MurphyA/hacker-news huggingface dataset:
by ildar | 2026-02-25 19:20:33+00:00
I run AI agents on my laptop 24/7. One day I realized my agent had unrestricted access to my SSH keys, AWS credentials, and crypto wallet. No prompt injection needed - it already had permission.

Tools like LlamaFirewall (Meta) and NeMo Guardrails (NVIDIA) protect the prompt layer, but nothing protected the host machine itself.

ClawMoat is the missing layer:

- 4 permission tiers (observer to full), enforced at runtime
- Forbidden zones - auto-protects ~/.ssh, ~/.aws, browser data, wallets
- Credential monitoring - alerts on access attempts
- Skill/plugin auditing - hash verification + suspicious pattern detection
- Network egress logging - see where your agent sends data

Zero dependencies, sub-millisecond, 142 tests, MIT licensed.

Comparison with LlamaFirewall and NeMo Guardrails: https://clawmoat.com/blog/clawmoat-vs-llamafirewall-nemo-gua...

Happy to answer questions about AI agent security architecture.
by NikolaNovak | 2026-02-25 19:20:34+00:00
One thing I've found, occasionally the hard way, is that helpful bystanders are always offering advice based on "ethical", "intuitive", "logical" and "common sense", usually without any aspect of "legal".

I got divorced a decade ago, and every well-wishing person in my life was strongly urging me to do things which were shockingly counter-productive / dangerous / wrong, based on their confident understanding (assumption, really) of the law which was completely and dangerously inaccurate.

Hacker News audience is global. People start accounts for various purposes. Yet people still freely share the notion that logging in to some unknown website run by an unknown company from a hard to spell country and then touching things is universally safe.

I miss the old "IANAL" tag which at least provided basic warning and self-awareness :-).
by zahlman | 2026-02-25 19:20:42+00:00
> Even the most used feature, coding, causes chaos without strict human oversight.

s/Even/Especially , I would think. Everyone's idea of how to get any decent performance out of an LLM for coding, entails allowing the code to be run automatically. Nominally so that the LLM can see the results and iterate towards a user-provided goal; but it's still untrusted code.
by notatoad | 2026-02-25 19:20:57+00:00
did we not read the same article? i saw three main claims in the article:

- removing stops makes the bus faster: obviously true.

- bus stops in america are closer together than bus stops in other places: backed up by data in the article.

- making the bus faster makes it better for riders. subjective, but as a bus rider i very much agree.

i don't understand how you can read this article and come to the conclusion that it's about making bus stops "nicer". that's just a little tangent it mentions. it'd be nice if bus stops were nicer.
by _whiteCaps_ | 2026-02-25 19:21:01+00:00
A few things that I've needed to deal with in my off grid setup:

I like the MidNite solar controllers.

LiFePO4 batteries are great, with a few caveats:

- you must use batteries from the same batch, ie you can't upgrade capacity piecemeal, to avoid degrading the new ones
- cable lengths are important because even small differences in resistive losses between batteries can mean that one battery is doing more charging / discharging
- you can't charge below 0\*C, which I'm assuming could be a problem in New England
by rsynnott | 2026-02-25 19:21:12+00:00
There are simulators for this, and of course there's data from places that have actually done it.

In Dublin we have a bit of a mixture of newish bus routes which largely have a sensible number of stops, and ancient routes (the oldest evolved out of tram routes laid out in the 1870s), which tend to have a stupidly high number of stops, because once you put one in it's very contentious to remove it. The super-regular stop routes are _so slow_.
by Imustaskforhelp | 2026-02-25 19:22:02+00:00
Such data analysis of HN related things are always so fun to read. Thanks for making this!

I have a quick question but can you please tell me by what's the age of "new" accounts in your analysis?

Because, I have been called AI sometimes and that's because of the "age" of my comments sometimes (and I reasonably crash afterwards) but for context, I joined in 2024.

It's 2026 now, Almost gonna be 2 years. So would my account be considered new within your data or not?

Another minor point but "actually"/"real" seems to me have risen in usage over 5 times. All of these words look like the words which would be used to defend AI, I am almost certain that I saw the sentence "Actually, AI hype is real and so on.." definitely once, maybe even more than once.

Now for the word real, I can't say this for certain and please take it with a grain of salt but we gen-z love saying this and I am certain that I have seen comments on reddit which just say "real" and OpenAI/other models definitely treat reddit-data as some sort of gold for what its worth so much so that they have special arrangements with reddit.

So to me, it seems that the data has been poised with "real". I haven't really observed this phenomenon but I will try to take a close look if chatgpt is more likely to say "real" or not.

Fwiw, I asked Chatgpt to "defend the position, AI hype sucks" and it responded with the word "real"/"reality" in total 3 times.

(another side fact but real is so used in Gen-z I personally watch channel shorts sometimes https://www.youtube.com/@litteralyme0/shorts which has thousands of videos atp whose title is only "real", this channel is sort of meme of "ryan gosling literally me" and has its own niche lore with metroman lol)
by ben_w | 2026-02-25 19:22:26+00:00
Notwithstanding that I do not believe he is competent, Musk is currently talking about turning the entire moon into a space data center factory, specifically with a capacity so large that the resulting products of said factory could freeze the tropics just by blocking out the sun.

It is fortunate for him that those of us who understand the implications of this, do not believe he can do it.

Do you believe he could do it? Would you act against him now, when most people think his success in this endevour is implausible? Or wait until he demonstates all the parts necessary, at which point action against him is impossible? Or do you believe his claims that him doing this will render work unnecessary rather than, as I fear, making it impossible without also making it unnecessary?

What about everyone else that you think would be on your side? If you need everyone on-side, timing matters too.
by hparadiz | 2026-02-25 19:22:32+00:00
I did the same thing in PHP before. Issue was a foreach over a foreach with a search. The fix was to build the result set as you populate the main array of objects. Basically as you add stuff to the array if there's a value that matches you throw it into another "results" array for any cardinality (unique value) that exists. Since in PHP objects are always just pointers your results arrays are relatively painless. Just a series of int32 integers basically. Then when you need an answer your result is instant. I ended up getting a 80-90% speed up. This is not just a php thing either. Folks end up doing this type of stuff in every language.
by judahmeek | 2026-02-25 19:22:59+00:00
> AI is getting really good at too many things, so this feels very different.

How are you going to follow that up with a single anecdotal example?

Respectfully, shame on you.

That said, summary (information compression) along with low-level inference does seem to be the tasks that A.I. is best at right now. Little surprise there. Information compression is the sole purpose of the attention transformer in the first place.
by tinfoilhatter | 2026-02-25 19:23:00+00:00
We have no idea what brings matter into existence, because material science only takes into consideration what we can measure. We base our understanding of the material world solely on that. We can only measure an infinitesimal amount of the stuff that's out there, and anything we can't measure we come up with blanket terms to describe - like dark energy or dark matter.

What if all matter and our shared reality, is a manifestation of the mind? What if we are all a single mind going through dissociative identity disorder and each of us is like an altar of a person that has multiple personalities? There are all sorts of possible explanations for phenomenal consciousness that material science shrugs off because it limits what is possible to only the matter that we are able to observe and measured, which again is a tiny fraction of all the known matter in the universe.

Edit: All of these downvotes to my original and subsequent reply are quite amusing. HN is honestly a terrible website - people just downvoting anything they don't want to hear. Why even read the website? Just speak your own thoughts into a tape recorder and play them back. Same effect.

The popular narrative must be preserved at all costs. No room for dissenting opinions on this website!
by dig1 | 2026-02-25 19:23:02+00:00
> Ask a twenty-two-year-old to connect to a remote server via SSH. Ask them to explain what DNS is at a conceptual level.

Modern IT has become a ubiquitous commodity, much like the car. You don't need to know how an engine works to drive; while that knowledge might make you more efficient, it isn't strictly necessary to get from A to B. Besides, most twenty-two-year-olds ten years ago didn't know how to use ssh, either.

However, if you want to call yourself an engineer (and work in the field), you must understand the underlying mechanics. IMHO if you want to defeat a competitor today, you don’t need industrial espionage - you just have to cut their internet and/or AI subscriptions. Modern vibe engineers would struggle to function.

> The man page is dead for most users. The RFC is unread by most developers who depend on the protocols it describes.

Well, those who are accustomed to using man pages still use them today. I find them far more accurate than whatever an AI might spit out at any given moment. As for RFCs, they were always read by a small population - either those implementing the protocols or the few of us who like to brag about obscure technical details.

> You can now write complete programs without understanding what a single line of them does... until something goes wrong in production at two in the morning and you are completely without tools to respond.

I’m not worried about this. When things go south, there will still be experts who will know how to fix them. But since those experts will be fewer and farther between, they will likely charge $1k/hr, and rightfully so. If you are in that field, more power to you! :D
by scottyah | 2026-02-25 19:23:54+00:00
That's cool, keep talking about it I guess. Why you're expecting me to provide "parallel mappings" is totally beyond me. You're in a bubble because although you seem great at researching one side, you seemingly cannot apply those same skills for the other. You just want a dopamine win from discarding whatever I say based upon whatever moral framework you've set up in your head that's gotten you to this point.
by simonw | 2026-02-25 19:23:55+00:00
I know TDD provides better results for coding agents from 6+ months of experience working this, plus confirmation from conversations with other practitioners. TDD is the key methodology used by the popular superpowers set of Claude skills by Jesse Vincent, for example.

I'm not going to be trying to irrefutably prove everything I write about in the Agentic Engineering Patterns book - that would require a credible research team and peer-reviewed papers, and that's not a level of effort I'm willing to put into this.
by testbyhuman_tor | 2026-02-25 19:23:56+00:00
This resonates. I've seen teams where backend engineers build technically correct APIs that are impossible for the frontend to use well — resulting in janky UX that nobody on the backend team ever sees.

The simplest fix I've found: have engineers (backend included) watch one real user try the feature they built. Not a QA pass — an actual person encountering it for the first time. The disconnect between "it works" and "someone can use it" becomes viscerally obvious.

Most backend engineers I know actually care about this once they see it. They just never get exposed to real usage.
by alexjplant | 2026-02-25 19:23:56+00:00
> One, the article asserts that too many stops is the main cause of low ridership in the US. I didn’t even see a correlation (which would still not prove one causes the other) between number of stops and ridership. This is the central thesis of the article.

n = 1 but this is precisely why I seldom rode the bus in college. Except for going clear across campus in the evening to apartment complexes that were a semi-substantial trek down the highway it was always quicker to walk. Walking 1.5 miles in 25 minutes was faster than a bus that made 14 stops before it got to where you were going.

I like light rail. It has the advantages of cutting through traffic and being more efficient to boot. I'd say we should adapt buses to a similar modality but anecdotally bus-only lanes don't work as well as they ought to because, as a surprise to nobody, people are bad drivers and interfere with their operation.
by unbalancedevh | 2026-02-25 19:24:00+00:00
I think it was "Smarter Every Day," but there's a YouTube channel where the guy went all-out in trying to design, source, and manufacture a simple grill scrubber 100% in the US, and failed. He got the product finished and on the market, but it was literally impossible to do it with 100% American content. IIRC, part of the problem was suppliers that lied about their sourcing, but that still represents the complete lack of availability of US sources.
by fogzen | 2026-02-25 19:24:09+00:00
I can't help but compare what happened with nuclear physics to what will happen with ASI/AGI. We could have used nuclear energy to provide abundant, clean energy. Instead we used it for warfare to kill people. All the of the brightest minds and frontier technology was directed towards killing people.

We could use AI for medical advances and to create a communist utopia without serfdom. But it's already looking like we're getting killer robots and more oppression.

Hope I'm thinking about this wrong. I fear very soon the government will begin nationalizing AI resources and forcing AI researchers to direct their efforts towards weapons systems. Similar to what happened in physics. "We have to be first to have autonomous robot armies" basically.
by xdennis | 2026-02-25 19:24:19+00:00
I used to do that too… even using the ellipses character instead of three dots. But on the other hand I'm not a native English speaker and have poor spelling (i.e. words pass spell check, but are incorrect).

That's one of the signals I use to detect if YouTube videos are AI slop. If it's narrated by a non-native speaker, it's much more likely to be high quality. If it's narrated by a British voice with a deep timber, it's 100% AI.
by maxdo | 2026-02-25 19:24:24+00:00
Well, it’s the last company who has more or less complete clue on how to build computers.

When the war will start what wit China are you going to use ? What’s even more critical who will be the one who will start manufacturing?

Yeah maybe it’s a tiny drop in the ocean , but that’s the start at least of something. Not just installing solar toilets billed as solar panels for $40k as it was under previous administration
by Aachen | 2026-02-25 19:24:50+00:00
Not sure if serious but I don't think that's precisely it. To me, it's more that it rehashes a point until it's fully beaten to death, putting obvious aspects in a list, being subtly wrong, writing a conclusion paragraph to the previous three sentences... it's boring but not because of what it writes but, instead, how it writes it. Of course, it can also be inherently uninteresting but then you should have entered a prompt that causes the autocomplete function to ramble about something you're interested in :P
by snailmailman | 2026-02-25 19:24:51+00:00
This does unfortunately actually work pretty well as a security measure. The new domains that are cheap and good for fun side projects, are also cheap for scammers.

For a while I noticed all the scam links my grandmother was getting were from ‘.top’ domains. I fully blocked it at the DNS level. Her DNS settings also block all newly registered sites for 90 days. She hasn’t ever had issues with it. But these have actively prevented her from clicking on scam links multiple times.

Facebook, google, and all the popular sites are all older than 90 days, on popular well known TLDs. My grandmother doesn’t seek out new trendy sites.

It was definitely something I considered when buying a new domain. I sorted by price, and then immediately ignored all the cheapest domains that were ~$1 because I’ve seen them being used for scams. They may be cheap but good luck using them.
by timonoko | 2026-02-25 19:25:01+00:00
Duck me sideways. I must have read this book, because I wrote Pascal-like compiler for 8080, by the order of Finnish Army in 1977. All I remember that I invented tail-recursion all by myself.

https://photos.app.goo.gl/xeDuC7LDvo2ABMGo9

Me myself find this remarkable, because I could not get to the "Digital Science"-faculty because of bad scores and inappropriate hairdo.
by terminalshort | 2026-02-25 19:25:08+00:00
Yeah, pretty much. A material emitting a previously unknown form of energy that turns out to be extremely harmful is really something you can only discover by trial and error. And what do you mean it's happening to other people? I am being exposed to all kinds of shit like PFAs and microplastics today. But it turns out that the technological progress outweighs all the environmental pollutants and accidents that it took to get here and we still live healthier and longer lives than we did before.
by pbhjpbhj | 2026-02-25 19:25:11+00:00
>post they make

Will they realise their life has devolved to pretending an LLM is them and watching whilst the LLM interfaces {I was going to say 'interacts', not this fits!} with other bots.

Will they then go outside whilst 'their' bot "owns the libs" or whatever?

Hopefully at some point there is a Damascus road awakening.
by surgical_fire | 2026-02-25 19:25:29+00:00
I was the whole time trying to figure out if it was AI.

I was ambivalent about it. The way the arguments are presented don't read as much like AI.

Perhaps it was indeed just for proofreading. Although I know that MS Word turns single dashes into em-dash. Maybe they used Word when writing the thing?

It's one of the reasons I am sort of abandoning dashes when writing and using instead semicolons.
by observationist | 2026-02-25 19:25:39+00:00
Autonomous Proxies for Execration - spam bots whose entire purpose is flooding the internet with spam so as to make identifying anything true utterly impossible. If you can't differentiate between real and unreal information in online comments, then online comments stop being a significant factor in shaping public opinion. You need to abstract - identify reliable sources of information, individuals or institutions that do the work to collect and curate.

We're already seeing this as a side effect of the mishmash of influence operations on social media - with so many competing interests, mixed in with real trolls, outrage farmers, grifters, and the like, you literally cannot tell without extensive reputation vetting whether or not a source is legitimate. Even then, any suggestion that an account might be hacked or compromised, like a significant sudden deviation in style or tone or subject matter, you have to balance everything against a solid model of what's actually behind probably 80% or more of the "user" posts online.

There are a lot of aligned interests causing APEs to manifest - they're a mix of psyop style influence campaigns, some aimed at demoralization, others at outrage engagement, others at smears and astroturfing and even doing product placement and subtle advertisement. The net effect is chaos, so they might as well be APEs.
by enragedcacti | 2026-02-25 19:25:50+00:00
For fixed route transit, speed is latency. The faster the bus can make the average trip, the tighter the timetable can be given the same number of buses. Fewer stops also improves consistency which means you can plan to arrive at the stop closer to the scheduled time, and timetables can be tightened even more by reducing the layover times that keep the bus synchronized with the time table.

Separately, the variability problem can be somewhat solved with the real-time location updates that many agencies provide. You'll still have to wait the same amount of time, but some of it can be done comfortably in your house when the bus is running late.
by mayhemducks | 2026-02-25 19:25:53+00:00
I'm really not understanding this. Doesn't the typical path for advanced technology making it into the hands of civilians start with military applications and end with it being modified for civilian use?

If the Pentagon wants Anthropic's technology because it has desirable characteristics, can it not just train its own AI models? Why can't the Pentagon build data centers full of GPUs and hire some smart people like the commercial AI providers did?

Why in this case, has the usual path for technology been flipped? Starting out as commercial tech for civilians, and then being re-purposed for military use feels unusual to me. Maybe Hegseth's "War department" has a recruiting problem.
Show HN: Penclaw.ai hire OpenClaw tenant for pentesting
by ozgurozkan | 2026-02-25 19:25:55+00:00
This idea flashed to me when someone wanted to hire me as a pentester by falsely thinking that I was an expert at pentesting on Reddit. Then I revealed to him that I am not a pentester, my AI is.

Previously, I shared an ablated closed-source LLM on Show HN.
https://pingu.audn.ai/

Penclaw is basically OpenClaw + the best abliterated model + unlimited tokens ( you share a 1 GPU VM H100 locally with 40 tenants )

It also affors a filesystem UI, Cursor like edit options, console access, one-click MCP deploy and connect, MCP marketplace that lists new pentesting and red teaming MCPs (MCPs that has objectionable actions that Claude or OpenAI models refuse) constantly.

This is an experiment to share 1 GPU VMs rather than buying mac studios for openclaw.

Feel free to give feedback obviously that's why I share it here.
by lapcat | 2026-02-25 19:26:21+00:00
> The user's other blogs also have the same telltale em dash usage and usage of “” instead of "".

Oh for fuck’s sake. Can we please stop with this nonsense? You must think my blog is LLM-generated too.

I’m so tired of the illiterate denying the humanity of the literate. How do you think LLMs were trained? On human writing.
by thesuitonym | 2026-02-25 19:26:41+00:00
Smartly, I got firstnamemiddleinitiallastname@gmail.com. I never get anybody else' details.

On the other hand... Occasionally someone gets my info because some careless person entered my email address into their system incorrectly. You'd think this problem would be solved by moving to a custom domain, but I still once in a while find someone completely ignore what I put into the form and sign me up as firstnamelastname@gmail.com.
by rozap | 2026-02-25 19:27:09+00:00
Maybe you haven't worked with someone like this? You ask them to do the simplest thing and they can't. And not like, they don't know so they go figure it out, they are just like "I don't know how to do that". Then they attempt to engineer (er, vibecode) enormously complicated solutions to solve problems that aren't problems for anyone else on the team, because other folks on the team know how to use a terminal or text editor. Like I asked someone (an engineer!) to open a text editor and he said "What's that". It's truly bizarre.
by theamk | 2026-02-25 19:27:15+00:00
not that kind of language, it does not even come with integer types or "plus" operator by default.. they do give an example of

define { minutes { dequote choose {minutes} {} = {:} <-[characters] } } { minutes {1:23} }

which does Python's equivalent of

"1:23".split(":", 1)[1]

or for a more direct translation:

def minutes(x):
return x[1:] if x[0] == ':' else minutes(x[1:])
minutes("1:23")