MurphyA/hacker-news huggingface dataset:
by iamnothere | 2026-01-27 20:52:27+00:00
Thanks, this would be helpful. I will follow on by recommending that you always make it a point to note how user freedom will be preserved, without using obfuscating corpo-speak or assuming that users don’t know what they want, when planning or releasing products. If you can maintain this approach then you should be able to maintain a good working relationship with the community. If you fight the community you will burn a lot of goodwill and will have to spend resources on PR. And there is only so much that PR can do!

Better security is good in theory, as long as the user maintains control and the security is on the user end. The last thing we need is required ID linked attestation for accessing websites or something similar.
by bijant | 2026-01-27 20:52:31+00:00
Yea excuse my autism its making me slower to adapt to a changing reality where diversity and inclusion has suddenly become irrelevant even in projects focused on issues pertaining to Linux governance and accessibility. I'm still mentally stuck in the early 2020s when every FOSS Project had BLM banners on their site pronouncing their "deep dedication" to female and minority empowerment and I thought after the last election cycle we'd now be back at the "equal opportunities" stage and hadn't regressed to the "females have periods and blacks look funny and having them in the office kills the bro-vibes and means you can only do racist and sexist jokes at home" stage yet... Obviously I was wrong and the only thing that matters is whether and what they have raised and at what valuation. It's also great that they are not doing that soft AI stuff but extremely erect hard crypto(graphy not the other kind) which is, needless to say, only possible with the manliest of male alpha-turing Chads.
by mothballed | 2026-01-27 20:52:39+00:00
They haven't for a long time, just that most of the time they were doing things we thought was for good (EPA, civil rights act, controlled substance act, etc) and we thereby entered a post-constitutional world to let that stuff slide by despite the 10th amendment limiting the federal powers to enumerated powers.

Eventually we got used to letting the feds slide on all the good things to the point everything was just operating on slick ice, and people like Trump just pushed it to the next logical step which is to also use the post-constitutional world to his own personal advantage and for gross tyranny against the populace.
by YeGoblynQueenne | 2026-01-27 20:52:44+00:00
I see, you don't know what I'm talking about. My apologies, I assumed a common background. Here's some introductory materials on Bayesian vs frequentist interpretations of probability:

Bayesian and frequentist reasoning in plain English

https://stats.stackexchange.com/questions/22/bayesian-and-fr...

Comparison of frequentist and Bayesian inference

https://ocw.mit.edu/courses/18-05-introduction-to-probabilit...

To Be a Frequentist or Bayesian? Five Positions in a Spectrum

https://hdsr.mitpress.mit.edu/pub/axvcupj4/release/1

Beyond Bayesians and Frequentists - Computer Science

https://cs.stanford.edu/~jsteinhardt/stats-essay.pdf

You'll find that it's a big subject with a long history and many strongly-held opinions that have nevertheless evolved over the years. Happy reading!
by khimaros | 2026-01-27 20:52:49+00:00
"SERA-32B is the first model in Ai2's Open Coding Agents series. It is a state-of-the-art open-source coding agent that achieves 49.5% on SWE-bench Verified, matching the performance of much larger models like Devstral-Small-2 (24B)" from https://huggingface.co/allenai/SERA-32B
by brooke2k | 2026-01-27 20:53:06+00:00
FWIW, Rider has very good support for keybindings - I can't vouch for vim bindings directly but their emacs keybinding scheme is brilliant, IMO it's the next closest thing to working from Emacs itself. So I'm guessing the vim bindings support is similarly fantastic.

I spent ages trying to get Emacs to work well with C# stuff, because I can't stand using IDEs that don't have some sort of emacs-style keybinding support, but eventually I bit the bullet and started using Rider and honestly it's been amazing and worked seamlessly with everything I've thrown at it (especially Godot). Highly recommended.
Show HN: SaecretHeaven – Zero-knowledge encrypted photo vault with IPFS backup
by blackknightdev | 2026-01-27 20:53:20+00:00
Hey HN,
I built SaecretHeaven because I was frustrated that every cloud photo service can see my images. Google scans for content, Apple has master keys, and most services store unencrypted.
SaecretHeaven is different:
• *True zero-knowledge*: Photos are encrypted client-side with XSalsa20-Poly1305 before upload. The server only sees encrypted blobs.
• *Decentralized storage*: Encrypted files go to IPFS with Pinata pinning across multiple EU nodes. No single point of failure.
• *Key anchoring*: Your 12-word recovery phrase derives your encryption key via Argon2id. We never see it.
• *Works offline*: Full PWA with local-first architecture. Desktop apps via Tauri.
Tech: Next.js 14, Better Auth, Supabase (metadata only), IPFS/Pinata
The beta opens Feb 3rd with 30 spots. Would love feedback from the HN community on the security model.
Site: https://saecretheaven.com
Happy to answer any questions about the architecture!
by OhMeadhbh | 2026-01-27 20:53:40+00:00
Couple of minor nits:

1. Some rando on X saying "OMG! I infiltrated a lefty signal group" doesn't mean said rando actually did infiltrate a signal group.

2. Signal was not the app Hegseth, et al. used. They used TM SGNL, which is a fork of Signal. But that's a minor nit.

3. Encryption is not the same thing as authentication. And authentication is somewhat meaningless if you let everyone into your encrypted group chat.
by engineer_22 | 2026-01-27 20:54:08+00:00
> Prism is free to use, and anyone with a ChatGPT account can start writing immediately.

Maybe it's cynical, but how does the old saying go? If the service is free, you are the product. The goal is to hoover up research before it goes public. Then they use it for training data. With enough training data they'll be able to rapidly identify breakthroughs and use that to pick stocks or send their agents to wrap up the IP or something.
by bri3d | 2026-01-27 20:54:09+00:00
> Before this point in time, Linux never supported being an immutable image.

What? As just one example, dm-verity was merged into the mainline kernel 13 years ago. I built immutable, verified Linux systems at least ten years ago, and it was considered old hat by the time I got there.

> The best you could do was, TiVoization, but that would be too obvious and won't fly.

What does this even mean? "TiVoization" is the slang for "you get a device that runs Linux, you get the GPL sources, but you can't flash your own image on the device because you don't own the keys." This is the exact same problem then as it was now and just as "obvious?"

I understand the fears that come from client attestation (certainly, the way it has been used on Android has been majorly detrimental to non-Google ROMs), but, to the Android point, the groundwork has always been there.

I'd be very annoyed if someone showed up and said "we're making a Linux-based browser attestation system that your bank is going to partner on," but nobody has even gone this direction on Windows yet.

> Oh, Rust is memory safe. Good luck finding holes.

I break secure boot systems for a living and I'd say _maybe_ half of the bugs I find relate to memory safety in a way Rust would fix. A lot of systems already use tools which provide very similar safety guarantees to Rust for single threaded code. Systems are definitely getting more secure and I do worry about impenetrable fortresses appearing in the near future, but making this argument kind of undermines credibility in this space IMO.
by eth0up | 2026-01-27 20:54:25+00:00
After over a decade of Debian, when I upgraded my PC, I tried every big systemd-based distro, including opensuse, which I wholly loathed. I finally decided on Void and feel at home as I did 20+ years ago when I began.

There are serious problems with the systemd paradigm, most of which I couldn't argue for or against. But at least in Void, I can remove network-manger altogether, use cron as I always have, and generally remain free to do as I please until eventually every package there is has systemd dependencies which seems frightfully plausible at this pace.

Void is as good as I could have wanted. If that ever goes, I guess it's either BSD or a cave somewhere.

I'm glad to see the terse questions here. They're well warranted.
by AlexCoventry | 2026-01-27 20:54:28+00:00
Yeah, this new trend of handing over all your keys to an AI and letting it rip looks like a horrific security nightmare, to me. I get that they're powerful tools, but they still have serious prompt-injection vulnerabilities. Not to mention that you're giving your model provider de facto access to your entire life and recorded thoughts.

Sam Altman was also recently encouraging people to give OpenAI models full access to their computing resources.
by raw_anon_1111 | 2026-01-27 20:54:32+00:00
I hate to tell you this - but you are completely wrong and you need to learn how to use modern tools to do your job.

Source: Professional software developer (or adjacent) for 30 years and I’ve worked in cloud architecture for 8 years working with both cloud architecture and software developer - at startup, then working at AWS directly and now a staff consultant at a third party firm.

I don’t “vibe code”. I keep my hands on the wheel and treat AI as a junior developer.

I know AWS (and before that on prem architecture). For infrastructure as code, I j know CloudFormation and have use it for 8 years.

I had a project that wanted to use the CDK. I gave ChatGPT the contract with the requirements, the transcript of my customer call where I went over the design proposal and the well labeled architecture diagram I did.

I told ChatGPT (didn’t use Codex) I needed Terraform for the architecture. I asked it for suggestions. I filled in a few blanks and just started copying and pasting the files to my IDE (yeah I know there is a better way. I am getting to that)

Here is where the little vibe coding comes in. Another guy wrote the web front end for the client. I don’t do web programming. I needed to remove the customer specific requirements so yeah, I just told Claude Code what I needed to do and it did it. I threw it on our internal GitHub account in case I needed it later as a generic reusable solution.

Ends up I could use it for my next project - but they wanted CloudFormation. I have certain patterns, helper scripts, shell scripts I use when doing CloudFormation deployments that I developed (and put through the open source process) at AWS.

I created a folder with both my Terraform based project and my CFT reference project and used Claude Code to convert one piece at the time).

On the software development side, on that same project, I designed the backend API how I wanted it to be exposed and the architecture. I’m not ashamed to admit I didn’t write a single line of code and it was all AI generated.

I did the customer facing work, the design, the architecture, delivery, etc. I stand by the architecture.
by Insanity | 2026-01-27 20:55:22+00:00
As an outsider as well, I think the damage done will be hard to reverse in just a decade. You lost trust of your closest allies. Even after the current presidential term, why would we (Europeans, Canadians, ..) invest in ties with the US, when the _next next_ president can be an entire shitshow again?

The American people have shown that they are okay voting for the same nationalistic rhetoric twice. If it was just once, maybe it's a fluke. Now it seems more like a pattern hinting at the mindset of ~50% of Americans.

Also, if I want to be really pessimistic, I'd look at history, at some point Roman turned on Roman (Caesar crossing the Rubicon) after years/decades of political turmoil. The things happening today in Minnesota etc could be preludes a similar Rubicon crossing moment that will shatter the republic..
by crystal_revenge | 2026-01-27 20:55:43+00:00
I'm never sure why people assume that Palantir is magically unlike the overwhelming majority of tech startups/companies I've worked at: vastly over promising what is possible to create hype and value while offering things engineering knows will never really quite work like they're advertised.

To your point, but on a larger scale, over hyping Palantir has the added benefit of providing a chilling effect on public resistance.

As a former government employee I had the same reaction to the Snowden leaks: sure the government might be collecting all of this (which I don't support), but I've never seen the government efficiently action on any data they have collected.

Incompetence might be the greatest safety we have against a true dystopia.
by duxup | 2026-01-27 20:55:50+00:00
No surprise. Trump and Co. were lying as soon as the news broke even while video showed otherwise.

https://np.reddit.com/r/Minneapolis/comments/1qlvpgy/better_...

Anyone who even accidentally gets in the way of the current administration is labeled a domestic terrorist… meanwhile their thugs are free to terrorize. https://np.reddit.com/r/Minneapolis/comments/1qoo7n5/ice_age...

Families and etc lined up for investigations and so on.

Meanwhile their leadership try to extort voter information. https://www.nytimes.com/2026/01/26/us/politics/minnesota-tru...

Nothing is honest about what the current administration says.
by afpx | 2026-01-27 20:56:23+00:00
I became entralled and hypnotised by 90s liberalism. Convinced that their ‘change’ would actually happen, I backed their candidates and media for 30 years waiting for a solution to even the lowest hanging fruit. Instead of getting any solution at all, I watched them rope in more rubes for ‘bigger and better issues’. The self-righteous, like the younger me, are so easily redirected.
by bijant | 2026-01-27 20:56:25+00:00
You'd probably best ask a stylist about that. I was pointing at a different issue. Historically (at least in the last decade or so) it became common best practice in such governance focused projects pushing systemic changes in large and diverse projects to aim for a minimum of inclusivity at least in "community / developer outreach" type roles and not to seed an office culture with only members of a single ethnicity and gender.
by teaearlgraycold | 2026-01-27 20:56:35+00:00
The hand-drawn diagram to LaTeX is a little embarrassing. If you load up Prism and create your first blank project you can see the image. It looks like it's actually a LaTeX rendering of a diagram rendered with a hand-dawn style and then overlayed on a very clean image of a napkin. So you've proven that you can go from a rasterized LaTeX diagram back to equivalent LaTeX code. Interesting but probably will not hold up when it meets real world use cases.
by OhMeadhbh | 2026-01-27 20:56:51+00:00
Meh. Palintir is optimized to sell data to the government. Said governments usually don't care about the quality of data about any one individual. Wear sunglasses when you go out and stay off facebook and it's amazing how little palintir signal you send up. Bonus points if you created an LLC to pay your utility bills. But... Palintir is not as good as you seem to be implying.
by nyc_data_geek | 2026-01-27 20:57:05+00:00
I'm not against generating more electricity, I am against generating unnecessary emissions using obsolete combustion based mechanisms, and I'd appreciate it if you didn't put words in my mouth.

The current administration is enforcing the use of these obsolete technologies, and the likes of Elon Musk are using things like gas turbines in clear contravention of the law in places like Tennessee to satisfy power demand for a thing no one really wants anyway, except the already wealthy who see it as an opportunity to eliminate labor costs and make everyone more pliable and stupid than they already are.

It's worth noting that the same people profiting off the current AI bubble, are the same people donating a lot of time and money to elect and maintain this regime. Have you never heard of the network state? It is rather late in the day to play the fool.

https://www.selc.org/press-release/musks-xai-explores-anothe...
by mikepurvis | 2026-01-27 20:57:51+00:00
I supported a non-earning spouse for a decade in Canada and it's always been a bit murky. Like in 2014-2015 there was a concept of transferring up to 50k of income to the spouse ("Family Tax Cut"), but Trudeau's Liberal gov't canceled it when they came into power; I think they correctly recognized that it was basically a handout to families privileged enough to be in a position where there was enough spread between the two earners that transferring that sum would be significant.

CRA is even pretty careful about letting a spouse claim capital gains income; it's always attributed back to whoever earned the original principal (outside of inheritance). I think the only way around this is to formally "loan" the spouse their investment money, but you have to charge them interest and the interest is of course income to you.
by tombert | 2026-01-27 20:58:15+00:00
Yeah, if you’re comparing it to macOS, then I would broadly agree that desktop Linux is less-ready.

I do think it has improved considerably, especially on AMD hardware, and I think it’s better than Windows at this point. macOS is arguably better, but Macs are considerably more pricey, so they can be a bit difficult to recommend to people.
by watermelon0 | 2026-01-27 20:58:53+00:00
> Traditionally, operating a Matrix homeserver has meant accepting a heavy operational burden. You aren't just installing software; you are becoming a system administrator. You have to provision virtual private servers (VPS), tune PostgreSQL for heavy write loads, manage Redis for caching, configure reverse proxies, and handle rotation for TLS certificates. It’s a stateful, heavy beast that demands to be fed time and money, whether you are sending one message a day or one million.

I have limited experience with Matrix, but you don't actually need Synapse (reference homeserver) which is quite a resource hog and not even remotely easy to setup/administer.

You can just use the lightweight Continuwuity homeserver for the Matrix part, and Caddy for the reverse proxy/TLS/ACME part, installed on a VPS. Both require minimal configuration, and provide packages for many Linux distributions, as well as Docker images.

(Continuwuity is a fork of conduwuit which was a fork of Conduit. Conduit was abandoned, but is now active again, and there are also other active forks as well. However, it seems to me that Continuwuity is currently the most active fork.)
by ActorNightly | 2026-01-27 20:59:05+00:00
Just to be more pedantic, there is more nuance to all of that.

Nobody smart is going to disagree that LLMs are a huge net positive. The finer argument is whether or not at this point you can just hand off coding to an LLM. People who say yes simply just haven't had enough experience with using LLMs to a large extent. The amount of time you have to spend prompt engineering the correct response is often the same amount of time it takes for you to write the correct code yourself.

And yes, you can put together AGENT.md files, mcp servers, and so on, but then it becomes a game of this. https://xkcd.com/1205/
Show HN: ML-Ralph – An autonomous agent loop for ML experimentation
by psoto | 2026-01-27 20:59:27+00:00
We adapted RALPH for ML workflows.

It runs experiments autonomously, forming hypotheses, training models, evaluating results, iterating on evidence.

W&B integration for long-running jobs. Full audit trail.

Tested on Kaggle Higgs Boson, hit top 30 in a few hours.

Still early, lots to improve. Would love feedback.

github.com/pentoai/ml-ralph
by input_sh | 2026-01-27 20:59:29+00:00
I'm just guessing, but this:

> and have posted my rough mixes [...] on my SoundCloud for more then ten years

...easily implies >3h of uploads, which is over the free plan limit. If you're over that limit and stop paying, yes, it makes perfect sense that they'd threaten with deletion of some of your existing uploads.
Show HN: I Wrapped the Zorks with an LLM
by alecf | 2026-01-27 20:59:49+00:00
I grew up on the Infocom games and when microsoft actually open-sourced Zork 1/2/3 I really wanted to figure out how to use LLMs to let you type whatever you want, I always found the amount language that the games "understood" to be so limiting - even if it was pretty state of the art at the time.

So I figured out how to wrap it with Tambo.. (and run the game engine in the browser) basically whatever you type gets "translated" into zork-speak and passed to the game - and then the LLM takes the game's output and optionally adds flavor. (the little ">_" button at the top exposes the actual game input)

What was a big surprise to me is multi-turn instructions - you can ask it to "Explore all the rooms in the house until you can't find any more" and it will plug away at the game for 10+ "turns" at a time... like Claude Code for Zork or something
by Miyamura80 | 2026-01-27 20:59:49+00:00
A prompt injection attack via GitHub issues that is close to invisible, even to experienced engineers, and visible to LLMs. Clawdbot is full of security holes and we're having fun. What are some workflows you / you've seen others use with clawdbot that seems ripe for jailbreaks? Please suggest below and we'll try jailbreak
by bhadass | 2026-01-27 21:00:03+00:00
hard to do "credit assignment", i think network effects go brrrrrr. karpathy tweeted about it, david sacks picked it up, macstories wrote it up. suddenly ppl were posting screenshots of their macmini setups on x and ppl got major FOMO watching their feeds. also peter steinberger tweets a lot and is prolific otherwise in terms posting about agentic coding (since he does it a lot)

its basically claude with hands, and self-hosting/open source are both a combo a lot of techies like. it also has a ton of integrations.

will it be important in 6 months? i dunno. i tried it briefly, but it burns tokens like a mofo so I turned it off. im also worried about security implications.
by jorvi | 2026-01-27 21:00:11+00:00
Again, that exploit factor is irrelevant now because WebUSB is blacklisted from accessing, among other things, HID class devices. So no site, even with permission, can access U2F devices over WebUSB. There is no special blacklist needed per vendor or anything.

You are right that it was a security hole in Chrome <67. Which is almost a decade in the past by now.
by spauldo | 2026-01-27 21:00:33+00:00
You're confusing two different things.

For most C and C++ software, you use the system packaging which uses libraries that (usually) have stable ABIs. If your program uses one of those problematic libraries, you might need to recompile your program when you update the library, but most of the time there's no problem.

For your company's custom mission critical application where you need total control of the dependencies, then yes you need to manage it yourself.
by Rperry2174 | 2026-01-27 21:00:42+00:00
This keeps repeating in different domains: we lower the cost of producing artifacts and the real bottleneck is evaluating them.

For developers, academics, editors, etc... in any review driven system the scarcity is around good human judgement not text volume. Ai doesn't remove that constraint and arguably puts more of a spotlight on the ability to separate the shit from the quality.

Unless review itself becomes cheaper or better, this just shifts work further downstream and disguising the change as "efficiency"