MurphyA/hacker-news huggingface dataset:
Show HN: Aspara – Open-source ML metrics tracker that stays fast at scale
by tkng | 2026-02-18 15:14:16+00:00
I built Aspara, a metrics tracker for machine learning experiments that doesn't choke on large runs.
Aspara applies LTTB downsampling server-side, so charts render instantly even if you have 10M data points for a single run.

Zero setup locally. Remote-ready when your team grows. Live demo (no signup): https://prednext-aspara.hf.space/

Features:
- Web dashboard + Terminal UI with Vim keybindings (great over SSH)
- Tag-based organization for managing hundreds of runs
- Simple logging API — init(), log(), finish()

Would love feedback on what matters next: image logging or log auditing?
by toast0 | 2026-02-18 15:15:00+00:00
Almost every OS needs a bootloader; but not every OS needs to develop one. Certainly there's some exceptions where there's not really separation between the two functions, but it's not common and most hobby OSes have the distinction unless they're single sector OSes.

The booloader and the kernel are separate stages; they're both interesting, but pick the part that interests you and work on that. With the multiboot standard and existing loaders like ipxe and grub, if you want to write a kernel, there's no need to write your own bootloader.

Otoh, if you want to write your own bootloader, you can do that too, there's plenty of existing kernels to boot.

And yeah, this kernel does nothing. But it would be a reasonable start to a kernel that does things, although you would need to write all the things.

Bare metal in qemu is a little fishy, but it's easier to take a screenshot of qemu than to take a screenshot of a full computer. I would expect this to run on a full computer as long as it supports BIOS booting, and then it would be a bare metal boot and halt kernel.
by MrMorden | 2026-02-18 15:15:07+00:00
Getting an EE degree is always an option — but since CS isn’t an engineering degree getting a second bachelor’s will take four years part-time.

I’m doing that now at ASU and the total requirement for me is 71 semester credits. Maybe I could have found a program for which I only needed 60ish, but that’s the only program in the country with part-time remote classes that will cover what I need (antennas and RF). Someone who is interested in digital design will have more options. (And I haven’t really looked at other countries so YMMV considerably outside the US.)
by jamincan | 2026-02-18 15:15:35+00:00
I did a two week trip through Southern Utah and northern Arizona two years ago and it was amazing. I loved it, the scenery was incredible and I would love my parents to make the same trip to share what I experienced. They recently outfitted their truck with a camper in the back and have been enjoying long roadtrips in their retirement and it would be a perfect trip for them.

But they have zero interest in going. Part of it is fear and uncertainty about the situation there currently, but another part is just the sourness that the idea of visiting the US right now gives that kind of sucks the appeal out of such a trip.

There are other places they can visit, and Canada is indeed a lovely country in its own right, but I hope there is a time again where they can find joy in the idea of visiting the US and enjoying the beauty of the southwest before they are too old to really appreciate it.
by whizzter | 2026-02-18 15:16:02+00:00
There was a link posted here that showed some hernia surgery in Malawi costing 400$ , some others listed via links at 160$ to 1000$.

I honestly have no idea about healthcare costs in countries like that, but assuming the main cost is a surgeon, the reported median salary for surgeons in Sweden is between 110-150k usd yearly. Assuming 200 working days a year and available for something like 4 surgeries a day on average that goes to about 137 usd per surgery. Adjust for Malawi being a far cheaper country but addition of more staff and a cost of 400$ for a relatively minor surgery doesn't seem too far fetched if there isn't middlemen taking a cut (actually googling it seems like middlemen can take a fairly large cut even with those costs).
by shotwellj | 2026-02-18 15:16:18+00:00
Hi HN, I built AIR because my own AI agents went off the rails.
I run an e-commerce store and deployed agents to handle customer communications. They started sending wrong information, making promises we couldn't keep, and handling complaints badly. When I tried to figure out what happened, I had scattered logs across services with no way to prove what the agents actually said.

AIR is a flight recorder for AI systems. It's an OpenAI-compatible reverse proxy (written in Go) that sits between your code and your LLM provider. Every prompt, completion, and tool call gets recorded with HMAC-SHA256 tamper-evident audit chains — modify one record and the chain breaks.

What makes this different from Langfuse/Helicone/LangSmith: accountability, not just observability. Tamper-evident chains instead of mutable logs. Content stays on your infra (S3/MinIO). 22 compliance controls auto-mapped to SOC 2, ISO 27001, and EU AI Act. Deterministic replay of any AI decision.

Python SDK integrates with OpenAI, LangChain, and CrewAI: pip install air-blackbox-sdk
Interactive demo (no signup): https://nostalgicskinco.github.io/air-blackbox-gateway/air-d...

Everything is Apache-2.0. 200+ tests. CI on every push.
by lelanthran | 2026-02-18 15:16:24+00:00
> I guess this is the difference, I expect the commit to represent a somewhat working version,

On a solo project I do the opposite: I make sure there is an error where I stopped last. Typically I put in in a call to the function that is needed next so i get a linker error.

6 months later when I go back to the project that link error tells me all I need to know about what comes next
by streetfighter64 | 2026-02-18 15:16:41+00:00
Well, there's a very famous story of one of the cofounders of reddit facing a million dollar fine and 35 years in prison for just downloading, not seeding, scientific articles. Not entirely the same, but quite related as his motivations were similar to those of Anna's Archive.

https://en.wikipedia.org/wiki/United_States_v._Swartz
by brunoborges | 2026-02-18 15:16:54+00:00
In many cases, yes, public fields are fine. But there are limitations:

- Can't synchronize access. `synchronized` keyword is not applicable to fields, only to methods and code blocks.

- Can't proxy. Not possible in public fields, therefore can't intercept calls before state is changed. This is useful for example in mocking frameworks, and telemetry libraries.

- Can't evolve. Methods allow encapsulation, which allows evolution of the implementation detail. For code base where the public field is accessible by consumers only within the same code base, this may be fine. But for shared libraries, it can easily become a problem.
by shayanbahal | 2026-02-18 15:16:58+00:00
This is so cool, thank you for sharing. I'm diving on the website and code and see what you got there. would be great to join and chat further about this.

RE Hello taking 18s, yes that is long, but one caveat is that with longer text it doesn't get longer linearly due to compression, the more repetition the better compression.
by noisy_boy | 2026-02-18 15:17:18+00:00
You are in the "not-enough-AI" stage - keep increasing your usage but try to keep it very gradual to avoid entering the "do-more-AI-within-this-budget" stage too soon. It seems like the firing would be in following stages:

1. too old/expensive

2. not using AI

3. using AI but not productive

4. productive using AI but not within AI budget

5. reduce AI budget and GOTO 3
by giancarlostoro | 2026-02-18 15:17:21+00:00
I sort of have this indirectly solved with a project I'm working on inspired by Beads. One thing I added is as you have the LLM work on tasks, you can sync them directly to GitHub, I would love to add other ticketing / task backends to it, but I mostly just use GitHub. You can also create them on GitHub and sync them down and claim a task (the tool will post a comment on GitHub that you've claimed the work). I can see people using it to collaborate easier, but for the time being it's just me using it for myself. ;)

These tasks become your prompt once refined. I basically braindump to Claude, have it make tasks from my brain dump. Then I tell Claude to ask me clarifying questions, it updates the tasks and then I have Claude do market research for some or all tasks to see what the most common path is to solve a given problem and then update the tasks.

https://github.com/Giancarlos/guardrails
by camel-cdr | 2026-02-18 15:17:25+00:00
> SVE was supposed to be the next step for ARM SIMD, but they went all-in on runtime variable width vectors and that paradigm is still really struggling to get any traction on the software side.

You can treat both SVE and RVV as a regular fixed-width SIMD ISA.

"runtime variable width vectors" doesn't capture well how SVE and RVV work. An RVV and SVE implementation has 32 SIMD registers of a single fixed power-of-two size >=128. They also have good predication support (like AVX-512), which allows them to masked of elements after certain point.

If you want to emulate avx2 with SVE or RVV, you might require that the hardware has a native vector length >=256, and then you always mask off the bits beyond 256, so the same code works on any native vector length >=256.
by amluto | 2026-02-18 15:18:36+00:00
No, the article really doesn’t explain. It explains why the implementation can produce a fixed secret under malicious input, and that there’s an RFC saying “don’t implement it like this” but not what effect it has on the security of the system.

From a quick glance at the literature, failing to validate keys looks like it might break the Insider-CCA property, and maybe this affects some authenticated KEM constructions. And, just as a guess, maybe Matrix/Olm has a design such that this matters.

I agree with the author that the library should absolutely fix the bug or clearly document the specific reason it doesn’t and what is needed to retain security. But it looks like the explanation and the POC involve direct library calls and not the actual protocol except for that one sentence. And I’m curious what the protocol is doing.
by kevinfiol | 2026-02-18 15:18:43+00:00
It's been a while since I've tried it, but post-1.0 release of Bun still seemed like beta software and I would get all sorts of hard to understand errors while building a simple CRUD app. My impression from the project is the maintainers were adding so many features that they were spread too thin. Hopefully it's a little more stable now.
by threethirtytwo | 2026-02-18 15:18:44+00:00
That's because you're getting left behind. The technology is outpacing you because most likely you're not using it right. Also likely you're not in an environment that pushes you to use it right so you just give it half assed attempts, never putting the initial effort to up your game with AI.

At my company, if you don't use AI, you're productivity will be much slower than everyone else and that will result in you getting fired. The expectation is 3-4 PRs a day per person.
by RickJWagner | 2026-02-18 15:18:55+00:00
“Our fight against human trafficking is one of the great human rights causes of our time, and the United States will continue to lead it — in partnership with you. The change we seek will not come easy, but we can draw strength from the movements of the past. For we know that every life saved — in the words of that great Proclamation — is 'an act of justice'; worthy of 'the considerate judgment of mankind, and the gracious favor of Almighty God'."
— President Barack Obama

It is estimated that more than 20 million men, women and children around the world are victims of human trafficking. The United States is a source, transit and destination country for some of these men, women and children — both U.S. citizens and foreign nationals — who are subjected to the injustices of human trafficking, including forced labor, debt bondage, involuntary servitude, and sex trafficking. Trafficking in persons can occur in both lawful and illicit industries or markets, including in brothels, massage parlors, street prostitution, hotel services, hospitality, agriculture, manufacturing, janitorial services, construction, health and elder care, and domestic service, among others.

White House Archives from Obama era

https://obamawhitehouse.archives.gov/node/230831
by weatherlite | 2026-02-18 15:19:29+00:00
Sorry I meant to say the private sector, not sure if it changes the argument though since you seem to believe inefficiencies are all over the place - in public companies, private etc.
I've worked in tech all my life and in general if you were grossly inefficient you'd get fired. Now tech may be a high efficiency / low bullshit industry but I'm assuming in general if you are truly shit at your job you'd get fired no matter the industry.
by ACS_Solver | 2026-02-18 15:19:30+00:00
I'm sure Apple has data showing that their extremely lockdown strategy is good for their business but I feel like I'm one of the potential customers Apple could gain if they didn't have that.

They're a fantastic hardware company. But my admittedly very limited experience with Apple software, from iPad to their streaming service website, has been miserable. The UX doesn't work for me, the software just doesn't do what I want. Understandable, Apple very much designs their software to work for a particular workflow they come up with, if you like that workflow it's great, for someone like me it's miserable. But I would gladly buy their hardware if I could freely run an OS of my own choosing.
by yoavm | 2026-02-18 15:19:32+00:00
I thought about offering alternative "torrents list", but didn't find any. Internet Archive would be a great one. I'm not sure about how ATProto works, but I made sure to enable WebTorrents so that it would be quite easy to download from Levin seeders using a browser only.

As for tipping - I really appreciate it, but there are really many people/projects that would need it much more than me.
by lock1 | 2026-02-18 15:19:35+00:00
> Those are both syntactically valid lines of code. (it's actually one of python's many warts). They are not ambiguous in any way. one is a number, the other is a tuple. They return something of a completely different type.

You just demonstrated how hard it is to "check" an email or text message by missing the point of my reply.

> "Now imagine trying to spot that one missing comma among the 20kloc of code"

I assume your previous comment tries to bring up Python's dynamic typing & late binding nature and use it as an example of how it can be problematic when someone tries to blindly merge 20kloc LLM-generated Python code.

My reply, "Your example will unambiguously resolve to an error in a standard-conforming Python interpreter." tried to respond to the possibility of such an issue. Even though it's probably not the program behavior you want, Python, being a programming language, will be 100% guaranteed to interpret it unambiguously.

I admit, I should have phrased it a bit more unambiguously than leaving it like that.

Even if it's hard, you can try running a type checker to statically catch such problems. Even if it's not possible in cases of heavy usage of Python's dynamic typing feature, you can just run it and check the behavior at runtime. It might be hard to check, but not impossible.

On the other hand, it's impossible to perform a perfectly consistent "check" on this reply or an email written in a natural language, the person reading it might interpret the message in a completely different way.
by mapkkk | 2026-02-18 15:19:36+00:00
I would just like to add some cautionary anec-data: there are widespread cases in certain jurisdictions where rightsholders are known to seed the same torrents themselves, just to turn around and send love letters to leechers that connect to them. A good example is Germany with movies and TV shows.

Now, I don't know if, say, Wolters Kluver would/does the same thing, and what the realistic risk of an individual receiving such a letter is, but I think it makes it worthwhile to go over the actual law in your jurisdiction before diving head first on things like this.

I'm not saying it's wrong to seed these things, I'm just saying it might be a good idea to weigh the risks if you don't have a cool 500€ in cash to part ways with.
by crazygringo | 2026-02-18 15:19:56+00:00
To be fair, OP talks specifically about that -- that's a full quarter of the post:

> I’ve spent the past year moving away from surveillance platforms... And yet I willingly feed more context into AI tools each day than Google ever passively collected from me. It’s a contradiction I haven’t resolved. The productivity gains are real enough that I’m not willing to give them up, but the privacy cost is real too, and I notice it.
by gortok | 2026-02-18 15:20:20+00:00
There are two issues I see here (besides the obvious “Why do we even let this happen in the first place?”):

1. What happened to all the data Copilot trained on that was confidential? How is that data separated and deleted from the model’s training? How can we be sure it’s gone?

2. This issue was found; unfortunately without a much better security posture from Microsoft, we have no way of knowing what issues are currently lurking that are as bad as —- if not worse than —- what happened here.

There’s a serious fundamental flaw in the thinking and misguided incentives that led to “sprinkle AI everywhere”, and instead of taking a step back and rethinking that approach, we’re going to get pieced together fixes and still be left with the foundational problem that everyone’s data is just one prompt injection away from being taken; whether it’s labeled as “secure” or not.
What determines whether a post gets visibility on Hacker News
by beratbozkurt0 | 2026-02-18 15:20:20+00:00
Hi HN

I’ve been trying to share some of my blog posts and side projects here over the past months, but I’ve noticed that most of them get almost no visibility. They receive little to no upvotes, very few views, and sometimes no interaction at all. I’m not sure if I’m doing something wrong, if my posts are being filtered, or if my content simply isn’t a good fit for the community.

I’d genuinely like to understand how Hacker News works from the perspective of people who have been here longer.

A bit about me: I’m an indie developer who builds products in public and writes technical posts about what I learn (frontend architecture, experiments, lessons from building apps, etc.). I’m not trying to spam or promote aggressively — I mostly want to share things I think other developers might find useful.

Some questions I’m hoping to get feedback on:

• Is there a common reason posts don’t get visibility even if they’re relevant?
• Are there unwritten rules about how/when to submit content?
• Is it better to post as “Show HN”, a normal link, or a text post?
• Does the title matter more than the content at first?
• Could account age/karma affect initial exposure?

I’m asking this not just for myself, but to turn the answers into a small guide for other indie hackers who might be struggling with the same thing.

I’d really appreciate honest feedback — even if the answer is simply: “Your posts aren’t interesting enough for HN.” That would still help me improve.

Thanks in advance
by erdii | 2026-02-18 15:20:30+00:00
The kubernetes apiserver allows using CEL in CustomResourceDefinition validation rules:
- https://kubernetes.io/docs/reference/using-api/cel/
- https://kubernetes.io/docs/tasks/extend-kubernetes/custom-re...

It also allows using CEL in ValidatingAdmissionPolicies:
- https://kubernetes.io/docs/reference/access-authn-authz/vali...
Show HN: Poncho, a general agent harness built for the web
by heycesr | 2026-02-18 15:20:35+00:00
Hi HN! I'm building poncho, a framework for building custom AI agents that are version-controlled in git, developed locally, and deployed as isolated endpoints (serverless-friendly by default).

Poncho agents follow the same conventions as openclaw or claude code so they probably feel familiar.

You can talk to them via terminal or web ui to build new skills or configure the agent, and they're compatible with the Agent Skills open spec, so you can port your skills. Small caveat: right now it's compatible with .md skills and js/ts scripts, but many skills are bash or python-based. I'm still figuring out what would be the best way to extend support for those skills without overcomplicating it, if anybody has any ideas I appreciate it!

Some features:

- Git-native: agent behavior, skills, and tests live in your repository (reviewable diffs + easy rollbacks).
- Single-file agent definition: define runtime config + instructions in AGENT.md (YAML frontmatter + prompt content).
- Skills you can ship: AgentSkills-style skills/*/SKILL.md plus TypeScript/JavaScript scripts under scripts/.
- MCP support: connect remote tool servers and inject required environment variables through config.
- Conversation-first API + streaming: stored conversations with SSE streaming responses and tool events.
- Pluggable storage + memory: local files for dev or hosted stores (e.g. Upstash), with optional persistent memory + recall.
- Testing + observability: poncho test workflows and OpenTelemetry traces/events.

Now the cool thing about poncho agents is that they're super easy to deploy to Vercel/Fly/Lambda/etc, so you can share them with anybody in your team and enable non-technical people with custom skills.

I also built and deployed a couple example agents here:
- https://github.com/cesr/product-agent
- https://github.com/cesr/marketing-agent

I'd love some feedback, I started building poncho because I wanted a fast and easy way to build and share agents with my team. Let me know what you think!
by bubblewand | 2026-02-18 15:20:38+00:00
Rot-13 explanation:

Gur frevrf unf cbvagf vg zvtug raq, ohg qbrfa'g, naq gura qbrf noehcgyl raq abg irel sne vagb vgf ynfg frnfba. Gurer'f n yvggyr rkgen wbl gb or unq vs lbh qba'g xabj dhvgr jura vg jvyy or bire (frrvat gur rcvfbqr pbhag ba gung ynfg frnfba, va cnegvphyne, fcbvyf gung). Vg'f abg yvxr gung ehvaf gur fubj be nalguvat, ohg vg'f n yvggyr orggre vs lbh pna znantr gb erznva oyvaq gb vg.
by kakacik | 2026-02-18 15:21:26+00:00
He is a manipulative POS from the start (remember the 'dumb f_cks' quote? How much more do you need to know about the person which is still the same person we discuss?). High level and high functioning sociopath.

So is everybody else up there regardless of the name of the company, only their quality of PR and luck varies. Now are you happy that most of this forum works for similar or worse people, can you internally accept that and come back to work like nothing is happening? Or do you need to invent a bit of alternate reality where its not your/your company case somehow and you are on good moral mission because XYZ?

Not that many people can actually properly do this from my experience, most need to somehow feel they are on the good side of history even if they were doing/helping very questionable stuff to be polite. Just one small example - companies living from ads.
by mtrimpe | 2026-02-18 15:21:29+00:00
CEL is much more computationally limited as it aims to keep evaluations in the microsecond range.

With OPA you can easily create policies that take tens, hundreds or even thousands of millisecond.

That comes at the expense of a lot of power though, so much of the complex logic that you can write in OPA simply isn't achievable in CEL.
by hamdingers | 2026-02-18 15:21:29+00:00
US colocated seedbox with ~10k film and tv torrents seeding at any given time, the last letter I got was ~2014 IIRC, before that it was several a year. I never responded to any of them.

I don't think I'm especially good at covering my tracks, so either they've abandoned individual enforcement in favor of going after distributors or they no longer bother with non-residential IPs.