to get fairly confident in 10-15 minutes).

But you could also have students convince an AI (probably in a proctored space?) if you need to scale this approach out.