MurphyA/hacker-news huggingface dataset:
by mlshashikiran | 2025-12-10 09:20:44+00:00
Hey HN. I'm sharing Protecto because we built something we wish existed when we were building AI agents at a startup.

The problem: This year, we spent 6 months talking to startup founders building with AI. The conversation was always the same. "We need to mask PII in customer data. Our compliance team won't let us ship without it. But the enterprise solutions are $50K/month and take 3 months to implement. We can't afford either."

We looked at existing privacy solutions. Enterprise tools (Imperva, Varonis) are over-engineered for startups. Database masking tools don't work for AI workflows (logs, embeddings, fine-tuning). Custom builds take forever. So most founders either shipped without protection or got blocked.

What we built: Protecto is an API that detects and masks PII in real-time. You add simple APIs to your LangChain/CrewAI/n8n workflow. It masks customer data before your LLM sees it, preserves semantic meaning (so your AI still works), and costs $250/month starting.

What's different:

1. We use LLMs for detection instead of regex. Catches context-dependent PII that pattern matching misses (99%+ accuracy vs ~80% for traditional approaches).

2. Context-aware masking. Instead of "[PII] [PII] has [PII]", we do "<PER>xyz<.PER> has diabetes" so your AI stays useful.

3. Low latency. We know performance matters for startups, so we optimized aggressively. Real-time processing adds negligible overhead.

4. Built for developers, not committees. No sales calls, no 3-month implementations. Free tier with 1,000 API calls (no credit card). Try it immediately.

We've been in beta with 50+ startups. Results:

- Series A fintech went from "compliance won't let us ship" to production in 48 hours - Healthcare startup got HIPAA approval in 30 minutes - AI platform launched 13 weeks earlier than planned

We're not claiming this is perfect. There are trade-offs (masking vs utility, accuracy vs speed). But for the 500+ startup teams building AI with customer data right now, this solves a real problem that enterprise solutions don't.

Free tier is test-ready. Try it. The backstory is in our blog post if you're curious why we built it.

Happy to answer technical questions about the approach.
by nutjob2 | 2025-12-10 09:20:47+00:00
This is misguided, the moral imperative is to get to the correct diagnosis and treatment by any means possible, usually an "all of the above" strategy. In my experience many doctors are not ideal, and this "always consult a doctor" is legal boilerplate to avoid being sued.

Usually you've got less than a 50-50 chance of getting useful help from a doctor on any one visit.

In my case multiple doctor's treatment of my hypertension was largely useless because it followed the "typical" treatment. I only found what worked for me by accident.

In other cases my own research was far superior to a regular doctor's visit.

I can also quote the experience of a family member whose research into a major surgery paid huge dividends and if they had followed the advice of the first 2 doctors the surgery would very likely have failed.

The chances of getting correctly diagnosed and treated for a problem that is not obvious is surprisingly close to zero unless you have a very good doctor who has plenty of time for you.
by lambertsimnel | 2025-12-10 09:21:02+00:00
> It is an overly broad definition of political to the point of uselessness and absurdity

I don't think it's useless or absurd, just not usually applicable. After all, each action has a specific political significance.

> It's also just tedious

Fair enough, but couldn't we say the same about many other things? For example, Brownian motion might not usually warrant our attention, but it's there for when we decide it is of interest.
by johnnyanmac | 2025-12-10 09:21:17+00:00
You're not wrong. But consider a different lens:

Celeste isn't a game that would need to worry about performance in 2018. It's 2d sprites with box collisions and relatively minimal particle effects. Your toaster can run Celeste.

But a game like Factorio with heavy simulations and complex interactions and pathing absolutely needs to consider performance to pull off a seemless experience.

Those are the kinds of games I'd hope engines like Bevy could enable farther down the line. Design is still key, but some game types are a larger technical challenge than others.
by lurk2 | 2025-12-10 09:21:42+00:00
> It's a poignant observation about how similarly inane arguments are perceived as evidence of mental illness or deep insights based on the social perception of the speaker.

It’s not a poignant observation. This is the issue I had with the entire article; it was an uninsightful, unoriginal tweet that the author dragged out into more than two dozen paragraphs.

> The author of this article is a solid storyteller

I disagree. He’s using formulaic creative writing methods and came across as pretentious.

> Meandering storytelling is intentional

The meandering added nothing to the story. You summarized the entire post in less than a paragraph.
by choeger | 2025-12-10 09:22:09+00:00
The answer is type-safety. LLMs produce errors, as do humans. A language with carefully designed semantics and a well-implemented safety checker (or maybe even a proof assistant) will help express much more correct code.

I've had the most success running Claude iteratively with mypy and pytest. But it regularly wants to just delete the tests or get rid of static typing. A language like Haskell augmented with contracts over tests wouldn't allow that. (Except for diverging into a trivial ad-hoc dynamic solution, of course.)
by johncolanduoni | 2025-12-10 09:22:45+00:00
I agree it doesn’t magically eliminate bugs, and I don’t think rearchitecting the existing Linux kernel would be a fruitful direction regardless. That said, OS services split out into apps with more limited access can still provide a meaningful security barrier in the event of a crash. As it stands, a full kernel-space RCE is game over for a Linux system.
by sebg | 2025-12-10 09:24:27+00:00
Congratulations on your first internet dollar! So many people try and never make it as far as you have!

Off of the top of my head, a few things to think about as you start / continue this journey:

- find out how the original (only) customer found you and see who else is around - ask for a referral from the original customer - figure out what else you can sell to the original customer

Realistically, it depends on what you mean by "expand". Are you looking to build a venture-fundable business, something that grows into a job replacement for you, or something that helps pay for weekend activities?

Depending on what your aim is the "what do I do next" activities will be drastically different.

So what type of expansion are you looking to do?
by kqr | 2025-12-10 09:24:33+00:00
I don't think this is true. Granted, last time I tried to get good at an RTS was toward the end of the Brood War era but the established wisdom at that time was very clear that hour-for-hour, time spent practicing resource management was much more effective than time spent practicing clicking quickly.

Yes, really good players click fast, but they also have impeccable resource management. The group I played with did run the obvious experiment: the best one of us was forced to play against the rest (one at a time) with an artificial click frequency limit. He felt like his abilities were greatly reduced, but he still beat everyone else quite easily.
by cloudwalk9 | 2025-12-10 09:26:45+00:00
Your EDIT. The first thing it suggested is actually very similar to ensembles in meteorology. I actually find myself doing that often if it's something extremely important. Just feels natural to cross-check with other models or with reality. The disclaimer says it may make mistakes after all...

Like you don't predict the weather or a hurricane track with a single model. The NHC uses many.

It's still probablistic, but if multiple models are independently in agreement, then it's at least worth investigating further.
by boxed | 2025-12-10 09:26:48+00:00
I tried django-q and I thought it was pretty terrible. The worst was that I couldn't get it to stop retrying stuff that was broken. Sometimes you ship code that does something unexpected, and being able to stop something fast is critical imo.

Fundamentally I think the entire idea behind celery and django-q is mostly misguided. People normally actually need a good scheduler and a bring-your-own queue in tables that you poll. I wrote Urd to cover my use cases and it's been rock solid.
by throwaway290 | 2025-12-10 09:28:46+00:00
"I don't necessarily think this as it is will work" != "harmful" or "dumb"

Like do warnings on cigarettes work? I definitely saw a guy move cigs to older pack he had from china because he didn't like ugly warning picture on the new pack. Do mandatory id checks work? If I saw some kids get their hands on smokes does it mean "it doesn't work" and therefore there should be no limits on big tobacco?

is a start
by adrian_b | 2025-12-10 09:28:47+00:00
> The 486 was the first Intel CPU to utilize a cache.

The 486 was the first Intel CPU to integrate a cache on its die (following the competing Motorola CPUs MC68020 and MC68030).

Previous Intel CPUs already utilized caches, otherwise they could not achieve 0-wait state memory access cycles.

The cheaper 80286 and 80386SX motherboards usually omitted the cache to minimize the costs, but any decent higher-end 80386DX motherboard included an external write-through cache, with a size typically between 32 kB and 64 kB, so significantly bigger than the internal 8 kB write-through cache of 80486. An 80386DX without cache could never approach its advertised speed.

Because of the small internal cache of 80486, all good 486 motherboards implemented an external L2 cache, usually with sizes between 128 kB and 256 kB, as by that time the cost of cache memory chips had diminished in comparison with that of the years of 80386.

In the beginning, write-through caches were used, as they were much easier to implement externally.

Pentium (1993) was the first Intel CPU with a write-back cache (of 16 kB), which then was also added to the Intel 486DX4 CPU (100 MHz). Then AMD made 2 kinds of 486DX4 @ 100 MHz CPUs, an early model with an 8 kB write-through cache and a late model with an 8 kB write-back cache (which had also taken the CPUID instruction from Intel Pentium). AMD's DX4 @ 133 MHz had the write-back cache extended to 16 kB, like that of Pentium (and it was rebranded as 5x86, to confuse the buyers).
by terribleperson | 2025-12-10 09:30:02+00:00
Has it? More than one forum has expected that commentary should contribute to the discussion. Reddit is the most prominent example, where originally upvotes were intended to be used for comments that contributed to the discussion. It's not the first or only example, however.

Sure, the motivation for many people to write comments is to satisfy themselves. The contents of those comments should not be purely self-satisfying, though.
by stuaxo | 2025-12-10 09:30:25+00:00
We don't need religion for that, humanism exists a way of living for instance.

I don't think (most) people treat science "as a religion".

Some tech leaders seem to have swap Ayn Rand (who if you look at the early days definitely acted like a cult leader), to this AI doomer cult, and as a result seem to be acting terribly.

Religion was much wider spread in the 1800s, but that didn't stop industrialists acting terribly.

I don't think the theory holds water at all.
by hn_throw2025 | 2025-12-10 09:30:58+00:00
I am eight months into Gastritis. I have seen several doctors at my local practice. They have examined me, sent me for blood tests, even an endoscopy. That’s all great, but the advice remains to just keep taking PPIs and wait it out. Nothing beyond the basics when it comes to dietary advice.

My flareups and their accompanying setbacks have been greatly reduced because I keep a megathread chat going with Gemini. I have pasted in a symptom diary, all my medications, and I check any alterations to my food or drink with it before they go anywhere near my mouth. I have thus avoided foods that are high FODMAP, slow digesting, or surprisingly high in fat or acidity.

This has really helped. I am trying to maintain my calories, so advice like “don’t risk X, increase Y instead” is immediate and actionable.

The presumption that asking a LLM is never a good choice assumes a health service where you can always get a doctor or dietician on the other end of the phone. In the UK, consultations with either for something non-urgent can take weeks, which is why people are usually pushed towards either asking a Pharmacist or going to the local Emergency department (which is often not so local these days).

So the _real_ choice is between the LLM and my best guess. And I haven’t ingested the open web, plus countless medical studies and journals.
by bloppe | 2025-12-10 09:31:05+00:00
If a project switches from an open-source to a closed-source license, then from the outside, it just looks like the project was abandoned. The final commit that was published under the open-source license will always be open source. It's the future commits that are now closed source.

So no, I don't have any specific examples of that happening.

In the case of both Redis and Terraform, the forks were announced after the license change, not before. Indeed, the forks were motivated by the license change. The community didn't get a warning "hey, we're about to change the license, fork it while you still can!". It just changed.

That's what I mean when I say the license change does not apply retroactively. The commit of Terraform that existed before the license change is still open-source. I could create a fork branching off that commit today if I wanted to.
by weinzierl | 2025-12-10 09:31:20+00:00
That is so good to hear. I feel Rust support came a long way in the past two years and you can do a functional Rust kernel module now with almost no boilerplate.

Removing the "experimental" tag is certainly a milestone to celebrate.

I'm looking forward to distros shipping a default kernel with Rust support enabled. That, to me, will be the real point of no return, where Rust is so prevalent that there will be no going back to a C only Linux.
by spi | 2025-12-10 09:31:28+00:00
Thanks, very nice to see these results! Certainly using GPUs with more RAM makes things simpler to scale. Gradient accumulation is as easy as adding a counter for number of steps and an "if counter % gradient_accumulation_steps:` around `optimizer.step()`, so that can also be tried simply on a single GPU / cheaper GPUs. But if you can just use 8xA100 and your pipeline parallizes well, you also get results (almost) 8 times faster, which is certainly nicer to experiment of course!
by indigo945 | 2025-12-10 09:31:36+00:00
"Ask HN: How do you prevent ad-injection in AR glasses", comments:

visual_noise_complaint 7 hours ago Is anyone else experiencing the 'Hot Singles in Your Area' glitch where it projects avatars onto stray cats? It's terrifying. cat_lady_2035 6 hours ago Yes! My tabby cat is currently labeled as 'Tiffany, 24, looking for fun'. I can't turn it off.

"Europe passes 'Right to Human Verification' Act", from the article:

"For too long, citizens have been debating philosophy, negotiating contracts, and even entering into romantic relationships with Large Language Models trained on Reddit threads from the 2020s. Today, we say: enough. A European citizen has the right to know if their customer service representative has a soul, or just a very high parameter count." — Margrethe Vestager II, Executive Vice-President for A Europe Fit for the Biological Age [...] Ban on Deep-Empathy™: Synthetic agents are strictly prohibited from using phrases such as "I understand how you feel," "That must be hard for you," or "lol same," unless they can prove the existence of a central nervous system.

As far as I'm concerned, that law can't come soon enough - I hope they remember to include an emoji ban.

For "Visualizing 5D with WebGPU 2.0", the link actually has a working demo [1].

I'm sad to say it, but this is actually witty, funny and creative. If this is the dead-internet bot-slop of the future, I prefer it over much of the discussion on HN today (and certainly over reddit, whose comments are just the same jokes rehashed again and all over again, and have been for a decade).

[1]: https://sw.vtom.net/hn35/pages/90099800.html
by samuel | 2025-12-10 09:31:43+00:00
I agree with the sentiment, but I think it's a pretty naive view of the issue. Companies will want all info they can in case some of their workers does something illegal-inappropiate to deflect the blame. That's a much more palpable risk than "local CA certificates being compromised or something like that.

And some of the arguments are just very easily dismissed. You don't want your employer to see you medical records? Why were you browsing them during work hours and using your employers' device in the first place?
by kqr | 2025-12-10 09:31:46+00:00
I agree. I think people underestimate the size of the Korean Brood War scene, even relatively early on. In my country, I had seen some huge LAN parties with associated competitions, but then I got introduced to Korean Brood War competitions; they were filling stadiums with audiences and had pyrotechnics and professional TV productions and everything. It was insane.
by gschizas | 2025-12-10 09:31:49+00:00
The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to "http.schannel". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it should be a default at the least).
by aatd86 | 2025-12-10 09:32:03+00:00
Maybe that's the whole point. Entities which rely on the product enough to propose contributions are more likely to be paying customers who really need to have a given feature available?

People seem to complain that they are burnt out by open source quite often so not sure that there are that many contributions apart from a couple projects.

It may also protect a project against business vultures. If you are trying to monetize your project but someone richer than you forks it and offer it for free, what can you do?

Yet, by being source available, the code is still auditable. It is easier for people to understand how the software works. And nowadays you can fine tune an LLM over it I guess...

Seems that is might also be a valid perspective? You can probably have a kind of bus clause so that source code does not become abandoned?
by notthemessiah | 2025-12-10 09:32:17+00:00
I'm guessing he means Rust voicing solidarity with Ukraine and sympathy with everyone affected by a conflict? It's hard to tell when people vaguepost. I guess wars of invasion/annexation are too controversial to oppose.

"Before going into the details of the new Rust release, we'd like to state that we stand in solidarity with the people of Ukraine and express our support for all people affected by this conflict."
by Arainach | 2025-12-10 09:32:40+00:00
Writing isn't always about terse summaries of information. If you want that, have an LLM summarize it.

Good writing expresses concepts and ideas in engaging ways. You could write a few paragraphs summarizing theology, philosophy, and family dynamics that could be read in 10 minutes, but that doesn't come close to matching or replacing Dostoyevsky.

Doing everything as efficiently as possible misses the point. It's similar to how handwritten notes are slower but are retained more because of the process and taking the time to make them and read them.
by sunrunner | 2025-12-10 09:33:06+00:00
acko.net is one I thought of immediately too. The front page for Three.js usually has some nice examples too.

Of course, with WebGL and WebGPU support becoming ever more ubiquitous I'm not sure when 'impressive 3D website' just becomes either 'impressive website' or 'impressive 3D'.

[1] https://threejs.org/
by narcraft | 2025-12-10 09:33:51+00:00
It'd be like copyright trolling the Library of Babel. The set of useful programs would be totally eclipsed by incoherent gibberish (even if there were a means to ensure that the randomly generated code were syntactically correct). In other words, the signal to noise ratio would be microscopic and running this scheme in finite time would effectively result in zero valuable code being successfully squatted.
by bayindirh | 2025-12-10 09:34:10+00:00
IIRC, it was not about Rust vs. C, but a commotion rooted from patch quality and not pushing people around about things.

Linux Kernel team has this habit of a forceful pushback which breaks souls and hearts when prodded too much.

Looks like Hector has deleted his Mastodon account, so I can't look back what he said exactly.

Oh, I still have the relevant tab open. It's about code quality: https://news.ycombinator.com/item?id=43043312
by caust1c | 2025-12-10 09:34:44+00:00
> it prevents entire classes of bugs where IDs get mixed up across services.

~Does this really happen for people? I haven't ever seen this class of bug, and shudder to think of how it happens in code. Sure support tickets are nicer with the prefix, but how would a bug manifest in the code itself?~

Edit: of course it can happen with `new.id = old.id` where new and old are different types, now that I think about it after coffee. However, I'd be hesitant to claim that this prevents those bugs, instead I'd argue that it simply makes them easier to identify.

Also, KSUID has been around since before UUIDv7 and seems to meet all of the author's same requirements and has many client libraries already. Guess people doing research on it still aren't able to find it, or just want to do their own anyway which is cool too.
by Philpax | 2025-12-10 09:35:17+00:00
I agree with you for the most part, but it's worth noting that those standards can expose a C API/ABI while being primarily implemented in and/or used by non-C languages. I think we're a long way away from that, but there's no inherent reason why C would be a going concern for these in the Glorious RIIR Future:tm:.
by KaiserPro | 2025-12-10 09:35:47+00:00
Our cyber team have installed zscaler on most people's laptop, and somewhere in the fabric of the office internet connection.[1]

For those that don't know, its a MITM proxy with certificates so that it can inspect and unroll TLS traffic.

ostensibly its there to stop data exfiltration, as we've had a number of incidents where people have stolen data and sent it to competitors. (our c-suite don't have as much cyber shit installed, despite them being the ones that are both targets more, and broken the rules more....)

Now, I don't like zscaler, and I can sorta see the point of it. But.

Our cyber team is not a centre of technical excellence. They somehow managed to configure zscaler to send out the certs for a random property company, when people were trying to sign into our VPN.

this broke loads of shit and made my team (infra) look bad. The worrying part is they still haven't accepted that serving a random property company's website cert instead of our own/AWS's cert is monster fuckup, and that we need to understand _why_ that happened before trying anything again.

[1] this makes automatic pen testing interesting because everything we scan has vulnerabilities for NFS/CIFS, FTP and TCP dns.