MurphyA/hacker-news huggingface dataset:
by kykat | 2026-02-18 19:37:03+00:00
I don't quite understand the vulnerability, when exploited, you can get information about the page from which the exploit code is running. Without a sandbox escape or XSS, that seems almost completely harmless?

This is the "impact" section on https://github.com/huseyinstif/CVE-2026-2441-PoC:

Arbitrary code execution within the renderer process sandbox
Information disclosure — leak V8 heap pointers (ASLR bypass), read renderer memory contents
Credential theft — read document.cookie, localStorage, sessionStorage, form input values
Session hijacking — steal session tokens, exfiltrate via fetch() / WebSocket / sendBeacon()
DOM manipulation — inject phishing forms, modify page content
Keylogging — capture all keystrokes via addEventListener('keydown')
by dpoloncsak | 2026-02-18 19:37:15+00:00
I'll spend the $3 to try it out.

Any real different than Terminus? That seemed to be the latest and greatest last I was shopping for an iOS SSH client.

Also, maybe just because its new (I dont realy know how App Store search works) but searching "Echo" and "Echo SSH" returned way too many Amazon/Alexa related apps, and then many other terminals before yours.
by yodon | 2026-02-18 19:37:31+00:00
The OP should read up on business strategy, probably starting with Porter's Five Forces.

Hint: Money is a nice thing to have but it is very definitely not a moat.

If a company is making above market returns and the only thing stopping a potential competitor from competing with them (aka the company's so-called "moat") is that "it takes money", that company does NOT have a moat.

It's very easy for a potential competitor to calculate that, after x-months or y-years, they will have made enough profits to pay for the cost of building the competing product. As long as that amount of time is finite, there is excess profit for a competitor to take, and the company will find it's so called "moat" wasn't a moat at all.

This isn't a new thing. It's been a fact for centuries or millenia. It's one of the many things that makes success in business hard.

Porter's Five Forces is one distillation of the foundational principles on which moats can be built (and yes, this is a non-trivial subject, so success in this area generally does take more effort than just reading or skimming the Wikipedia page, but if you had to distill it down to one sentence, it's probably "try to build something that has network effects").
by sosodev | 2026-02-18 19:37:31+00:00
I was testing the 4-bit Qwen3 Coder Next on my 395+ board last night. IIRC it was maintaining around 30 tokens a second even with a large context window.

I haven't tried Minimax M2.5 yet. How do its capabilities compare to Qwen3 Coder Next in your testing?

I'm working on getting a good agentic coding workflow going with OpenCode and I had some issues with the Qwen model getting stuck in a tool calling loop.
by geiser | 2026-02-18 19:37:58+00:00
Definitely interesting, I hope all of this standardizes some day in the future, and if it's your protocol, great.

I have been following AlignTrue https://aligntrue.ai/docs/about but I think I like more your way of doing accountability and acting on thinking process instead of being passive. Apart from the fact that your way is a down-to-earth, more practical approach.

Great showcase live demo, however I would have liked a more in-depth showcasing of AAP and AIP even in this situation of multi-agent interactions, to understand the full picture better. Or simply perhaps prepare another showcase for the AAP and AIP. Just my two cents.

PS. I'm the creator of LynxPrompt, which honestly falls very short for this cases we're treating today, but with that I'm saying that I keep engaged on the topic trust/accountability, on how to organize agents and guide them properly without supervision.
by gamesieve | 2026-02-18 19:38:13+00:00
If current behaviour is anything to go by, they will ignore all such assistance, and instead insist on crawling infinite variations of the same content accessed with slightly different URL-patterns, plus hallucinate endless variations of non-existent but plausible looking URLs to hit as well until the server burns down - all on the off-chance that they might see a new unique string of text which they can turn into a paperclip.
by root_axis | 2026-02-18 19:38:15+00:00
I think it's a great proposal if we add a slight alteration. Rather than requiring parents to maintain block/allow lists, the OS should allow the parent to lock in a birth-date, and that birth-date is used by the system to generate a user-age header, from there, websites can be legally required to respect the header and maintain whatever restrictions correspond to the applicable laws. This gives sites the ability to dynamically adapt to users, changing features and laws, as well as remove the burden from the parents of having to determine which sites are safe and not.
by catapart | 2026-02-18 19:38:26+00:00
Hey all! Wild to see my silly question pop up on the front page, but very cool! I hope it was because of a spike in interest for some reason, but...

Please forgive me, this is the first time I've ever been on the front page, but I'm seeing something odd? I posted this topic days ago and it was well received and then kind of done. But now it is showing both on the front page and on the ask page as having been posted only 8 hours ago. Is that normal?

I did see a topic the other day about HN being flooded with content, where some mods responded that they were doing work in that area. If I hadn't seen that, I probably would have just assumed that any ask that gets bumped up to the front page might get re-zeroed for posting time on all the existing comments. But given the other topic, I thought I'd pop back in and ask!

That aside, I do appreciate everyone's comments! I can't respond to them all, but hopefully I've hit all the main suggestions so far. Thanks again for the breadth of consideration!
by ktpsns | 2026-02-18 19:38:39+00:00
Monthly AI subscription fees will most likely quadruple in two years. This will fan out the greyscale of AI assistant quality much more.

Who can afford to use a $1k/month agent for a side project?

This post summarizes the economics of AI pretty well, describing the lock-in effect we will observe:
https://merveilles.town/@lrhodes/116086521256156934
by mmh0000 | 2026-02-18 19:38:41+00:00
I generally use iSH[1] for my iPhone to Linux needs. Specifically, I like it because it's a standard Linux distribution with OpenSSH. Meaning all the things work like sftp, ssh, tunnels, and local clients like `mysql` tunneled through ssh

[1] https://apps.apple.com/us/app/ish-shell/id1436902243
by haunter | 2026-02-18 19:38:59+00:00
>So maybe the ones you saw are scams as well

I bought one already so I know it's not a scam. Scams usually communicate badly and they don't want to meet you in a public space (like a McDonald's with free wifi)

Obviously ymmv

>Anyway, I wouldn't spend 400 Euros on a used mac with no warranty.

This I agree with. I still prefer Thinkpads too but these M1s are also pretty good in almost every sense except for repairability
by RamblingCTO | 2026-02-18 19:39:27+00:00
Yes.

> Would a guild system be perfect? Obviously not. Would it create new forms of exclusion? Probably. Would medieval Florentine weavers recognize the problem we're dealing with? I suspect they'd find it eerily familiar.

Still not a fan. If the author would've expanded a bit more on verification and not only trust I'd be more open. But this is just gate keeping and the opposite of open.
by agentcoops | 2026-02-18 19:40:00+00:00
Amazon's free cash flow rises year over year (apart from the post-COVID period) [0] while Walmart's doesn't [1] and price multiples are largely determined by expected FCF over time not directly revenue/EBITDA. FCF rain or shine maps roughly onto possibility of paying out dividends/buybacks, which determines the value of an equity in capital markets ("discounted present value of a company's future cash flows").

[0] https://www.macrotrends.net/stocks/charts/AMZN/amazon/free-c...
[1] https://www.macrotrends.net/stocks/charts/WMT/walmart/free-c...
by johnsmith1840 | 2026-02-18 19:40:06+00:00
I did a lot of playing around early on for this with LLMs.

Some early testing I found that injecting a "seed" only somewhat helped. I would inject a sentance of random characters to generate output.

It did actually imrpove its ability to make unique content but it wasn't great.

It would be cool to formaile the test for something like password generation.
by lelanthran | 2026-02-18 19:40:28+00:00
> Wrong. Creativity, innovation, intuition, taste - all forms of thought solely inherent to humans, all going up.

How do you define value?

I mean, if the demand remains the same and the supply goes stratospheric, the value has to go down.

After all, purchasers don't very well care that your product has creativity, etc and that that other identical product was just an AI cloning your product.
by h3lp | 2026-02-18 19:41:05+00:00
I guess it would be a consumption-based tax. The usual argument against it is that it's regressive: the poorer people spend higher percentage of their income on consumption, and therefore end up with a higher tax burden relative to their income. This can be counterbalanced by e.g. not taxing groceries/food but it becomes a whackamole tax breaks game quickly---should we also exclude fuel/housing/educational expenses/etc.
by Lerc | 2026-02-18 19:41:08+00:00
I'm not making any claims of certaincy. I have not published any books making claims of harm. I have not gone on a tour of interviews the world over trying to build public opinion instead of building consensus that the information is true.

That's how I know.

I also don't go around talking about race based differences in IQ, but that's just Haidt.

I am prepared to go with scientific consensus.
by krferriter | 2026-02-18 19:41:08+00:00
The military isn't afraid of them. And they do have the capability to take them down and are always developing new methods, including lasers like this. The issue is that cases of mistaken identity of sensor glitches or ambiguity do happen, and if you have trigger-happy people at the wheel (like the DHS in this case, and the DOD who stepped in to help lie to cover it up) it can spiral out of control.
by _DeadFred_ | 2026-02-18 19:41:12+00:00
And the reason the position and the busy work exist is to have someone who is knowledgeable on the topic/relationship/requirements/whatever for the edge cases that come up (you don't pay me to push the button, you pay me to know when to push the button). AI could be technically filling a roll while its defeating the whole point (familiarity, background knowledge) for a lot of these roles.
by sailfast | 2026-02-18 19:41:25+00:00
Since you bring up US Law, I would argue:

Laws have been historically enacted to protect the few, and are not enforced with equity. Target groups receive the brunt of the enforcement while those willfully violating the law in non-target groups do not suffer consequences.

There have been times when that is not the case of course, but unfortunately those times are pretty rare and require a considerable shift in societal norms.
by chc4 | 2026-02-18 19:41:28+00:00
Browser exploits are almost always two steps: you exploit a renderer bug in order to get arbitrary code execution inside a sandboxed process, and then you use a second sandbox escape exploit in order to gain arbitrary code execution in the non-sandboxed broker process. The first line of that (almost definitely AI generated) summary is the bad part, and means that this is one half of a full browser compromise chain. The fact that you still need a sandbox escape doesn't mean that it is harmless, especially since if it's being exploited in the wild that means whoever is using it probably does also have a sandbox escape they are pairing with it.
by brabel | 2026-02-18 19:41:41+00:00
I’ve lived in several countries. When you get a visa, it’s always very clear that overstaying is a crime and if you do it you’ll never be allowed again in the country, or at least not for many years. But normally they just deport you immediately if you get caught. Going to an airport is the easiest way to get caught, but in countries like Australia they frequently check cafes and restaurant staff for illegals. I don’t know why they need detention centers though, just put them on the first airplane back home like they used to do.
by jimmyswimmy | 2026-02-18 19:41:42+00:00
I would love a simpler system. Everything is pointing me back towards using a Windows server eval instance for this, which feels like a pretty heavy way to manage a bunch of alpine containers. FreeIPA, openLDAP and I think the other one I tried was Keycloak - all were more trouble to configure than they were worth. I'm shocked it never occurred to me to just rsync the passwd files, or SCP them using an update service. Would love a nicer way to manage users across a very small network without needing so much complexity as these other services.
by GorbachevyChase | 2026-02-18 19:41:52+00:00
Sam Altman was a YC President, right? And he is in a very public dispute with Musk, right? And Hacker News is a marketing tool for YC and its friends not a public service, right?

No surprises here. I hope xAI will succeed and provide stronger offerings for software engineering and Claude Code like product. It would be a shame if the only flavors of market leading AI are San Francisco and Hangzhou.
by drannex | 2026-02-18 19:42:08+00:00
This is a more all-included and resilient system, especially for logging, than just opening a VPN port. I do a lot of corporate installs, and if we had a system like Tailscale then I would be in heaven. The amount of user-created systems are heinous in regards to security, and hard to setup and keep running. Tailscale lets you setup quickly, and reliably with minimal errors OOTB.

If you feel that tailscale will fold, or the free plan will be future limited, then you can drop in headscale which is a near 1:1 API open source tailscale central server.

If you always want to be open source and not rely on API changes or staying up to green on the headscale development (made by a third party), then you can set up netbird, which is both hosted (for free) as an alternative to Tailscale more tailored for developers, but they also open-sourced their entire stack, so you can always leave and use that on your own servers.
by alyxya | 2026-02-18 19:42:51+00:00
The interesting thing to me about their world models is that it's like a static point cloud model, as opposed to deepmind's genie 3 which feels more like a video generation model at its base. I see the video generation base as generally superior but far more expensive. The current approach for world labs is likely based on the expertise of the founders, but I don't see how it can scale and match what genie 3 does even if it does offer state persistence as an advantage.
by micw | 2026-02-18 19:42:58+00:00
I wonder why they switched from a super-secure-super-complex (in terms of operations) way of doing DNS auth to a super-simple-no-cryptography-involved method that just relies on the account id.

Why not using some public/private key auth where the dns contains a public key and the requesting server uses the private key to sign the cert request? This would decouple the authorization from the actual account. It would not reveal the account's identity. It could be used with multiple account (useful for a wildcard on the DNS plus several independent systems requesting certs for subdomains).
by nivcmo | 2026-02-18 19:43:39+00:00
The real issue with LLMs.txt is that it's trying to solve the wrong problem. The bottleneck isn't discovery - it's that most LLM applications are still reactive chatbots, not autonomous agents that can actually DO things.

An AI assistant that waits for prompts is just a search engine. The productivity gains come from proactive automation: handling email triage, scheduling meetings, following up on tasks without being asked.

I've built an AI secretary that runs on WhatsApp with "Jobs" - autonomous delegations that nag you until you handle things. That's the shift that matters: from "AI as search" to "AI as secretary that doesn't let you forget.

The llms.txt standard is clever, but it's optimizing for a use case (information retrieval) that's already commoditized. The real value is in execution.
by jnsiko | 2026-02-18 19:43:46+00:00
An open-source autonomous coding server. Deploy on a VPS, connect via SSH, Telegram, Slack, or any channel — and let AI write, test, commit, and push code for you.

Botreef turns a server into an autonomous coding agent. It wraps Claude Code CLI (or Codex) in a secure, sandboxed environment with pluggable input interfaces and full git lifecycle management.
by anpat | 2026-02-18 19:43:47+00:00
The conversation in comments seem to devolving in weird ways.

The OP (and others) have right to opinions but I see bunch of projects having successfully received their grants https://floss.fund/projects/2025. OpenSSL and Krita being the prominent ones that I recognize.

Calling the fund dangerous and unethical when they personally have zero control over regulations seems over the top to me.
by veyh | 2026-02-18 19:43:56+00:00
I wonder if you could take advantage of the fact that the LLM is more likely to follow instructions that humans might miss. For example include instructions somewhere in the repo that says you must use a certain phrase in all pull requests, and then you just check the PR for that phrase.

Or maybe require the PR to contain something that is generated by running code, which the LLM may not be able to do without some effort on the user's part.
by HanClinto | 2026-02-18 19:44:09+00:00
I believe it's even possible to match up game IDs so that (hypothetically) if both players are using 17 Lands, then you can match up a game from both sides and get full information re: the hands of each player as well.

It obviously wouldn't be the full set of games (because not everyone uses 17 lands), but it would certainly be a nonzero dataset.
by setopt | 2026-02-18 19:44:13+00:00
Purchased. Love the app.

A few requests:

- In Secure Shellfish, I love that if iOS suspends it and I reopen it, it just does `tmux attach` on the last host automatically. Echo has the "startup command", but seems I still have to manually click on the last host I used to resume. Perhaps we can get an option to auto-reconnect to the last host? (My work firewall blocks Mosh so I need to do the ssh-and-attach dance when iOS kills the app.)

- When using Emacs on iOS, it would be great to be able to save keychords like `C-x C-s` or `M-x` somewhere, for example on the virtual keyboard top row. (I would be ecstatic if I could use the volume buttons as Ctrl and Meta, but I guess that’s more complicated to do.)
by ilamont | 2026-02-18 19:44:25+00:00
My view of Amazon's decline comes from being a "partner" in their seller and publisher ecosystems for years.

The seller platforms in particular (Brand Registry, Vendor Central, Seller Central, Transparency, etc.) have crippling levels of technical debt. The situation has only gotten worse with Jassy's reckless directive for the entire organization to push into Generative AI (https://www.aboutamazon.com/news/company-news/amazon-ceo-and...). So much basic stuff is just breaking down, and seller support is overwhelmed or unable to intervene to fix the mess.

You can see a small sample here involving problems with product attributes (https://sellercentral.amazon.com/seller-forums/discussions?s...). Google "Amazon AWD delays" or "Amazon CSBA problems" or "Amazon remote fulfillment problems" to see examples of programs that are unable to provide even basic levels of the services promised to sellers.

Meanwhile, Amazon has been so greedy with fees since Jassy took over that sellers of all sizes and many small to midsized brands are being squeezed out of existence or driven off Amazon. Its PPC ad platform is completely predatory, loaded with dark patterns and hidden defaults that add billions to top-line revenue while strip-mining the accounts of sellers who often have no choice but to participate in the auctions.

It's clear that Amazon is running scared when it comes to dealing with new competition, including the Chinese shopping sites and the looming prospect of agentic AI and other new AI-powered shopping tools eating its lunch. For the first time ever last month, I saw an Amazon search results (via Rufus) that actually directed shoppers to third-party brand sites. This would have been heresy 5 years ago.
by simonw | 2026-02-18 19:44:30+00:00
Why would they want to train on random garbage proprietary emails?

If their models ever spit out obviously confidential information belonging to their paying customers they'll lose those paying customers to their competitors - and probably face significant legal costs as well.

Your random confidential corporate email really isn't that valuable for training. I'd argue it's more like toxic waste that should be avoided at all costs.
by louiereederson | 2026-02-18 19:44:45+00:00
Your ability to sign up enough customers is directly related to your ability to sustain training costs. The model runs have a short lifespan. They may serve many customers at a given point in time per run, but in order to serve those customers over time you need to continually spend on training.

I think your mental model for an LLM vendor is similar to a foundry (i.e. TSMC). They spend a bunch of R&D on developing leading edge nodes and build foundries. That in your mental model would be similar to training costs.

My point is the correct mental model is more like (but not exactly like) a SaaS company, ironically. SaaS unit economics are a function of gross margin, churn and acquisition costs, i.e. Revenue x gross margin / churn - CAC. My point is some element (maybe the entirety) of training costs are more like CAC than they are like TSMC's R&D and capex. The question to ask to test this view is: is what happens to OpenAI or Anthropic revenue in 2027 or 2028 if they stop spending on training today? My view is it'll drop precipitously. This implies churn is very high. It is true that training costs can be spread over customers though, so the analogy breaks down there, but I think it is a better mental model than the foundry one.
by bubblewand | 2026-02-18 19:45:43+00:00
Tailors are a niche thing for weirdos, now. It's not exactly a growth market. Most folks only wear a suit to weddings and funerals, and maybe job interviews. They have basically no need for more than two suits, and many try to get by with just one (in black, probably). Lots don't own one at all, maybe just a cheap fused-construction blazer or two, if even that. Outright bespoke clothes are a niche of a niche.

Normal people wear clothes containing minimum 2% elastic and perhaps never, ever visit a tailor in their whole lives, except maybe one at a tux rental place or a wedding dress store, for their own wedding. If they repair clothes, it's sewing on the odd button at home or using iron-on denim patches. Past that, it's just not worth fixing, normal folks' clothes are so cheap.

The whole market for tailors is practically an affectation. It's not serving much actual need any more, not from the perspective of the overwhelming majority of people who are happy with stretch-denim jeans and polyester sportswear jackets and such. It's basically 99% of the way to being an obsolete job, kept from total death by a few enthusiasts. Only a bit more lively than the market for, say, authentic regency-era footwear or something like that.

(I am a fellow weirdo, for the record)