MurphyA/hacker-news huggingface dataset:
by ben_w | 2026-01-12 16:02:31+00:00
> Example?

Unit tests. Lean. Typed languages. Even more broadly, compilers.

> I trust the same people to discover compiler backdoors.

https://micahkepe.com/blog/thompson-trojan-horse/

> you're missing the point entirely. Rowhammer, the fdiv bug, they're all mistakes. And sure, malevolence also exists.

Rowhammer was a thing because the physics was ignored. Calling it a mistake is missing the point, it demonstrates the falseness of the previous claim:

We have properly abstracted away the physics of computation. A modern computer operates in a way where, if you use it the way you've been instructed to, the physics underlying the computations cannot affect the computation in any undocumented way.

Rowhammer *is* the physics underlying the computations affecting the computation in a way that was undocumented prior to it getting discovered and, well, documented. Issues like this exist before they're documented, and by definition nobody knows how many unknown things like this have yet to be found.

> But when mistakes or malevolence are found, they're fixed, or worked around, or at least documented as mistakes.

If you vibe code (as in: never look at the code), then find an error with the resulting product, you can still just ask the LLM to fix that error.

I only had a limited time to experiment with this before Christmas (last few days of a free trial, thought I'd give it a go to see what the limits were), and what I found it doing wrong was piling up technical debt, not that it was a mysterious ball of mud beyond its own ability to rectify.

> With an LLM you don't even know how it's supposed to behave.

LLM generated source code: if you've forgotten how to read the source code it made for you to solve your problem and can't learn how to read that source code and can't run the tests of that source code, at which point it's as interpretable as psychology.

The LLMs themselves: yes, this is the "interpretability" problem, people are working on that.
by egypturnash | 2026-01-12 16:02:38+00:00
My spouse tried out for the people who sub-contract the app store reviewing and it was very much as you surmise, they require you to do a very oddly specific number of reviews in an hour (29, IIRC) and do not pay very well. Pay and time per review might have gotten better if he'd stuck with it and climbed to a similar level as his previous position in a mapping company but we are not at that level of desperation yet.
by skipants | 2026-01-12 16:02:46+00:00
A couple small things:

1. as many have harped about, the LLM writing is so fluffed up it's borderline unreadable. Please just write in your own voice. It's more interesting and would probably be easier to grok

2. that repo is obviously vibe-coded, but I suppose it gets the point across. It doesn't give me much confidence in the code itself, however.

And a big thing:

Unless I'm misunderstanding, I feel like you are re-inventing the wheel when it comes to Authorization via MCP, as well as trying to get away with not having extra logic at the app layer, which is impossible here.

MCP servers can use OIDC to connect to your auth server right now: https://modelcontextprotocol.io/docs/tutorials/security/auth...

You give the following abstractions, which I think are interesting thought experiments but unconventional and won't work at all:

Ring 0 (Constitutional): System-level constraints. Never overridable.
Example: "Never self-replicate" "Never exfiltrate credentials"

Ring 1 (Organizational): Policy-level constraints. Requires admin authority to change.
Example: "No PII in outputs" "Read-only database access"

Ring 2 (Session): User preferences. Freely changeable by user.
Example: "Explain like I'm five" "Focus on Python examples"

In Ring 0 and 1 you're still asking for the LLM to determine if the security is blocked, which opens it up to jailbreaking. Literally what your whole article is about. This won't work:

# Generate (Pass filtered tools to LLM)
response_text, security_blocked = self._call_llm(
query, history, system_prompt, allowed_tools, tools
)

Ring 0 and 1 MUST be done via Authorization and logic at the application layer. MCP Authorization helps with that, somewhat. Ring 2 can simply be part of your system prompt.

Standard RBAC acts as a firewall: it catches the model’s illegal action after the model attempts it.

That's the point. It's the same reason you will have mirroring implementations of RBAC on a client and server: you can't trust the client. LLM can't do RBAC. It can pretend it does, but it can't.

The best you can do is inject the user's roles and permissions in the prompt to help with this, if you'd like. But it's kind of a waste of time -- just feed the response back into the LLM so it sees "401 Unauthorized" and either tries something else or lets the user know they aren't allowed.

I'm sorry, but as a resident of Ontario and a developer this whole posting just enrages me. I don't want to discourage OP but you should know there's a lot just incorrect here. I'd be much more relaxed about that if it all wasn't just one-shotted by AI.
by bluGill | 2026-01-12 16:03:00+00:00
Sure, but uncle (who drove a truck for a job) sat down with the manual for several hours one night and figured it out. He was probably the only person in the entire town he lived in. Most people could have as well - but it would mean spending several hours of study and most people won't do that unless forced (and rarely even then - see all the tropes about homework...)
by CuriouslyC | 2026-01-12 16:03:19+00:00
Scribe grew out of fixing all the problems with code bundlers like Repomix. The covering set feature is the thing that clearly sets it apart, the performance difference is extreme; up to 98% token use reduction on SWE-bench tasks. I lead with it because it's the place where I'm far ahead of other tools, people won't adopt something because it's slightly better, scribe is a step change.
by WorldMaker | 2026-01-12 16:03:24+00:00
My trick has been a simpler/faster/dumber HDMI switch that isn't the TV so that you can leave the TV on a single HDMI input and delegate any input switching to the the switch rather than the slow TV UI.

That adds extra complexity in terms of an extra remote. In my case, the simpler/faster HDMI switch is also the surround sound receiver so that moves volume as well to the simpler, dumber remote.

It's not ideal either, but reducing use of the TV's terrible UI is reducing temptation to just go back to the TV's terrible apps. (Also as the sibling option points out, the other trick is isolating the TV out of the network entirely. Sometimes the UI gets even slower to "punish" you for not allowing its smart features and ads to work, or the UI is just badly written and relies on a lot of synchronous waits for network calls for things like telemetry [six of one, half dozen of the other], which gets back to reasons to use a dumb input switch and get away from the TV's own UI.)
by semi-extrinsic | 2026-01-12 16:03:51+00:00
A year ago I went down the rabbit hole of looking into custom trackball-keyboard integrations. Ploopy, Charybdis, Dactyl, CCK-ball, etc. My final boring conclusion is that what I had already been doing for the past 20 years is much cheaper and gets me 99.99% of the way:

All you need is a regular ~$50 trackball and a regular ~$100 keyboard without a numpad. (You can have an overlay for that, if you need it.)

As someone else pointed out, this new trackball will make you move your fingers (and wrists) significantly off home row. If you do that in one direction or the other doesn't really matter.

If this works better for you than a Logitech or Kensington trackball, sweet, use it. But so far all the reviews are like "I've never used a trackball, but this looks cool". We've had this technology since the literal 1990s guys.
by ljm | 2026-01-12 16:04:03+00:00
Sending a URL encoded form or some JSON in a POST request is also easier for most people to understand than the myriad ways you might format a query string in the URL (which may have a stricter limit on size).

You only have to look at how different services handle arrays in query strings to understand that serialising it is conceptually easier.

Comes up a lot in search or filter APIs. I'm sure there was some effort many moons ago to create a QUERY method for that.
by mike-cardwell | 2026-01-12 16:04:04+00:00
If your first fish tank is just going to be something small with a goldfish or two in it, I'm not sure how you go about doing that as I've not done that before. Maybe you just fill the tank from the tap and chuck the fish in? I decided to go for a large planted heated freshwater tank with interesting fish and shrimps and snails, so I had to be careful to monitor the water and find out what species could co-exist, what pH and temp they like, etc. It took 6 weeks before I could put anything in it safely, so one tip would be to patient. Another would be, go and speak to the people in the pet shop / aquatics center about what you're doing as they can tell you everything you need to know. I got most of my advice from ChatGPT, but double checked it with the kind people at the aquatics center as I was setting things up.
by parliament32 | 2026-01-12 16:04:09+00:00
Not even coding tasks. Just getting an LLM to help me put together a PromQL query to do something somewhat non-standard takes dozens of tries and copy/pasting back error messages.. and these aren't complex errors, trivial things like missing closing brackets and the like.

I know the usual clap back is "you're just missing this magical workflow" or "you need to prompt better" but.. do I really need to prompt "make sure your syntax is correct"? Shouldn't that be, ya know, a given for a prompt that starts with "Help me put together a PromQL query that..."?
by Zababa | 2026-01-12 16:04:11+00:00
> Rather: an intended part of the ordinary course of using a Sprite. Like git, but for the whole system.

What I've been waiting for, for a long time. Basically the thing you need if you want agents to run freely but still in a safe way kinda.

>For reasons we’ll get into when we write up how we built these things, you wouldn’t want to ship an app to millions of people on a Sprite. But most apps don’t want to serve millions of people. The most important day-to-day apps disproportionately won’t have million-person audiences.

I appreciate a lot this vision of personal computing.

I'll give sprites a try, they sound super cool.
Show HN: Reversing YouTube's "Most Replayed" Graph
by prvt | 2026-01-12 16:04:15+00:00
Hi HN,

I recently noticed a recurring visual artifact in the "Most Replayed" heatmap on the YouTube player. The highest peaks were always surrounded by two dips. I got curious about why they were there, so I decided to reverse engineer the feature to find out.

This post documents the deep dive. It starts with a system design recreation, reverse engineering the rendering code, and ends with the mathematics.

This is also my first attempt at writing an interactive article. I would love to hear your thoughts on the investigation and the format.
by ojosilva | 2026-01-12 16:04:22+00:00
Their target is the Enterprise anyway. So they are apparently willing to enrage their non-CC user base over vendor-locking.

But this is not the equivalent of Oracle over Postgres, as these are different technology stacks that implement an independent relational database. Here were talking about Opencode which depends on Claude models to work "as a better Claude" (according to the enraged users in the webs). Of course, one can still use OC with a bazillion other models, but Anthropic is saying that if you want the Claude Code experience, you gotta use the CC agent period.

Now put yourself in the Anthropic support person shoes, and suppose you have to answer an issue of a Claude Max user who is mad that OC is throwing errors when calling a tool during a vibe session, probably because the multi-million dollar Sonnet model is telling OC to do something it can't because its not the claude agent. Claude models are fine-tuned for their agent! If the support person replies "OC is an unsupported agent for Claude Code Max" you get an enraged customer anyway, so you might as well cut the crap all together by the root.
by thomasmg | 2026-01-12 16:05:18+00:00
I wonder, how can a programming language have the productivity of a high-level language ("write like a high-level language"), if it has manual memory management? This just doesn't add up in my view.

I'm writing my own programming language that tries "Write like a high-level language, run like C.", but it does not have manual memory management. It has reference counting with lightweight borrowing for performance sensitive parts: https://github.com/thomasmueller/bau-lang
by prathje | 2026-01-12 16:05:50+00:00
I work as a freelancer, but I have been wanting to start something of my own. A couple of months ago, I started working on VideoZero.ai with the vision of generating videos that feature text, formulas, and graph elements without breaking after 10 seconds or weird artifacts. Instead of generating raw pixel values, we leverage Motion Canvas to create the video elements. Some results are quite cool, but some videos are quite crappy. We have a whole list of animations to explore here: https://videozero.ai/gallery
by vunderba | 2026-01-12 16:06:14+00:00
Nice article! I’ve experimented a bit with autogenerating “Where’s Waldo?”-style images. Even models that can output higher resolutions (Seedream can do 4K) tend to generate faces that look like they’ve been shoved into a fireplace, like Sandor Clegane.

This is where something like ADetailer (YOLO + Img2Img) really feels necessary to clean up all the finer details but it would probably take a lot of manual tweaking.
by postalcoder | 2026-01-12 16:06:30+00:00
Modern UI design has trended toward hiding more and more things. I think it's super useful to expose a new, hyper-malleable control surface to the user (the stream deck is popular for a reason!). If the touchbar was ubiquitous, competition would force developers to think more deeply about interaction design and building apps that thoughtfully use it.

Adoption engenders development, and development engenders adoption. All of the best use cases of a touch bar are ones we would have seen had such a virtuous cycle been allowed to occur.
by rspoerri | 2026-01-12 16:06:41+00:00
She was so focussed on it and started crying when we hid it after only a very short time. This is not normal a behaviour. This only happens with things that are very addictive (also for example sugar). I do understand that not everybody can do it like that, but if you can create such an environment it's much better for them (in my opinion).
by crazygringo | 2026-01-12 16:07:07+00:00
It says in the body:

> while Apple Music reached all-time highs in both listenership and new subscribers.

I'm assuming listenership is total subscribers.

It doesn't need to be "astounding". But it is significant, given the competition from Spotify and YouTube and other streaming services. When you're not the most popular service, it's genuinely a challenge to be on the growing side of things rather than the shrinking side or stagnant side.
by tensegrist | 2026-01-12 16:07:12+00:00
typo:

// A numeric string between 32 and 49 is assumed to be in the 2000s:
console.log( new Date( "49" ) );
// Result: Date Fri Jan 01 2049 00:00:00 GMT-0500 (Eastern Standard Time)

// A numeric string between 33 and 99 is assumed to be in the 1900s:
console.log( new Date( "99" ) );
// Result: Date Fri Jan 01 1999 00:00:00 GMT-0500 (Eastern Standard Time)

the second interval should start at 50, not 33
by F7F7F7 | 2026-01-12 16:07:15+00:00
When word came out that Tim Cook was shifting Apple to a service first business people lost their mind.

I think the future (whether we like it or not) is a single general computing device (thin client, true laptop replacement) that can fit in one’s pockets, communicate and cast to terminals, and help power a set of wearables like glasses.

That’s going to take a level of vertical integration that Apple is best positioned to do.
by fredley | 2026-01-12 16:07:32+00:00
The Yoto system actively encourages you to buy 'blank' cards to fill with your own content, and the process is relatively simple. Simply remove the DRM from the borrowed media, (convert to an appropriate format if required), then upload to the card. Wipe your card whenever you borrow a new audio book from the libarary for a clear conscience. yt-dlp is also a great source of content.
by fb03 | 2026-01-12 16:07:46+00:00
I've created a toy coding agent called "caducode". More of a thought experiment that materialized into a little something.

The philosophy behind it is: instead of providing a bunch of tools to the LLM, you simply provide a single tool: run_python(). The Agent just generates code to do whatever it needs, to inspect local files, to carry edits, to run commands.

https://github.com/flipbit03/caducode

It worked surprisingly well, even with a very small 30b local model.
by HarHarVeryFunny | 2026-01-12 16:07:51+00:00
Sure, but the AI is faster & cheaper than a human, or even of a team of humans. So, if you are a solo developer and can't afford to hire a team of humans to help accelerate your project, you now have the option of using AI instead.

It seems the capability and utility of these models/products is increasing very fast. Agentic tools like Claude Code that run locally in your terminal and therefore have access to all your dev/test tools and environment is a huge advance since now the output isn't just code, it's fully tested debugged code, that passes whatever tests and quality gates you tell it are necessary.

At the same time that the tooling has improved, so have the models, and only very recently (last 6 months or so). People swear by Opus 4.5, and I've also been impressed by Gemini 3.0. A year ago I was also much more skeptical of the utility of AI for serious use, but they've improved a lot.
by palmotea | 2026-01-12 16:07:58+00:00
> Tobi Lutke very explicitly did not pass off the work as his own. He attributed it to Claude. Does the fact that he didn't know about and include all of Claude's sources make it plagiarism?

Yes. The OP wrote:

>>>> so decides to let Claude Code plagiarize one

Read it carefully: Claude Code is the actor that's doing the plagiarizing.

What Tobias Lutke is doing is gushing about plagiarism like it's original work.

It's like if I gave you a copy of To Kill a Mockingbird, but with my name as the author, and you then went around telling everyone how impressive of a writer I am.
by csemple | 2026-01-12 16:07:59+00:00
Yes, on your first point "layer 1" isn't fundamentally new. It's applying standard systems administration principles, because we're currently trusting prompts to do the work of permissions.

With the pattern I'm describing, you'd:
- Filter the tools list before the API call based on user permissions
- Pass only allowed tools to the LLM
- The model physically can't reason about calling tools that aren't in its context, blocking it at the source.

We remove it at the infrastructure layer, vs. the prompt layer.

On your second point, "layer 2," we're currently asking models to actively inhibit their training to obey the constricted action space. With Tool Reification, we'd be training the models to treat speech acts as tools and leverage that training so the model doesn't have to "obey a no"; it fails to execute a "do."
by pron | 2026-01-12 16:08:12+00:00
> And "opt-in non-tracing GC that isn't used largely throughout the standard library" is not a reasonable definition.

Given that refcounting and tracing are the two classic GC algorithms, I don't see what specifying "non tracing" here does, and reference-counting with special-casing of the one reference case is still reference counting. I don't know if the "reasonable definition" of GC matters at all, but if it does, this does count as one.

I agree that the one-reference case is handled in the language and the shared reference case is handled in the standard library, and I think it can be reasonable to call using just the one-reference case "not a GC", but most Rust programs do use the GC for shared references. It is also true that Rust depends less on GC than Java or Go, but that's not the same as not having one.

> When it comes to having more segfaults, we know. Zig "wins" most segfaults per issue Razzie Award.

And Rust wins the Razzie Award for most painful development and lack of similarly powerful arenas. It's like declaring that you win by paying $100 for something while I paid $50 for something else without comparing what we got for the money, or declaring that you win by getting a faster car without looking at how much I paid for mine.

> This is what happens when you ignore one type of memory safety.

When you have less safety for any property, you're guarnateed to have more violations. This is what you buy. Obviously, this doesn't mean that avoiding those extra violations is necessarily worth the cost you pay for that extra safety. When you buy something, looking just at what you pay or just at what you get doesn't make any sense. The question is whether this is the best deal for your case.

Nobody knows if there is a universal best deal here let alone what it is. What is clear is that nothing here is free, and that nothing here has infinite value.
by AnimalMuppet | 2026-01-12 16:08:24+00:00
I'm not sure that the tariffs are just bias plus bad economic theory. I think it's that Trump sees tariffs as a source of revenue under his personal control - that is, not subject to the congressional budgeting process.

It remains to be seen whether the courts will agree with that. Last I saw, they didn't, but it wasn't a final decision.
by MontyCarloHall | 2026-01-12 16:08:35+00:00
Because their focus on user privacy makes it difficult for them to train at scale on users' data in the way that their competitors can. Ironically, this focus on privacy initially stemmed from fumbling the ball on Siri: recall that Apple never made privacy a core selling point until it was clear that Siri was years behind Google's equivalent, which Apple then retroactively tried to justify by claiming "we keep your data private so we can't train on it the way Google can." The result was a vicious cycle: initially botch AI rollout -> justify that failure with a novel marketing strategy around privacy that only makes it harder to improve their AI capabilities -> botch subsequent AI rollouts as a result -> ...

To be clear, I'd much rather have my personal cloud data private than have good AI integration on my devices. But strictly from an AI-centric perspective, Apple painted themselves into a corner.
by flanbiscuit | 2026-01-12 16:08:52+00:00
ChatGPT is currently integrated into Apple Intelligence. When I ask Siri something I can choose to use ChatGPT for my answer.

https://support.apple.com/guide/iphone/use-chatgpt-with-appl...

So I'm guessing in a future update it will be Gemini instead. I hope it's going to be more of an option to choose between the 2.