MurphyA/hacker-news huggingface dataset:
by xp84 | 2026-01-23 01:48:21+00:00
(Frame of reference: US only) That's a shame, given 18-25 is just the age where a credit card skimmer or online card fraud causing a big fraudulent withdrawal from your checking account, and weeks of waiting to get it back, could be devastating. This has happened to people in my family (likely from gas stations) but we only use credit cards except to pull cash from ATMs, so we only suffer a temporary dip in our available credit line while they investigate and do not have to pay the disputed charges in the meantime.

I know people with terrible credit may have problems getting a credit card, and others may have trouble not treating a credit line as spendable beyond their means, but everyone else should keep the 'debit card' at home or at least confined to their wallet.
Show HN: An agent sandboxing starter that's inspired by claude.ai/code
by lebovic | 2026-01-23 01:48:25+00:00
Hey HN! I built an agent sandboxing starter project that's heavily inspired by claude.ai/code.

This is yet another agent sandboxing project, but this one is interoperable with Claude Code's built-in session management. It does this by using the three arguments that I learned about from trying out claude.ai/code: --replay-user-messages, --sdk-url, and --resume. The --sdk-url arg enables live interaction over a WebSocket, and the --resume arg pulls session history from a URL.

This starter includes persistent sessions that are interoperable with what Claude Code expects, event streaming over a WebSocket, a web app, and spawning sandboxes through Modal or a Docker host.

Long-lived credentials stay outside of the sandbox; it has a basic credential-injecting proxy for the Anthropic API and GitHub. The proxy limits git pushes to a session-scoped branch.

I built this after collaborating with a team that's building an agent for biology. If something like this was available to them when they started, it might have sped up the start.

There's still a gap between forking this app and charging users for a custom agent, but I think it's a somewhat sane set of choices for quickly prototyping.

(I used to work at Anthropic, but this isn't affiliated with them and was built solely with public information.)
by vbezhenar | 2026-01-23 01:48:28+00:00
This whole API vs plan looks weird to me. Why not force everyone to use API? You pay for what you use, it's very simple. API should be the most honest way to monetize, right?

This fixed subscription plan with some hardly specified quotas looks like they want to extract extra money from these users who pay $200 and don't use that value, at the same time preventing other users from going over $200. Like I understand that it might work at scale, but just feels a bit not fair to everyone?
by 1vuio0pswjnm7 | 2026-01-23 01:49:26+00:00
Alternative to archive.md:

https://www.msn.com/en-gb/money/other/capital-one-strikes-5-...

Text-only:

https://assets.msn.com/content/view/v2/Detail/en-in/AA1ULTnJ...
by Nadav--Shanun | 2026-01-23 01:49:34+00:00
For a decade we fed the web to machines. They learned to summarise, imitate style, and conjure fluent answers. And yet, something stubborn remains out of reach: how people actually do things. The living, tacit know-how that sits in our hands, our eyes, our pauses — the choreography of expertise as it unfolds on a screen or in a conversation. The internet holds many answers; humans hold the process.
by HALtheWise | 2026-01-23 01:50:14+00:00
Your expectation is wrong in this case for almost all languages. The design of Pylance (as is sorta forced by Python itself) chooses to execute Python to discover things like the Python version, and the Python startup process can run arbitrary code through mechanisms like sitecustomize.py or having a Python interpreter checked into the repo itself. To my knowledge, Go is one of the few ecosystems that treats it as a security failure to execute user-supplied code during analysis tasks, many languages have macros or dynamic features that basically require executing some amount of the code being analyzed.
by throwup238 | 2026-01-23 01:50:41+00:00
> My implication was the "thinking/reasoning" modes are a way for LLM providers to put their thumb on the scale for how much the service costs.

It's also a way to improve performance on the things their customers care about. I'm not paying Anthropic more than I do for car insurance every month because I want to pinch ~~pennies~~ tokens, I do it because I can finally offload a ton of tedious work on Opus 4.5 without hand holding it and reviewing every line.

The subscription is already such a great value over paying by the token, they've got plenty of space to find the right balance.
by tempaccsoz5 | 2026-01-23 01:51:22+00:00
This varies a lot between countries and cultures.

For example in New Zealand, EFTPOS cards are very popular (similar to debit cards, but issued directly by our banks so no user fees ever - the merchant pays for the machine and that's it). People usually have all 3 - an EFTPOS card for most in-person purchase (although online EFTPOS is gaining adoption), a debit card for online or paywave-only places, and a credit card for large purchases/ emergencies. Credit cards here are highly unpopular among the under-25 age bracket; most young people just have EFTPOS and debit.

I think this might be a result of our stricter banking regulations compared to economies like the U.S.; it's difficult for banks to offer tempting enough rewards schemes to entice people to credit cards. Additionally, there is much less of a borrowing culture - most people will only ever properly borrow money once - buying a house. Paying cash for cars is the norm, and purchasing anything else on finance is seen as stupid compared to just saving the money (and earning the interest yourself).
by Quarrelsome | 2026-01-23 01:51:47+00:00
and that's a very good thing. I only recognise our nation from 1945 onwards, establishment of the welfare state, the idea the government cares for its people. The idea that victims matter. While it wasn't just overnight and was many years in the making, there was this element of cruelty, a survival of the fittest, seen in the victim blaming of street urchins with rickets in the early 20th century.

In 1966 there was an industrial disaster where a school was submerged in coal waste and 116 children died. The coal company offered £50 per child as compensation. There was a national outcry that marks the change in attitude and the compensation was increased tenfold to £500 (quite a lot back then). Did we see this in Flint with the polluted water, or in Ohio when that train derailed with all the chemicals?

There's something about having absolutely everything in the world and then pissing it all away in an enormous own goal of world wars that is extremely humbling and I'd like to think that plays a key part in the British psyche and I think its for the better.

My grandparents were the war generation I knew, having lived through the blitz, and all they wanted was to sit in the garden and have a nice cup of tea. They didn't want to be the best or were looking externally for validation. Just a nice sit down and a chin wag and I think that's a positive way to be, as opposed to what I imagine was the driving force of the Imperial era in always wanting more and trying to prove how "great" our nation should be. We proved how great we are in two of the most destructive wars in the world's history where the entirity of Europe lost. We suck.
by genewitch | 2026-01-23 01:52:52+00:00
i read the related parts of the linked file in the repo, and it took me a while to find your comment here again to reply to. Are you saying that the failure modes of claude with "coding" webapps or whatever OP was doing? i originally thought it might have meant like... jailbreak. But having read it, i assume you meant the former, as we both read the same thing and it seemed like a series of admonitions to the LLM, written by the LLM (with some spice added by OP? like "YOU ARE WRONG") and i couldn't find anything that would warrant a ban, you know?
by beached_whale | 2026-01-23 01:52:53+00:00
From the article: "Marc Prokosch, an attorney representing the family, said the family had an active asylum case and shared paperwork showing the father and son had arrived to the US at a port of entry, meaning an official crossing point. The family did everything they were supposed to in accordance with how the rules have been set out,” he said. “They did not come here illegally. They are not criminals.” He said there was no order of deportation against them and he believes the father and son have remained together in detention."

Sounds like they followed the rules and laws. Homeland Security calls everyone they detain illegal aliens but doesn't have to prove that either.
by Nextgrid | 2026-01-23 01:53:13+00:00
What's happening here is that Google wants to spy on which links you click and track your activity on that site by explicitly setting new cookies in the link's new tab from the URL params (re-bootstrapping a tracking cookie/etc to defeat opening it in an isolated tab or private browsing window), so they rewrite all links to point to their redirector endpoint.

Such an endpoint is vulnerable to "open redirect" exploits, where a redirect exploit on a trusted domain (google.com/youtube.com) is used to conceal a malicious link. The confirmation page is used to make the endpoint useless for such purposes.

But the confirmation page would be super annoying for normal users who intended to click the link, so there's a further mechanism where the redirector link has some ID that's also present in your cookies, so that as long as it is you who hits the redirector endpoint the confirmation page is bypassed - but if you try to use it in an "open redirect" attack your victim wouldn't have the matching cookie and thus would get the warning.

In their case they must be opening the link in a new context that doesn't share state (cookies/etc) with the old one (either deliberately or as a result of a privacy plug-in/feature) and so get the interstitial.
by tialaramex | 2026-01-23 01:53:18+00:00
I saw Baby Driver, which I really liked but I haven't seen any of the three movies since that.

The Cornetto trilogy are excellent. I'm a big fan of Three Colours (my favourite is White) and I think that actually in the same way that Kieślowski clearly doesn't care about the supposed theme, he just wants money to make movies, we can say the same for the Cornetto movies. We're bringing the commonalities to it in our interpretation, Wright didn't pour great effort into ensuring that these movies "work" as a trilogy, but they do if you squint, in the same way that Kieślowski didn't put great effort into relating his three films to the French flag but if you squint you can make it work fine.
by burntcaramel | 2026-01-23 01:53:41+00:00
WebAssembly Text Format (wat) is fine to use. You declare functions that run imperative code over primitive i32/i64/f32/f64 values, and write to a block of memory. Many algorithms are easy enough to port, and LLMs are pretty great at generating wat now.

I made Orb as a DSL over raw WebAssembly in Elixir. This gives you extract niceties like |> piping, macros so you can add language features like arenas or tuples, and reusability of code in modules (you can even publish to the package manager Hex). By manipulating the raw WebAssembly instructions it lets you compile to kilobytes instead of megabytes.
I’m tinkering on the project over at: https://github.com/RoyalIcing/Orb
by CompoundEyes | 2026-01-23 01:54:08+00:00
I’ve been having fun using Codex CLI to reverse engineer the Eventide H90 pedal’s serialized preset file format. Been chipping away at mapping all the parameters and quirks into markdown docs. Codex has been happily comparing bytes and requesting variations it needs to diff files to determine what caused a change. I can now ask “make me a vocal preset with an octave down, harmonic 3rd and a 5th up with with tight micro pitch doubling and then reverse delay in series” “Sure thing boss” File appears. So much music hardware has deep functionality hampered by terrible menu diving editing experiences.
by pc86 | 2026-01-23 01:54:47+00:00
I think your right the statement in and of itself doesn't imply any morality. My issue was with these two sentences in close proximity:

> 200 years ago slavery was more extended and accepted than today...Morality changes, what is right and wrong changes.

In the context of the comment that's replying to (arguing for an objective, and if I can read between the lines a bit, unchanging moral truth) even if it's not explicitly arguing that slavery 200 years ago was fine, it is at least arguing that under some specific mix of time and circumstance you could arrive in a situation where enslaving someone is morally just.
by xp84 | 2026-01-23 01:55:35+00:00
The reason is just that it would be more risky, I think. Compare the scenarios:

1. Scammer clones your credit card with a skimmer and pays for $500 of clothes at the mall. You dispute the charges. The funds are actually not given to the store for a bit given that credit transactions take a while to settle. Upon the dispute, the store now needs to prove that you were there and bought those clothes to get their $500, or else the bank/Visa won't pay them.

2. Scammer clones your debit card with a skimmer and pays for $500 of clothes at the mall. You dispute the charges. The store already got paid though. The bank doesn't want to give you another $500 in case you are actually in on the scam, then they'll be out an additional $500. Eventually assuming they can't prove you actually bought the clothes, I think the store would have the $500 confiscated, but usually you're still liable for $50 if you reported it quickly enough, but could be more if you take too long to report the fraud.

Of course debit cards can easily be converted to even easier-to-launder money substitutes, too.
by dragonwriter | 2026-01-23 01:56:25+00:00
> Almost noone is going to read some general warning about how it "may" execute code. At the very least, scan the project folder and mention what will be executed (if it contains anything).

I’m not sure this is possible or non-misleading at the time of granting trust because adding or updating extensions, or changing any content in the folder after trust is granted, can change what will be executed.
by burnt-resistor | 2026-01-23 01:56:28+00:00
More MAANG workforce-demoralizing round-after-round of layoffs because everyone else is doing it. Unionize and/or quit and form your own employee-owned co-op that is more stable, positive, and get closer to real customer needs.

This anti-pattern encourages the best talent to leave while making a shop more difficult to hire attract the best.

Cut once and cut deep, but these layoffs aren't about survival, they're about wage suppression, compliance, and emulation of others to raise profits in the short term.

Corporations aren't your friends.
by CWuestefeld | 2026-01-23 01:57:29+00:00
I'm wondering why the guy at Microsoft in charge of Windows is still employed.

Over the weekend my installation of Playnite (a catalog/launcher for my games) was broken by the update, until I moved its data off of OneDrive[1]. And I just figured out that a couple of icons on my desktop have become completely inert and unresponsive due to the same bug - again due to an interaction between the Windows Shell and OneDrive. And this one I can't fix, I can't shift my desktop out of OneDrive.

MS's strategy at this point is that Windows is a loss leader to get people onto the subscriptions for Office and OneDrive. So when the Windows team releases bugs that break usage of those services, forcing people off them onto alternative solutions, the guy in charge of those updates really needs to be answering some tough questions.

[1] I've now got SyncThing handling this.
by Rochus | 2026-01-23 01:57:31+00:00
> I knew they did it for their own pleasure.

The shepherd can afford to sing for hours because he has a job herding sheep. The modern musician, by contrast, is often told to "get a real job" so they can afford to make art (fortunately, I followed this advice twenty years ago and now only make music as a hobby). Your argument also implies that the "purest" form of music is one generated by people who have no choice but to work in the fields; it suggests that if musicians want to find "pleasure" in their art again, they should perhaps accept poverty and obscurity as the price of admission; ironically, that's the reality of a majority of musicians today.
by StoneAndSky | 2026-01-23 01:59:05+00:00
Agree with everything being said here.

However, it is no longer even remotely paranoid to be concerned that the current administration plans to do one or more of:

1. Put its thumb on the scale of future elections by flooding cities with paramilitary forces on election day,

2. Declare mail-in ballots illegitimate and seize them,

3. Seize voting machines before votes are fully counted.

I don't see an alternative to trying to figure out how to make online voting secure.
by JasonResearch | 2026-01-23 01:59:09+00:00
This repo contains reproducible tests of acceleration-domain normalization on galaxy dynamics using public data. The main focus is the SPARC disk galaxy sample, with a separate dwarf-galaxy analysis using the same logic.

I’m not proposing new forces or modified dynamics — just testing whether different normalization choices behave differently under stress. I tried to break the disk result via distance perturbations, alternate radius definitions, surface-brightness splits, and morphology binning.

I’d appreciate help determining whether the reduced scatter is trivial/circular given dataset construction, or whether it reflects a genuinely nontrivial regularity.
by caminante | 2026-01-23 01:59:09+00:00
This was discussed on HN in 2023 [0]. The hole high context v. low context model doesn't have scientific backing.

> The model of high-context and low-context cultures offers a popular framework in intercultural communication studies but has been criticized as lacking empirical validation

[0] https://en.wikipedia.org/wiki/High-context_and_low-context_c...
by marssaxman | 2026-01-23 01:59:39+00:00
I do the same - I use my debit card for everything, all the time. If I don't have the money to buy something, I'd rather just wait until I do; credit cards make it too easy to spend money faster than I earn it.

People who like to tell other people they shouldn't use debit cards often cite fears of fraud, but that's really never been a problem for me.
by xp84 | 2026-01-23 01:59:59+00:00
I suspect the play they're making is that putting millions of new Discover cards out there will be a tipping point, pressuring the remaining merchants who don't take it, as a play to break the Visa/MC duopoly.

This could be not that hard to pull off. American Express historically was less accepted because of their high fees, but I don't think Discover has or had that problem.
by tfvlrue | 2026-01-23 02:00:13+00:00
In case anyone else is curious, since this is something I was always confused about until I looked it up just now:

"Baud rate" refers to the symbol rate, that is the number of pulses of the analog signal per second. A signal that has two voltage states can convey two bits of information per symbol.

"Bit rate" refers to the amount of digital data conveyed. If there are two states per symbol, then the baud rate and bit rate are equivalent. 56K modems used 7 bits per symbol, so the bit rate was 7x the baud rate.
by mbil | 2026-01-23 02:01:06+00:00
thanks for sharing this, it resonates with me. as some other commenters have said, CLIs, cURL, and other shell tools are composable and discoverable. it seems like a good direction.

auth considerations are present in the design of MCP. this, as opposed to the hodgepodge auth story with CLIs. there are APIs that either don't support OAuth or where using bare credentials is more expedient, and using agent-visible env vars is a security incident waiting to happen. but that doesn't necessarily mean we must use MCP. i think it's a matter of time before agentic tools come bundled with a proxy layer from which secrets / env vars can be set and used but not directly read [0].

[0] https://www.joinformal.com/blog/using-proxies-to-hide-secret...
by thegrim000 | 2026-01-23 02:01:22+00:00
It's extremely common advice to not keep large sums of cash sitting in your checking account. With capital one (and others) you can just open a free savings account, keep the bulk in there (if you don't want to invest it instead), which earns an actual interest, and then there's never a "big" amount of vulnerable cash sitting in your checking account. There's also free/instant transfers between savings and checking when you need to move more into your checking.
Show HN: CleanAF – One-click Desktop cleaner for Windows
by Zemmouri | 2026-01-23 02:02:11+00:00
Hi HN,

I built CleanAF because my Windows Desktop kept turning into a dumping ground for downloads and screenshots.

CleanAF is a tiny one-click tool that:

keeps system icons intact

moves everything else into a timestamped “Current Desktop” folder

auto-sorts files by type

requires no install, no internet, no background service

It’s intentionally simple and does one thing only.

Source + download: https://github.com/TheZemmouri/CleanAF

I’m considering adding undo/restore, scheduling, and exclusion rules if people find it useful.

Feedback welcome.
by thomasfromcdnjs | 2026-01-23 02:03:15+00:00
I'm working on tpmjs.com the npm registry for ai tools (just the vercel ai sdk flavor atm)

which lets users create collections of any publicly available tool which let's us do awesome things

We can auto generate a skills.md for collections https://tpmjs.com/ajax/collections/unsandbox/skills.md (https://tpmjs.com/ajax/collections/unsandbox to see the collection)

We analyze all the tools source code to write the skills.md using LLM's and then we auto inject three different ways agents can iteract with them

- hosted mcp servers for collections automatically e.g. https://tpmjs.com/api/mcp/ajax/unsandbox/sse

- a cli tool that can invoke each tool in the collection e.g. tpm run --collection ajax/unsandbox --tool [tool-name] --args '{"key": "value"}'

- restful endpoints for direct execution of tools e.g. curl -X POST https://tpmjs.com/api/mcp/ajax/unsandbox/http

It's very much alpha, but after building this, I don't see why you can't let agents choose any method they want of interacting with your service.

It means your agents can use CLI, MCP or REST, only in one style or any style all at once.
by Incipient | 2026-01-23 02:03:41+00:00
But for large searches, I then have to spend a lot of time validating the output - which I'd normally do while reading the content etc as I searched (discarding dodgy websites etc).

On the other hand, where I think llms are going to excel, is you roll the dice, trust the output, and don't validate it. If it works out yayy you're ahead of everyone else that did bother to validate it.

I think this is how vibe coded apps are going to go. If the app blows up, shut down the company and start a new one.
by marssaxman | 2026-01-23 02:05:58+00:00
That has not been my experience at all. I've been using debit cards for all my everyday non-cash purchases for about thirty years now, and it's worked just fine. I expect to keep doing it indefinitely.

I have had exactly one encounter with fraud: a vindinctive ex-girlfriend stole my card info and had herself a little shopping spree, emptying my checking account. I walked into the credit union branch, filed a report, and walked out with $300 and a new card. All the stolen money was restored within a few days. It was not a big deal.