MurphyA/hacker-news huggingface dataset:
by avaika | 2025-12-30 03:36:48+00:00
I don't trust LLM enough to handle the maintenance of all the abstraction buried in react / similar library. I caught some of the LLMs taking nasty shortcuts (e.g. removing test constraints or validations in order to make the test green). Multiple times. Which completely breaks trust.

And if I have to closely supervise every single change, I don't believe my development process will be any better. If not worse.

Let alone new engineers who join the team and all of a sudden have to deal with a unique solution layer which doesn't exist anywhere else.
by mlinhares | 2025-12-30 03:37:27+00:00
You don't, same as for the "generate momentjs and use it". People now firmly believe they can use an LLM to build custom versions of these libraries and rewrite whole ecosystems out of nowhere because Claude said "here's the code".

I've come to realize fighting this is useless, people will do this, its going to create large fuck ups and there will be heaps of money to be made on the cleanup jobs.
by omoikane | 2025-12-30 03:37:42+00:00
I backed up lots of emails that I deemed precious, but I still search through email first, because sometimes it's just easier to search email than to search my backups.

Also, oftentimes I search email not so much for the content, but to find the timestamp associated with a particular event. I have had to search old email metadata a few times when I get an unexpected question related to time (for example, gmail will ask when you created the account as part of its account recovery process).
by duxup | 2025-12-30 03:37:51+00:00
This reads like a letter in a given context, with sort of bullet point political memes / surface level gripes pasted in?

I have no idea what liberal education has to do with zoom or wearing a mask. As far as I can tell the author has no interest in telling me. Complaints about virtue-signalling seem sorta strange as an article like this seems like itself is about as virtue-signalling as it gets.

A far as fear of "the science" I never know what that kind of reference means, does this guy think people should drink bleach or take horse medicines? As far as I can tell he might, and just moves on to the next vague bullet point gripe.
by DrewADesign | 2025-12-30 03:39:55+00:00
> I imagine HN, despite being full of experts and vet devs, also might have a prevalent attitude of looking down on using tools like MCP servers or agentic AI libraries for coding, which might be why something like this advertised seems novel rather than redundant.

I’m not sure where the ‘despite’ comes in. Experts and vets have opinions and this is probably the best online forum to express them. Lots of experts and vets also dislike extremely popular unrelated tools like VB, Windows, “no-code” systems, and Google web search… it’s not a personality flaw. It doesn’t automatically mean they’re right, either, but ‘expert’ and ‘vet’ are earned statuses, and that means something. We’ve seen trends come and go and empires rise and fall, and been repeatedly showered in the related hype/PR/FUD. Not reflexively embracing everything that some critical mass of other people like is totally fine.
by Uvix | 2025-12-30 03:41:41+00:00
Most games don't have that sort of licensed content to start with, so comparing to the total population of games isn't meaningful.

Offering a perpetual license would limit the licensor's options (e.g. they could never offer someone else an exclusive license, nor could they adjust the rates if the brand becomes more popular, nor could they terminate if the developer/publisher becomes toxic), so I guess while it's theoretically possible I just don't see why they'd want to offer such a license.
by sathish316 | 2025-12-30 03:41:57+00:00
Nice work! You might also want to look at Vibe Kanban, which supports similar features across multiple projects and multiple coding CLIs - https://www.vibekanban.com/

Superset will be a good alternative for someone who is using only ClaudeCode or CLIs. But for someone using Cursor, How does this differ from Cursor’s Agents UI, which supports local background agents using Git worktrees?
by kryogen1c | 2025-12-30 03:42:02+00:00
>proactive [...] security program

Idk how proactive patching an exploited-in-the-wild unauth RCE is, but pr statements gonna pr i guess.

>This [...] vuln is not a breach or compromise of MongoDB

IANAL, but this seems like a pretty strong stance to take? Who exactly are you blaming here?

>vulnerability was discovered internally
>detected the issue

Interesting choice of words. I wonder if their SIEM/SOC discovered a compromise, or if someone detected a tweet.

>December 12–14 – We worked continuously

It took 72 clock hours, assumably hundreds of man hours, to fix a malloc use after free and cstring null term bug? Maybe the user input field length part was a major design point??

>dec 12 "detect" the issue, dec 19 cve, dec 23 first post

Boy this sure seems like a long time for a first communication for a guaranteed compromise if internet facing bug.

Not sure there's a security tool in the world that would stop data exfiltration via protocol error logs.
by Brajeshwar | 2025-12-30 03:42:07+00:00
For emails, here is my current simple backup setup. Of course, I’m also looking to do this without having to open Thunderbird, or I might have an old laptop running it. So, work-in-progress.

For the email accounts I want a backup, I set it to spew out POP3 without doing anything (don’t mark read or delete). I set up Thunderbird with that POP3. It has a backup copy of all the emails. I’ve had searchable emails since like 2004/2005, and I’ve occasionally replied to people and gotten back in touch with very old friends from the Internet.

I saw an open-source tool sometime back (I think, here on Hacker News) that backs up your IMAP mails with a nicely done interface. That would be nice to have.

Edit: Perhaps Bichon,[1] mentioned somewhere in the other comment threads[2] was the one.

1. https://github.com/rustmailer/bichon

2. https://news.ycombinator.com/item?id=46429250
by theteapot | 2025-12-30 03:42:25+00:00
Might not be how it appears. The CVE number can be reserved by the org and then "published" with only minimal info, then later update with full details. Looking at the meta data that's probably what happened here (not entirely sure what the update was though):

{
"cveId": "CVE-2025-14847",
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"state": "PUBLISHED",
"assignerShortName": "mongodb",
"dateReserved": "2025-12-17T18:56:21.301Z",
"datePublished": "2025-12-19T11:00:22.465Z",
"dateUpdated": "2025-12-29T23:20:23.813Z"
}
by ramoz | 2025-12-30 03:42:58+00:00
I agree with this take. Esp with the simplicity of /sandbox

I created the feature request for hooks so I could build an integrated governance capability.

I don’t quite yet think the real use cases for hooks has materialized. Through a couple more maturity phases it will. Even though it might seem paradoxical with “the models will just get better” - to which is exactly why we have to be hooked into the mech suits as they'll end up doing more involved things.

But I do pitch my initial , primitive, solution as “an early warning system” at best when used for security , but more so an actual way (opa/rego) to institute your own policies:

https://github.com/eqtylab/cupcake

https://cupcake.eqtylab.io/security-disclaimer/
by EMM_386 | 2025-12-30 03:43:11+00:00
> in some md file

1a directly from Anthropic on agentic coding and Claude Code best practices.

"Create CLAUDE.md files"

https://www.anthropic.com/engineering/claude-code-best-pract...

It works great. You can put anything you want in there. Coding style, architecture guidelines, project explanation.

Anything the agent needs to know to work properly with your code base. Similar to an onboarding document.

Tools (Claude Code CLI, extensions) will pick them up hierarchically too if you want to get more specific about one subdirectory in your project.

AGENTS.md is similar for other AI agents (OpenAI Codex is one). It doesn't even have to be those - you can just @ the filename at the start of the chat and that information goes in the context.

The naming scheme just allows for it to be automatic.
by danaris | 2025-12-30 03:43:43+00:00
No; the way around this, as it always has been, is redistribution.

I know it's considered a dirty word in many circles nowadays, but by far the most effective means we know of disincentivizing a singleminded focus on the accumulation of wealth is to make that number something you can't keep pushing up after a certain point.

No human being will ever be genuinely discouraged from making a better product or making themselves better at doing something because they couldn't turn their (personal, not company) $30 million/year into $300 million/year. Because a) at those numbers, the only material difference is the number; your lifestyle won't change appreciably, and b) if you actually cared about making a better product or making yourself better at doing a thing in the first place, that kind of extra money (or lack thereof) wouldn't be important enough to change that.
by CalChris | 2025-12-30 03:46:06+00:00
The FA doesn't mention the USS Independence by name but it was a WWII aircraft carrier sunk in the Gulf of the Farallones in 1951. It had been at Bikini Atoll during atomic tests.

https://en.wikipedia.org/wiki/USS_Independence_(CVL-22)

A good book on the Farallones (the only book?) is The Devil's Teeth, Susan Casey.

A few fun facts. The Farallones are an archipelago, but South Farallones is the largest and only habitable island. It supported a small town when it was an egg source for San Francisco. Legally, the Farallones are part of San Francisco.

You can often see the Farallones from San Francisco on a relatively clear day at sunset. They're due west of SF and if you walk out in the street on say Balboa (or one of the alphabetical streets) and look out, you'll see them. A little elevation helps and it's easier later in the day. Point Reyes as well, if it's clear.

There are OYRA crewed and SSS singlehanded sailing races starting+finishing at the St Francis Yacht Club which round South Farallones. These start in the morning maybe 8am and finish in the evening, maybe 12+ hours. The wind usually picks up in the evening which is both good (get home faster) and difficult (broaching in the swirls of the south tower of the Golden Gate Bridge (the South Tower Demon) is common).

https://jibeset.net/racedoc/JACKY/T004394200/si.pdf

The Farallones are a seabird rookery. Lots of birds. Lots of shit and the Farallones are upwind. So you can smell the Farallones well before you get there.

The Farallones are a protected area. You can't land on them without a permit. The best way to qualify is to volunteer for the Farallones Patrol which delivers people+stuff and takes people+garbage. Then you tie up to a mooring buoy and get a tender from the island. Then you get a docent tour of the island.

People have swum which is insane since it's a great white shark feeding area.

https://en.wikipedia.org/wiki/Farallon_Islands
Show HN: Endpoint State Policy – Policy as Data
by scanset | 2025-12-30 03:46:11+00:00
Endpoint State Policy (ESP) is a policy-as-data system that keeps policy intent separate from execution.

Policies define desired state and evidence as structured data, not scripts. They’re compiled into constrained contracts that execution engines must follow, producing attestations instead of free-form output.

The contract model limits what execution can do, preventing policy logic from turning into ad-hoc tooling, while allowing the same policy to run across different environments and backends.

ESP focuses on portable intent, constrained execution, and verifiable outcomes — not embedding policy into tools.
by syncsynchalt | 2025-12-30 03:46:47+00:00
Oh, it includes the Abuse-like HL2 platformer that I played while waiting for HL2 to install, apparently named "Codename: Gordon". https://delistedgames.com/codename-gordon/

I'm glad I found this, as it includes a steam:/ URL that lets me re-install it if I'd like to play it again.
by cvballoon | 2025-12-30 03:48:48+00:00
This post and these comments give me low confidence in our HN community. No one here seems to understand ad platforms.

Google is far from dead. It still has the majority of the world’s online ad revenue, with Microsoft coming in second, then Meta at a far third. People assume that TikTok and Insta _must_ have the most since they assume that’s what all of their friends use, but even though they’re growing, they’re still not there yet.

Video ads on YouTube and others have a lot of play also, and everyone thinks of the TV commercials played during the Super Bowl.

But Google is still f-ing everywhere.

It’s fine to call them dying, but are they really when they are best positioned for ads in AI? OpenAI or Anthropic don’t have the data about users that Google has. There’s a reason that Buffett invested in Alphabet recently.
by adrianwaj | 2025-12-30 03:50:07+00:00
Well, people do things for free because they enjoy it. Maybe there should be a place where developers can list the things they would do almost for free. But then they could solicit payment up front before starting work. So just as http://weargustin.com is for clothes, something like that for software. Then, the "pledgers/pre-funders" can get privileges once built: maybe even exclusive access.

There's also a crowd-funding oriented idea here: https://reddit.com/r/oasisnetwork/comments/1py9cah/app_idea_...
by Night_Thastus | 2025-12-30 03:50:19+00:00
No?

If I use a library, I know it will do the same thing from the same inputs, every time. If I don't understand something about its behavior, then I can look to the documentation. Some are better about this, some are crap. But a good library will continuing doing what I want years or decades later.

An LLM can't decide between one sentence and the next what to do.
by voidfunc | 2025-12-30 03:50:38+00:00
If you call something a Porsche, John Deere, or a Sig Sauer and inaccurately represent it you're doing brand damage especially in the modern era where it could become a toxic meme on TikTok or whatever.

That's no good and should be prevented.

Developers could pony up for perpetual licenses if they cared but they don't.
by leshow | 2025-12-30 03:51:26+00:00
If you want my opinion, I think LLMs can be pretty good at generating simple code for things you can find on stackoverflow and require minor adjustments. Even then, if you don't really understand the code you can have major issues.

Your site is case in point of why LLMs demo well but kind of fall apart in the real world. It's pretty good at fitting lego blocks together based on a ton of work other people have put into React and node or the SSE library you used, etc. But that's not what Karpathy is saying, he's saying "the hottest programming language is english".

That's bonkers. In my experience it can actually slow you down as much as speed you up, and when you try to do more complicated things it falls apart.
by scanset | 2025-12-30 03:52:00+00:00
ore context: ESP was built explicitly as a replacement for SCAP/XCCDF-style policy systems, which tightly couple intent, checks, and tooling. That coupling makes reuse, extension, and continuous verification hard.

ESP treats policy as data and compiles it into constrained contracts. Those contracts can be mapped to external frameworks (NIST 800-53/171, CIS, MITRE ATT&CK, etc.) without embedding framework logic into execution. The mapping lives at the policy layer; execution stays generic.

Its strength is in Zero Trust–style architectures: policies define what state is allowed, execution verifies it continuously, and evidence is emitted as attestations rather than one-off reports. That makes it easier to reason about drift, enforcement, and trust boundaries over time.

It’s not a scanner replacement by itself — it’s a substrate for expressing and enforcing policy intent consistently across environments.
by AndyNemmity | 2025-12-30 03:53:04+00:00
I experience the same things. What I’ve found is there is no issue I can’t solve so it doesn’t repeat.

The real issue is I don’t know the issues ahead of time. So each experience is an iteration stopping things I didn’t know would happen.

Thankfully, I’m not trying to sell anyone anything. I don’t even want people to use what I use. I only want people to understand the why of what I do, and how it adds me value.

I think it’s important to understand this thing we use as best we can.

The personal value you can get, is entirely up to your tolerance for it.

I just enjoy the process
by Brajeshwar | 2025-12-30 03:54:11+00:00
All the time. I read an interesting thing about someone online, and that name strikes me as someone I have interacted with. I search my email archive, then reply to that thread or start a new one to catch up. All of them have been super happy, “wow! You replied to our email from 10 years ago!”

I do have “Clean Inbox”[1] because I don’t see or interact with them, but I keep them. The only emails I see are the actionable “Unread OR Flagged.”

1. https://brajeshwar.com/2024/email/
by sathish316 | 2025-12-30 03:54:27+00:00
It’s not for building 10 complex or overlapping features at a time.

Parallel agents are useful for:

1. Offloading minor refactoring work

2. Offloading non-overlapping features

3. Offloading unit or integration test additions

4. Exploring multiple ways to build a feature with maybe different coding models

5. Seeing how Claude code thinks for extremely ambitious ideas and taking only the gist of it

Most of these tools don’t make working with Git merges or conflicts to main simpler in their UX. Even in Cursor, it helps to be good at using git from the command line to use Parallel agents effectively (diff, patch, cherry-pick from worktree to main etc)
by volkercraig | 2025-12-30 03:54:28+00:00
Fads like AI come and go. Any argument that AI is going to replace all programmers is based on the notion of indefinite exponential growth,which is something very rare in nature.

Once you get your foot into the door and get put on your first project with consultants and outsourced workers youll start to realise how low the bar actually is.

Any advantages AI gives programmers will be eaten up by jevons paradox.
by Night_Thastus | 2025-12-30 03:54:32+00:00
Consistency is best, with a slow gradual, measured movement towards 'better' where possible. When and where the opportunity strikes.

If you see a massive 50 line if/else/if/else block that can be replaced with a couple calls to std::minmax, in code that you are working on, why not replace it?

But don't go trying to rewrite everything at once. Little improvements here or there whenever you touch the code. Look for the 'easy wins' which are obvious based on more modern approaches. Don't re-write already well-written code into a new form if it doesn't benefit anything.
by pndy | 2025-12-30 03:54:50+00:00
Beside my friend who was gifted with invitation, there was nobody else from my circles (sic) and when asked they were replying with standard "why I should make yet another account". So for me it was a ghost town right from the start.

And frankly it was actually the first place where I truly noticed how big companies are extracting data from us; back then I felt really unpleasant when I tried to fill up profile.

I've got this old screenshot [1] and profile included: about me, "I know this stuff", current occupation, employment history, education path, place of residence with map, home and work addresses, relationship status and what kind of partner you are looking for, gender, other names - maiden name, alternative spelling, nickname, visibility in search results and a section for links to other websites. This may be seen as not much today but back then even facebook wasn't that "curious" - that was about to change.

I also tried to utilize Google Wave for our university group to keep us informed etc., but people wanted just "plain old" emails with attachments.

[1] - https://ibb.co/SDDGG3PJ
by crooked-v | 2025-12-30 03:55:13+00:00
I'm surprised the Elder Scrolls and Fallout games aren't mentioned at all here. They're pretty well known for not always having these boundaries, sometimes very effectively (getting ambushed in town in Oblivion by a secret cultist) and sometimes comically (like some of the nonsense that happens with raiders and settlements in Fallout 4).
by AdieuToLogic | 2025-12-30 03:56:19+00:00
> What is "skill entropy"

Skill entropy is a result of reliance on tools to perform tasks which otherwise would contribute to and/or reinforce a person's ability to master same. Without exercising one's acquired learning, skills can quickly fade.

For example, an argument can be made that spellcheckers commonly available in programs degrade people's ability to spell correctly without this assistance (such as when using pen and paper).
by ajsnigrutin | 2025-12-30 03:56:19+00:00
Come to slovenia, the buses here stop at every stop.

I know you bought a ticket for a train from the main station in ljubljana, and when you come there (and only then and there, not before, not online), you'll be notified that your train is leaving from a track a 10 minute walk away, because the station is being renovated.

And sure, you were a responsible traveller, came early, so a 10 minute walk is no problem... there are supposedly dots on the asphalt showing where to go, but they're already wiped off, so some granny or a college student will probably point you in the right direction.

So after you walk all that way to the right train tracks, and the train should already be there, you'll be notified that there is no train. Why? Someone jumped infront of the train somewhere. When? A few hours ago. But hey... there's a bus that will take you with your train ticket.

Where is the bus? Back at the main station, 10 minutes away. Surely you were very responsible and came not just 10 minutes early but 20 minutes early, because the bus leaves at the same time the train should leave.

The only thing worse were the international trains in the early 2000s through the balkans... you'd be in Zagreb, croatia, waiting for a nighttime international train towards ljubljana, slovenia, 5 minutes to departure, and dingdong, announcement, it says it'll be 10 minutes late. Wait 10 minutes, so 5 minutes until the delayed departure... dingdong, 20 minutes late. Ok.. 10 more minutes... the display shows 30 minutes. I mean... you could risk it and go for a coffee or something, but it's not worth walking all the way to a nicer bar and back if you only have 10 minutes until the train.

...and then, when the delay says 50 minutes, you get a phonecall from a friend, who's on that same train (travelling from thessaloniki), and she tells you that the train is ~6 hours late and that they just crossed the serbian->croatian border (5-6 hours away from zagreb).
by AndyNemmity | 2025-12-30 03:56:22+00:00
I think the correct approach is to be skeptical. You should push back.

I think of this stuff as trivial to understand from my point of view. I am trying to share that.

I have nothing to sell, I don’t want anyone to use my exact setup.

I just want to communicate the value as I see it, and be understood.

The vast majority of it all is complete bullshit, so of course I am not offended that I may sound like 1000 other people trying to get you to download my awesome Claude Code Plugins repo.

Except I’m not actually providing one lol
by vineyardmike | 2025-12-30 03:57:13+00:00
100%. My business is in the smart home space. I peruse various smart home subreddit communities, and they all have a few brands that are aggressively celebrated on Reddit. Market research, financial disclosures, and other public data largely indicates that these brands are not all that popular, especially in the biggest-spend markets.

We don’t find Reddit ads valuable.