MurphyA/hacker-news huggingface dataset:
by linuxhackerman | 2026-01-14 09:22:20+00:00
As pointed out by evgpbfhnr, I do avoid using environment variables and justify it (though with different reasoning than yours).

Your justification is the kind of thing I mention as out-of-scope (for my purposes!) in my conclusion:

> There are also many bases that I don’t cover and routes through which sufficiently-smart malware could easily still obtain the secrets I’m working with.

/proc/$pid/environ, /proc/$pid/mem and other such vectors (ptrace, bpftrace, equivalents on other platforms) are real, but:

- they're not vectors of _accidental_ leakage like dumping the full process environment to logs or shell history are

- they rely on privileged access existing at the time that I'm handling the secret, while logs or shell history can be obtained _in the future_

- they're not the kind of thing I expect broad-spectrum malware to go rooting for: the memory of all processes is a lot of data to classify/exfiltrate, and if I were a malware author I'd fear that that would be far too resource-intensive and thus conspicuous. Browser cookie storage, password manager databases, keylogging, and the like are much easier and more valuable pickings.
Show HN: Visibility and Controls for Browser Agents (ContextFort YC S25)
by ashwinr2002 | 2026-01-14 09:22:42+00:00
Hey HN! I’m Ashwin, co-founder of ContextFort (https://contextfort.ai/). We provide visibility and controls for AI browser agents like Claude in Chrome through an open-source browser extension.

Browser agents are AI copilots that can autonomously navigate and take actions in your browser. They show up as standalone browsers (Comet, Atlas) or Chrome extensions (Claude).

They’re especially useful in sites where search/API connectors don’t work well, like searching through Google Groups threads for a bug fix or pulling invoices from BILL.com. Anthropic released Claude CoWork yesterday, and in their launch video, they showcased their browser-use chromium extension: https://www.youtube.com/watch?v=UAmKyyZ-b9E

But enterprise adoption is slow because of indirect prompt injection risks, about which Simon Willison has written in great detail in his blogs: https://simonwillison.net/2025/Aug/26/piloting-claude-for-ch.... And before security teams can decide on guardrails, they need to know how employees are using browser agents to understand where the risks are.

So, we reverse-engineered how the Claude in Chrome extension works and built a visibility layer that tracks agent sessions end-to-end. It detects when an AI agent takes control of the browser and records which pages it visited during a session and what it does on each page (what was clicked and where text was input).

On top of that, we’ve also added simple controls for security teams to act on based on what the visibility layer captures:

(1) Block specific actions on specific pages (e.g., prevent the agent from clicking “Submit” on email)

(2) Block risky cross-site flows in a single session (e.g., block navigation to Atlassian after interacting with StackOverflow), or apply a stricter policy and block bringing any external context to Atlassian entirely.

We demo all the above features here in this 2-minute YouTube video: https://www.youtube.com/watch?v=1YtEGVZKMeo

You can try our browser extension here: https://github.com/ContextFort-AI/ContextFort

Thrilled to share this with you and hear your comments!
by Muromec | 2026-01-14 09:23:10+00:00
>A decent engineer in the US could make 5x their equivalent in most European nations. Staff+ engineers at FAANG could make 5x that. People in a good position tend to not like rocking the boat.

So... 500k is the normal pay and 2.5mil is the staff+ pay, right? How many people you know actually make that?
by beingfit | 2026-01-14 09:23:11+00:00
I would, but for a different job just for sustenance. I don’t love my job, but it isn’t a total grind either. I’m working because it pays. I live in a developing country and would use a good chunk of the $10 million (if I had it) to get out to, preferably, an English speaking developed country (it’s not as easy even then). Nevertheless, I think this could be a life changing amount (positive or negative) for most people around the world.
by torginus | 2026-01-14 09:23:29+00:00
Embedded devices that go on the internet by (to update) themselves are an anti-pattern.

I run a bunch of stuff using Home Assistant via the Zigbee integration - the Zigbee host on the local server gets to decide where to install updates from - which was the security mechanism for most most software for most of history.

Get your stuff from a reputable source. Signage keys are nice, but they don't work as the sole security measure in an unsound supply chain.
by ashwinr2002 | 2026-01-14 09:23:32+00:00
P.S.: The extension has as many permissions as Claude in Chrome itself. But, the only network requests from the extension are to posthog, just for us to know which features are being used.

Here is a youtube video where I show the network requests of the extension: https://www.youtube.com/watch?v=J356Nquxmp4

To know what posthog collects and how to disable it (change in a single line of code), please refer to this file: https://github.com/ContextFort-AI/ContextFort/blob/main/POST...
by RamblingCTO | 2026-01-14 09:24:32+00:00
In this thread: people throwing shade on tech that works, comparing it to a perfect world and making weird assumptions like no tests, no E2E or manual testing just to make a case. Hot take: most SWEs produce shit code, be it by constraints of any kind or their own abilities. LLMs do the same but cost less and can move faster. If you know how to use it, code will be fine. Code is a commodity and a lot of people will be blindsided by that in the future. If your value proposition is translating requirements into code, I feel sorry for you. The output quality of the LLM depends on the abilities of the operator. And most SWEs lack the system thinking to be good here, in my experience.

As a fractional CTO and in my decade of being co-founder/CTO I saw a lot of people and codebases and most of it is just bad. You need to compare real life codebases and outputs of developers, not what people wished it would be like. And the reality is that most of it sucks and most SWEs are bad at their jobs.
by kentiko | 2026-01-14 09:24:41+00:00
The complexity of a can isn't as extreme as a disposable ARM chip, but it is still quite a sophisticated mass produced object.
https://www.youtube.com/watch?v=hUhisi2FBuw

Many daily life, single use objects have a lot of thoughts put into them:
https://www.youtube.com/watch?v=pj0ze8GnBKA
by vladvasiliu | 2026-01-14 09:25:57+00:00
Isn't this a bit like "paper" cups for coffee / water? We switched to these at work a few years ago, and it's an all-round horrible experience.

I swear every other one leaks right away, and those that don't can only be refilled once or twice before they do. So you end up going through like 10 of those a day. I also don't know how "eco-friendly" they actually are, since there's a picture of a dead turtle on them under a text to the effect of "don't throw out in nature".

I guess on the plus-side, our company at least provides ceramic cups to their internal employees. But since it's the employees' responsibility to clean them, not everybody is off the disposable cup train.
by mike_hearn | 2026-01-14 09:26:13+00:00
Cardiff University is extremely unlikely to be neutral, and a study done more than a decade ago tells us little about the state of the BBC today.

The OP gave many examples but you only need to know one: the BBC broadcast fake footage of Trump created by splicing together different parts of a speech he gave. The parts were separated by more than 50 minutes and they hid the splice by cutting to the crowd. This manipulation of the public only came to light because an internal whistleblower tried to report what happened, then discovered the BBC institutionally supported this kind of video manipulation so blowing the whistle internally was useless. He reported it to the Telegraph instead.

In other words:

• The BBC broadcasts fake news clips.

• It does so deliberately, with the full approval of its board.

• They refused to apologize or clean house.

• They probably do it a lot and get away with it.

That's it. That's the only thing you need to know about the BBC's political bias.

And it's not just them. Channel 4 News broadcast an entirely fake video of Farage during the last election. It framed him by using an actor who was collaborating with an undercover film crew (and the actor was acting at the time). This was proven beyond all doubt and C4 refused to do anything about it. Once again, institutional fraud in service of election manipulation.

There's no real gap between using actors or mid-sentence splices and using AI, special effects or other standard Hollywood tactics. So the idea that British TV news is biased in favour of the right is farcical on its face. Let us know when they're regularly faking videos of Starmer! I grew up in Britain and the state of Britain's institutions is just shameful. It's tin pot third world stuff. British people need to understand that their state owned TV channels are completely unreliable sources to learn about the world from.
by slow_typist | 2026-01-14 09:26:18+00:00
Some resources are still scarce. And a lot of those 6E24 kg is iron and nickel we can never get to. Another big fraction is basically molten stone. And we really should stop putting more carbon into the atmosphere.

Also, if you go for measures like mass processed, the weight of microchips, pcbs, parts is only a tiny fraction of what has to be processed and build in the supply chain.

Agreed that it is smarter to use oil for plastics then to burn it directly.
by rbanffy | 2026-01-14 09:27:01+00:00
> The point of the conference is not the official conference itself, but the meetings that happen around the conference.

In a lot of the corporate-sponsored conferences I go to - the networking and discussions happen around the talks - some talks are good, but they are not targeted towards the decision makers: the real discussions happen in the corridors, the meeting rooms, in the parties, the after-parties and, mostly, the after-after-parties.
by trusche | 2026-01-14 09:28:13+00:00
> manufacturing a sense of urgency, this is especially bad if you try to sustain this state all indefinitely

Sadly, I have seen this in almost every startup led by founders without an engineering background I've ever been a part of.

In my personal experience, this is often caused by overeager sales team promising the world for the next deal, only to fob it off to the engineering team who now "urgently" need to build "features" and "work hard" to make it happen. This is when your intrinsically motivated engineers start looking for the exit.
by theshrike79 | 2026-01-14 09:33:15+00:00
In Finland we have salary bands for some jobs, but it's usually just the minimum. Some have a maximum, but there are always "personal bonuses" the employer can give on top of that. But these are usually "old" professions like teachers, nurses, factory workers.

For IT jobs I haven't seen an official salary band anywhere and there basically is no union mandated maximum and the minimum is mostly a suggestion.

We also get universally negotiated percentage raises every now and then, but it's like 1-2%. Personal raises are on top of that and can be a LOT more.

The maximum cap sounds just stupid. When you hit the limit, why would you do anything past the absolute minimum to stay at that level?
by Xelbair | 2026-01-14 09:35:13+00:00
>made it work

More like made it dysfunctional - i live in EU btw

Laws are system made by people who live within that system - it is a part of resource distribution system. Lawmakers do work in their own interest, and so far the only way we found to make a system work for benefit of everyone is by putting those vested interests at odds - hence non-bipartisan democracy.

This is basically a game theory problem, and when faced with prisoner dilemma you're saying 'it would all work if everyone chose to cooperate' If your solution to political problem is 'if only everyone did X' you don't have a solution but wishful thinking. Sure this can happen, but it is not a stable system, not one that can be moved from place A to B.

You keep saying i have set mind about those issues - yet you refuse to address underlying logical assumption by saying that (non-distinct) X made it work, without even providing an example of working solution - i don't think it's me who's arguing in bad faith here.
by f1shy | 2026-01-14 09:35:37+00:00
Not so fast. Have you very carefully read the full small print of the insurance policy? Did you review that with a lawyer? Is incredible how different "normal" people vs. lawyers can understand a contract.

I'm pretty sure there is a clause, which states that you have to inform if you have and/or are not allowed to have fire loads, or anything that could cause a fire, or make it worse, or something along the lines in legalese. These formulations are always there because of people hoarding fuel in the basement, for example, or O2 Tank, or whatever. They are formulated in the most generic way possible to catch anything you do "wrong". Failing to follow such clauses, also when not explicitly stated, is dropping your obligations in the contract. And then there will be a clause that of course says, that not following the contract from your side, also exempts the company of paying.

Note also there are clauses that are very softly specified, like "use rooms for the intended purpose" which may be a problem if you store idk, paint in the garage, which may be flammable, in which case a fire in the garage will not be (at least fully) covered.

Ask me how I know...
by kmm | 2026-01-14 09:35:49+00:00
In that case following Alice's input is still the best strategy, but you'll be worse off: you'd only be right if both tell the truth, at 80%80%=64%, or both lie, at 20%20%=4%, for a total of 68%.

In the general case of n intermediate occasional liars, the odds of the final result being accurate goes to 50% as n grows large, which makes sense, as it will have no correlation anymore to the initial input.
by asmor | 2026-01-14 09:36:10+00:00
I remember a time when the v3 API didn't even have IDs and whenever someone in your org changed their username or renamed a repo you'd be left guessing who it is.

This is also the reason I wrote our current user onboarding / repo management code from scratch, because the terraform provider sucks and without any management you'll have a wave of "x got offboarded but they were the only admin on this repo" requests. Every repo is owned by a team. Access is only ever per-team.
by smokel | 2026-01-14 09:36:22+00:00
One of the more inspired design choices of the parking ticket devices in my area is the inclusion of a key repeat feature.

If you keep your finger on the touchscreen for just long enough, it helpfully repeats the keystroke while you're entering a license plate.

Given the inevitable hardware issues, this means that what should be a single tap frequently becomes a burst of identical characters.

The programmers who worked on this probably would've liked to be game developers instead.
by pjmlp | 2026-01-14 09:37:30+00:00
The way many of us get work assignments is:

- Have to deploy product XYZ (because we don't write everything from scratch)

- Need to extend said product

- Use one of the official SDKs, because we aren't yak shaving for new platforms

Thus that is how we end up using the languages we kind of complain about.

To be fair, languages like Elixir and Gleam do exist, because too many complain about Erlang, which me with my Prolog background see no issues with.
by sublinear | 2026-01-14 09:37:32+00:00
I think the concern expressed as "impossible" is whether it can ever do those things "flawlessly" because that's what we actually need from its output. Otherwise a more experienced human is forced to do double work figuring out where it's wrong and then fixing it.

This is not a lofty goal. It's what we always expect from a competent human regardless of the number of passes it takes them. This is not what we get from LLMs in the same amount time it takes a human to do the work unassisted. If it's impossible then there is no amount of time that would ever get this result from this type of AI. This matters because it means the human is forced to still be in the loop, not saving time, and forced to work harder than just not using it.

I don't mean "flawless" in the sense that there cannot be improvements. I mean that the result should be what was expected for all possible inputs, and when inspected for bugs there are reasonable and subtle technical misunderstandings at the root of them (true bugs that are possibly undocumented or undefined behavior) and not a mess of additional linguistic ones or misuse. This is the stronger definition of what people mean by "hallucination", and it is absolutely not fixed and there has been no progress made on it either. No amount of prompting or prayer can work around it.

This game of AI whack-a-mole really is a waste of time in so many cases. I would not bet on statistical models being anything more than what they are.
by boston_clone | 2026-01-14 09:37:51+00:00
it seems as though you’re reaching extraordinarily far back in time to apply a definition that simply doesn’t exist anymore. hell, the time period you’re referencing (…80 years ago!) is when “gay” still meant “happy”.

obviously, you’re free to use whatever words you like, but your clinging to outdated terminology and being perpetually misunderstood is not a failure of other people.
by account42 | 2026-01-14 09:37:55+00:00
> Nah, he continued to grift off the right wing while saying more and more unhinged shit until he shuffled off this mortal coil.

Someone who makes their living from their art adjusts it to the preferences of the remaining customer base. And levying hate at someone makes them like you and those you represent less. This is neither surprising nor is it a valid post-hoc justification for the original outrage at a perfectly moral statement.

> Could it perhaps have anything to do with the fact that that's a 4chan-originated dogwhistle that was hyper-viral at the time?

All that means is that everyone else is either racist against white people or too much of a coward to speak out of the racism of their peers. It doesn't make the statement worse or any less correct. Maybe instead of cancelling people for stating reasonable opinions that other people you hate also say, think hard about why you and your friends are not willing to say those things. Do you care more about your making statements in accordance with your morals or more about not being seen as part of the wrong tribe?

> The president of the most powerful country on earth and the richest man in the world say things like that all the time. Why the victim complex?

Even if that was true, it doesn't change the fact that the woke crowd objects to that while being fine with essentially the same statement levied against whites.
by andyjohnson0 | 2026-01-14 09:37:56+00:00
I generally agree with your post, but:

> But at an art gallery, Picasso is near worshipped despite his torrid misogyny and abuse in his personal life which was terrible even by the standards of his day.

Picasso's work is the thing that is generally venerated, not so much the (rather loathsome) man himself. Similarly for Eric Gill, who produced great artistic work despite being an truly awful human being.

Scott Adams seems to have confined himself to merely expressing prejudiced views, amplified somewhat by his modest fame. But then his creative work doesn't in any way match Picasso's or Gill's either.
by sofixa | 2026-01-14 09:38:30+00:00
You can run vLLM with AMD GPUs supported by ROCm: https://rocm.docs.amd.com/en/latest/how-to/rocm-for-ai/infer...

However from experience with an AMD Strix Halo, a couple of caveats: it's drastically slower than Ollama (tested over a few weeks, always using the official AMD vLLM nightly releases), and not all GPUs were supported for all models (but that has been fixed).
by JP44 | 2026-01-14 09:38:57+00:00
Mostly because I learn the best by doing, reiterating and then expanding, especially with programming. Essentialy, building a form of context or mindmap if you will.

When I was testing Typescript/React I followed the docs and some guides and got thrown in the deep end, I could follow and understand the steps but not reproduce or adapt them because the (or my) scope was limited, also, libraries; so many libraries used..

By starting with a HelloWorld and expanding it step by step, going back and forth. Using forums/blogs to see available functions or similar oss projects for what I wanted to do, then use the docs to read about the used functions.

Kagi already helped save me a lot of time by reducing spam posts and using language shebangs etc. With Claude I either give a snippet that I cannot translate or am stuck on, like you do, or I'll prompt something like: 'describe steps used to get from input=.. to output=.. in go, this/that needs to be done/transformed, do not output actual code'.

I guess the main thing is that I want to be engaged in my personal/hobby projects and think about the problem and solution and not just copy/paste because that takes the fun away (in case of work, if it makes me more productive I'll take it. Just need to remember I'm the one who is responsible). It's like buying a pre-assembled puzzle.
by catlifeonmars | 2026-01-14 09:40:07+00:00
I’m not so much worried about a malicious agent, more so a confused deputy if that makes sense. The agent itself seems like a juicy RCE vector with a larger surface area than an unpatched binary. And think of all the side channels for delivering your exploits. You don’t need to bake into an executable payload, probably well crafted wording in a README.

Like you say, there’s a larger attack surface area for kernel vs hyper visor. If it’s easy to do, why wouldn’t you take advantage of the extra isolation of a VM?

It’s 2026 and microVMs are a thing. The DevX gap between VMs and containers is shrinking.
by setopt | 2026-01-14 09:40:34+00:00
Depends, it’s hard to make a blanket statement like that. Recycled steel and aluminum for example is absolutely not a scam. But for plastics, I agree that waste incineration is mostly a better solution than recycling (which produces low-quality plastics with some risk of unhealthy contaminants in the few cases that it’s not actually a scam).
by troupo | 2026-01-14 09:41:49+00:00
> operating under pseudonyms, the tracks are commissioned with the intent to reduce the company’s royalty payouts to artists, per Pelly.

As I already wrote elsewhere, no one, including the article's own authors, understood a single thing from the article.

Spotify doesn't produce its own music. It licenses 100% of its music from external distributors. Apart from a few scammy companies there are dozens of companies whose entire repertoire and catalog is ambient/background/noise/elevator/shopping mall music etc. that they commission from ghost composers.

There is literally money being paid to distributors for these tracks. To quote the original article you didn't even read, this one: https://harpers.org/archive/2025/01/the-ghosts-in-the-machin...

--- start quote ---

Epidemic’s selling point is that the music is royalty-free for its own subscribers, but it does collect royalties from streaming services; these it splits with artists fifty-fifty.

--- end quote ---

Wait, what about "no royalties" crap? Oh, all of that is just "per Pelly". Though I'll admit that there are probably companies that license music for a flat fee (though I assume those would be rare).

Also note: Spotify doesn't pay artists. Spotify doesn't have direct contracts with artists. Spotify pays distributors and rights holders. And then those, in turn, pay royalties based on their contracts with artists. (According to one of the ghost artists interviewed, he is paid significantly more than he would be if he was trying to release music himself, BTW).