MurphyA/hacker-news huggingface dataset:
by mannykannot | 2026-01-24 02:56:01+00:00
This is my reading, as an outsider: the head activator almost certainly does not exist, but the question of fraud is somewhat ambiguous.

Whether fraud was committed, however, is rather beside the point here (IMHO). This is a real-life story about clashes of personalities, where ambiguity is the norm. Something is going on beneath the surface, but it is not clear exactly what and why. I would say there is evidence for an indictment, but not for a conviction.
by arwt | 2026-01-24 02:56:03+00:00
I implemented something similar a while back (exists just as a portfolio demo now: subpinger (dot) interrupt (dot) sh).

If you want go for that sort of "live" feeling, you should consider implementing websocket streaming instead of HTTP polling, it will feel a lot nicer for users.

Are you actually ingesting certificates or are you just showing a stream of entries from different logs? I figure the former as nothing seems to be searchable -- and ingesting this data can get very expensive very quickly.

Nevertheless, cool project! I am constantly thinking about ways to turn CT log data into meaningful, actionable streams for others. If you want to work on something, give me a shout!
by jimmar | 2026-01-24 02:58:11+00:00
Seeing things like, "<h2 id="new-driving-model">New driving model</h2>" on their list of latest releases does not inspire a lot of confidence. Yes, the HTML tags are displayed on the page. Some basic quality assurance on the website would help me trust the quality assurance applied to their product offering.

https://comma.ai/openpilot
by cpgxiii | 2026-01-24 02:58:16+00:00
It's both. Anything that you effectively have optimized to the details of its environment will end up dependent on that environment. If that environment is the real world, then it's fine. If that environment is a simulator, now you have sim-to-real problems.

There's always going to be a gap between reality and simulation, because simulation fidelity has an incredibly long tail. "Digital twins" are relatives, not identical replicas, because everything about capturing the real world for simulation involves simplification and discretization and abstraction.
by runaround555 | 2026-01-24 02:58:40+00:00
Anecdotal but the last time I actively still played at local games half of the players for that ruleset had at least 30-40% of their armies 3D printed. Half of that had 100% of their armies 3D printed and weren't buying GW at all.

I think a big part of it comes down to scale- like that author mentioned, going through the effort of setting up a printer, printing, curing etc. for a handful of models is a pain in the ass. But if you're printing then curing half an army in one go (which the nature of resin printers easily allows you to do by stacking/arranging minis) it comes out as worth it over spending a few hundred USD on official plastic.
by rcv | 2026-01-24 02:59:33+00:00
Looks like your login is busted. I get the following when trying to log in with Google or Github:

```
{
"code": "REDIRECT_URL_NOT_WHITELISTED",
"error": "Redirect URL not whitelisted. Did you forget to add this domain to the trusted domains list on the Stack Auth dashboard?"
}
```
Ask HN: How are you enforcing permissions for AI agent tool calls in production?
by amjadfatmi1 | 2026-01-24 02:59:42+00:00
I’m seeing more teams ship agentic systems that can call real tools (DB writes, deploys, email, billing, internal APIs). Most of the safety patterns I hear are prompt rules + basic validation + “human-in-the-loop for risky stuff.”

My question: in a real production environment, what’s your enforcement point that the agent cannot bypass?
Like, what actually guarantees the tool call isn’t executed unless it passes policy?

Some specific things I’m curious about:

Are you enforcing permissions inside each tool wrapper, at a gateway/proxy, or via centralized policy service?

How do you handle identity + authorization when agents act on behalf of users?

Do you log decisions separately from execution logs (so you can answer “why was this allowed?” later)?

How do you roll out enforcement safely (audit-only/shadow mode -> enforcement)?

What failure modes hurt most like policy bugs, agent hallucinations, prompt injection, or tool misuse?

Would love to hear how people are doing this in practice (platform/security/infra teams especially)
by tzs | 2026-01-24 03:01:04+00:00
CDs were around $16 in 2000, which is equivalent to around $30 today, which is around 2.3 times what a Spotify premium subscription costs for one person.

Equivalently, a Spotify premium subscription in 2000 would be a little under $7.

I guarantee that if you asked young adults in 2000 if they would be interested in a subscription that lets them listen to nearly everything available on CD, at any time, as often as they wished, for $7/month they would have been ecstatic.

Same for DVDs, which were typically in the $20-25 range for new releases in 2000. They would not have been quite as happy as they would have been with Spotify because of the way video is split among several streaming services, but it would still be seen as a tremendous improvement.
by nomel | 2026-01-24 03:01:43+00:00
There's a few Lex Fridman podcasts with George Hotz, the founder. Highly recommend them:

#31 https://www.youtube.com/watch?v=iwcYp-XT7UI

#132 https://www.youtube.com/watch?v=_L3gNaAVjQ4

#387 https://www.youtube.com/watch?v=dNrTrx42DGQ
by thunderbong | 2026-01-24 03:02:32+00:00
The first paragraph of the article -

> Last week Cursor published Scaling long-running autonomous coding, an article describing their research efforts into coordinating large numbers of autonomous coding agents. One of the projects mentioned in the article was FastRender, a web browser they built from scratch using their agent swarms. I wanted to learn more so I asked Wilson Lin, the engineer behind FastRender, if we could record a conversation about the project. That 47 minute video is now available on YouTube. I’ve included some of the highlights below.
by Ronsenshi | 2026-01-24 03:03:27+00:00
"Your scientists were so preoccupied with whether or not they could, they didn’t stop to think if they should."

I'm curious what is the energy/environmental/financial impact of this "research" effort of cobbling together a browser based on AI model that had been trained on freely available source code of existing browsers.

I can't imagine this browser being used outside of tinkering or curiosity toy - so the purpose of the research is just to see whether you can run absurd amount of agents simultaneously and produce something that somewhat works?
by digitalPhonix | 2026-01-24 03:06:40+00:00
> When I was testing vehicles in 2019 I found that a bunch of them had lane keeping but they kind of "bounced" between the lines

That’s lane keep/lane assist; not lane centering. It’s supposed to bounce between the edges of the lane. (I guess, not supposed to, but that’s what it does as opposed to actually tracking some position in the lane).

The auto industry as a whole did a massive disservice not clearly differentiating “lane keep”/“lane assist” v/s “lane centering”. They are hugely different and trying to use lane keep to stay centered is really dangerous.

Same model car with different trim levels/packages would have lane keep or lane centering making it really confusing to consumers what they had and what safe usage would be.
by zeroq | 2026-01-24 03:06:55+00:00
Not an Googler, but my, probably way too much romanticized, understanding of Google was that they never ask you about specific tech because for everything there's an in-house version.

The problem is that too many people drank too much koolaid and trying to parrot everything to a letter without understanding the bigger picture.

The best example would be Kubernetes. Employed by many orgs that have 20 devs and 50 services.
by inkyoto | 2026-01-24 03:07:44+00:00
The issue is that XSD came along much later, and its use did not become binding in XML validation scenarios, hence partial success, even when the XSD-based validation tooling was available at the time.

XSD provides a clean abstraction for the technical validation that sits separately from the application / business / processing layers and dramatically increases the chances of a «clean» request reaching the aforementioned layers without having to roll multiple defensive checks in there.

Granted, an XSD can become complex very quickly, especially if indulged in too much, but it does not have to be.
by sitharus | 2026-01-24 03:08:53+00:00
Well that will depend on your local laws, but to my knowledge except for certain authorised pilot programs all cars on the road must have a driver.

Where I live if you are in the driver’s seat no matter if you were actually actively driving you are considered to be the driver. This has been well established here in drink-driving cases, but you’d have to ask a lawyer for your area.
by nashashmi | 2026-01-24 03:09:30+00:00
> Currently, openpilot performs the functions of Adaptive Cruise Control (ACC) and Automated Lane Centering (ALC). openpilot can accelerate, brake automatically for other vehicles, and steer to follow the road/lane. [1]

[Some of the] Cars that are currently supported already have "smart cruise" and "lane follow". Why then use a third-party self-driving system?

[1] https://comma.ai/openpilot#:~:text=Currently%2C%20openpilot%...
by Foreignborn | 2026-01-24 03:09:55+00:00
I value the author's optimism, but this list activates a deep fear in me. It feels like a such an American point of view to think a techno-ideal is defined simply by buying a different set of consumer electronics, many of which are just as throwaway as the ones before.

I know we can't get away from buying things--even a self-hosted homelab needs parts, and I'm not rejecting capitalism. But it feels like capitalism culture is so strong that it goes through everything people think like thread through a needle, everything they do is stitched with its color.

This makes me sad for the future my children will inherit. I want them to be excited by what comes next, the way I was excited by the N64 or the early web. But those things were exciting because they were _new frontiers_ and new stories, not because they were products.

If the only future we can envision is a curated list of retro-gadgets and subscriptions, we have lost the plot.
by godelski | 2026-01-24 03:10:44+00:00
Generally I recommend people use PopOS. It's well suited for laptops, as that's what System76 is focused on a they're shipping laptops with Nvidia GPUs. I personally prefer Arch based distorts like endeavor but even with wide community support it's just more likely a noob will face an error. Fwiw I've only faced one meaningful error in the last 3 years in endeavor but I've also been daily driving Linux for 15 years now
by epage | 2026-01-24 03:11:17+00:00
In Rust, we use workspaces for

- splitting up a package into smaller compilation units to speed up builds as llvm doesn't like large compilation units, e.g. I'm assuming this is why uv is split up

- splitting semver concerns (easiest if different parts of the api are versioned independently), e.g. one hope for splitting out `serde_core` is to allow breaking changes of `serde_derive`

- splitting out optional parts to improve build time (`features` can also be used but usability isn't as great), e.g. `clap` (cli parser) and `clap_complete` (completion support)

- local development tools, e.g. https://github.com/matklad/cargo-xtask

- less commonly run tests or benches that have expensive dependencies, e.g. `toml` splits out a benchmark package for comparing performance of `toml`, `toml_edit`, an old version of `toml`, and `serde_json`

- proc-macros generally have a regular library they generate code against

- lower development overhead to develop them together, e.g. anstyle has a lot of related packages and I wouldn't be wanting to maintain a repo per package

Packages also let you mix a library with bins and examples. We talked about multi-purpose packages vs libraries at https://blog.rust-lang.org/inside-rust/2024/02/13/this-devel... (this was before workspace publishing was supported).

Something this doesn't mention is that Cargo workspaces allow for sharing parts of the manifest through "workspace inheritance", including package metadata like the repo, dependency version requirements, lint configuration, or compilation profiles.
by Dev_Master | 2026-01-24 03:11:44+00:00
I built a small desktop GUI tool for safely batch-renaming files by prepending or appending timestamps.

It’s written in Python (tkinter + ttkbootstrap) and focuses on “production-safe” workflows: preview before rename, dry-run mode, pause/resume, ETA + throughput, automatic name conflict resolution, and a persistent undo history saved to disk.

Supports drag & drop, folders (optional recursion), and large batches without freezing the UI.

Happy to hear feedback from folks who deal with file organization, backups, or timestamped workflows—and whether this scratches a real itch or overlaps with tools you already use.
by cthalupa | 2026-01-24 03:12:01+00:00
> horrified to come to the HN comments and LinkedIn comments proclaiming Gastown as the future of engineering.

I don't spend much time on LinkedIn, but basically every comment I've read on HN is that, at best, Gas Town can pump out a huge amount of "working" code in short timeframes at obscene costs.

The overwhelming majority are saying "This is neat, and this might be the rough shape of what comes next in agentic coding, but it's almost certainly not going to be Gas Town itself."

I have seen basically no one say that Gas Town is the The Thing.
by anon7000 | 2026-01-24 03:13:16+00:00
Bingo. As they say, “motion is lotion.” Staying in any position for a long time (even a “good” posture) is going to cause problems. Better being active if you’re passive, resting if you’re active, moving around, taking breaks, and basically just switching it up. All more important than doing one static pose or repetitive motion for an entire day.
by digitalPhonix | 2026-01-24 03:13:24+00:00
Mercedes Drive Pilot (“SAE Level 3”) is certified on some very specific stretches of insterstate in California to not require the driver to be responsible.

https://www.mbusa.com/en/owners/manuals/drive-pilot

Requirements:

- Stop and go traffic (or less than 40mph?)

- On some specific sections of highway

- Driver doesn’t need to monitor but must be ready to take over with 15(?) seconds of the system requesting

> Mercedes-Benz is assuming liability for any crashes or incidents that occur while the autonomous system is active
by rkagerer | 2026-01-24 03:14:05+00:00
The older I get, the less I buy into "too big to fail" arguments. I now view it as "can't fail soon enough". The sooner it breaks down, the sooner something better will supplant it.

This last sentiment holds true generally since organizations no longer subject to meaningful competition inevitably squat on their laurels and stop excelling at the things they used to be good at. We've seen it everywhere - Boeing, Google, Microsoft (with OS's), etc.
by godelski | 2026-01-24 03:14:39+00:00
If you have an Nvidia GPU you're generally going to need to edit the systemd services and change some kernel settings. This is a real pain point to be honest and it should be easier than it is (usually not too bad tbh)

If you want I can try to help you debug it. I don't have a fedora system but I can spin up a VM or nspawn to try to match your environment if you want
by vee-kay | 2026-01-24 03:18:23+00:00
Please stop defending terror supporter companies, with such illogical statements.

You have no clue what idealism means.

An ideal world is one where no terror attacks happen.

Proton has been actively campaigning against police and government in a terror prone region. Proton is openly encouraging terrorists to evade scrutiny.

If you support terrorism under any pretext, then we are done here.
by tokyobreakfast | 2026-01-24 03:18:26+00:00
I read at least one thread per day criticizing Tesla self-driving (which has hundreds of highly-paid engineers working on it) as unreliable vaporware, meanwhile I'm supposed to hack my car with some code off a GitHub repo?

I'll be adding this to my list of 101 creative ways to die, behind basement apartment in Venice, Italy.
by dragonmage65535 | 2026-01-24 03:18:37+00:00
Yeah, I'm also exploring the same, we use langgraph in production, but seeing how much more powerful claude code is with little guidance, I just have more trust on it, but the library right now is a library with a subprocess (claude code) and the tools also need to be served via MCP, not exactly light weight, and also it would be good to have more visibility. Did you find any good resources on this?
by gsf_emergency_6 | 2026-01-24 03:19:24+00:00
There is class mobility: anyone can be a hipster-- in 2001

Theses days, it's about migrating to those basements of the "interwebs" where the gen alpha trolls hang out.. little red book?

https://archive.ph/2026.01.24-032347/https://aletteraday.sub...
by MoltenMan | 2026-01-24 03:19:50+00:00
I think most people don't understand that 99% of people don't know what data encryption is and definitely don't care about it. If it weren't for Bitlocker, their laptops wouldn't be encrypted at all! And of course if your software (Windows) encrypts by default but you don't want to bother the average user with the details (because they don't know anything about this or care about it) you will need to store the key in case they need it.

To everyone saying 'time to use Linux!'; recognize that if these people were using Linux, their laptops wouldn't be encrypted at all!
by echelon | 2026-01-24 03:20:39+00:00
Rust has the nicest workspaces of any language I've dealt with. It makes monorepos naturally easy to build. No manually cobbled together Pants or Bazel or hacks - it's first class out of the box.

Here's a rather large workspace with desktop apps, server apps, CLI tools, and libraries:

https://github.com/storytold/artcraft/blob/main/Cargo.toml

Cargo allows you to universally pin dependencies and features across the entire repo (if you'd like), though you can also deviate from this.

Javascript, on the other hand, is not very fun. I've used Nx, Lerna, and native tools. The tooling is esoteric, and the setup is arcane.
by shagie | 2026-01-24 03:21:24+00:00
One of the earlier references to the 10x that I've found is in

https://www.scribd.com/document/557220119/NNPP-Article

> Researchers have found between a low of 5 to 1 to a high of 100 to 1 ratios in programmer performance. This means
that programmers at the same level, with similar backgrounds and comparable salaries, might take 1 to 100 weeks to complete the same tasks. [21, p. 8]

> The ratio of programmer performance that repeatedly appeared in the studies investigated by Bill Curtis in the July/August 1990 issue of American Programmer was 22 to 1. This was both for source lines of code produced and for debugging times - which includes both defect detection rate and defect removal efficiency. [5, pp. 4 - 6] The NNPP also produces a higher instance of defects in the work product. Figure 1 shows the consequences of the NNPPs.

The reference to 21 is Shneiderman, Ben Software Psychology: Human Factors in Computer and Information Systems (Cambridge, MA: Winthrop, 1980) and 5 is Curtis, Bill, "Managing the Real Leverage in Software Productivity and Quality", American Programmer July/August
1990

https://archive.org/details/softwarepsycholo00shne/page/8/mo... - this then goes into an entire book of sources and research.

There's also mention of DeMarco and Lister in some literature... which means Peopleware.

From there:

> While this [10 to 1] productivity differential among programmers is understandable, there is also a 10 to 1 difference in productivity among software organizations.

> H. D. Mills, Software Productivity (New York: Dorset House Publishing, 1988), p. 266.

> Our study found that there were huge differences between the 92 competing organizations. Over the whole sample, the best organization (the one with the best average performance of its representatives) worked more than ten times faster than the worst organization. In addition to their speed, all competitors from the fastest organization developed code that passed the major acceptance test.

> This is more than a little unsettling. Managers for years have affected a certain fatalism about individual differences. They reasoned that the differences were innate, so you couldn’t do much about them. It’s harder to be fatalistic about the clustering effect. Some companies are doing a lot worse than others. Something about their environment and corporate culture is failing to attract and keep good people or is making it impossible for even good people to work effectively.
by vee-kay | 2026-01-24 03:22:33+00:00
What case discussed above? You have not discussed any case here.

And the links I shared in my original comments show a dangerous situation, not a "case".

Proton has been actively campaigning against police and government in a terror prone region. Proton is openly encouraging terrorists to evade scrutiny.

Proton (or any legitimate company, for that matter) has no business doing subversive activities in terror sensitive areas like J&K. If they do, then they need to face the repercussions.

https://tfipost.com/2026/01/profit-over-people-proton-vpn-ge...

If you support terrorism under any pretext, then we are done here.
by cbbas1 | 2026-01-24 03:22:51+00:00
This lines up with something I’ve also seen a lot — most failures aren’t clever reconstruction attacks, they’re just leftover text layers or metadata that never got removed.

I took a simpler approach and built a small browser-only audit tool that just answers one question: is this PDF still leaking extractable content at all?

It doesn’t try to unredact or guess text, just flags whether text layers, hidden characters, or metadata are still present so you know whether the redaction actually worked.

https://audit.reactpdf.app

Curious if you’ve run into cases where PDFs look clean at the layer/metadata level but still leak via other mechanisms.
by trinsic2 | 2026-01-24 03:24:02+00:00
Ohh that's interesting. Never heard that quote from him I don't think. I like Alan Moore's perspective on life. Seems like he had an interest more in the ancient arts, but more from an intellectual perspective.. Thanks for the reminder. I need to look at his behind the scenes stuff. I remember watching a documentary on the Watchmen (2009 film) DVD when I was a kid. Maybe it was in that. Looks like he is doing short courses this days [0]

[0]: https://www.bbcmaestro.com/courses/alan-moore/storytelling
by themafia | 2026-01-24 03:24:24+00:00
> and I end up having all these typedefs in my projects

I avoid doing this now. It's more trouble than it's worth and it changes your code from a standard dialect of C into a custom one. Plus my eyes are old and they don't enjoy separating short identifiers.

> typedef struct { ... } String

I avoid doing this. Just use `struct string { ... };'. It makes it clear what you're handling. C23 finally gave us "auto", you shouldn't fret over typedefing everything anymore. I also prefer a "strbuf" type with an index and capacity so I can safely read and write to it with a derived "strview" having pointer and length only which references into the buffer.

> returning results

The general method of returning structures larger than two machine words is fairly inefficient. Plus you're cutting yourself off from another C23 gem which was [[nodiscard]]. If you want the 'ok' value checked then you can _really_ specify that. Put everything else behind a pointer passed in an argument. The sum type logic works just as well there.

> I tend to avoid the string.h functions most of the time, only employing the mem family when I want to, well, mess with memory.

So you use strlen() a lot and don't have to deal with multibyte characters anywhere in your code. It's not much of a strategy.