MurphyA/hacker-news huggingface dataset:
Show HN: Sandbox Agent SDK – unified API for automating coding agents
by NathanFlurry | 2026-01-28 14:06:48+00:00
We’ve been working with automating coding agents in sandboxes as of late. It’s bewildering how poorly standardized and difficult to use each agent varies between each other.

We open-sourced the Sandbox Agent SDK based on tools we built internally to solve 3 problems:

1. Universal agent API: interact with any coding agent using the same API

2. Running agents inside the sandbox: Agent Sandbox provides a Rust binary that serves the universal agent API over HTTP, instead of having to futz with undocumented interfaces

3. Universal session schema: persisting sessions is always problematic, since we don’t want the source of truth for the conversation to live inside the container in a schema we don’t control

Agent Sandbox SDK has:

- Any coding agent: Universal API to interact with all agents with full feature coverage

- Server or SDK mode: Run as an HTTP server or with the TypeScript SDK

- Universal session schema: Universal schema to store agent transcripts

- Supports your sandbox provider: Daytona, E2B, Vercel Sandboxes, and more

- Lightweight, portable Rust binary: Install anywhere with 1 curl command

- OpenAPI spec: Well documented and easy to integrate

We will be adding much more in the coming weeks – would love to hear any feedback or questions.
by ImPostingOnHN | 2026-01-28 14:06:54+00:00
> I think it’s very important to focus on how data collection of this nature is bad, not that “because Nazis did it” it’s bad.

It's bad for both reasons. Palantir is the IBM of our time, using scaled data engineering to handle the tracking and incarceration of ethnic minorities, who are quickly shipped off for worse persecution, including torture, at government-run camps, all without any due process.

> he can turn around and say he’s actually preventing Nazis

Anyone can say anything absurd, counterfactual, and unconvincing, regardless of circumstances. For us to consider it true, we'd need some evidence that it is at least more true than the opposite.

> Say thank you," Karp added.

Thanks for the link. Wow, I didn't realize that he was such an insufferable, sociopathic, abusive douchebag as a person. Like a wife-beater who insists his victim thank him for it.
by sotix | 2026-01-28 14:07:04+00:00
> If one of those 30 is related to politics I don't see the problem. Just don't click on it.

I think it's a fair issue for people trying to avoid triggering news topics. Sometimes the headlines can be really inflammatory. Avoiding them might be feasible for you and me but may be tougher for others. For example, the top post right now is titled, "ICE and Palantir: US agents using health data to hunt illegal immigrants", which is tricky because it is tech related and straddles the line of politics and tech. But I can see how someone might get triggered by reading that. Telling someone, "Just don't click on it", may be akin to telling an alcoholic, "Just don't drink that poured beer" in this case.

It would be nice if you could unsubscribe from certain tags like you can on Tildes. That way, you would have slight control over what you see while allowing others to keep what they want to see.
by flohofwoe | 2026-01-28 14:07:15+00:00
> At least Microsoft haven't fallen so low as to fail basic design principles like having transparent on top of transparent buttons

That's just because Microsoft has been there done that already 2 decades ago ;) (IIRC in Windows Vista).

Same with the fine-grained in-your-face permission popups. Introduced by Microsoft in Vista, copied by Apple in Mojave ;)
Ask HN: How do you get Cloudflare to take abuse reports seriously?
by y_oh_y | 2026-01-28 14:07:27+00:00
For context, I have to get involved in incident response from time to time. Typically, when you submit an abuse report with evidence attached it gets actioned relatively quickly, unless you're dealing with Cloudflare.

This was my experience yesterday when trying to report a site distributing malware and collecting stolen information:

- Fill out the 'Phishing and Malware' abuse report

- Recieve an automated email confirmation

- 4 minutes later recieve an automated email saying 'The reported content is no longer visible at the URLs included in your complaint.'

- Verify that the content is indeed still visible using the curl commands I included in the original abuse report

- Reply to the email (not via a simple reply, because that's a no-reply address, instead you have to copy/paste their abusereply email address) explaining the situation again

- 2 minutes later recieve an automated email saying that the abusereply email address doesn't accept or process abuse reports and to fill out the online form instead. You know, the one that I filled out in the first place

Contrasting this with other service providers, Cloudflare seem to actively defend malware distribution sites. I'm at the point where I'm considering blocking anything fronted by Cloudflare to safeguard our environments.

Am I doing something wrong?
by florkbork | 2026-01-28 14:07:35+00:00
I think it's important to assess the quality of the comments - they aren't bringing facts, just stating opinions; doing so quickly and agreeing with each other. You can test this out - pick a few names on the comments that disagree, ctrl+f, and you'll quickly find one individual with 29 comments at the time of writing all over the thread; with a handful of others with 1-4 responses.

This is not actually what the majority of people think and feel.

IE; from recent polling
> 55%+ of Americans have “very little” confidence in ICE, while 16 percent only have "some".

That's ~71% of ordinary US folks; and I would wager many international folks are very clear eyed about the situation.

But why don't you see a ratio of 7/10 of top level comments critical? It's reasonable to assume that about half of those people are just keeping to themselves or part of the political middle that feel something is a "bit wrong"; but not quite enough to go yell into the internet about it. For the others, arguing is tiring and doesn't seem to change much. Watching the situation induces feelings of dread, despair or helplessness.

On the opposing side, that 29% of people are faced with the fact that they might actually be the "baddies" (https://www.youtube.com/watch?v=ToKcmnrE5oY), and a good number of them are flooding conversations to prove they are in fact "not"... because admitting otherwise would mean they are actually doing something quite morally or ethically wrong by their own or their community standards. Since that would be unthinkable! the only logical reaction is to post frequently in shrill defense.

If you keep that in mind - the relative psychology of each group - it's much easier not to despair if "everyone" seems to be saying the opposite of what you would expect.
by gorgoiler | 2026-01-28 14:07:46+00:00
Sorry, I wasn’t clear enough. We’re talking about three things here:

(1) Encryption: fast and fantastic, and a must-have for at-rest data protection.

It is vulnerable to password theft though. An attacker might insert evil code between power-on and disk-password-entry. With a locked down BIOS / UEFI, the only way to insert the code is to take the boot drive out of the device, modify it, put it back, and hope no one notices. “Noticing” in this case is done by either:

(2) Trust chaining: verify the signatures of the entire boot process to detect evil code.

(3) Tamper detection: verify the physical integrity of the device.

My point is that (1) is a given, and out of (2) or (3), I’d rather have the latter than deal with the shoddiness of the former
by myrmidon | 2026-01-28 14:07:58+00:00
Not so! Concentration camps predate the Nazis by quite a bit, and the term was/is used for all kinds of prison-like setups where inmates are held outside the rule of law.

E.g. US camps holding Japanese immigrants during WW2.

Sure, it might be somewhat hyperbolic (arguable, because ICE/current administration has few qualms dismissing constitutional rights whenever convenient), but the term is definitely not Nazi-exclusive (even the Germans had concentration camps long before Hitler, in Namibia)
by menaerus | 2026-01-28 14:08:04+00:00
The point was not in simplicity but rather in if AI is replacing some people's jobs. I say that it certainly is, as given by the example, but I also acknowledge that the technology is still not at the point where human engineers are no more required in the loop.

I built other things too which would not be considered trivial or "simple", or as you say they're architecturally complex, and they involve very domain specific knowledge about programming languages, compilers, ASTs, databases, high-performance optimizations, etc. And for a long time, or shall I say never, have I felt this productive tbh. If I were to setup a company around this, which I believe I could, in pre-LLM era I'd quite literally have to hire 3-5 experienced engineers with sufficient domain expertise to build this together with me - and I mean not in every possible potential but the concrete work I've done in ~2 weeks.
by account42 | 2026-01-28 14:08:36+00:00
Most people don't like it when you drag them where they don't want to go and like it even less when you ignore that they "scream" about it. If system was universally positive no one would have to be dragged. This patronizing attitude of its developers and proponents is one of the main reasons why I avoid SystemD like the plague.

Oh and "modern" is becoming more and more a pejorative for tech as far as I'm concerned.
by ben_w | 2026-01-28 14:08:55+00:00
> How much funding does Reform receive from foreign parties?

The general consensus is "a lot by the surprisingly cheap standards that are British politics".

> And should said foreign parties come to an eventual collapse where would it leave Reform?

Unclear; as with Trump (and Musk, and Johnson), Farage is an effective TV personality, willing to be seen to be foolish just so long as he is in fact being seen.
by naravara | 2026-01-28 14:09:09+00:00
The acting as if there is a clearly demarcated distinction between the “public” and “private” sectors seems mostly like a 20th or 19th century atavism. The only substantive difference today seems to be that the former actor is more restrained by political input (in functioning democracies at least) and the latter is less so. But in terms of who has authority over how people live their lives and the level of totalizing control over communication and commerce it’s more like overlapping and competing fiefdoms than the “state = coercive power” and “private sector = market power” dichotomy people often try to imply.
by jacquesm | 2026-01-28 14:09:12+00:00
The should be separable, but they are not. Data collected privately absorbed by the government is a serious problem, even anonymized data can be de-anonymized if you can put more than one database next to each other. This allows for far more insights than any single database could give you and this is a real danger.

Keep in mind that DOGE made off with a huge stash of data, which combined with other data, such as voter registration data, twitter messages (public and private) and other such datastores could become an extremely efficient tool in messing with elections. The whole system is predicated on that being hard and so we trust the outcome of elections but with todays tools in the hands of the large US companies currently in cahoots with the Trump administration this is childs play.
by unayung | 2026-01-28 14:09:19+00:00
Hey HN,

I built a face for my Clawdbot. One <script> tag, zero dependencies, zero build step.

Demo: just open index.html. It auto-detects what's available and adapts:

- Open the file directly → animated face, tap to cycle 16 expressions
- Run the included Node server → push-to-talk appears (Whisper STT)
- Pass a WebSocket URL → chat input appears, face reacts to responses in real-time

The face is a single self-contained JS file (face.js, ~17KB) that injects its own SVG, CSS, and animation loop. Natural blinking, pupil drift, breathing animation, ambient glow, and a subtitle system — all pure JS/SVG, no canvas, no WebGL, no React.

There's also a gateway integration module (clawdbot.js) that maps agent events to expressions automatically — thinking when processing, investigating when searching the web, working when running code, confused on errors.

Built for Clawdbot (https://github.com/clawdbot/clawdbot) and Moltbot (https://github.com/moltbot/moltbot), but face.js works standalone with anything. Just call face.set('happy', 5000).

Zero npm install. Zero bundler. Copy the file, add the script tag, done.
by randomint64 | 2026-01-28 14:09:20+00:00
That's right, Signal (https://kerkour.com/signal-app-rust), Proton (https://kerkour.com/proton-apps-rust), Matrix, Wire and many more are using a share, cross-platform Rust core and a platform-dependent UI layer.

But it's not only the security-critical paths, but also most of the business logic (see the 2 posts above).
by tucnak | 2026-01-28 14:09:39+00:00
I'm not convinced. (A bit of advice: if you wish to make a statement about performance, always start by measuring things. Then when somebody asks you for proof/data, you would already have it.) If what you're saying were true, it would be a big deal, except unfortunately it isn't.

Dispatch has overheads, but it's largely insignificant. Where it otherwise would be significant:

1. Fused kernels exist

2. CUDA graphs (and other forms of work-submission pipelining) exist
by switchers | 2026-01-28 14:09:51+00:00
If you already have a prepared list then fair enough, but what are you personally doing to take part in the healing of society that consuming mainstream news media helps with? The person you're replying to hasn't said they live as a hermit and don't engage in any part of their local society.

I fully agree that it all seems fucked and there is no point in following anything other than specific tech stuff I'm interested in. Anything else actually important someone else in my life will probably mention it to me. Or the explosion will vaporise me and knowing it's coming won't have helped much.
by creshal | 2026-01-28 14:10:24+00:00
They're unsure because a lot depends on the legal status of children born to non-citizen parents in the US after a executive order tried to revoke birthright citizenship: https://www.bmj.com/content/390/bmj.r1538

If that EO was legal, then sharing the data is, too. If it wasn't, then it's probably a privacy violation, but the CMS isn't allowed to make that call themselves, they have to rely on court decisions for it. And challenging EOs is not trivial.
by davydm | 2026-01-28 14:10:33+00:00
sounds like a plan - if someone were to create an app to do this, I'd probably check it out and use it; tho honestly, I don't have the combination of time and motivation to do it myself :/

I might even pay a subscription fee for a service which does this on my behalf (no more than $5 a month, and an easy sell at $1-2 pm), tho that has it's own problems, in that I'd have to allow it to authorise as me. So, something better would be an app which launches an oauth login at google (for example), then uses that token for that session only (ie, requires user intervention each time). I'd probably run this a few times a week.
by Quarrelsome | 2026-01-28 14:10:36+00:00
If we are to learn from the brutal Soviet sanctioned forced deportations of the Baltic nations following world war 2, then justice will come but it will take time.

Once the Baltic nations gained independence they tried everyone involved in the administration of those orders, which took place without trial or oversight and often resulted in the replacement families being deported if the actual tagets could not be found.

Ofc Stalin or any of the power brokers at the time were long dead, so instead it was a parade of lower level admin workers, all who were elderly in their 80s or 90s and who at that time were young, simply doing the bidding of their employers.

The lesson: don't be a bag holder for people who will die before you leaving you to hold the responsibility for their crimes.
by blub | 2026-01-28 14:10:38+00:00
Just like Google’s Rust-in-Android blogs this reads like a PR piece (and in the case of facebook also recruitment piece) with some technical words sprinkled in for effect. The overall communication quality is that of a random startup’s “look what we did” posts.

The interesting aspects, such as how they protect against supply-chain attacks from the dependency-happy rust toolchain or how they integrated the C++ code with the Rust code on so many platforms - a top challenge as they said - remain a mystery.

Would also be interesting to hear how much AI-driven development they used for this project. My hope’s that AI gets really good at Rust so one doesn’t have to directly interact with the unergonomic syntax.
by Moomoomoo309 | 2026-01-28 14:11:19+00:00
Oh, I see Google's angle now. They want to make android a viable desktop OS in order to have more users using android Chrome rather than Windows Chrome, because the former lacks extension support, and thus ad blockers. Of course, you can still install brave or kiwi browser or Firefox to your heart's content, but most people won't. It's brilliantly simple. It's not too bad for power users, they'll probably use a different browser, or for developers, given the work they're putting into the Linux containers, but for most users...we'll see the expected result.
by ampersandy | 2026-01-28 14:12:22+00:00
My take has nothing to do with charity to Cloudflare, but to the author. I can't help remembering that quote from the 50's where an IBM exec said they weren't going to fire an employee who made a costly mistake for the company, they just spent $$$ training them.

I think it's fair to assume, given the historical quality of the CF blog, that this was a (big) mistake by an individual, and not "Cloudflare", as an entity, making this claim.
by snowwrestler | 2026-01-28 14:12:38+00:00
HQ2 ended up in Crystal City, Virginia, which is a commercial district of Arlington County, and it’s fine. The pandemic-driven remote work trend led Amazon to scale back the number of buildings.

The state and localities did a good job structuring incentives so everything was tied to milestones, some of which Amazon ended up not hitting. My recollection is that NY was offering to give a lot more away, which helped fuel the backlash, but don’t quote me on that.

It also helped in VA that Crystal City has been a commercial wasteland for many years thanks to DoD decentralization. A lot of offices moved down to Fort Belvoir and surrounding areas, leaving Crystal City with a lot of vacant office space. Nothing was being “lost” by Amazon coming in.

Local real estate agents put “HQ2” in their listings for a few years but it didn’t matter much because homes near Crystal City were already super expensive.
by codingdave | 2026-01-28 14:12:47+00:00
Everyone could build a SaaS before, it just is quicker and cheaper now because you don't have to hire a coder. The difference between success and failure is still building the "correct" product, for both meanings of "correct". For those who are unaware, meaning #1 is to build the product that the market will adopt, meaning #2 is to build the product correctly so it is sustainable and maintainable.

LLMs do not guarantee either of those, so unless they improve to the point where they do, this really doesn't change the overall market, it just changes the level of resources required to play.

What LLMs are going to replace is more likely to be the spreadsheets that departments run on, sharepoint and salesforce lists, and other such low-cost, low-effort, and legacy tools that departments tend to use for their own local processes.
by lelanthran | 2026-01-28 14:12:48+00:00
> Your success [as a manager] can be built from your teams success, rather than your own individual contribution.

Well, yes. That's what good managers are: a force multiplier.

A bunch of rockstar devs reporting to a poor manager may never move the needle in an organisation. A bunch of below average devs reporting to a stellar manager will definitely move the needle.
by shagie | 2026-01-28 14:13:06+00:00
The python code would be

def some_call():
return [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]

def print_evens(nums):
for n in filter(lambda n: n % 2 == 0, nums):
print(n)

def func():
filtered = list(filter(lambda n: n % 2 == 0, some_call()))
print_evens(filtered)

if __name__ == "__main__":
func()

How would you write a failing test that prevents the list from some_call() from having the same filter applied to it twice?
Show HN: MyTunes Pro – A TUI, keyboard-first music player for Linux develope
by loxo | 2026-01-28 14:13:09+00:00
Hi HN

I built MyTunes Pro for developers who live in Linux terminals, use the keyboard for everything, and want music that doesn’t interrupt their flow.

https://mytunes-pro.com

This is a TUI-centric, keyboard-first music player built around YouTube search and playback — with no ads, no visual noise, and no attention hijacking.

Why it works especially well on Linux

Linux-first mindset
Designed with terminal-heavy workflows in mind.
Feels at home next to tmux, vim, and your shell.

⌨ Keyboard-only control
Search, open, and control music without touching the mouse.
If you think in keybindings, this is for you.

TUI-oriented experience
Minimal UI, predictable behavior, no distractions.
Inspired by VI-style tools: fast, quiet, and intentional.

Ad-free YouTube music playback
Just the music. No recommendations, no popups, no autoplay traps.

More than a player

A shared music hub for developers
Discover and share tracks with developers around the world.

Built for long coding sessions, not passive consumption.

Why I made this

Most music apps try to keep you engaged.
MyTunes Pro tries to disappear.

I wanted a music player that:

respects focus

fits terminal-centric workflows

feels like a dev tool, not a media platform

Tech notes

Web-based (works well as a PWA)

Optimized for desktop & Linux environments

No generative AI — just fast search and playback

I’d love feedback from Linux users, terminal lovers, and anyone who codes with music on all day.

Happy to answer questions. Thanks for reading
by speakingmoistly | 2026-01-28 14:13:31+00:00
> Given that children can generally work from 13, which is around the time that they'll be able to use VPNs, this seems like an interesting situation.

Just a hot take, but perhaps the focus shouldn't be "how can we ensure that nigh-preteens can connect to the office network".

That aside, legislating on whether VPN access is legal or not is still a ridiculous and dangerous idea.
by nicolasarsen | 2026-01-28 14:13:43+00:00
I was tired of having to pay for GitTower so I'm building the open source free version.

It is in beta, as of now it implements basic features like GitHub desktop.

The app is not signed yet, I will be doing that today with a new release as well.

If you guys find bugs, have suggestions or feedback I'd be happy to hear constructive tips!

Thanks a lot :D
by Quarrelsome | 2026-01-28 14:14:11+00:00
bear in mind that ICE are forcibly deporting people in the process of applying for green cards whose lawyers have assured them that a lapsed VISA isn't an issue (it never used to be) as they have married an American citizen and maybe even have children with them.

A robotics engineer from Germany was forcibly deported a few months back because ICE were waiting for him at the immigration office when he went to visit to further the application.