MurphyA/hacker-news huggingface dataset:
by akie | 2026-02-21 11:57:04+00:00
Why so negative lol. The speed and very reduced power use of this thing are nothing to be sneezed at. I mean, hardware accelerated LLMs are a huge step forward. But yeah, this is a proof of concept, basically. I wouldn't be surprised if the size factor and the power use go down even more, and that we'll start seeing stuff like this in all kinds of hardware. It's an enabler.
by amabito | 2026-02-21 11:57:12+00:00
The tooling gap exists partly because git's data model has no native concept of "this branch's upstream is another feature branch" — each PR is independent from the forge's perspective, so rebasing one layer in the stack requires manually re-targeting every PR below it. FAANG-internal tools solve this by storing the stack relationship in a metadata layer outside git itself, then regenerating the PR graph after each rebase. Without that layer, the bookkeeping falls on the developer, which is why most teams abandon the workflow after two or three levels deep regardless of how disciplined they are.
by j-bos | 2026-02-21 11:57:25+00:00
> The more you engange with fitness content, even if it's training programs or how to correctly do certain exercises, platforms like YouTube will start flinging misogynistic content at you and it's incredibly hard to remove.

That explains why out of no where I got reccomendations for some gender conflict greentext channel, I had just that week been looking for lifting techniques.
by jimnotgym | 2026-02-21 11:58:29+00:00
> but in most others, they are way overkill.

As an accountant I am able to enforce an accounts regime appropriate to my entity, with concepts like 'materiality' to help. I'm not sure about ISO9001, I'm more familiar with PCIDSS, and I found it to be very proscriptive, and 'all or nothing', compared with accounting standards. For instance in a small company, it is perfectly reasonable to state verbally to your auditor that your control over something is that you are close enough to the transactions to see misstatements by other people sat in the same room. Or even that you have too few people to exercise segregation of duties controls. In a larger company it is not ok. I don't see that same flexibility in other kinds of standards
by JumpCrisscross | 2026-02-21 11:59:06+00:00
> I'm not convinced that there is a point in attempting explaining it

That encapsulates my point.

I’ve worked on various pieces of legislation. All privately. A few made it into state and federal law. Broadly speaking, the ones that make it are the ones in respect of which you can’t get its supporters to stop calling in on.

Privacy issues are notoriously shit at getting people to call their electeds on. The exception is when you can find traction outside tech, or if the target is directly a tech company.
by mikkupikku | 2026-02-21 11:59:31+00:00
I am sure there are many good corporate security policy people doing important work. But then there are people like this;

I get handed an application developed by my company for use by partner companies. It's a java application, shipped as a jar, nothing special. It gets signed by our company, but anybody with the wherewithal can pull the jar apart and mod the application however they wish. One of the partner companies has already done so, extensively, and come back to show us their work. Management at my company is impressed and asks me to add official plugin support to the application. Can you guess where this is going?

I add the plugin support,the application will now load custom jars that implement the plugin interface I had discussed with devs from that company that did the modding. They think it's great, management thinks its great, everything works and everybody is happy. At the last minute some security policy wonk throws on the brakes. Will this load any plugin jar? Yes. Not good! It needs to only load plugins approved by the company. Why? Because! Never mind that the whole damn application can be unofficially nodded with ease. I ask him how he wants that done, he says only load plugins signed by the company. Retarded, but fine. I do so. He approves it, then the partner company engineer who did the modding chimes in that he's just going to mod the signature check out, because he doesn't want to have to deal with this shit. Security asshat from my company has a melt down and long story short the entire plugin feature, which was already complete, gets scrapped and the partner company just keeps modding the application as before. Months of my life down the drain. Thanks guys, great job protecting... something.
by wamiks | 2026-02-21 12:00:03+00:00
Thanks for the link. Yeah, interesting and creative work. I can see how it can help reason about large models. "Interpret" seems more aspirational than real. It's still largely narrative driven. I've been waiting for something deep in this area, I'm not sure it will be this community or not. For sure, as of today, the bold claim is someone understands.

> Your argument applies to humans as well
Yeah, I'm talking about obvious and trivial errors that reveal lack of representation of the code. But your question did make me think, cheers.
by skydhash | 2026-02-21 12:00:54+00:00
Those looks more like noise to me. A squashed merge (or a final squash before PR) would be:

TN 43 - Fix mismatched interface between Foo and Bar

We've moved the X property to a more appropriate place and
improved the documentation for Feature Foo. We've also found and fix
an O(n^2) implementation in feature Bar.

The the ticket TN-43 will have all the details that have lead to the PR being made: Bug reports, investigations, alternative solutions,...

The commit message is what's more important. I don't think I've ever needed what is in a merged branch. But I've always wanted the commit at one point to have tests passing and a good description of the patch. And all the talk in the engineering team are always about ticket. It does makes sense to align those.
by pvtmert | 2026-02-21 12:00:57+00:00
From my experience, it depends on how you frame your "service" to the reviewers. Obviously 2023 was the very early stage of LLMs, where the security aspects were quite murky at best. They (reviewers) probably did not had any runbook or review criteria at that time.

If you had advertised this as a "regular service which happens to use LLM for some specific functions" and the "output is rigorously validated and logged", I am pretty sure you would get a green-light.

This is because their concern is data-privacy and security. Not because they care or the company actually cares, but because fines of non-compliance are quite high and have greater visibility if things go wrong.
Show HN: I bought Big Interview's .ai domain to roast their negligence
by justice_devb | 2026-02-21 12:01:00+00:00
I recently acquired the .ai domain for Big Interview, a major AI interview prep platform.

I offered to transfer it to them for $799 (which is less than the price of 3 of their own "Interview Pro" packages), but I was completely ignored by their leadership.

So, I spent my weekend building an interactive "Public Notice" site to roast the irony: a company that teaches interview preparation was completely unprepared for its own brand security.

The site features a drag-and-drop communication board showing the ignored emails.

Curious to hear the community's thoughts on SaaS domain security and how to handle these situations.
by hu3 | 2026-02-21 12:01:20+00:00
Doing things faster/easier means I now do most of these things whereas I didn't before.

Because I have limited time and energy. Take learning as an example:

I couldn't afford to spend a weekend learning the tradeoffs made by the top 5 WebGL JavaScript game engines AND generate the same demos for all of them to compare DX, and performance on my phone. And as I had more questions about their implementation I would have to scavenge their code again, for each question.

Example questions:

- Do they perform sorting or are their drawing immediate? sort on z? z and y? z/y and layers? immediate'ish + layers?

- What are their GPU atlas strategies? fixed size? multiple with grouping by drawing frequency to reduce atlas switching? 2048? 4096? How many atlases? Does it build the atlas at boot or does it support progressive atlas sprite loading? How does it deal with fragmentation? What does it use for packing algo? Skyline ir something more advanced? How is their batch splitting behaviour and performance characteristics?

- Does it help with ECS? How is their hierarchical entity DX, if any? Does it math with matrices for transformations or simpler math?

...and so on. Multiply the number of questions by at least 10.

And I asked LLM to show me the code for each answer, on all 5 engines.

This kind of learning just wasn't feasible for me before with my busy life.

So when I say "easier" it often means "made possible".

Finally let's not forget most of us in HN are incredibly privileged and can afford to learn futile things on the weekend. But for a great part of the less privileged population, having access to easier learning is LIFE CHANGING.
by embedding-shape | 2026-02-21 12:01:33+00:00
> Are there any good reasons to use multiple GitHub user accounts?

Is there any good reasons not to separate what you work on into multiple GitHub accounts? Not to mention some people don't want all their projects attached to one profile, some people also develop in their free-time, and don't want to mix freetime/work projects under the same user account, for multiple reasons.
by foldr | 2026-02-21 12:01:48+00:00
I think this is a very implausible take for two reasons.

First, the King doesn't have that kind of power over the justice system in the UK. He cannot choose when, whether or why Andrew is arrested.

Second, Andrew's arrest is a negative news story for the royal family, not a positive one. Their ideal scenario would have been one where the Andrew/Epstein story gradually dropped out of the news cycle following the stripping of Andrew's royal titles. This arrest, and likely subsequent trial, are just going to keep it in the news for months or years to come.
by _pdp_ | 2026-02-21 12:01:52+00:00
On EU data sovereignty:

The OP is right. For that reason we started migrating all of our cloud-based services out of USA into EU data centers with EU companies behind them. We are basically 80% there. The last 20% remaining are not the difficult ones - they are just not really that important to care that much at this point but the long terms intention is a 100% disconnect.

On IDV security:

When you send your document to an IDV company (be that in USA or elsewhere) they do not have the automatic right to train on your data without explicit consent. They have been a few pretty big class action lawsuits in the past around this but I also believe that the legal frameworks are simply not strong enough to deter abuse or negligence.

That being said, everyone reading this must realise that with large datasets it is practically very likely to miss-label data and it is hard to prove that this is not happening at scale. At the end of the day it will be a query running against a database and with huge volumes it might catch more than it should. Once the data is selected for training and trained on, it is impossible to undo the damage. You can delete the training artefact after the fact of course but the weights of the models are already re-balanced with the said data unless you train from scratch which nobody does.

I think everyone should assume that their data, be that source code, biometrics, or whatever, is already used for training without consent and we don't have the legal frameworks to protect you against such actions - in fact we have the opposite. The only control you have is not to participate.
by jimnotgym | 2026-02-21 12:03:52+00:00
It seems odd though. Don't you have the right to bear arms, with some idea that it is needed to prevent the government from exercising excessive powers over you, yet actually doing anything with those guns to protect yourself from tyranny is a crime?

I remember hearing once that the constitution, having been written by a bunch of insurrectionists, intended people to have the power to keep the government out of their business. It seems they have lost that?
by hermanzegerman | 2026-02-21 12:04:23+00:00
No it won't.
It's about reducing eWaste from the devices itself. Throwing away a whole device just because the battery is bad is much worse than just throwing away a worn out battery.

My 9 year old ThinkPad T470 is doing well with his 3rd or 4rd battery (and a new SSD and more RAM).

Also external powerbanks are pretty unpractical compared to a fresh new internal battery.
by embedding-shape | 2026-02-21 12:04:39+00:00
It's actually about git account switching as far as I can tell, which does make sense, you can have multiple "git" users indeed. Maybe it's the wording that is wrong? Read "account" as "user" and it might make more sense :)

# in ~/.gitconfig
[includeIf "gitdir:/home/user/projects/embedding-shapes/"]
path = /home/user/.gitconfig-embedding-shapes

# in ~/.gitconfig-embedding-shapes
[user]
name = embedding-shapes
email = embedding-shapes@proton.me

[core]
sshCommand = ssh -i /home/user/.ssh/id_embedding-shapes

That's one of my git "accounts", currently I have four in total, one being my "real identity", other are pseudo-anonymous users.
by miki123211 | 2026-02-21 12:05:01+00:00
The problem with software is that it's all so, so decentralized.

If you're building a bridge in South Dakota, there's somebody in South Dakota building that bridge. That person has to follow South Dakota laws, and those laws can require whatever South Dakota regulators want, including sign-offs by professional engineers.

If you're a South Dakota resident signing up for a web portal, the company may have no knowledge of your jurisdiction specifically (and it would be a huge loss for the world if we moved to a "geo-block every single country by default until you clear it with your lawyers" regime). That portal may very well be hosted in Finland by a German hosting company, with the owners located in Sweden, running Open Source software primarily developed in Britain. It's possible that no single person affiliated with that portal's owner ever stepped food in your jurisdiction.
by peterfirefly | 2026-02-21 12:05:45+00:00
> Removable batteries were the industry standard in the early days of mobile phones, and it worked perfectly.

Phones back then were bad (so accommodating replaceable batteries was easy), and batteries degraded quickly (so it was a necessity).

Modern phones are smaller, need to be more water proof, stuffed to an unimaginable degree with components -- and modern batteries last a really long time.

I am not so sure it's a good idea to force them to become consumer replaceable again.

My iPhone SE (1st gen) ended up being pushed apart from the inside last year because the battery had swelled up. I could have had it replaced but the CPUs were a bit too weak for the modern world and the RAM too limited. A fresh new battery would not have upgraded the CPUs or the RAM.

Li-ion batteries have improved since 2016 so I expected the battery in my iPhone 16e to outlast the useful life of the CPUs and RAM in it.

> extract the remaining rare earths

More for the gold, I believe. There are youtubers who do it semi-professionally and are remarkably transparent about how they do it. It looks like the only really toxic fumes they contend with are a tiny bit of sulphuric acid vapour from their electrolytic baths.

I don't think we should ship the trash to Africa or poor parts of Asia. I don't see how replaceable batteries would have prevented my iPhone SE from becoming trash or have prevented my iPhone 16e from becoming trash in the future. Or preventing them from ending up in Africa/Asia, for that matter.

Edit: had accidentally written "back" in the first line when I meant "bad".
by tamimio | 2026-02-21 12:05:46+00:00
This process will be done in a way that you won’t even have to do it in 3min, it will be part of you phone wallet, and whenever you sign up you will be required to verify it there, essentially, all big tech will be having a copy of your biometric, and consequently, all three letter agencies too. Welcome to the tyranny of big tech!
by mhher | 2026-02-21 12:05:50+00:00
While I understand the premise I think this is a highly flawed way to operate these tools. I wouldn't want to have someone with my personal data (whichever part) that might give it to anyone who just asks nicely because the context window has reached a tipoff point for the models intelligence. The major issue is a prompt attack may have taken place and you will likely never find out.
by embedding-shape | 2026-02-21 12:06:19+00:00
That's a very different approach, and a bot user is very different from a regular Telegram account, it won't be nearly as "useful", at least in the way I thought openclaw was supposed to work.

For example, a bot account cannot initiate conversations, so everyone would need to first message the bot, doesn't that defeat the entire purpose of giving openclaw access to it then? I thought they were supposed to be your assistant and do outbound stuff too, not just react to incoming events?
by tialaramex | 2026-02-21 12:06:53+00:00
I would bet that in the opposite circumstance you'd say the same thing:

"Is there any reason to not just switch to 0-based indexing if we could? Seems like 1-based indexing really exacerbates off-by-one errors without much benefit"

The problem is that humans make off-by-one errors and not that we're using the wrong indexing system.
by latexr | 2026-02-21 12:07:13+00:00
> People without consideration for the implications will inevitably get burned

They will also burn other people, which is a big problem you can’t simply ignore.

https://theshamblog.com/an-ai-agent-published-a-hit-piece-on...

But even if they only burned themselves, you’re talking as if that isn’t a problem. We shouldn’t be handing explosives to random people on the street because “they’ll only blow their own hands”.
by duskdozer | 2026-02-21 12:07:43+00:00
>For libraries, you also cause compounding churn for your dependents.

This is the thing that I don't really understand but that seems really popular and gaining. The article's section "Test against latest instead of updating" seems like the obvious thing to do, as in, keep a range of compatible versions of dependencies, and only restrict this when necessary, in contrast to deployment- or lockfile-as-requirement which is restricted liberally. Maybe it's just a bigger deal for me because of how disruptive UI changes are.
by frizlab | 2026-02-21 12:07:45+00:00
you’re supposed to use your personal account to create a business “profile” for the company you work for. the company is supposed to have created a space for it on business.facebook.com

creating a “pro” facebook account is indeed disallowed by the facebook’s policy

I’ve done that multiple times. works well but you indeed to not have a clear separation between work and personal life, which is not good. I don’t mind it because I don’t use facebook, but it could be a problem for other people.

I honestly don‘t get how facebook think the world works…
by TZubiri | 2026-02-21 12:07:47+00:00
The sentence is correct and accurately describes OAuth.

Delegate is just a standard word, look it up on a dictionary. If anything its internal technical definition is precisely in that sentence.

>"First half of what"

The spec, the standard, half of it deals with X, the other half of it deals with Y. Namely one half being how user grants permission to a third party, and the other half being how the third party makes requests to the main data holder.

If you need another definition: OAuth is a three way protocol between users, a service provider, and a third party. A user gives specific permissions to the third party, so that the service provider can share specific resources with the third party, who acts on the user's behalf.
by misnome | 2026-02-21 12:08:38+00:00
I’d infinitely prefer a relevant wikipedia article to an AI “Answer” that is almost always wrong.

Google lens image search used to be amazing, I tried a repeat of a search I did before of a piece of art, it showed the same piece but confidently listed the artist and year wrong by about 300 years.

I’ve had relatives do “research” about things I mentioned I needed to do, and they’ve just sent screenshots of the incorrect AI answer.

It’s made google almost entirely useless, there is zero incentive for them to try to make search better (vs incentive to make it worse) and even if they did want to make it better the sheer volumes of slop have made that even harder.

We’ve completely sabotaged out ability to collate information at scale as a civilization, for the benefit of a few companies that were already the largest in the world to begin with. And it turns out, very few people notice or even care about this.
by bradley13 | 2026-02-21 12:09:28+00:00
I haven't logged into Facebook for many years, but this made me curious. I'm a guy, in my 60s. Looking at my feed, the first two posts are family/friends, the third is some video about a guy I never heard of, the next three f/f, then a political post, etc..

Overall, about 2:1 family/friends vs. crap. That's still too much crap, but no "thirst posts" at all. Maybe those only target younger guys?

Logging out now. I just have no interest in how a cousin I haven't seen in decades has redecorated her bedroom.
by pvtmert | 2026-02-21 12:09:51+00:00
Great idea, happy to ~steal~ be inspired by.

I propose a few other common elements:

1. Another AI agent (actually bunch of folks in a 3rd-world country) to gatekeep/check select input/outputs for data leaks.

2. Using advanced network isolation techniques (read: bunch of iptables rules and security groups) to limit possible data exfiltration.

This would actually be nice, as the agent for whatsapp would run in a separate entity with limited network access to only whatsapp's IP ranges...

3. Advanced orchestration engine (read: crontab & bunch of shell scripts) that are provided as 1st-party components to automate day-to-day stuff.

Possibly like IFTTT/Zapier/etc. like integration, where you drag/drop objectives/tasks in a *declarative* format and the agent(s) figure out the rest...
by zozbot234 | 2026-02-21 12:10:22+00:00
You'd need real rack-scale/datacenter infrastructure to properly match the hosted models that are keeping everything in fast VRAM at all times, and then you only get reasonable utilization on that by serving requests from many users. The ~100X slower tier is totally okay for experimentation and non-conversational use cases (including some that are more agentic-like!), and you'd reach ~10X (quite usable for conversation) by running something like a good homelab.