MurphyA/hacker-news huggingface dataset:
Show HN: Buildcage – Restrict outbound network access during Docker builds
by dash14 | 2026-02-14 16:56:16+00:00
Hi HN,

I built buildcage as part of our supply chain security efforts at work. The problem we kept running into: when you run `RUN npm install` in a Dockerfile, that command can connect to anywhere on the internet, and you have no visibility into where it actually goes. Even with pinned dependencies, a compromised package could still exfiltrate build secrets or phone home to a C2 server during the build itself.

buildcage is a Docker container that wraps BuildKit with an internal proxy. You give it a list of allowed domains, and only connections to those domains go through — everything else is blocked and logged. Your Dockerfiles stay exactly the same.

If you use GitHub Actions, it's a few lines to add to your workflow — see the quick start guide.
https://github.com/dash14/buildcage#quick-start

I want to be upfront — this is not a silver bullet. If a malicious package is delivered through a legitimate registry, the connection goes to an allowed domain and buildcage can't catch it. You should still pin dependencies, use lock files, and scan for vulnerabilities.

The way I think about it: buildcage is a last line of defense. If something slips through all your other measures, at least it can't call home to an attacker's server.

That framing is exactly why I focused on making it easy to adopt. A security tool that's hard to set up doesn't get set up. With buildcage, you add a few lines to your GitHub Actions workflow and everything just works — no certificate injection, no Dockerfile changes, no special build flags.

Would love to hear your thoughts — whether it's about the approach, the limitations, or how this fits into your own workflow.
by mfuzzey | 2026-02-14 16:56:27+00:00
I disagree.

Sure corporations have to respect the LAW in their juradiction, even if said law is unpopular or unethical.
But they don't have to, and shouldn't where ethics and human rights are involved, go beyond what is required by the law. Since Trump has come to power a lot of big organsations seem to be reversing their previous positions to gain political favour, which is wrong.

The solution is probably for them to appeal to the public. "We stand up to ICE abuse" would probably help them in the markets.

Something interesting happened recently in France where it turned out that the American subsiduary of CapGemini was selling serives to ICE. They were forced to sell that subsiduary after public outcry.
by HurairahShamsi | 2026-02-14 16:56:59+00:00
I've built GrahamBell (https://grahambell.io/) — a blockchain x telecom architecture rethinking traditional Proof of Work where:

(1) Each node mines at exactly 1 hash per second (2) Parallel mining, mining pools, capital resources, and hardware dominance provide no advantage (3) ASIC/GPU/CPU optimisation becomes ineffective (4) Mining is integrated with audio/video calls (5) Telecom (audio/video call) usage is incentivised (reverse billing per active call time) (6) Telecom is open-source and paired with mining to promote DePIN.

The goal is to remove centralisation pressures in blockchain by enabling mass participation in solo mining under network-enforced rules which can only increases with fairness, affordability, and accessibility.

Telecom (audio/video call) integration with mining, an already widely adopted infrastructure is an intentional design choice to promote adoption and real usage, which is key to maximising security, decentralisation and opening new paths for on-chain scalability.

There is a working demo and a browser-based client available. I’d recommend watching the demo first and then trying the browser client:

(1) 6-minute demo explaining how mining is capped at 1 hash/sec per node (for now): https://youtu.be/i5gzzqFXXUk (2) Browser client (no wallet or setup required): https://grahambell.io/mvp/Proof_of_Witness.html (3) Visual representation of mining during live calls: https://youtu.be/gPz7d3lGz1k

I’m assembling an early group of participants to stress-test the P2P version when released.
If interested, details are here: https://grahambell.io/mvp/#waitlist

Happy to answer questions.
by mjevans | 2026-02-14 16:57:00+00:00
I recalled there were some new instructions added that greatly help with this. Unfortunately I'm not finding any good _webpages_ that describe the operation generally to give me a good overview / refresher. Everything seems to either directly quote published PDF documents or otherwise not actually present the information in it's effective for end use form. E.G. https://www.felixcloutier.com/x86/ -- However availability is problematic for even slightly older silicon https://en.wikipedia.org/wiki/X86-64

- XSAVE / XRSTOR

- XSAVEOPT / XRSTOR

- XSAVEC / XRSTOR

- XSAVES / XRSTORS
by scrlk | 2026-02-14 16:57:24+00:00
> Claude was used to do things their guidelines prohibit (facilitate violence, develop weapons or conduct surveillance)

There's Claude Gov models for this:

> U.S. national security customers may choose to use our AI systems for a wide range of applications from strategic planning and operational support to intelligence analysis and threat assessment. Claude Gov models deliver enhanced performance for critical government needs and specialized tasks. This includes:

> * Improved handling of classified materials, as the models refuse less when engaging with classified information

> * Greater understanding of documents and information within the intelligence and defense contexts

> * Enhanced proficiency in languages and dialects critical to national security operations

> * Improved understanding and interpretation of complex cybersecurity data for intelligence analysis

https://www.anthropic.com/news/claude-gov-models-for-u-s-nat...
by zozbot234 | 2026-02-14 16:57:42+00:00
The problem is not so much "when unsafe code gets called indirectly by safe code", which is fine if the unsafe code is written correctly. The problem is that "when C-like or Zig-like unsafe code wants to call safe code", the safe code is running in a context where its implied invariants may be violated, leading to insta-UB.

For instance, any &mut reference in Rust is assumed not to be aliased, and any &reference not involving UnsafeCell<...> is assumed not to be written to. These implied contracts can be loosened, e.g. by using &Cell<> if applicable (can be read or written safely, but only "as a whole object": access to the internals does not escape beyond any single operation) which is arguably closer to idiomatic C.
by gom_jabbar | 2026-02-14 16:57:49+00:00
Yes, probably. In a Heraclitean cyberspace, concealment and secrecy are essential.

The second season of the New Creative Era podcast is about online Dark Forests. [0]

They even have a Dark Forest OS. [1]

[0] https://blog.metalabel.com/into-the-dark-forest/

[1] https://www.dfos.com/
by 1shooner | 2026-02-14 16:57:56+00:00
>The older user surge has real revenue implications. Older consumers tend to have higher disposable income and higher average order values. The fact that this cohort grew mobile time by 27.5% and now uses 17+ apps per day means they are increasingly reachable and transactable through mobile.

I opened this link expecting discussion of mental health or implications for social cohesion, but found just more attention monetization.
by OutOfHere | 2026-02-14 16:58:08+00:00
A centralized platform with marginally cleverer cryptography can technically allow posts and comments to belong to a user, but not be traceable back to the user! When asked by the government who made a particular post or comment, it should not be possible for the platform to readily identify who made it. Of course the IP address should not be tracked either, certainly not beyond 1h. The logged in user would still be able to view and manage all of their posts and comments because they would have the cryptography key to do so. So what about spam and guardrail control -- one solution is to let AI classify it. Much more can be possible with cleverer uses of cryptography. In short, it is not formally necessary to switch to a decentralized or federated solution to address the anonymity issue.
by rzerowan | 2026-02-14 16:58:14+00:00
All the more ironic when those selfsame corps act as arms of govenment agaist official enemy governments/people. See the recent brouhaha by Facebok over getting banned from Russia and years previously from China over pretty similar demands.

And the way they all fell inline with sanctioning the ICC (Microsoft/Google) when the only laws in play were US domestic ones being pushed globally.
by speedgoose | 2026-02-14 16:59:28+00:00
Remember that the S in IoT stands for Security.

I have deployed open MQTT to the world for quick prototypes on non personal (and healthcare) data. Once my cloud provider told me to stop because they didn’t like it, that could be used for relay DDOS attacks.

I would not trust the sleep mask company even if they somehow manage to have some authentication and authorisation on their MQTT.
by ttul | 2026-02-14 16:59:52+00:00
I wonder how much the tech bros are going to regret having bent over for Trump in 2028 when a Democrat is sitting in the Whitehouse looking at rolling out some retribution using the new legal tools the Trump team succeeded in securing during his second term. We might see some heavy regulation descending onto the industry as a response.

On the other hand, the long term trend of billionaires and large companies getting their way politically will likely continue.
by fallinditch | 2026-02-14 17:00:04+00:00
There certainly are arenas where LLM writing provokes adverse reactions, and in general I think people are becoming less tolerant of it.

Personally, I often find the smell of AI annoying, but I don't mind the way you used it in this article, and after all, there are some good use cases for AI writing.

I assume it will become easier and commonplace to configure LLMs to produce 'de-ragebatified' writing styles.

Pretty soon I reckon we'll be so inundated with AI content in all media that it simply won't be possible or rational to be offended by it, it will just become our new reality, our new world.
by biztos | 2026-02-14 17:00:05+00:00
As long as we are ranting: I have many multilingual converstations. At some point iOS started offering the "German/English" keyboard option. I assume it also does "French/Swahili" or whatever, but for some reason it didn't auto-create a combination for "Hungarian/English" which I use more than German/English.

This sounds like a great idea, but in practice it just autocorrects incorrectly in two languages instead of one. Which is a shame, since even the German government uses a lot of Denglish these days, you'd think it would be trainable.

Meanwhile, when the chat gets stuck in the wrong language, it's a comfort to know that selecting another (or trying to press Shift for that matter) will take me to Keyboard Settings at least 80% of the time. Because who knows when you might need to change those!
by mvkel | 2026-02-14 17:00:46+00:00
Related, I have a personal project that has several modules that run in a sequential pipeline. As each module is activated, I have an animated portrait avatar of a Starcraft II character, so at a glance, I can see which module is running at any one time. If I were hand-coding the app, it never would have existed, because it would have felt like a waste of dev calories. Now it's there because it's fun. Coding with AI will mark the return of whimsy in software.
by csa | 2026-02-14 17:00:59+00:00
> The firm simply assumes that if the top X was sufficient in the past, it is still sufficient now.

> From the perspective of modern management, there's really no reason to keep people if you can automate them away.

These are examples of how bad management thinks, or at best, how management at dying companies think.

Frankly, this take on “modern management” is absurd reductionist thinking.

Just a few points about how managers in successful companies think:

- Good employees are hard to find. You don’t let good people go just because you can. Retraining a good employee from a redundant role into a needed role is often cheaper than trying to hire a new person.

- That said, in any sufficiently large organization, there is usually dead weight that can be cut. AI will be a bright light that exposes the least valuable employees, imho.

- There is a difference between threshold levels of compliance (e.g., docs that have to be filed for legal reasons) and optimal functioning. In accounting, a good team will pay for themselves many times if they have the time to work on the right things (e.g., identifying fraud and waste, streamlining purchasing processes, negotiating payment terms, etc.). Businesses that optimize for making money rather than getting a random VP their next promotion via cost-cutting will embrace the enhanced capability.

Yes, AI will bring about significant changes to how we work.

Yes, there will be some turmoil as the labor market adjusts (which it will).

No, AI will not lead to a labor doomsday scenario.
by pibaker | 2026-02-14 17:01:04+00:00
So what? This website is just some man's collection of blogs, not a government registry funded by tax money. It does not seem to even take public donations. Why shouldn't its maintainer be allowed to exercise personal judgement in his curation efforts? Why does he have to justify putting one blog up there but not another any more than the New York Times need to justify publishing one article but not another?

It is weird how entitled people can get when it comes to things others create and distribute for free. The same seems to happen with open source software in general too. Somehow the ones who pay nothing, ask for the most.
by blincoln | 2026-02-14 17:01:21+00:00
Looks like it's improved even further - I'm seeing that model listed with 512x384 resolution, and it's $300 on Amazon.

Pretty incredible! I felt like I was getting an amazing deal when I paid about $1000 15 years ago for a FLIR E4 that I could flash into an E8. I might finally retire that in favour of one of these.
by Johnny555 | 2026-02-14 17:02:27+00:00
>For baby 10M+1 are they going to tell a Swiss woman that she can’t have a baby?

This wouldn't happen because it's not actually a population control measure, it's an immigration control measure - when the population gets above 9.5M, Switzerland would start shutting down immigration/asylum. There's nothing in the initiative that would set controls on births by Swiss citizens. (and it would be unlikely to be needed since Switzerland is facing the same low birth rate of other western countries)
by wolvesechoes | 2026-02-14 17:02:42+00:00
> why both Mitchell Hashimoto (creator of Ghostty etc.) and Richard Feldman (of Elm fame, creator of Roc-lang)

Both undoubtedly are talented programmers, but you overestimate impact and importance of these project.

GitHub stars and HN posts are not very good indicator of what happens in the real world
by giancarlostoro | 2026-02-14 17:04:03+00:00
> I equally blame the previous administration for leaving a privacy invasive apparatus, as stated by others here this goes back to the Patriot Act.

I was talking about Bush administration. I don't know a lot about that time period since I was just a teenager during that administration and didn't care about politics back then, but I vividly remember Obama because I've always been passionate about not having the government spying on citizens, and a free and open web. Everything wrong with social media we set ourselves up for.
by dahart | 2026-02-14 17:04:03+00:00
Copyright does not cover ideas, period. If you write your own novel and use your own word choices, even if you copy the plot structure exactly and the same character names while writing a new book, it’s not even considered a derivative work under the law, it’s a new work. Copyright covers copying the fixed work itself. You aren’t in violation of copyright unless you copy the words themselves.

The flip side is that this is why the article’s discussion about randomness and monkeys on typewriters is irrelevant to copyright law. It’s a copyright violation to produce the same “fixation” no matter how you do it. If you generated a random sequence of characters, and it happened to match a NYT best selling book, you violate the book author’s copyrights, and claiming it was random isn’t a viable defense. Intent to copy can make it worse, but lack of intent does not absolve. There is precedent for people coming up independently with the same songs and one being successfully sued.

Do note that there are other laws that might cover plagiarism of ideas, trademarks, code, etc., copyright isn’t the only consideration, but copyright seems to be often misunderstood. We definitely have some novel questions because of the scale of AI’s copying, the nature of training and the provenance of the training data, and because of AI’s growing ability to skirt copyright law while actually copying.
by myvoiceismypass | 2026-02-14 17:04:41+00:00
> the law still prohibits foreign nationals and foreign organizations spending in US elections

Cute. Which enforceable laws prevent foreign nationals from buying trump/melania crypto (for favors, pardons, etc)? That's what you mean, right?

https://www.npr.org/2025/10/24/nx-s1-5583983/trump-pardons-j...
by pocksuppet | 2026-02-14 17:04:43+00:00
If you need it in order to do what the user asked, you don't need the popup. The user asking to do a thing is consent to do what is obviously necessary to accomplish that thing, and may be consent to do what is less obviously necessary. The user's click on "sign in with google" is consent to share data with Google as needed to complete the sign-in, but no more - it's not consent to Google Analytics.

Legal bases for processing: https://gdpr-info.eu/art-6-gdpr/ Everyone knows part A because that's a catch-all. If the user requested something, it's better UX to use Part B. Parts C and F apply sometimes. You still have to follow the rest of the GDPR, like letting them delete it.
by srcreigh | 2026-02-14 17:04:46+00:00
This is kind of the root of the issue. Humans are mystical beings with invisible sensibilities. Many of our thoughts come from a spiritual plane, not from our own brains, and we are all connected in ways most of us don't fully understand. In short, yes I can read minds, and so can everybody else.

Today's LLMs are fundamentally the same as any other machine we've built and there is no reason to think it has mystical sensibilities.

We really need to start making a differentiation between "intelligence" and "relevance". The AI can be perfectly intelligent, but without input from humans, it has no connection to our Zeitgeist, no source material. Smart people can be stupid, too, which means they are intelligent but disconnected from society. They make smart but irrelevant decisions just like AI models always will.

AI is like an artificial brain, and a good one, but humans have more to our intelligence than brains. AI is just a brain and we are more.
by csjh | 2026-02-14 17:04:55+00:00
You’re missing the fact that the compiler isn’t forced to fill every register in the first place. If it was less efficient to use more registers, the compiler simply wouldn’t use more registers.

The actual counter proof here would be that in either case, the temporaries have to end up on the stack at some point anyways, so you’d need to look at the total number of loads/stores in the proximity of the call site in general.
by bmitc | 2026-02-14 17:04:56+00:00
What's wrong with egui's virtual lists? It has support for them. https://docs.rs/egui/0.25.0/egui/containers/scroll_area/stru...

Unfortunately, it seems GPUI is no longer in development.

Iced looks great, but the developer is very open about it being a personal project (https://book.iced.rs/philosophy.html). That is appreciated, but for companies or even individuals wanting to adopt it, it's a big hurdle to get across.
by hateful | 2026-02-14 17:05:43+00:00
I would imagine, in this example, that the fact that you put in the numbers yourself gives you a mental map of where the numbers are and how they relate to each other, that having AI do it for you doesn't give you.

You could stare at a large sheet of numbers for a long time, and perhaps never get the kind of context you gained by entering them.

Additionally, if there was a mistake, it may not be as noticeable.
by 0xy | 2026-02-14 17:06:21+00:00
Oh really? Tell me more about this appropriate handling, let's start with Bill Clinton and Obama. [1] [2]

[1] https://arc-anglerfish-washpost-prod-washpost.s3.amazonaws.c...

[2] https://www.washingtonpost.com/immigration/kids-in-cages-deb...
by throwaway150 | 2026-02-14 17:06:32+00:00
> So what? This website is just some man's collection of blogs, not a government registry funded by tax money. It does not seem to even take public donations. Why shouldn't its maintainer be allowed to exercise personal judgement in his curation efforts?

Unnecessarily aggressive response from you given that you are addressing positions I never actually took. Of course the maintainer is entitled to exercise personal judgement about what gets included. When did I say anything othrwise?

What I am saying is that, as a user, it is frustrating to spend time putting together submissions and then hear absolutely nothing back. I am not demanding special treatment, just a basic acknowledgement or a brief explanation when something is rejected. Expecting that level of courtesy when you interact with a project does not strike me as unreasonable. If that is considered entitlement, then yes, I suppose I do expect basic courtesy from people I engage with.

All I am asking is whether anyone might be interested in building something more community-ish, where decisions do not rest entirely with one individual. If someone creates that, I am happy to support it with my time and contributions. That is the only point I am making.
by abelanger | 2026-02-14 17:08:19+00:00
Author here - I'm also generally skeptical of coding agents, but with the right problem domain and approach they can produce quality output when paired with humans. There was a point in time in the chess world where computer + human was stronger than computer or human alone. I think we're in that era for a handful of applications. Not for things like kernels, browsers, or databases.

> Besides, who is going to maintain that code?

I maintain the code. If Claude gets sunset tomorrow, I'll still be able to maintain and write it - I've already rewritten parts of it.

You could make the same argument for a team member leading a project that you've worked on. Is that code forever required to be maintained by one team member?

Previously the overhead of ensuring code quality when the development process was driven by Claude Code was greater than just writing the code myself. But that was different for this project.