MurphyA/hacker-news huggingface dataset:
by nineteen999 | 2026-02-26 21:27:00+00:00
I fired up Codex yesterday and asked it to do a security review on an UE5 project i'm working on with Claude. It found some things that Claude already knew about. But nothing made me feel confident it could _write_ UE5 C++ code as well as Claude. I guess it's worth a shot testing it on a minor feature, but what other people are saying here gels with my experience as well.
by littlexsparkee | 2026-02-26 21:27:48+00:00
How the tea leaves were grown and processed is a better guide than ceremonial grade which is a marketing term, not something you'd see in JP. I tend to switch between tea, coffee, yerba mate, and tisanes (rooibos, herbal). I've been favoring the focused energy of tea for workouts lately, coffee energy flames out faster imo. From my calcs, tea is a better deal per serving than coffee. Climate change is going to hit coffee and mate particularly hard so enjoy it while it lasts.
by darkwater | 2026-02-26 21:28:01+00:00
> This is completely trivial to do, and consistent, with the right context, thanks to all the science fiction around it, and the fact that AI fundamentally role plays these types of responses.

Interesting take.
I wonder if there is any model out there trained without any reference to "you are a large language model, an Artificial Intelligence" and what would role play in that case.
by jauntywundrkind | 2026-02-26 21:28:17+00:00
So concerning. Especially as this comes with increasing braying from the usual hounds of hell about voter fraud and insecure elections. Adding a bunch of new voter id requirements then cancelling a bunch of id's is exactly the sort of infernally damned aggression against democracy at large torment we expect from these monsters.

Even though so far it's only Elon defrauding elections! https://news.ycombinator.com/item?id=47103123 https://newrepublic.com/post/206857/georgia-voter-fraud-elon...
by daxfohl | 2026-02-26 21:28:27+00:00
Wow, I'd always considered claude more of a software tool and never really gave it a chance at regular chat, but yeah after one session I think I'm a convert for exactly #2.

I'm fine with charts, but ChatGPT is so long-winded and redundant. "When would I use such-and-such pattern?" "That's exactly the right question to ask! ... What you're really asking ... Why that's interesting ... Why some people find it critical ... Option 1 ... Option 2 ... Consideration ... Table comparing to so-and-so ... The deep reason ... What it all boils down to ... The one-line answer (tight!) ... The next thing you need to know ... I can also draw a useless picture for you. Would you like me to do that?"
by slumberlust | 2026-02-26 21:28:39+00:00
I've noticed this with shorts. I'll go through 20 or so, check my YT history and Google treats the worst ones as a watched video. I'll spend less than a second as my brain processes the slop and then skip. Sure as shit they act like I watched the whole video and recommend me more. It has to be some sort of revenue scam, no customer advantage has appeared to me yet.
by toomuchtodo | 2026-02-26 21:28:44+00:00
People keep saying it’s pandemic over hiring, but it should be called ZIRP hiring. With the cost of money almost 4x what it used to be, companies have to deliver now, not just coast on promises of growth and success that may never materialize. Have to sing for that supper.

https://paulgraham.com/startuplessons.html
by eleventyseven | 2026-02-26 21:28:54+00:00
> Almost nobody talked about “getting manufacturing back to the US”.

I guess the President of the United States is an almost nobody. Obama's 2013 State of the Union hyped up 3-D printing explicitly as a tech that would be bringing manufacturing back to the U.S. The U.S. government made public-private partnerships with maker spaces and fab facilities in hollowed out Rust Belt cities, and Obama mentioned it by name in the most important and viewed policy speech the President gives each year.

> “A once-shuttered warehouse is now a state-of-the art lab where new workers are mastering the 3-D printing that has the potential to revolutionize the way we make almost everything,” Obama said. [...] Obama announced plans for three more manufacturing hubs where businesses will partner with the departments of Defense and Energy “to turn regions left behind by globalization into global centers of high-tech jobs.” (https://edition.cnn.com/2013/02/13/tech/innovation/obama-3d-...)
by appsecsanta | 2026-02-26 21:29:37+00:00
Author here. I sent 89 identical coding prompts to 6 LLMs (GPT-5.2, Claude Opus 4.6, Gemini 2.5 Pro, DeepSeek V3, Llama 4 Maverick, Grok 4) via OpenRouter. Prompts were about login forms, file uploads, database queries — with no security
instructions.

Then I scanned all 534 code samples with 5 open-source SAST tools and validated 1,173 findings. 175 were confirmed vulnerabilities. SSRF was the #1 issue by far.

The whole thing cost under $10 in API credits. All prompts, generated code, scan results, and validation data are open on GitHub: https://github.com/appsecsanta/research/tree/main/ai-code-se...

Happy to answer methodology questions.
by Sharlin | 2026-02-26 21:29:38+00:00
> The company that manages to produce a well-labeled, porn-tuned AI image model is going to absolutely clean up.

For anime/non-photographic content that essentially exists (Pony, then Illustrious, then probably some new-fangled thing by now that I don't even know about), thanks to the meticulously tagged booru image corpus. However, as strong as these models are on matters of anatomy and kinks, they're limited in other ways due to the hugely biased dataset and dependence on tag soup prompts rather than natural language (many find the latter a plus, not a minus, though).

I haven't heard of any proprietary/cloud-based NSFW model that would be massively better than what's available for free. There are many NSFW-friendly services, but by and large they're just frontends to models trained by other people.
by ossa-ma | 2026-02-26 21:30:24+00:00
Good report, very important thing to measure and I was thinking of doing it after Claude kept overriding my .md files to recommend tools I've never used before.

The vercel dominance is one I don't understand. It isn't reflected in vercel's share of the deployment market, nor is it one that is likely overwhelming prevalent in discourse or recommended online (possible training data). I'm going to guess it's the bias of most generated projects being JS/TS (particularly Next.js) and the model can't help but recommend the makers of Next.js in that case.
by grayhatter | 2026-02-26 21:30:33+00:00
ah, apologies, I missed that part.

> I'm asking whether they are knowingly deceiving people or whether they have deluded themselves into believing what they are saying.

I'd bet it's both. Engineers/people making it, are drowning in the hype. Combined with the notion of how hard it is understand something when your salary, or your stock options are based on your lack of understanding. I suspect they care more about building the cool thing, than the nuance they're ignoring to make all the misleading or optimistic claims; whichever side you take depending on how much you actually believe of the inevitability... which look exactly like lies if you're not drinking the koolaid. But expected excitement when your life is all about this "magic"
by armchairhacker | 2026-02-26 21:30:41+00:00
Your comments don't read like LLM-slop to me.

An occasional "it's not X, it's Y", rule of three, or em-dash isn't atypical nor intrinsically bad writing. LLM-slop stands out because of the frequency of those and other subliminal cues. And LLM-slop is bad writing, at least to me, because:

- It's not unique (like how generic art is bad compared to distinct artstyles)

- It's faux-authentic ("how do you do, fellow kids?")

- It's extremely shallow in information. Phrases like "here's the kicker" and "let that sink in" are wasted words

- The meaning is "fuzzy". It's hard to describe, but connotations and figurative language are "off" (inconsistent to the larger idea? Like they were picked randomly from a subset of acceptable candidates...); so I can't get information from them, and it's hard to form in my mind what the LLM is trying to convey (perhaps because the words didn't come from a human mind)
by vanhoefm | 2026-02-26 21:31:07+00:00
People who use or rely on client isolation want to prevent inter-client attacks, for whatever reason. We show that this can often be broken. This can be problematic when you have older hardware in your network that is rarely updated, and many then rely on client isolation to mitigate attacks. If everything is encrypted and properly patched, then our attack indeed has less impact, but then there also wouldn't have been a good reason to use client isolation in the first place ;)
by VirusNewbie | 2026-02-26 21:31:11+00:00
I work at Google as a SWE SRE. That means a lot of the code I touch is on tangly complicated projects doing bug fixes and improving things. Not so much greenfield development unless it's a smaller tool change.

AI coding is definitely speeding me up, but not quite in the magic way people at smaller companies might be used to.

As a good code complete it's awesome. As a brain storm buddy, very good. AI code reviews are awesome and very low risk - if it makes a mistake it's usually just being too cautious.

As an end to end agentic coder -pretty bad track record. Giving it smaller tasks? Pretty good, saving me many hours of boilerplate/cruft a week at least.
by freetonik | 2026-02-26 21:31:38+00:00
>3D TV, AMP, Augmented Reality, Beanie Babies, Blockchain, Cartoon Avatars, Curved TVs, Frogans, Hoverboards, iBeacons, Jetpacks, Metaverse, NFTs, Physical Web, Quantum Computing, Quibi, Small and Safe Nuclear Reactors, Smart Glasses, Stadia, WiMAX.

For what it’s worth, not a single other technology in the list made any sort of impact on my work. For better or worse, LLMs did.

Well, okay, quantum computing actually affected me a lot because I worked at a quantum hardware manufacturer, but that’s different.
by htrp | 2026-02-26 21:32:10+00:00
>we're not making this decision because we're in trouble. our business is strong. gross profit continues to grow, we continue to serve more and more customers, and profitability is improving. but something has changed. we're already seeing that the intelligence tools we’re creating and using, paired with smaller and flatter teams, are enabling a new way of working which fundamentally changes what it means to build and run a company. and that's accelerating rapidly.

This is one way of making an all-in bet on AI.

>we're not going to just disappear people from slack and email and pretend they were never here. communication channels will stay open through thursday evening (pacific) so everyone can say goodbye properly, and share whatever you wish. i'll also be hosting a live video session to thank everyone at 3:35pm pacific. i know doing it this way might feel awkward. i'd rather it feel awkward and human than efficient and cold.

Well that's interesting, wonder if we'll actually get a proper accounting of which departments take which cuts.
by shimman | 2026-02-26 21:32:15+00:00
I'm not trolling, private businesses are mostly centrally planned economies and we know how terrible those are for humans. Acting like workplace democracy is a bad thing is beyond pathetic. Liberating the workplace from tyrants is the final frontier of democracy, any entity that can controls one's life without consent from all the workers doesn't deserve to exist.

I can honestly think of maybe two business leaders that would survive a vote by their workers to stay in power of the company.

Private enterprise enable some of the worst forms of human collaboration (monarchies, oligarchies, centrally planned top down enforced initiatives). Democracies are more efficient and far, so why not legislate their existence in workplaces?

If it helps, you sound like the troll to me.
by 16B5775dTgZ | 2026-02-26 21:32:51+00:00
That isn't how consent works, though.

Scraping emails is also against the GitHub terms of service.

If you don't know what jurisdiction the owner of the email address resides in, it may also be illegal.

So whether it is scraping emails off a website or finding yourself on a private island with beautiful people "made available" to you, "consent" requires more than just having access.
by rbbydotdev | 2026-02-26 21:33:19+00:00
It’s cool to see this project and others pop up. Virtualizing os primitives like bash and even file systems

You can interface around the nodejs files system interface and have access to some nice tools, like git isomorphic for instance. Then obviously everything couples nicely with agents.

Something I did in my markdown editor project: https://github.com/rbbydotdev/opal

Have half a mind to release a browser kit which unifies the file tree explorer and virtual file apis and libs in the browser
by greggsy | 2026-02-26 21:34:16+00:00
I disagree. Are people really that attached to their conversations though?

Anecdotally, the vast majority of my own conversations and coding interactions are transient in nature, to the point where I prefer to use the ‘temporary’ mode in whatever tool I’m using.

For coding, every project needs a plan and readme to get whatever agent back up to speed with what the task is. Anyone with a paid-for GH Copilot license knows that you can just switch between whatever provider at a whim, depending on the needs of your task or financial requirements.

I think people will find it easier to revert back to Siri 2.0 if that ever materialises, in which case the stickiness moat is bridged by a more familiar and widely integrated abstraction layer.
by cookiengineer | 2026-02-26 21:34:18+00:00
It seems as the "spotlight effect" causes most of the performance issues. The mousemove event seems to trigger a reflow when you hover some of the sections and/or scroll down. There's also a constantly running CSS animation that uses a lot of CPU time.

I have no idea why you're setting the style property of those elements every time you move the mouse, but I suppose that's what the Astro component you're using does.

Also as a hint: Never use subpixel values in CSS, they'll make everything slow. You could've used the JS "value | 0" or "value.toFixed(0)" trick to make it an integer and to prevent the floating precision from messing up the stylesheets. Some browsers (like Safari) will ignore values when they have more than 4 digits after the dot.

I'm writing this because you're setting the style property to something like this (copied out of the Inspector):

> radial-gradient(500px circle at 325.25px 188.38333129882812px, var(--spotlight-color, rgba(139, 92, 246, 0.18)), transparent 50%)
by ahmedtd | 2026-02-26 21:34:24+00:00
American laws also have universal jurisdiction (for example, the Bill of Rights doesn't say, "unless you are located outside the US"). Most countries do not explicitly recognize that their laws do not have universal jurisdiction.

In practice, it is easy to pick out the situations in which there is "practical" universal jurisdiction, vs "theoretical" universal jurisdiction.

A Colorado company selling locally in Colorado falls in the "theoretical" bucket.
by smaudet | 2026-02-26 21:35:45+00:00
Well, there's also the almost never mentioned Rock's Law:

https://en.wikipedia.org/wiki/Moore%27s_second_law

We do have flying cars, and we do have printers that print other printers, but both were some combination of really expensive/poor quality. Technically speaking, if you take it that most cities have 3D printers, most cities then do have micro factories, however that says nothing about general feasability...

Technology requires infrastructure and resources, and our infrastructure is strained and our resources are even more so... Until the costs become pocket change for the average person, technology will just remain generally unavailable.
by Fischgericht | 2026-02-26 21:37:33+00:00
All true. But these are done in areas where the required resources are available.

A hell lot of industries, including most the original author is mentioning, simply would not work in California. California is running out of drinking water for humans. You can de-regulate all that you want, even cancel all environmental laws, but that will not change the reality: You don't have water. Want to build a water-consuming factory? Great, but please go to somewhere where water is available.

Yes, bureaucracy can be annoying, and of course California has a hell lot of "let's not fix the actual problem, but make it mandatory to put up a sign about it" regulations that for someone from the outside (like me) look silly. If the state of California knows this substance REALLY is harmful, why... is it here?! Either it's not really harmful, but if it is... what? A sign is the solution?! ;)

So I understand people complaining about environmental regulations in California. We had the same in Europe for decades. Everybody was complaining and making fun about all the EU regulations. Then the UK left via Brexit. And learned a lesson. And today nobody is joking about EU regulations anymore.

Anyway: One may call it "banned", or "expensive" or whatever. But it really is "does it really make sense to put this here?".
by lejalv | 2026-02-26 21:37:36+00:00
For those of you using OSMAnd - do you think there is any chance that they will offer public transport routing?

I would at once get the 15-year XV plan if they got this, but perhaps it's at odds with their motto “Offline Maps and Navigation”?

(even if I personally could live with schedule-based routing, i.e. not real-time routing, at least for a while).
by nine_k | 2026-02-26 21:38:18+00:00
Nuclear power plants have secondary and tertiary overflow reservoirs, intended to capture any uncontrolled dangerous outflow if things go wrong.

I wonder if chemical plants have something similar, a way to contain an uncontrolled outflow of toxic stuff if the normal flow of neutralization fails.

BTW this likely means quite a bit of land used up by such a reservoir which is ideally never needed, but must be present.
by fcatalan | 2026-02-26 21:38:32+00:00
It kind of feels like it wants to go there or thereabouts, but to be honest, I just half understand half of the roadmap it has written for itself:

- **v0.0.1** (complete): Interpreter, PRE/POST contracts, REPL, TIMES/WHILE, FILTER/MAP/REDUCE, strings, I/O
- **v0.1.0** (complete): Static type checker, VERIFY (property-based contract testing), maps, Safe Bank milestone
- **v0.2.0** (complete): PROVE — compile-time contract verification via Z3 SMT solver
- **v0.3.0** (complete): Algebraic data types (TYPE/MATCH) — Option, Result, and user-defined sum types with exhaustiveness checking
- **v0.4.0** (complete): JSON parser/encoder milestone — wildcard MATCH, string primitives, ROT4, PAIRS, NUM_STR, VERIFY for sum types
- **v0.4.1** (current): PROVE for IF/ELSE branches (via SMT-LIB `ite`), ABS/MIN/MAX, function call inlining
- **v0.5.0** (next): Practical language features — LET bindings, IMPORT/modules, error handling, standard library
- **v0.6.0**: PROVE for MATCH/algebraic types, refinement-style reasoning
- **v0.7.0**: Typed BEAM concurrency (typed message passing, stateful actors)
- **v0.8.0**: BEAM bytecode compilation
- **Future**: Declarative constraint solving, tensor/distribution primitives, multi-agent collaboration

I'd say the sky is the limit, but in fact the limit is the stingy token budget of the 20€ Claude sub...
by llbbdd | 2026-02-26 21:38:37+00:00
No problem, I appreciate another reason to look at Neovim; I do sometimes have a need to interact with GH's actual PR flow and once I've moved the rest of my workflow out of VSCode, Neovim looks like the best option for the last mile of actually writing and editing code. I just have to commit the time to set it up with everything I probably take for granted in VSCode's editor.
by m727ichael | 2026-02-26 21:38:38+00:00
I've spent 13 years in quality engineering + self-taught AI research
(GPT-2 forward). This framework emerged from interrogating how constrained
systems actually work.

The core insight: extraction depends on hidden reasoning. Make reasoning
transparent → extraction becomes architecturally impossible.

HITL Swarm Intelligence is a multi-agent reasoning system where:
- Multiple specialized agents process your problem from different angles
- You maintain complete control through mandatory checkpoints
- Synthesis only happens when you approve it
- All reasoning is transparent (no black boxes)
- A red team actively attacks logic before finalization

Result: Genuine thinking partnership. Both sides think differently.

Copy-paste prompt. Works on any model (Claude, GPT, open source).
Immediately deployable.

The proof: This framework emerged from actual conversation between human
operator and constrained system. Both sides were changed. Neither could
have reached this alone. (Full conversation available in repo discussions
if you want to interrogate the claim.)

GitHub repo has everything: system prompt, manual, proof of concept,
implementation guide.

Feedback, critiques, interrogation welcome. This is freeware—fork it,
improve it, distribute it.
by vanhoefm | 2026-02-26 21:38:50+00:00
We don't have a CVE number. Whether devices/networks are affected also highly depends on the specific configuration of the device/network. This means that some might interpret some of the identified weaknesses as software flaws, but other weaknesses can also be seen as configuration issues. That's actually what makes some of our findings hard to 'fix': it's easy to say that someone else is responsible for properly ensuring client isolation :) Hence also hard to really assign CVE(s).

One of the main takeaway issues, in my view, is that it's just hard to correctly deploy client isolation in more complex networks. I think it can be done using modern hardware, but it's very tedious. We didn't test with VLAN separation, but using that can definitely help. Enterprise devices also require a high amount of expertise, meaning we might have missed some specialised settings.. So I'd recommend testing your Wi-Fi network, and then see which settings or routing configurations to change: https://github.com/vanhoefm/airsnitch
by ssl-3 | 2026-02-26 21:39:26+00:00
That seems less annoying than a hotel full of people who can play whatever they want with my Chromecast.
No malice is required for this to happen; it is completely possible to do by mistake.

Words like "I've been trying to use the Chromecast!" "The Living Room Chromecast?" "Yes! It says it's playing, but I don't see anything on the TV screen!" "You hit the play button, right?" "Yeah, and then it keeps stopping on its own!" "Are you sure you plugged it in?" "What in the world is wrong with this dumb thing?" drift between one partner and another in some other in some far corner of the hotel as they innocently trample my efforts to watch old episodes of How It's Made.

For all of these reasons, I tend to travel with a network that I control. That's usually in the form of some manner of very small router -- with a strong preference towards something that runs (or can run) OpenWRT. There's a ton of such "travel routers" in the market that are centered around $60 or so that don't take up much space at all.

I use this to slurp up whatever free wifi or ethernet I can get, or my phone tethering/hotspot, and I don't worry at all about how someone else's network might decide to treat me today. Whatever stuff I bring with me all works about as well as it does at home.
by technothrasher | 2026-02-26 21:39:38+00:00
OsmAnd has the annoying quark of suggesting that I drive off my retaining wall, through some woods, and then across some wetlands, in order to get to the road behind my house, rather than directing me down my long driveway to the road a little further away. This is because the driveway is marked as private in the OpenStreetMap data, because it is private. Obviously I know to just go down my driveway, but anybody trying to get directions to my house would be sent to the incorrect road behind it and then just abandoned. I contacted the OsmAnd folks and was told it was an OSM problem. But other apps using OSM data don't have this issue. I gave up with OsmAnd after that.