MurphyA/hacker-news huggingface dataset:
by tuetuopay | 2026-01-21 09:13:11+00:00
This is the opposite of leet code.

Yes, this applies to some simulated imaginary CPU with an artificial problem. Except that the job asked here is exactly the core of what a performance engineer will do at anthropic: optimize kernels for their fleet of GPUs. Is it simplified? Yes! (e.g. the simulator does not restrict memory access patterns)

This is a real-world problem adapted to a lab setting that can fit in one's head in a matter of hours. Leetcode would have you reimplement the hashmap used in there.
by Mashimo | 2026-01-21 09:13:21+00:00
I have no idea who he is, never heard of him. You shall not judge a book by its cover but .. he is making it hard. His video titles are:

* Devuan: The Non-Woke Debian Linux Fork (Without Systemd)

* NeoFetch But in Rust and More Gay

* Chimera Linux is "Here to Further Woke Agenda by Turning Free Software Gay"

* Are Jews the Cause of DEI in Big Tech?

Yeah .. I did not watch a single video of his. But just from a short few seconds It's not anything I want to invest time in to see if he has a point or not. Life is too short.
by aragilar | 2026-01-21 09:13:31+00:00
No, it very much does. If you want to join two network segments such that on one side all devices are on 10.1.X.X and the other all devices are 10.2.X.X, you'd use a mapping between 10.1.a.b and 10.2.a.b

See https://en.wikipedia.org/wiki/Network_address_translation#Me...
by fc417fc802 | 2026-01-21 09:14:03+00:00
UPnP is only relevant for software that's already running on your machine locally. People here aren't generally talking about outbound connections and I think you both know that. The practical effect of NAT as commonly encountered in a residential setting is to drop inbound unsolicited connection attempts.

And yes, everyone is aware that you could also do that with a stateful firewall. And no, none of us care about arguments of definition that attempt to frame NAT as technically being a firewall based on how it operates in practice. Being intentionally obtuse by refusing to acknowledge the obvious isn't going to convince anyone.
by mbornstein | 2026-01-21 09:14:17+00:00
You should add https://www.roastworks.co.uk/ in the UK - they are surprisingly affordable for great quality, their Guji Natural is a staple in my ever changing bean selection I have at home.

You should also add notes coffee roasters from the UK: https://notescoffee.shop/products/iwd-pao-villages-myanmar?v...

This Myanmar coffee is what got me exploring beans outside Ethiopia and Kenya again

Also Story coffee https://www.storycoffee.co.uk/ - their Christmas roast with beans from Sidamo in 2023 has me still thinking about them

And finally Roca Junior from Munich: they are by far the best roasters in Munich and I could name a few more good ones there https://rocajunior.de/

Ok and at least one honorable mention from a trip I recently did to Toulouse: Cerise - outstanding fruity natural processed beans and balanced roasts: https://lecafecerise.fr/boutique-cafes/

I could give many more recommendations of local roasters in European cities, I try to visit as many as possible when I travel, take bags home and mark them on google maps. I guess some are difficult to get shipped/order online but this DB could also be great to find local gems in your area
by colechristensen | 2026-01-21 09:15:22+00:00
There's an impedance mismatch between some people and LLMs and I think one of the major reasons boils down to having preconceived notions about how it should get things done and being frustrated and disappointed when it doesn't. If you explore how to get the best out of it you can by trying many different kinds of ways to interact with it you'll have much more success.

I have had similar problems with colleagues who couldn't abide by others solving problems in ways that they disagreed with and would only be agreeable coworkers if they thought in the same way.
by atraac | 2026-01-21 09:15:34+00:00
In my case, I use JetBrains Junie(it uses various models underneath) and it mostly works fine, but I don't vibe code entire products with it, I just give it easy, neatly defined tasks. Improve readme, re-implement something using the same approach as X, create a script that does Y etc. It's fairly good at making one-off tools I need, we messed up something and need a tool to f.e. fill up db with missing records? I'll just make a console app that does this. We need a simple app that will just run somewhere and do one thing(like listen to new files and insert something to a db). It's perfectly fine for that. I wouldn't trust it with day to day job, features, anything more advanced(I do mostly backend work). I also have to verify thoroughly what it ends up doing, it tends to mess up sometimes but since most of what it does is non-critical, I don't mind. I too don't believe the claims of people who just straight up Claude they way through a codebase to do 'grand' things but I have a small sample.
by nusl | 2026-01-21 09:15:37+00:00
They don't care. They generate large amounts of these, spam them out, and hope for some small success. If they get banned or blocked, they make new accounts. Shame isn't even a factor; it's all about money. They don't even attempt to understand or care about a product.

This was partially the case before, where you'd still get weird spammy or extortive reports, but I guess LLMs enable random people to shoot their shot and gum up the works even more.
by watwut | 2026-01-21 09:15:43+00:00
The only country that ever actually asked for help as NATO member was USA. And they helped. And now, the biggest threat is USA, who is trying to cast itself as a victim.

This is not the case of Europe externalizing the cost. It is the case of USA using other countries for own benefit, then starting aggression against them while trying to cast itself as victim.
by Knucklebones | 2026-01-21 09:16:53+00:00
What a weird coincidence, I was reading this article when my power went out for the first time ever at this house (4 years). Talk about uncanny!

It did feel pretty good being able to go to my closet, hit the 'push' light I'd stuck to the wall so I could see better, then calmly grab a couple of lanterns-slash-phone chargers. Added bonus: getting to share one with our older neighbour (who had plenty of light but no way to charge a phone).

I grew up in a place with a few power outages every year, albeit brief ones. A few basic preparations in the present can make your future much easier.
by legitimate_key | 2026-01-21 09:16:59+00:00
I'm experiencing this exact problem building app that blurs sensitive data for screen sharing and recording.

Users immediately ask: "How do I know you're not collecting my data?"

What I've learned about building trust:

1. Being defensive doesn't work - people's privacy concerns are valid

2. You need to over-explain how it works: no AI, local processing only, no data ever leaves the browser

3. Provide ways they can verify: open DevTools Network tab, check the code, read the privacy policy

4. Be transparent about what you DO collect (I only collect usage analytics, never the actual data being processed)

5. Build in public around the privacy/data protection topic so people see your values

The counterintuitive part: "free tool that protects privacy" sounds good, but it's actually MORE suspicious because "why would you give this away for free?"

The extension is called DataBlur if you want to see how I'm handling the transparency piece in practice. But curious what specific privacy concerns came up for you - was it about data storage, what you're collecting, or something else?
by dinkblam | 2026-01-21 09:18:26+00:00
good explanation and i also wondered why many of the CGI effects today are so unbelievably bad - and worse than decades ago.

it still doesn't explain why it is done:

• why do directors and producers sign off effects that are just eye-bleeding bad?

• using a realtime engine to develop the effects, doesn't preclude using some real render-pass at the end to get a nice result instead of "game level graphics". a final render-pass can't be that expensive that ruining the movie is preferred? if 20 years ago a render-farm could do it, it cannot cost millions today, can it?
by aidenn0 | 2026-01-21 09:18:32+00:00
We only have one because the Coastal Commision issued one for a plant around 1990 in a previous drought. The permit was maintained through to the current drought, at which point the Coastal Commission tried to get it shut down, but they lost since it was already permitted. Note that maintenance on the plant during the wet years was contentious; I don't know how it polled, but there were vocal people complaining about it, since it was barely used. Had those people prevailed, water would have been much dearer in the most recent drought.
by ben_w | 2026-01-21 09:18:59+00:00
Eventually, but consider the power envelope for compute in an android is 10-100x lower than for a car*, while at the same time the range of tasks it has to be good at is a strict superset of driving a car, and that open source attempts at self driving cars are far behind the proprietary attempts, and that compute efficiency is only doubling every 2.5-3 years (Koomey’s Law), so expect something like 20 years before these are properly general purpose and also not remote controlled.

Still plenty of value from special purpose and from remote control, but that's the timeline for solving both at the same time.

* even with the compute being external, the global electricity supply is presently a few hundred watts/capita and already being used for all the other things we want electricity for, hence all current anger about data centers making electricity too expensive, but renewables could tilt this to 8 billion robots with 1kW compute each in as little as 10 years if we brush aside all the decarbonisation efforts and keep burning petrol in cars and gas in stoves etc., otherwise more like 15 years for that.
by amluto | 2026-01-21 09:19:12+00:00
If a user’s verification attempts fails because their own rules block access, that doesn’t sound like a Cloudflare bug. If a user’s verification attempt fails because of Cloudflare’s built in rules, maybe that’s an issue, and maybe Cloudflare tried to fix that and messed up.

All that being said, this workflow is rather odd. We’re talking about a customer who uses an HTTP-01 challenge to get a certificate for a domain that is proxied by Cloudflare’s TLS-terminating proxy. Setting this up in a way that is useful is dramatically harder than letting Cloudflare deal with the certificate. Maybe the idea is that the user could example proxying and get something vaguely secure without any reconfiguration at all all on the origin machine? How many users have ACME configured and are willing to run a wide-open origin behind Cloudflare anyway?
by buesra | 2026-01-21 09:19:29+00:00
We built RobyGraph Nebula to combine graph theory with agentic AI. It’s a browser-based strategy game where you code a robot agent to navigate networks.

It runs on the yFiles Playground, so you can jump straight into the JavaScript/TypeScript editor without any setup. I’m curious to see what strategies people come up with to outsmart the opponent's pathfinding.

Happy to answer any questions about the API or the graph logic!
by embedding-shape | 2026-01-21 09:20:08+00:00
Had a hard lock of a new computer I'm setting up. Instinctively, I did SysRq + REISUB as I've been thought, then continued troubleshooting. Figured that maybe not everyone knows about this rescue command :)

The Wikipedia page isn't great, here's a TLDR for forcing a clean shutdown, even if the computer locked up, as long as the kernel is still alive:

- Hold the SysRq key and press this sequence of keys, with a short pause between each:
- R = switch keyboard from "raw" mode (so X/Wayland can’t intercept)
- E = send SIGTERM to most processes
- I = send SIGKILL to most processes
- S = sync disks (flush writes)
- U = remount filesystems read-only
- B = immediately reboot (no further shutdown steps)

Mnemonic I personally use, bet others have better ones: "Reboot Even If System Utterly Broken", REISUB!
by alkonaut | 2026-01-21 09:20:46+00:00
All of this might as well be greek to me. I use ChatGPT and copy paste code snippets. Which was bleeding edge a year or two ago, and now it feels like banging rocks together when reading these types of articles. I never had any luck integrating agents, MCP, using tools etc.

Like if I'm not ready to jump on some AI-spiced up special IDE, am I then going to just be left banging rocks together? It feels like some of these AI agent companies just decided "Ok we can't adopt this into the old IDE's so we'll build a new special IDE"?_Or did I just use the wrong tools (I use Rider and VS, and I have only tried Copilot so far, but feel the "agent mode" of Copilot in those IDE's is basically useless).
by ericdiao | 2026-01-21 09:21:18+00:00
The OP is explicitly not doing coordinated disclosure yet.

<del>No post / incident on CA/Browser Forum also.</del>

Edit: Incident on dev-security-policy@moz: https://groups.google.com/a/mozilla.org/g/dev-security-polic...

---

Translation by LLM of the post on Chinese forum V2EX:

LiteSSL appears to be a CA that only emerged last year. It provides free TrustAsia-backed wildcard certificates issued via ACME.

However, in my testing, its ACME server very frequently errors out with:

> Too many concurrent connections from IP 10.254.14.70 (limit: 10),
> urn:ietf:params:acme:error:rateLimited:concurrent

This clearly indicates a backend misconfiguration: LiteSSL incorrectly treats the reverse proxy’s internal IP as the client’s real IP when applying rate limits.

More seriously, LiteSSL has a *critical authentication vulnerability*.

Its DNS-01 challenge cache appears to have a very long validity period, and it does *not* verify that a certificate issuance request comes from the same ACME account that completed the original DNS-01 challenge. As a result, anyone can arbitrarily re-issue (steal-sign) certificates that were originally issued via DNS-01.

You can browse certificates issued by this CA here (ECC/RSA behave similarly). Pick any certificate with a wildcard domain, and you can re-issue it using your own LiteSSL ACME account without triggering validation:

[https://crt.sh/?CN=%25&iCAID=438132](https://crt.sh/?CN=%25&iCAID=438132)

`ssyhwa.cloudns.cl` is a temporary domain I created for testing; it has already passed DNS-01 validation and can reproduce the issue.

`*.vaadd.com` was a randomly selected victim domain, and I was also able to successfully steal its certificate.
by fc417fc802 | 2026-01-21 09:21:21+00:00
First they will have to change their policy of only providing one IPv4 address per ONT connection. Then they will have to convince me to disable NAT on my router, disable the DHCP server on my router, and bridge the WAN port with the LAN block.

Meanwhile in IPv6 land the ISP provided router that my relative has came configured by default to hand out globally routable addresses from the ISP provided /64. Thankfully it also had a stateful firewall enabled by default so there was no difference in practice.
by tcldr | 2026-01-21 09:21:23+00:00
Totally agree. If I don’t understand the code as if I’d written it myself, then I haven’t reviewed it properly. And during that review I’m often trimming and moving things around to simplify and clarify as much as possible.

This helps both me and the next agent.

Using these tools has made me realise how much of the work we (or I) do is editing: simplifying the codebase to the clearest boundaries, focusing down the APIs of internal modules, actual testing (not just unit tests), managing emerging complexity with constant refactoring.

Currently, I think an LLM struggles with the subtlety and taste aspects of many of these tasks, but I’m not confident enough to say that this won’t change.
by mapyr | 2026-01-21 09:22:27+00:00
Hey HN, author here.
I've been running local LLMs with MCP tools and managing multiple servers got annoying fast. Each capability needs its own server, so at 5-10 of them you're juggling processes, wondering which one crashed, and your configs are all over the place.
MCP Hangar is basically a registry that sits between your LLM client and your providers. Lazy loading so they start only when you actually call them. Health checks with circuit breaker. Works with Kubernetes (wrote an operator with CRDs) but also standalone with Docker or Podman. There's an optional auth layer if you need it.
Core is Python, operator is Go, architecture is DDD with event sourcing because I wanted full audit trail for enterprise use cases.
Mostly looking for feedback on edge cases I haven't thought of and what's missing for production use. Happy to answer questions.
by honzabe | 2026-01-21 09:22:35+00:00
My guess would be that the OP subscribes to the MAGA worldview, because in their alternative reality, the US-Europe security arrangement was not a mutually beneficial relationship between allies, but a parasitic relationship where the US pays, and Europe reaps the benefits.

Obviously, this worldview is strategically myopic, based on ignoring many things the US was getting out of this arrangement, like US military bases in Europe (also used for power projection to the Middle East), Europeans buying US weapons (big part of why those weapons are so advanced), doing America's bidding in the UN, supporting US military adventures (however misguided) in Iraq and Afghanistan, etc.

It could be argued that the US role of being the security provider to Europe and others was the main source of their wealth and power. The US had the proverbial goose laying golden eggs, but Trump got angry that they had to shelter that goose, so he kicked her out... no goose would abuse the US like that!

Here is one example: Trump saying that the EU was formed to screw the United States: https://www.youtube.com/watch?v=9kq28VSlvUw
by inglor_cz | 2026-01-21 09:22:40+00:00
"Why are you making it sound like the issue is binary?"

Because your declaration about the regulations seeking to protect us from big evil sounded quite absolutist in itself.

A bit of a motte-and-bailey. Some of them are undoubtedly good, some less so, and we shouldn't lobotomize ourselves by immediately dragging slavery out when starting discussions about the current regulatory level.

"Were those authorities doing the inspection from the EU or the local nation?"

EU law gets transposed into national laws of the constituent nations and local authorities then enforce it, but it is still EU law.

It is very different from the US where state authorities aren't tasked by enforcing federal regulations, because the Feds have their own enforcement infrastructure.

Compared to the US, EU-own enforcement infrastructure is tiny and mostly outsourced to local governments.
by nottorp | 2026-01-21 09:22:55+00:00
> The "inside" is your /56 or /48.

No it's not mine. It's the ISPs.

> which is useful for terrible ISPs with rotating network prefixes

... which is what you said :)

> If you can make your way through the absolute slog that is ARP+DHCP, you can get through NDP+SLAAC. Or even NDP+DHCPv6 if you're a control freak.

Oo enterprise. I believe you missed another 5 or 6 acronyms that are also required for having ipv6 internally.
by theshrike79 | 2026-01-21 09:23:08+00:00
#2 is a big thing

I have an actual work service that uses a specific rule engine, which has some performance issues.

I could just go to Codex Web and say "try library A and library B as replacements for library X, benchmark all three solutions and give me a summary markdown file of the results"

Then I closed the browser tab and came back later, next day I think, and checked out the results.

That would've been a full day's work from me, maybe a bit more, that was now compressed to 5 minutes of active work.
by n4r9 | 2026-01-21 09:23:22+00:00
I think their definition of valid is consistently aligning with the meaning of "acknowledging and accepting someone's internal experience".

As soon as you start trying to apply normative judgements to someone's feelings, as opposed to their behaviour, you inevitably end up drawing an arbitrary and cutlurally informed line between what you or socirty think is okay and what's not. It's only a problem if I feel excited by someone else's pain if my consequent behaviour actually leads to the other person suffering. I have no direct control over my emotions, but I can control my reaction to them. You just telling me it's wrong to feel excited is futile and potentially counter-productive.
by shafyy | 2026-01-21 09:23:25+00:00
This is a pretty good summary how it works for me, too. My main use case being the "advanced autocomplete" or what you call "typing for me".

But to answer the OP's question: I am on the same boat as you, I think the use cases are very limited and the productivity gains are often significantly overestimated by engineers who are hyping it up.
by MPSimmons | 2026-01-21 09:23:39+00:00
>This difference in theory versus practice is precisely why we see people objecting that IPv4 is more secure as far as default configurations go when it comes to home use.

I mean, I agree with them. I think people who say 'NAT is not security' are only correct in the absolute most pendantic way and that the way NAT is commonly configured is literally the only reason the internet doesn't consist mostly of botnets.

But I also suspect that if IPv6 were more common, we as a society would be better at it, and not do dumb things like hand out globally routable IPs via DHCP6
by creata | 2026-01-21 09:24:25+00:00
> The most charitable interpretation is that this whole project (supposed problems with CBZ, the readme, the code) is the output of an LLM.

Do LLMs perform de/serialization by casting C structs to char-pointers? I would've expected that to have been trained out of them. (Which is to say: lots of it is clearly LLM-generated, but at least some of the code might be human.)

Anyway, I hope that the person who published this can take all the responses constructively. I know I'd feel awful if I was getting so much negative feedback.
by rcxdude | 2026-01-21 09:25:02+00:00
The reason is it's a hell of a lot cheaper and easier to work with, and in general enables things to be done that would otherwise be cost prohibitive.

(And AFAIK they do usually do a non-realtime run, but a high-end render going for maximum photorealism also requires a whole different pipeline for modelling and rendering, which would essentially blow the budget even more so)
by dlcarrier | 2026-01-21 09:25:12+00:00
Banks aren't even liable for losses from account takeovers, at least if their system is compliant, regardless of whether that makes it secure. Their biggest incentive is customer satisfaction, which fraud does hurt.

It's credit cards that have to reimburse for fraud, but they charge the merchant for it, plus fees, so they have absolutely no incentive to prevent fraud, if not an incentive to outright encourage fraud. That would explain why their implementation of the already compromised EMV was further nerfed by a lack of a PIN in the US.
by em-bee | 2026-01-21 09:25:28+00:00
already decades ago when we were kids eating pudding with a fork was a fun past time, and i am sure the idea is as old as pudding or forks themselves. i mean, the fact that it spread so fast shows that there are many who already practiced it. it's actually surprising it took this long to become a meme.

heck, my cousin bet with me or let me compete eating pudding with chopsticks. (and that was long before i went to china)

practically speaking, the only downside of using a fork (or chopsticks) is scraping the bottom when you are finishing up.
by Ygg2 | 2026-01-21 09:25:53+00:00
> • why do directors and producers sign off effects that are just eye-bleeding bad?

It's a bit cheaper.

> • using a realtime engine to develop the effects, doesn't preclude using some real render-pass at the end to get a nice result instead of "game level graphics".

It's probably a bit expensive in terms of effort or processing-wise.

In both cases you aren't ruining a movie. You're just making it more mediocre. People rarely leave cinema because CGI is mediocre.