MurphyA/hacker-news huggingface dataset:
by bluesnowmonkey | 2026-02-21 22:34:21+00:00
Agreed. People aren’t ready for this, even (maybe especially) on HN.

Everyone’s hung up on how nobody really does waterfall. Or course. But a LOT of people are vibing their code and making PRs and then getting buried in code reviews. Just like the article says, you can’t keep up that way. Obviously. Only agents can review code as fast as agents write it. But I find as of recently that agents review code better than people now, just like how they write it better. Gotta lean into it!
by nosefurhairdo | 2026-02-21 22:34:41+00:00
React + ReactDOM adds ~50kb to a production bundle, not even close to a couple of mbs. React with any popular routing library also makes it trivial to lazy load js per route, so even with a huge application your initial js payload stays small. I ship React apps with a total prod bundle size of ~5mb, but on initial load only require ~100kb.

The idea that React is inherently slow is totally ignorant. I'm sympathetic to the argument that many apps built with React are slow (though I've not seen data to back this up), or that you as a developer don't enjoy writing React, but it's a perfectly fine choice for writing performant web UI if you're even remotely competent at frontend development.
by carb | 2026-02-21 22:35:21+00:00
Sorry, meant say that Blacksky is much more important than the metrics you point to, with more detail on that wiki.

They're the first alternative full stack, the first alternative AppView, and that is something that the author should have mentioned. However, it weakens the argument so they left it out.

"Number of contributors" has never meant impact. You wouldn't dismiss openssl or curl, ya know?
by skeeter2020 | 2026-02-21 22:37:34+00:00
This author plays fast and loose by comparing the broad, long-term overview of a waterfall project with a dumbed-down close-up of an iterative methodology. Just because you put a bunch of opinions, or at best naive (and wrong) interpretations into clean diagrams doesn't make them right.

There's no such thing as "AI-native engineers"; it's still developers who use AI and non-developers who use AI. Why you'd want to be in second group is beyond me.
by rapnie | 2026-02-21 22:38:10+00:00
You can also search for "make invalid states impossible/unrepresentable" [0] to find more info on related practices. See "domain modeling made functional" [0] as a nice example

[0] https://geeklaunch.io/blog/make-invalid-states-unrepresentab...

[1] https://www.youtube.com/watch?v=2JB1_e5wZmU
by __tnm | 2026-02-21 22:38:59+00:00
yeah i sandbagged the size just a little to start (small enough to fit on the c3, 888 picked for good luck & prosperity; I even have a build that pads to get 888 exactly), so i can now try reduce some of it as an exercise etc.

but 100kb you’re not gonna see :) this has WiFi, tls, etc. doom didn’t need those
by Klonoar | 2026-02-21 22:39:03+00:00
I feel like a lot of the comments here are from people who either weren't around for, or didn't grow up in, the era where adactio and the wider web dev scene (Zeldman, etc) were the driving force of things on the web.

If you've only been in a world with React & co, you will probably have a more difficult time understanding the point they're contrasting against.

(I'm not even saying that they're right)
by wvenable | 2026-02-21 22:40:12+00:00
> to know how a specific ORM composes queries targetting a specific database backend, however, is where the magic falls apart

I've never found this to be a particular problem. Most ORMs are actually quite predictable. I've seen how my ORM constructs constructs queries for my database and it's pretty ugly but also it's actually also totally good. I've never really gained any insight that way.

But the sheer amount of time effort I've saved by using an ORM to basically do the same boring load/save pattern over and over is immeasurable. I can even imagine going back and doing that manually -- what a waste of time, effort, and experience that would be.
by dudeinhawaii | 2026-02-21 22:40:27+00:00
After 2 days of giving it a go, I find that Gemini CLI is still considerably worse than both Codex and Claude Code.

The model itself also has strange behaviors that seem like it gets randomly replaced with Gemini-3-Flash or something else. I'll explain.

Once agentic coding was a bust, I gave it a run as a daily driver for AI assistant. It performed fairly well but then began behaving strangely. It would lose context mid conversation. For instance, I said "In san francisco I'm looking for XYZ". Two turns later I'm asking about food and it gives me suggestions all over the world.

Another time, I asked it about the likelihood of the pending east coast winter storm of affecting my flight. I gave it all the details (flight, stops, time, cities).

Both GPT-5.2 and Claude crunched and came back with high quality estimations and rationale. Gemini 3.1 Pro... 5 times, returned a weather forecast widget for either the layover or final destination. This was on "Pro" reasoning, the highest exposed on the Gemini App/WebApp. I've always suspected Google swaps out models randomly so this.. wasn't surprising.

I then asked Gemini 3.1 Pro via the API and it returned a response similar to Claude and GPT-5.2 -- carefully considering all factors.

This tells me that a Google AI Ultra subscription gives me a sub-par coding agent which often swaps in Flash models, a sub-par web/app AI experience that also isn't using the advertised SOTA models, and a bunch of preview apps for video gen, audio gen (crashed every time I attempted), and world gen (Genie was interesting but a toy).

This will be a quick cancel as soon as the intro rate is done.

It's like Google doesn't ACTUALLY want to be the leader in AI or serve people their best models. They want to generate hype around benchmarks and then nerf the model and go silent.

Gemini 3 Pro Preview went from exceptional in the first month to mediocre and then out of my rotation within a month.
by mberning | 2026-02-21 22:40:50+00:00
They also realize that adding two integers in a higher level language could look quite different when compiled depending on the target hardware, but they still understand what is happening. Contrast that with your average llm user asking it to write a parser or http client from scratch. They have no idea how either of those things work nor do they have any chance at all of constructing one on their own.
by perrygeo | 2026-02-21 22:41:02+00:00
I agree. I think this is the LLM superpower: making quick prototypes that allow us to speak concretely about technical tradeoffs.

My comment was pointed at people who use AI specifically with the goal of making anything easier and faster. Doesn't matter what it is. "Faster and easier is better". as though doing more of the same shit are primary goals in themselves.

If you're using AI to explore better technical decisions, you're doing it right! AI can be a catalyst for engineering and science. But not if we treat it like a mere productivity tool. The quality of the thing enabled by the AI very much matters.
by daem | 2026-02-21 22:41:15+00:00
I want my agent to read my iMessages so I granted the OpenClaw node process permission to interact with iMessage. I asked my agent to draft me a response to a text I received, expecting it to send me the draft so I could copy-paste into iMessage and tweak it.

To my surprise, it sent a text message reply.

I've since learned my lesson and implemented a skill as an interface with iMessage. But it definitely spooked me when it happened.
by nandomrumber | 2026-02-21 22:41:49+00:00
There is a great way to store, transport, and use hydrogen:

Bind it to various length carbon chains.

When burned as an energy source the two main by products are carbon dioxide which is a plant growth nutrient, and water which is also essential to plant growth.

Environmentalists will love it!

And they can prise my turbo diesels engines from my cold dead hands.
by brk | 2026-02-21 22:41:59+00:00
Sources are primarily boating forums, dockside conversations, etc.

In theory your boat in right in the sweet spot of recommended power range at 60HP. I don't know all the background on it, so all kinds of potential problems, but I would wager that "propped wrong" is unlikely to be the core culprit.

I'd start by getting it weighed and comparing your loaded weight to manufacturer specs. USCG requires positive buoyancy for hulls under 20'. This is typically achieved with using expanding foam in hull cavities, and that foam can have a tendency to absorb and hold water if the boat develops any failure of the seals around the bilge areas that are foamed. Reports of poor performance are very common for these sub 20' hulls because of waterlogging. If not a waterlogged hull, you might also just have too much stuff on-board.

To a lesser degree, a bimini can also have an adverse affect on speed/planing, if it's acting like a parachute. Not sure if you have a bimini, but if so it's worth trying a run with it up vs. down.

I'd also look at how your outboard is mounted. It's not clear if it the outboard from the factory, or if the boat has been repowered. Outboards being too high, too low, etc. are pretty common issues that can also majorly impact performance.

That's a few thoughts that comes to mind off-hand.
by hutao | 2026-02-21 22:43:29+00:00
The phrasing that I hear more often is "make illegal states unrepresentable"; both the submitted article and Alexis King's original article use this phrase. At least according to https://fsharpforfunandprofit.com/posts/designing-with-types..., it originates from Yaron Minsky (a programmer at Jane Street who is prominent in the OCaml community).

EDIT: Parent comment was edited to amend the "impossible/unrepresentable" wording
by cmurf | 2026-02-21 22:43:58+00:00
>Why would someone let an elected official enrich themselves and their friends with your money? Why would the legislative branch allow that?

Republicans in Congress were elected expressly to allow Trump to do as he wishes.

>A populace with a functioning representative democracy deserves its leaders.

Yes. Despite Trump himself being a fascist, the government continues to operate as a representative democracy. Most Congresscritters have their thumbs up their asses waiting for things to get much worse, which mirrors the vast majority of voters.

Is it national apathy? Decadence? Addiction to the drama, anger and depravity of Trump TV?

Elect an abuser, get abused. Is this surprising?
by Jenk | 2026-02-21 22:44:14+00:00
> In the 20 years I've worked in software. I've never even seen a shop that works this way. From 20 person teams to 10,000 employee companies. Maybe I've been lucky. but to me it reads as a straw man. Something to punch against that doesn't really exist

30 years ago it was the norm. It really is true that the industry (standard) has shifted a lot in that time.

But I work at a place like this right now. I was hired by the new CTO to help them change this, having spent the previous 20 years actively avoiding places just like this.

Project-based planning by a roomful of not-technical people: Funding, scope, design, shape of team, deadlines, tech stacks, vendors etc. all "locked in" before any engineer is even approached, let alone asked for input.

I cannot overstate how uncanny it feels to be working here - like I have actually time travelled back to the 90s.
by senfiaj | 2026-02-21 22:45:19+00:00
I don't belong to both "AI has replaced engineers" and "AI will never replace engineers" camps. But for now, AI is far from replacing SWEs and development processes, especially for complex software (that has many complicated specifics, such as deployment, migration, specification, code conventions, domain knowledge etc).

Yes, nowadays AI is really powerful, our company even encourages us to use it for generating some code / documentation or reviewing your own code / documentation. In recent years several IDEs are integrating it. But it's not a panacea and has its limitations. Still, it has to be supervised, the generated code should still be reviewed and corrected. You should view AI as more like an "IDE autocompletion on steroids". You need to understand the difference between a vibe coder and a normal developer who enhances his productivity by AI.

Currently AI hasn't enough autonomy for fully replacing SWEs and development processes (yet). Full stop. The article might become correct in 20 years I guess.
by thaumasiotes | 2026-02-21 22:45:34+00:00
> it was the same for me, the language feels very different by 1300.

The language in section 1300 isn't much different from section 1400. Almost all of it is still good English today if you give the words their modern spelling:

Then after much time spoke the Master, and his words were cold as winter is. His voice was as the crying of ravens, sharp and shrill, and all that heard him were adread and durst not speak.

"I deem¹ thee to the death, stranger. Here shalt thou die, far from thy kin and far from thine own land, and none shall know thy name, nor none shall thee beweep."

And I said to him, with what boldness I might gather, "Why farest thou with me thus? What trespass have I wrought against thee, that thou deemst¹ me so hard a doom?"

"[Swie!]"² quoth he, and smote me with his hand, so that I fell to the earth. And the blood ran down from my mouth.

And I [swied],² for the great dread that was come upon me was more than I might bear. My heart became as stone, and my limbs were heavy as lead, and I []³ might no more stand nor speak.

The evil man laughed, when that he saw my pain, and it was a cruel laughter, without mercy or pity as of a man that hath no [rewthe]⁴ in his heart.

Alas! I should never have come to this town of Wolvesfleet! Cursed be the day and cursed be the hour that I first set foot therein!

¹ We still have this word in modern English, but the meaning is different.

² No idea what this word is.

³ I assume the ne in the text here is required by some kind of grammatical negative agreement with the rest of the clause. In more modern (but still fairly archaic) English, nothing goes here. In actual modern-day English, the grammar of this clause isn't really available for use, but it's intelligible.

⁴ This turns out to be the element ruth in ruthless, and a man with no ruth in his heart is one who is literally ruthless, without "ruth". It literally means "regret", but the use in the text clearly matches the metaphorical sense of the modern word ruthless.
by FergusArgyll | 2026-02-21 22:45:37+00:00
> Are there any examples of people/companies trusting degenerate gamblers on prediction markets and making real life-changing decisions?

If "real life-changing decisions" includes deciding to take a flight based on polymarket placing a low price on war breaking out, then yes.

I'd also challenge you to outperform "Degenerate gamblers"
by dataviz1000 | 2026-02-21 22:45:45+00:00
Copilot in vscode is a fucking nightmare!

After spending $450 in January for the nightmare, I switched to $200 month subscription using the Claude Code plugin which I assume is a wrapper around the Claude Code cli -- 1000% better.

The trillion dollar company seriously needs to start dumping upper and mid management! You can quote me on that.
by skeeter2020 | 2026-02-21 22:46:08+00:00
THIS is what makes me so mad: the best software developers are really good at evaluating new technologies, they see where they work best and where they are not a good fit. They're curious, excited, love to share but keep a healthy skepticism and really want to understand. They are balanced and look for the nuance. They've now been told by their bosses & CTOs that this is not good enough; dive in head-first without looking or find a new job (no, this is not hyperbole). That monster weight on one end of the see-saw keeps pushing me and others towards the other end to balance it, but I don't belong there and I'm not a Luddite. I want to straddle the middle and shift my weight back and forth as appropriate and the pro-AI army keeps pushing me away. It drives me bonkers.
by fragmede | 2026-02-21 22:46:29+00:00
Not in any great detail. Gold vs ld isn't something I bet most programmers know rigorously, and thats fine! Compilers aren't deterministic, but we don't care because they're deterministic enough. Debian started a reproducible computing project in 2013 and, thirteen years later, we can maybe have that happen if you set everything up juuuuuust right.
by TrnsltLife | 2026-02-21 22:47:08+00:00
My grandparents had my parents. My parents had me. I had my children. Hopefully they will have theirs.

Even if we can't remember, we know they were there. They succeeded in carrying on the species. We can wonder about them and what their lives were like.

"Lo, now, do I see my fathers and my fathers' fathers back to the beginning!"

"I go now to join my fathers, in whose mighty company I shall no longer feel ashamed."
by chongli | 2026-02-21 22:47:43+00:00
That's assuming the hydrogen is just loose in the area, like it'd been released from a balloon in a chemistry classroom. That amount of hydrogen is extremely small, from an energy standpoint. Equivalent to a teaspoon of gasoline or so.

If you assume a realistic fuel capacity for a hydrogen vehicle, the hydrogen tank will be both much larger than a gas tank and the hydrogen will be under extreme pressure. A tank like that in your car would be extremely dangerous even if it were filled only with inert gas.
by simondotau | 2026-02-21 22:49:38+00:00
Being rude isn't helpful. It's not their fault, it's the unavoidable reality of treating complex social signalling as one-dimensional. At minimum Hacker News would need to separate approval/disapproval signals from assessments of whether a comment is constructive. That’s not a simple change given the obvious abuse vectors. It would require a penalty mechanism, which in turn depends on reliably distinguishing good-faith participants from bad actors.
by raw_anon_1111 | 2026-02-21 22:49:42+00:00
You can’t overcome human nature. Why wouldn’t I verify any junior that asked me? That’s just like I’m never going to give someone a bad reference

How are you going to prove they did it? And in the age of AI, I expect developers to use AI to code.

That gets back to why a system like this is worthless, statistics are that people only spend 6 seconds on a resume before they decide to interview a candidate, they definitely aren’t going to take time to look at a resume. They are definitely not going to look at a GitHub profile or a third party site.

I have an anecdote from both sides.

When I left Amazon in 2023, I interviewed for a position as an architect for a company where I would be responsible for leading the integration of all the companies they acquired. I was interviewing with the director and he did his standard spiel about what the company does and some of the architecture.

I knew he hadn’t looked at my resume then. I was the architect for one of their most recent acquisitions and he was explaining the system I designed and that was clear on my resume. I had left the company to work for AWS in 2020 and I was referred by a former manager that was still there.

On my side, I never look at resumes, I don’t really care what technology you know. AI can write code and you can learn new technology. I want to know how you think through problems, how you learn, how you adapt and how you troubleshoot.

I go into every interview purposefully blind.
by ms_sv | 2026-02-21 22:50:06+00:00
That is very interesting, it is like a starting filter for candidates which can catch candidates that might not be a fit for the job after all. Basically the candidate was lacking the discipline and patience to be able to handle paperwork and administrative duties to even start doing the job. Got me thinking how would it be possible to catch something like this before it happens, would be a very big challenge

So it all boils down to, handle the administrative challenge first, then make the boss happy and not make his life harder as well as everyone on the team and lastly for promotion simply be efficient, I like this framework it works so well.

I think these all work for any industry, since defense is a bit stricter then there is a higher chance to avoid a bad hire.
by hu3 | 2026-02-21 22:51:37+00:00
Not my experience. What doesn't work for you?

I use Opus 4.6 (for complex refactoring), Gemini 3.1 Pro (for html/css/web stuff) and GPT Codex 5.3 (workhorse, replaced Sonnet for me) mostly on it.

For small tools. But also for large projects.

Current projects are:

1) .NET C#, Angular Oracle database. Around 300k LoC.

2) Full stack TypeScript with Hono on backend, React on frontend glued by trpc, kysely and PostgreSQL. Around 120k LoC.

Works well in both. I'm using plan mode and agent mode.

My only complain is that it tends to get stutters after many sessions/hours. A restart fixes it.

$39/mo plan.
by bstsb | 2026-02-21 22:54:16+00:00
caveat not properly addressed in the blog post: all "attacks" are assuming full takeover of web servers, which is certainly a scenario that should be protected against, but isn't really a vulnerability unless chained with something else.

almost all online services would be "vulnerable" in this way - take almost any login system. an RCE on a system hosting a login page would obviously be vulnerable to account takeover

better link here (the technical details): https://zkae.io/
by kenniskrag | 2026-02-21 22:54:51+00:00
> Much like the other products we analyse, 1Password lacks
authentication of public keys. This trivially enables sharing
attacks similar to BW09, LP07 and DL02, something that the
1Password whitepaper...

> IMPACT. Complete compromise of vault confidentiality and
integrity. The adversary can read and decrypt all vault con-
tents encrypted after the attack, including passwords, credit
card information, secure notes, and other sensitive data stored
in the vault. Similarly, they can inject new items into the vault
after the attack.
REQUIREMENTS. The client fetches key material from the
server, for example due to the user logging in on a new device.
If executed on a non-empty vault, the attack results in the
client losing access to all items already in their vault, while
leaking any new items added to the vault after the attack took
place. If the attack is executed at the time of vault creation,
the attack is effectively undetectable by the client, since it
cannot distinguish between a ciphertext it created and the
ciphertext created by the server during the attack.
PROPOSED MITIGATION. A straightforward mitigation is to
have the client sign vault keys using the RSA private key in
the keyset before encrypting them with the RSA public key.
Ideally, two different key pairs would be used for...

from the paper: https://eprint.iacr.org/2026/058.pdf
by Mogzol | 2026-02-21 22:55:14+00:00
The "magic" of React though is in its name, it's reactive. If all you're doing is creating static elements that don't need to react to changes in state then yeah, React is overkill. But when you have complex state and need all your elements to update as that state changes, then the benefits of React (or similar frameworks) become more apparent. Of course it's all still possible in vanilla JS, but it starts to become a mess of event handlers and DOM updates and the React equivalent starts to look a lot more appealing.
by bstsb | 2026-02-21 22:55:40+00:00
a better summary from the site:

> We examine the extent to which security against a fully malicious server holds true for three leading vendors who make the Zero Knowledge Encryption claim: Bitwarden, LastPass and Dashlane [...] The attacks range in severity, from integrity violations of targeted user vaults to the complete compromise of all the vaults associated with an organisation.