MurphyA/hacker-news huggingface dataset:
by bigstrat2003 | 2026-02-24 20:54:13+00:00
Your post is addressing a strawman, not what I said. But to answer the words you so ungraciously put in my mouth:

> So... no food and safety regulations, because life is not safe, and people should have the freedom to poison food with cheaper, lethal ingredients because their freedom matters more?

This is harm to others and is very obviously something we should enforce. There are unreasonable laws about food (banning the sale of raw milk cheese for example, which most of the world enjoys with perfect safety), but by and large they are unobjectionable.

> You're right that things can't be made more safe without taking away the freedom to harm people. Which is why even the most freedom-loving countries on earth strike a balance.

I never said I was opposed to striking a balance. Of course we can strike a balance. Indeed we already have when it comes to installing apps on Android. But these measures are being advanced as if safety were the only consideration, which it isn't.

> You're taking the most extreme libertarian stance possible.

No, that is what you have projected onto me. That's not actually what my stance is.
by umairnadeem123 | 2026-02-24 20:54:28+00:00
the BLE company identifier approach is clever but fundamentally limited. MAC address randomization means you cant track individual devices, and the company ID only tells you the manufacturer - so any Meta headphones or Snap peripherals will trigger false positives.

a more robust approach would be to look at the full advertisement payload. smart glasses with cameras tend to advertise specific GATT services for live streaming or firmware updates that headphones dont. combining the company ID with service UUID patterns and advertisement interval timing would significantly reduce false positive rates without needing any active scanning.
by umairnadeem123 | 2026-02-24 20:55:25+00:00
the technical middle ground that nobody in this thread is proposing: tiered permissions based on installation source. play store apps get the current permission model. sideloaded apps get a more restrictive default where sensitive permissions (notification reading, accessibility services, SMS access) require a 24h delay before activation plus periodic re-confirmation.

this is how iOS already handles some developer-signed apps with provisioning profiles. the binary still runs but certain entitlements are restricted unless you jump through additional hoops. android could implement something similar at the OS level without requiring developer registration at all - just make the dangerous capabilities harder to grant for non-store apps, not impossible.
by nineteen999 | 2026-02-24 20:55:30+00:00
It depends where you lived. In my city (harshest/longest restrictions in the world), we were not allowed to leave the house for more than 30 minutes a day for 2.5 years unless we were out buying groceries. No large gatherings allowed at our homes. Mask usage enforced everywhere in public.

In the city in my country reknowned for having a much higher level of hypochrondria before the pandemic, imagine the mental health issues my city is going through now.
by fusslo | 2026-02-24 20:55:33+00:00
When I was in SF, the coworkers who drove in were those who lived outside of the city who were trying to save money and raise family. Buying a home in the city is impossible for these people (and me). Mostly less prestigious jobs, like cleaners, technicians, office managers. Not the App guys making 300k living in the Marina.

It's often an unintended tax on the poor.

IDK maybe there's some middle ground where we beef up public transport while beefing up parking at stations.
by andai | 2026-02-24 20:55:42+00:00
Interesting. This has to do with the "instruction following" aspect, right? I saw that GPT models do a lot higher than Claude on those benchmarks.

I haven't done my own tests, but I did notice a lot of models are very low there. You'll give them specific instructions and they'll ignore them and just pattern match to whatever was the format they saw most commonly during training.
by seanhunter | 2026-02-24 20:55:47+00:00
People often use that example, but Newton, for all he was unquestionably a giant of physics, was a bit of a weird dude and not 100% rationalist[1]. Additionally, just because he was a great physicist doesn't mean he knew anything at all about investment. You can be an expert in one field and pretty dumb in others. Linus Pauling (a giant in chemistry) had beliefs in terms of medicine that were basically pseudoscience.

Intelligent investor is a great book though.

[1] eg he wrote more than a million words on alchemy during his lifetime https://webapp1.dlib.indiana.edu/newton/project/about.do
by snowhale | 2026-02-24 20:56:03+00:00
the worktree pre-warming detail is interesting -- keeping a reserve pool and letting new tasks claim one instantly is the same pattern as connection pool pre-warming in databases. the underlying bottleneck is probably git having to traverse pack files and update the index when you run 'git worktree add'. one thing worth trying if you haven't: sparse checkout on the worktrees can cut that initialization time further, especially in large monorepos where most files are irrelevant to a given agent task.
by philipkglass | 2026-02-24 20:56:06+00:00
I was the person who emailed him about it earlier.

2024-09-05, me:

On another topic, I just noticed that the 700+ comments on https://news.ycombinator.com/item?id=41445413 all render on a single page. Hurray! Is the pagination approach obsolete now? I know that you've commented several times about wanting to optimize the code so pagination wasn't necessary. I don't know if that's finished or if pagination will have to go on the next time there's a big breaking story.

Dan G:

Yes: the performance improvements I've been working on for years finally got deployed, so pagination is turned off for now.

(In case you're curious, the change is that Arc now runs over SBCL instead of Racket.)

...

Btw you're the only person I know of who's noticed this and pointed it out so far!

I have very mixed feelings about how much I know about this site.
by gpu_systems | 2026-02-24 20:56:09+00:00
I built a deterministic PCIe transport validation tool for NVIDIA GPUs.

It measures:

- CUDA memcpy throughput (H2D / D2H)
- NVML PCIe bus-level traffic
- Negotiated link state (pre/post load)
- Replay counter deltas
- AER error counters
- Clock state transitions
- NUMA affinity and system signals

The goal is to validate transport health from the negotiated PCIe link state down to actual transfer behavior.

This is not a compute benchmark. It focuses strictly on transport integrity and link behavior.

Built for Linux using CUDA + NVML.
by umairnadeem123 | 2026-02-24 20:56:14+00:00
forth is one of those languages where building the interpreter teaches you more about computing than using it ever will. the key insight is how simple the execution model actually is - a stack, a dictionary of words, and an inner interpreter thats maybe 20 lines of C. everything else is built on top of that.

if anyone wants to go deeper after this challenge, jonesforth (https://github.com/nornagon/jonesforth) is a fully bootstrapping forth in x86 assembly with excellent literate comments that walk you through every design decision. you end up understanding how a language can be built from nothing but a handful of machine instructions.
by jasonriddle | 2026-02-24 20:56:18+00:00
It's been little things and mainly usability/polish things.

Sometimes the vault doesn't unlock and I have to enter in my password 2-3 times.

It doesn't always capture all information from a page properly when creating a new login and there are additional fields to capture.

The "detecting if a website supports key passes and one time password" feature for Watchtower was overwhelming with lots of information, until I clicked each one and had to ignore it.

These reasons alone are not enough for me to leave, the 3 big problems are below.

1 - I was feeling more uncomfortable having websites promote using passkeys, and I would store that in 1Password, but then I wasn't sure if 1Password as going to make it easy to migrate that stuff out. So, I want to use something open source, so I don't have to worry about losing access/managing that stuff in a propertiery/closed product. It might be easy to export/migrate out today, until something changes and they no longer allow that or make it very difficult/hard to scale/automate.

2 - I have a strong feeling this price increase is being justified by "AI" somehow. I'm sure, like all other companies, 1Password is internally forcing/requiring its developers to use coding models, and sonnet, opus, etc are expensive to use and the cost adds up. Also, I don't like the direction of where things are headed, where people are becoming more relaxed and not reviewing code properly and merging in code that will cause security issues later (perhaps openclaw fits into this bucket) or they are taking open-source code they laundering it for companies internally to use (I can't prove this, but if a model is trained on public data/code, it seems very likely). Something about that just bothers me.

3 - I've spent the last 3 years building up my homelab and using Pikapods for hosting various things. I want to support open-source more and run my own things and pay supporters properly to maintain things. I've always been a bit nervous what might happen if 1Password gets hacked, either because of poor security or due to a third party vendor. I still have the problem of my things getting hacked, but I pay more attention to how I secure things and use Tailscale and not publish things on the broad internet (when it makes sense). Also, I would be a hypocrite to dismiss the value of coding llms, as I'm using them myself. But how I'm using them, I'm using them to do security reviews of my docker compose files or kubernetes yaml files. Having coding llms has made it so much easier to maintain a homelab.
by adverbly | 2026-02-24 20:56:38+00:00
What do we think? Is this possible without AGI level breakthroughs?

If we see a continuation or even a slowdown of the current trend, the technology overhang, lagging productization, and catch up from the slow adoption of AI by businesses probably gets them part of the way there, but I don't know about 1000% growth at this point... Seems kinda like they're banking on another breakthrough no? And if they don't get the breakthrough, the downside risks such as a competitor of some sort destroying their margin can't exactly be ignored...
by giancarlostoro | 2026-02-24 20:56:41+00:00
Are you using either CLAUDE.md or .claude/INSTRUCTIONS.md to direct Claude about the different agents?

Also, be aware that when you add new instructions if you don't tell claude to reread these files, it will NOT have it in its context window until you tell it to read them OR you make a new CC session. This was a bit frustrating for me because it was not immediately obvious.
by umairnadeem123 | 2026-02-24 20:57:14+00:00
the security implications here are underrated. CSS is evaluated in contexts where javascript is explicitly blocked - email clients, markdown renderers with sanitizers, CSP-restricted pages. if CSS can do computation, those security boundaries are weaker than people assume.

the practical attack surface is small today because the clock mechanism is slow and the instruction set is limited. but the trajectory of adding more computational features to CSS (functions, conditionals, typed custom properties) means the gap between "theoretically turing complete" and "practically exploitable" keeps shrinking. browser vendors should be thinking about this now, not after someone demonstrates a CSS-only data exfiltration attack in a webmail client.
by umairnadeem123 | 2026-02-24 20:58:00+00:00
the fundamental issue this thread keeps circling around is that encryption-at-rest and process isolation solve different problems, and neither alone is sufficient.

encrypting .env prevents accidental commits and file reads. process isolation (proxy/surrogate credentials) prevents the agent from ever seeing real tokens. but most people need both because the threat model has two distinct adversaries: the agent itself (which might exfiltrate via tool calls or prompt injection) and accidental leakage paths (logs, error traces, shell history).

practically, the cheapest effective setup ive found: sops+age for the .env, a separate unix user for the agent with restricted filesystem permissions, and API keys scoped to the narrowest possible permissions with IP allowlisting where the provider supports it. total setup time is maybe 30 minutes and covers 90% of realistic attack surface.
by bpmct | 2026-02-24 20:58:06+00:00
I haven't developed on the Kindle ecosystem, but with old Nook devices I am able to set a screensaver, alarm, and put the device into deep sleep between refreshes. This changed my battery life from ~48 hours into 30+ days of battery life even with some old devices.

The "electric sign" app does this, which is where I referenced the code.

With the trmnl app for nook I wrote, the image only refreshes every 10 mins so the device will set a ~9 minute alarm to wake the device right before it needs to load the next update.
by pas | 2026-02-24 20:58:07+00:00
If those bad decisions have a lot of higher order effects and they turn out to be very costly for society, then limiting freedom seems worth it.

And it seems Google thinks society is beginning to unravel in SEA due to scammers. Trust breaks down, people stop using phones to do important things, GDP can shrink, banks go back to cheques, trees will be cut down!!

It's bad to let people go and catch the zombie virus and the come back and spread it, right?

...

I don't like it, but the obvious decision is to set up a parallel authority that can issue certificates to developers (for side loading), so we don't have to trust Google. Let the developer community manage this. And if we can't then Google can revoke the intermediary CA. And of course Google and other manufacturers could sell development devices that are unlocked, etc.
by barumrho | 2026-02-24 20:58:07+00:00
I'd say it's mainly to do with browser/iOS plugins not being responsive. I find myself often resorting to opening the app and copying and pasting the password or other info because autofill function doesn't work on different websites.

Otherwise minor UI things like categories on the sidebar which made it easy to navigate, but they got rid of it a while back.

Good luck with your project!
by switz | 2026-02-24 20:58:11+00:00
This is pretty wonderful and comes with some complicated AI-world incentives that I've been ruminating on lately. The better you document your work, the stronger contracts you define, the easier it is for someone to clone your work. I wouldn't be surprised if we end up seeing open source commercial work bend towards the SQLite model (open core, private tests). There's no way Cloudflare could have pulled this off without next's very own tests.

Speaking more about the framework itself, the only real conclusion I have here is that I feel server components are an misunderstood and under-utilized pattern and anyone attempting to simplify their DX is a win in my book.

Next is very complex, largely because it has incrementally grown and kept somewhat backwards compatible. A framework that starts from the current API surface and grows can be more malleable and make some tough decisions here at the outset.

Crazy to see it's already being run on a .gov domain[0]. TTFGOV as a new adoption metric?

[0] https://www.cio.gov/
by kbolino | 2026-02-24 20:58:22+00:00
Whole-file encryption with authentication is also more tamper-resistant. Basically the only thing an adversary can get away with there is rolling back the entire file to a previous version.

Whereas, any incrementally encrypted format has the additional risk of piecewise manipulations. For example, while SQLCipher authenticates each page, it doesn't authenticate the entire file, allowing for pages to be deleted, reordered, or duplicated (though duplication is easy to detect since each page has its own IV). The end result will generally just be a corrupted database, which will probably get detected by PRAGMA integrity_check, but compared to KDBX, this will not be detected by default nor is it guaranteed to be detectable at all.
by markus_zhang | 2026-02-24 20:58:58+00:00
I think gene and characteristics are more important than knowledge and degree. I happen to have two parents who are both in education, one teaches in university and one teaches in middle schools. Because of this I also know many friends whose parents are also teachers.

Without any statistical significance, but nonetheless the sample size is greater than 5. None of us consider their parents to be great, or even good teachers. All kids squandered sometime after they are free from the parents, usually in universities.

This experience impacts me so much, that I have a bias that teachers should not teach their own kids.
Show HN: CharityVerify – Trust scores for 138K Canadian charities
by buchler | 2026-02-24 20:59:26+00:00
I built CharityVerify to make Canadian charity data actually usable.

The Canada Revenue Agency publishes T3010 forms for every registered charity, but they're scattered across clunky databases with no standardization or comparability. I collected 15 years of filings for all 138,203 charities and built a trust scoring system on top.

Stack:
- Python + Playwright for CRA data collection (4s rate-limited)
- PostgreSQL (Supabase) — 12 T3010 tables, 138K charities, 457K directors, 362K directorship links
- Express.js REST API on Fly.io
- Daily GitHub Actions sync for new filings
- On-demand narrative generation via Claude Haiku

Scoring algorithm:
Three 0-100 scores per charity:
1. Legitimacy (filing consistency, directorship stability, CRA compliance)
2. Effectiveness (program spending ratio, overhead, donation efficiency)
3. Compliance (sanctions screening, FATF risk, political activity limits)

Each charity gets a letter grade (A+ to F, or NR for insufficient data).

Findings:
- Only 186 out of 85,507 registered charities scored A+
- Average effectiveness score: 51.6/100
- 487,692 flags generated (directorship overlap, compensation issues, filing gaps, etc.)

The core search/view is free. I'm building a tiered REST API for professional use cases (due diligence firms, grant-making orgs, etc.).

Code is closed-source for now, but the underlying CRA data is public domain. Happy to discuss the data pipeline, scoring methodology, or data collection approach.
by giancarlostoro | 2026-02-24 20:59:27+00:00
> So far my experience with skills is that they slow down or confuse agents unless you as the user understand what the skill actually contains and how it works. In general I would rather install a CLI tool and explain to the agent how I want it used vs. trying to get the agent to use a folder of instructions that I don't really understand what's inside.

For Claude Code I add the tooling into either CLAUDE.md or .claude/INSTRUCTIONS.md which Claude reads when you start a new instance. If you update it, you MUST ask Claude to reread the file so it knows the full instructions.
by jodrellblank | 2026-02-24 20:59:47+00:00
> "pure HTTPS port 443 -- you literally can't block it without breaking the web."

Sure you can, you do Man In The Middle certificate inspection and then filter it aggressively like it was HTTP; that's the product companies like ZScaler offer, and basically any business/enterprise firewall device - internet filtering to protect your company and prevent or detect data exfiltration and malicious activity. Or perhaps you could say that does 'break the web' but companies do it anyway and pay a lot of money so they can do it. (ZScaler is a $23Bn market cap company).
by stackghost | 2026-02-24 20:59:50+00:00
I use emacs regularly, and I think the complaints against it are perfectly valid. Emacs awesome in lots of ways, but it also really, really sucks in lots of other ways.

But putting emacs aside, the SBCL tooling seems reasonable to me. The real reason I rarely reach for lisp these days is not the tooling, but because the Common Lisp library ecosystem is a wasteland of partial implementations and abandoned code bases.

It's also been my experience that LLMs are better at writing more mainstream languages, especially "newbie-proof" languages like Go.

In any case, I don't see why one would reach for Allegro or Lispworks over SBCL unless one really enjoys writing lisp by hand and needs specific features they offer that SBCL doesn't. I would imagine those features are vanishingly few.
by arjie | 2026-02-24 20:59:55+00:00
Electronic audit trail makes SOC2 report easier for auditors. You can use paper trail instead, but electronics makes it easier. Few things in the world are required, but some of these compliance things are 'viral' in that if you're a vendor to a guy who needs compliance you need to practice the standards as well.

Besides, visibility is sufficient as a deterrent. Back in India, there'd be a big difference between leaving an old man in a chair in front of the shop and having exactly zero people in front of the shop. There are classes of people you deter with the former who will not be deterred by the latter. The old man is not 'security' - anyone motivated can shut him up without much effort. And yet his presence works.
by onecommit | 2026-02-24 21:00:07+00:00
Interesting thoughts - thank you! And directionally agree - given that agents are becoming ever better, they'll take more and more of the orchestration on themselves. Still, we believe that developers need an interface to interact with these agents; see their status and review / test their work. Emdash is our approach for building this interface of the future - the ADE :)
by hn1986 | 2026-02-24 21:00:11+00:00
Lots of good info here:
https://pmc.ncbi.nlm.nih.gov/articles/PMC11771116/

Look up some of the more recent treatments - many of which will get better with time. That's why detecting Alzheimer's early is a big deal
https://en.wikipedia.org/wiki/Lecanemab
by nick238 | 2026-02-24 21:00:22+00:00
US healthcare is a leader in administration fees (e.g. paying health system executives) compared to other countries around the world. High US healthcare cost isn't because of increased usage, but because of the higher admin fees and higher prescription drug prices. Prices are fixed high because law prevents the government from negotiating prices (o.b.o. Medicare/aid), and those provisions were inserted on behalf of pharmaceutical companies so their executives could make more money.

Paying individual workers more may have some benefits, but I think the key issue is usually overworking and burnout because the incremental cost of adding a whole new employee is way higher than just pressuring workers to do more work in the same time.