MurphyA/hacker-news huggingface dataset:
by andai | 2026-02-17 14:59:37+00:00
Gonna take this opportunity to get some feedback. I never figured out containers (one of these days..!), but I didn't want to yolo AI agents on my machine.

At some point I realized, what I'm actually worried about is it blowing up my files. So I just made a separate linux user, and put myself in the group.
So I can read/write the agent homedir, but agIents cannot read/write mine.

So now I just switch to agent user before running Claude, Codex, OpenClaw etc.

I'm not a security expert -- seems there are still some suboptimal aspects to this (e.g. /tmp is globally readable?), but it seems good enough for the main vector to me? ("Claude Code deleted my homedir/hard drive" that pops up every few weeks on Reddit...)

(If someone gets a remote shell via an exploit in a certain bloated agent framework that's a slightly different story though ;)

But I was wondering what you all think about that. "Just give it a Linux user." It doesn't seem to be a common approach, though I've seen a few other people doing it. I wonder if I'm missing something, or if it's actually a good solution but boring and non-obvious to most people.

--

As a side note the agents are getting scary good with their persistence and determination

https://www.reddit.com/r/ClaudeAI/comments/1r186gl/my_agent_...

I had a similar experience with Codex... "the instructions forbid me from deleting the remote branch, so I will find a creative workaround to achieve the same result..." Following the letter of the law, but not the spirit! They're already acting a lot like the paperclip maximizer, which is... something to think about...
by randusername | 2026-02-17 14:59:44+00:00
> AI replaces codified knowledge – the kind of learning you get from classrooms or textbooks – but struggles with tacit knowledge, the experiential judgement that accumulates over years on the job. This is why seniors are spared and juniors are not. But Oks’ thesis treats this as reassurance: see, humans with deep knowledge still have comparative advantage! I believe this is more of a senior worker’s luxury, and the protection for “seniors” will move up and up the hierarchy over time.

Times change, the ladders you and I climbed to success may not be around in the same forms for our children. That's not new. But will there be any ladders to climb if the bottom rungs are all gone?
by palata | 2026-02-17 14:59:52+00:00
> It is wrong to claim that an unlocked bootloader completely breaks the android security model.

You seem knowledgeable about this, so I'll take the opportunity to ask: if I install a malicious app and it manages to escape the sandbox and alter the system, my understanding is that it will be detected next time I boot it (because the image hash won't match). Isn't that true?

> Signing keys for bootloaders might just not matter

Again a question, I haven't found it in the official documentation: aren't those keys the "system keys"? As in, if my system is signed with some keys and an app is signed with those same keys, doesn't it allow this app to be a system app?
by linsomniac | 2026-02-17 14:59:58+00:00
Don't forget time-travel undo. If you get into a weird state with the undo tree, and g+/g- aren't helping, you can do ":earlier 5m" to go back to where you were 5 minutes ago, and ":later 30s" to step forward.

Unfortunately, when you're at "now" you can't do ":later 30m" to see the future.
by zobzu | 2026-02-17 15:00:12+00:00
ive seen:
-"but ios can be jailbroken and it doesnt have an AV!" while the MDM does not allow jailbroken devices, and they also allowed sudo on linux.

auditors are clueless parasites as far as im concerned. the whole thing is always a charade where the compliance team, who barely knows any better tries to lie to yhe auditor, and the auditor pick random items they dont understand anyway. waste of time, money and humans.
by smartmic | 2026-02-17 15:00:24+00:00
> For the first time in my life, I’m suddenly wary of meeting other "computer programmers" in the wild. I feel like there’s a decent chance we won’t actually have much in common, let alone values or morality.

Maybe the social group the author is referring to has split up (forked)? For example, I wouldn't call anyone producing vibe coded AI stuff a "programmer". That noun will be reserved for the original group.
Show HN: Visualize sentiment of Hacker News comment threads
by ngregorich | 2026-02-17 15:00:56+00:00
There have been more than a couple times that I have found myself reading a Hacker News thread comment by comment, intent on fully understanding the sentiment of each commenter and drawing a conclusion about the post overall

I’ve found digging deep on HN to be useful include when my spouse and I were deciding whether we should take job offers from companies that have been discussed, when doing (very biased) market research on a feature or product, and when learning about new technology

During my most recent comment deep dive, I built a tool to analyze and visualize the sentiment of each comment as a graph and make it pleasant to navigate. I also extracted keyword phrases so they could be counted and compared by sentiment. I used net promoter score (NPS) as a framework for sentiment aggregation

I decided to productize and share my work. HN Sentiment Tool (HST) is a static page built with SvelteKit where you paste a HN URL, paste an OpenRouter API key (you can audit the code or clone and run locally), choose a model, then analyze and visualize the sentiment comment by comment and across the entire post

The tool loads complete with a polarizing thread about Peter Steinberger joining OpenAI to give you an idea of how it works

I hope you find HST a fun and useful research tool. Let me know if you have any questions or suggestions
by reliabilityguy | 2026-02-17 15:01:07+00:00
> And given the whole Greater Israel plan

What is this “plan”?

> Palestinians live under a system of occupation and blockade

What did the Palestinians do to not end up in this situation?

> genocide

War is not genocide. And remarks by some of the politicians are not a proof of genocide as well.

> There is no way that Israel will be welcomed into the wider ME under this regime.

Israel just need to be stronger to survive as they did in the first 20-30 years of their statehood.
by crazygringo | 2026-02-17 15:02:53+00:00
Yup. This is precisely why the first image seems to have oscillating brightness, with clear sharp peaks at yellow and cyan. It's because it's not just changing color, it's literally twice as much light. It goes:

Red - 1x
Yellow - 2x
Green - 1x
Cyan - 2x
Blue - 1x
Magenta - 2x

(Of course magenta is not part of the spectrum.)

A very first step towards a better spectrum is just to maintain constant output brightness (accounting for gamma). There will still be perceptual differences in brightness, as we naturally perceive green as brighter than blue.

Obviously this gets taken into account by the time the author gets to the CIE color model. But there are a number of "intermediate" improvements like that, which you can make.
by jamiemallers | 2026-02-17 15:03:09+00:00
The "200 OK lie" is painfully real. I've seen variants of this at every company I've worked with - the worst was a checkout flow that returned 200 but silently dropped the payment processing step because a third-party SDK failed to load. Revenue graphs caught it before monitoring did.

On the false-positive front, a few things that helped us:

1. Retry with a fresh browser context before alerting. A surprising number of failures are stale cookies, cached service workers, or browser extensions leaking into headless sessions. If it fails, spin a clean context and try once more.

2. For DOM diffing, don't diff the full DOM - it's too noisy. Instead, define "assertion selectors" per check (e.g., [data-testid="cart-count"] should contain a number). This turns your synthetic checks into lightweight integration tests rather than fragile screenshot comparisons.

3. Capture the console log and network waterfall on failure. 80% of the time the root cause is visible in a failed fetch or a JS exception, and having that alongside the screenshot saves the debugging round-trip.

4. Multi-step flows (login -> add to cart -> checkout) need per-step timeouts, not just a global one. A slow CDN might make step 2 timeout while step 1 passes fine.

The Playwright + BullMQ stack is solid for this. One thing to watch: Playwright's default navigation timeout is 30s, which is generous for synthetic checks. We found 10-15s more realistic for catching actual degradation before users feel it.
by araz | 2026-02-17 15:03:42+00:00
While building pvec-rs (a persistent vector based on RRB-Trees) for my master's, I felt that abstract concepts like structural sharing and path copying were much easier to explain through visuals.

It took some time, but I’ve finally built an interactive tool to provide better intuition for how these trees work under the hood. The web-vis module compiles pvec-rs to WASM and uses D3.js to render the internal state changes in real-time:

- A brief intro on how the data structure works: https://abishov.com/blog/pvec-rs-visualizing-structural-shar...

- The visualization tool: https://pvec-rs.abishov.com/web-vis

- GitHub: https://github.com/arazabishov/pvec-rs

Let me know what you think!
by jamiemallers | 2026-02-17 15:03:46+00:00
The agent-based pull model is the right architecture here. We ran something similar internally and the key insight is exactly what you landed on: keep the agent dumb, evaluate server-side. The moment you put alerting logic on the agent, you need to redeploy agents every time you tweak a threshold, and coordinating that across 20 clusters is a nightmare.

K8s auto-discovery via Ingresses/Services/HTTPRoutes is clever. One edge case to watch: teams using custom CRDs for routing (Istio VirtualServices, Traefik IngressRoutes). You'll get requests for those pretty fast once people adopt this in real clusters. A plugin/annotation system where users can teach the agent about custom resource types would scale better than hard-coding each one.

The "what's actually down vs a blip" problem is where most monitoring tools quietly fail. Two things that help: (1) requiring N consecutive failures before marking down, with N configurable per-monitor (a database might need N=1, a CDN edge might need N=3), and (2) correlating failures across monitors. If 5 services behind the same ingress controller all fail simultaneously, that's one incident, not five.

Curious about your status page auto-generation. Do you group services by namespace, by cluster, or something else? In our experience the auto-generated grouping is never quite what customers want to show publicly, so having an easy way to override the hierarchy matters a lot.
by mikepurvis | 2026-02-17 15:03:50+00:00
Yeah, this tracks. My city has a few "retro" arcade bars with pinball, pacman, etc, and it's fun enough but you're for sure going for the nostalgia more than anything else.

I think part of the barrier to expanding the attached-to-other-things arcade concept is the whole aesthetic: an arcade is loud, with flashing lights, giant and sometimes lurid artwork on the machines. I think if you were able to make some machines that gave a high quality experience without all that side of it, you might be able to install them in other semi-public spaces: airports, train stations, shopping malls, basically anywhere you currently see things like massage chairs.

That said, maintenance is for sure a concern. The state of most public pianos does not inspire confidence.
by elliotbnvl | 2026-02-17 15:04:50+00:00
Yeah on further thought I totally agree. Between your comment and the other comment on this post I think I need to tighten my thesis: social media is dead, not the Internet.

I think the core idea probably will benefit from the increased focus. Your nicely phrased clarification of the problem as a matter of scale and trust of good humans is also, I think, addressed by the model I propose.
by Ronrey | 2026-02-17 15:05:06+00:00
Solo founder running 56 microservices and 69 autonomous agents in production. AI collapsed the build cost by 40-60x, but every architecture decision, security boundary, and ops choice still required experience. The article gets the direction right but the conclusion wrong — subscriptions don't die, per-seat pricing does. When agents are doing the work instead of humans clicking dashboards, you price
Show HN: Everdone CodeSecurity and CodePerformance
by vinitmaniar | 2026-02-17 15:05:20+00:00
Hi everyone,

Over the past few months, we’ve been building Everdone — an AI-powered engineering workflow platform.

We initially launched with:
- CodeDoc (AI-generated code documentation)
- CodeReview (structured issue detection + tracking)

Today we’ve added two more services:
- CodeSecurity — iterative application security review
- CodePerformance — structured performance improvement workflow

Why we built CodeSecurity
Most security tools generate a report and stop there.

In practice, teams:
- Fix a few issues
- Forget the rest
- Don’t re-verify properly

We designed CodeSecurity as an iterative loop instead of a one-off scan:
- Connect GitHub
- Select a PR or branch
- AI reviews for real, exploitable vulnerabilities
- Engineers fix
- Re-run → AI verifies whether issues are actually resolved

Issues are tracked with:
- Severity (High/Medium/Low)
- File + line numbers
- Concrete suggested fixes
- Status workflow (Open → In Progress → Resolved → Closed/Rejected)
- Full verification history

It behaves more like a managed security workflow than a static analyzer.

Why we built CodePerformance
Performance reviews often happen reactively (after something slows down in prod).

CodePerformance focuses on material runtime impact:
- Algorithmic inefficiencies
- N+1 queries
- Blocking I/O
- Memory pressure
- Concurrency bottlenecks
- Event-loop blocking (Node), GIL issues (Python), etc.

Same loop:
Find → Fix → Re-run → Verified.

Current platform
Everdone now includes:
- CodeDoc
- CodeReview
- CodeSecurity
- CodePerformance

Pricing:
- First 200 files free
- $0.05 per file per review (early access pricing)
- Unlimited users
- No contracts

Usage-based only.

We also have live demos on public OSS repos if anyone wants to explore without signing up.

We’re trying to build “Work as a Service” — AI systems that fit into real engineering workflows rather than replacing them or generating static reports.

Would love feedback from other founders or engineering teams.

Happy to answer anything.

— Vinit
by shzbzbjz | 2026-02-17 15:05:26+00:00
> I cannot justify hiring a mediocre new grad in Seattle for $120k who will end up using Claude Code anyhow when I can hire an early-career employee doing something similar in Romania or India for around $20k

Yes you can. Life and business is not about profit. It’s about bettering the lives of people. Make it a priority to hire American because you’re an American company.

You’re making a choice to prioritize profit (or foreign countries) over the country that you benefit from. This is an immoral and short sighted business decision, as you will eventually see a backlash from the host countries you’re effectively operating as a parasite in.

Not trying to persuade you, just laying out there are alternatives that’ll be a reality eventually. Take a look at the current political swings in Japan, Restore Britain, etc.
by parineum | 2026-02-17 15:05:36+00:00
> This guy wanted Putin on his podcast to hear his side of the story (let that sink in)

Many people have interviewed serial killers and not supported serial killers.

I would very much like to know Putin's actual motivations which would unlikely be spoken but his stated motives would also be enlightening.

I'm sure he'd go on with the standard "Nazis in Ukraine" line but in a 2-3 hour interview, I might get some new insights I don't get from 3 sentence sound bites.

We know so much about Hitler from his own writings and speeches. It seems to me that your philosophy on "platforming" Putin would also apply to making the words of Hitler available to the public.

Is there someone you think _could_ interview Putin responsibly?

> spoke Russian to Zelensky

I don't see the significance of that. They both speak Russian and English fluently. I don't know if Friedman speaks Ukranian but I'm not understanding what the implication is here. Surely the interview was in English since the podcast is?

> This is not an "impression" of his "interview style". This guy implicitly supports terrorist acts.

Implicitly being the key word here and is certainly subjective. If the body of evidence you're presenting is "would interview Putin" and "spoke Russian to Zelensky", I don't find that convincing.
by joquarky | 2026-02-17 15:05:54+00:00
> If nothing durable was learned, no changes are needed.

Off topic, but oh my god if you don't do this, it will always do the thing you conditionally requested it to do. Not sure what to call this but it's my one big annoyance with LLMs.

It's like going to a sub shop and asking for just a tiny bit of extra mayo and they heap it on.
by otterley | 2026-02-17 15:05:57+00:00
> the activities are clearly unconstitutional by any conventional analysis by any qualified US attorney. Whether or not you could develop the requisite proofs is another matter entirely

I assume that when you say "develop the requisite proofs," you mean "prevail in court." In Constitutional law, these are inseparable and an outcome of Marbury v. Madison. The Court says what the law is. If the Court's opinion is that the Government's behavior is permitted by the Constitution, then it follows that the behavior is Constitutional; and because our law relies on precedent, that interpretation is rather sticky. It does so happen that from time to time, we overturn precedent--and I hope we do, because we have some pretty bad law out there--but until then, we rely on it to predict the outcome of future cases.

> There can be zero doubt that the subpoena upon Google violated due process. Being an administrative subpoena, there was no judge involved but due process ( eg probable cause ) is still required and - absent some wildly unimaginable set of unknown facts - there was clearly no probable cause here.

Yeah, I agree. The problem is, without some sort of injury, there's likely no standing, and so the case will probably never see the light of day.
by ETH_start | 2026-02-17 15:06:35+00:00
Since the 1970s, some industries were deregulated, but overall legal and compliance complexity has still grown over time, according to all studies that I'm aware of on the subject of the regulatory burden.

The studies indicate that a few large early regulations aimed at clear externalities — like major air pollution — delivered substantial benefits on the balance, but many of the smaller restrictions added afterward, especially as they accumulated, mostly generated paperwork (huge compliance industries) and fixed costs (that made smaller firms less competitive) with diminishing returns.

The sensible goal should be to massively reduce the regulatory thicket, while keeping the small set of restrictions that have clear, major benefits and are straightforward to enforce, and replacing the rest with simpler standards or pricing mechanisms that prevent negative externalizations without dragging down productivity through top-down micromanagement of the economy that regiments the actions of private citizens.
by Tharre | 2026-02-17 15:06:36+00:00
Probably not for much longer though. Several countries, including mine, have already banned SMS 2FA for banking, and it's likely that that will be implemented for all of Europe in the near future, possibly with PSD3. Not that SMS 2FA was ever a good idea in the first place.

But yes banking apps are not mandatory, and likely won't be in the near future either, though the alternatives are treated a bit like second class citizens.
by microtonal | 2026-02-17 15:06:43+00:00
That's too simple. First of all, Pixel (which GrapheneOS requires) is one of the few Android phones with a separate secure enclave. GrapheneOS also applies a lot of hardening that other vendors do not: https://grapheneos.org/features#exploit-protection

This does make a material difference, e.g.: https://x.com/MetroplexGOS/status/1982163802188575178

That said, if a state-level actor is up against you, then it's hard to defend yourself against that.
by RussianFreedom | 2026-02-17 15:06:56+00:00
Hi HN,

With Telegram reportedly being restricted in Russia and WhatsApp facing various regulatory pressures in multiple regions, I’ve started thinking more seriously about dependency on mainstream messaging platforms.

Regardless of politics, the bigger question for me is architectural:

What happens when communication platforms are:
– centrally operated
– jurisdiction-bound
– metadata-heavy
– or easy to block at the infrastructure level?

I’m not looking for ideology-driven tools, but for messaging systems that:
– minimize metadata
– don’t rely heavily on centralized infrastructure
– are transparent about their threat model
– and are realistic about trade-offs

I recently came across a project called EncroGram (https://encrogram.com) that claims to focus specifically on minimizing metadata rather than just encrypting content.

I’m curious:
How do you evaluate newer messaging projects in this space?
What would you look for before trusting or adopting one?

Interested in architectural perspectives, not marketing claims.
by Aurornis | 2026-02-17 15:07:02+00:00
> For young software developers specifically, employment fell almost 20% from its 2022 peak.

Employment in the 2020-2022 range was highly unusual due to COVID stimulus the resulting unprecedented hiring. Tech companies were hiring anyone they could and after some time juniors were the only way to feed the insatiable demand for more headcount.

Comparing to this time without taking that into account is going to be misleading.

This period was also a strange time for remote work. I’ve been remote since before then, but COVID era WFH felt like a turning point when bad behavior during remote work became normalized. That’s when we started having remote hires trying to work two jobs (and giving us half an effort / not getting their work done), and there was a rise of “quiet quitting” as a news media meme because everyone thought they could always just walk out and get a new job if they got fired for not working. We also weren’t doing juniors any favors by hiring them in high numbers without a sufficient ratio of seniors to mentor and lead them.

That also coincided with the rise of GitHub Copilot and ChatGPT. These tools were not great at the time, but if you were a junior who was over-hired into a company that didn’t have capacity to mentor you and you were working remote in the age when Reddit was promoting quiet quitting and overemployment on your feed every day, banging out PRs with GitHub Copilot for a couple hours a day and then going about your life for a $135K salary right out of college felt like you just hit the jackpot of historical confluences for work-life balance.

I saw this exact story play out at multiple companies who got burned out on the idea of hiring juniors due to the risk. Combine that with the rapid improvement of the LLM tools and the idea quickly became that you just hire seniors and treat the LLMs as juniors rather than paying another salary for them to pilot Claude Code around. The seniors had to review the Claude Code output anyway, so why not cut out the middleman?

Then add the economic downturn and the chaos of whatever this administration is doing this month and now there are so many qualified seniors on the market that hiring juniors is hard to justify. This is the part that would have happened with or without AI.

All things considered, being down only 20% from the 2022 peak seems not that bad.