MurphyA/hacker-news huggingface dataset:
by Quothling | 2026-02-18 16:56:50+00:00
I work in a NIS2 regulated sector and I'm not sure we can ever let any AI agent run in anything we do. We have a centralized sollution where people can build their own chatbots with various configurations and cross models. That's in the isolation of the browser though, and while I'm sure employees are putting things into it they shouldn't, at least it's inside our setup and not in whatever chatbot they haven't yet run out of tokens on. Security wise though, I'm not sure how you can meet any form of compliance if you grant AI's access unless you have four eye validation on every single action it takes... which is just never going to happen.

We've experimented with rolling open source models on local hardware, but it's so easy to inject things into them that it's not really going anywhere. It's going to be a massive challenge, because if we don't provide the tools, employees are going to figure out how to do it on their own.
by nerdralph | 2026-02-18 16:57:03+00:00
The gcc stub surprised me:

user@shiro:/tmp/hn$ cat main.c

#include <stdio.h>

int main()
{
printf("Hello\n");
}

user@shiro:/tmp/hn$ cc main.c -o main; ./main

Hello, World!

user@shiro:/tmp/hn$ cat main

#!/bin/sh
echo 'Hello, World!'
by tonymet | 2026-02-18 16:57:05+00:00
This can have pros and cons. They will get much more vcpu / dollar on bare metal. And they can develop great operational discipline if they do it right.

On the downside, I don’t see them yet taking ops seriously. They are getting a lot of attention, but not yet establishing SLAs (at least not publicly). And their donations don’t seem to be scaling to the continued and expected demand.
by mothballed | 2026-02-18 16:57:22+00:00
I think you have it backwards. Regulation is what enables monopolies. There is no monopoly for any of the major industries like cow herding or cellular telephone service in Somalia despite almost no effective regulation. There is not even a monopoly of pirates despite them willing to use violence to try and enforce a monopoly.

If you look at the history of the US, for instance, railroad regulation was brought forth largely by the railroads because they found it impossible to form a cartel to keep up prices so instead they created regulation that outlawed the kind of discounting that breaks cartels apart. A similar thing happened in banking where the banks asked for a central bank to cartelize the interest ranks to stabilize their oligopoly.

A large portion of the regulation in the US was brought about as regulatory capture by corporations to increase the monopolizing effects and destroy the free market.
SEL Deploy – Cryptographically chained deployment timeline
by chokriabouzid | 2026-02-18 16:57:23+00:00
We wasted hours in post-mortems reconstructing "what deployed when."

SEL Deploy creates a tamper-evident deployment timeline:
• Each deployment: command hash, git commit, timestamp, exit code
• Chained to previous (tampering breaks the chain)
• Signed with Ed25519 (non-repudiable)
• Local SQLite for fast timeline queries

Try it:
git clone https://github.com/chokriabouzid-star/sel-deploy
cd sel-deploy
cargo build --release
./target/release/sel-deploy keygen
./target/release/sel-deploy run -- echo "hello world"

Built on SEL Core (deterministic engine, 33/33 tests).
Open source (MIT). No SaaS. Fully local.

GitHub: https://github.com/chokriabouzid-star/sel-deploy
by deadbabe | 2026-02-18 16:57:29+00:00
There have been some back of the napkin estimates on what AI could cost from the major platforms once no longer subsidized. It does not look good, as there is a minimum of a 12x increase in costs.

Local or self hosted LLMs will ultimately be the future. Start learning how to build up your own AI stack and use it day to day. Hopefully hardware catches up so eventually running LLMs on device is the norm.
by anonymars | 2026-02-18 16:57:44+00:00
"No it's not"

See how that works? Flippant dismissal contributes little if anything to discussion and is a conversational dead-end

---

What makes it "frighteningly illiterate" to ask "what difference does it make if they put a name to the post?"

Does it change the outcome? Does it change the ideas? Does it change the unsettling implications about alignment?

The internet is a frothing mob, look at the impact on Scott himself. Other than allow the internet to hunt him down and do it's thing or dig up ad-hominem attacks, what would change if the person put a name to it?

Other sibling comments made an attempt to answer that question
by noslenwerdna | 2026-02-18 16:57:48+00:00
"But internal study found users who stopped using Facebook and Instagram for a week showed lower rates of anxiety, depression, and loneliness."

This isn't causal though. The users who quit were not randomly selected. Maybe they were receiving some kind of mental health treatment, and as part of that they stopped. Then the recovery could have been from the treatment or it could have been from stopping.
by neebz | 2026-02-18 16:58:15+00:00
I've faced the same but my conclusion is the opposite.

In the past 6 months, all my code has been written by claude code and gemini cli. I have written code backend, frontend, infrastructure and iOS. Considering my career trajectory all of this was impossible a couple of years ago.

But the technical debt has been enormous. And I'll be honest, my understanding of these technologies hasn't been 'expert' level. I'm 100% sure any experienced dev could go through my code and may think it's a load of crap requiring serious re-architecture.

It works (that's great!) but the 'software engineering' side of things is still subpar.
by aix1 | 2026-02-18 16:58:27+00:00
I think that "Generate a strong password" is a pretty clear and unambiguous instruction. Generating a password that can be easily recovered is a clear failure to follow that instruction.

Given that Claude already has the ability to write and execute code, it's not obvious to me why it should, in principle, need an explicit nudge. Surely it could just fulfil the first request exactly like it fulfils the second.
by ekrsulov | 2026-02-18 16:58:29+00:00
Thank you! Advanced shape building tools are already available in the third button of the bottom menu (Advanced Tools), and it also includes Trim Path. Boolean operations are implemented as well. I’ll add proper path welding/union to the roadmap. Cleaning messy SVG paths is one of the core problems VectorNest wants to solve, so this feedback is super valuable. Really appreciate you trying it!
by Aurornis | 2026-02-18 16:58:33+00:00
Discord also announced that they would use algorithmic decision making to decide which accounts are old enough to not require ID. This didn't change the uproar at all.

If you think KOSA style regulations would allow social networks to avoid ID checks, I don't think you're paying attention. Just read the article we're all commenting on to see how people are willing to attack Facebook for even having internal statistical ideas about problems. If a KOSA style law was passed and Facebook could be shown to have knowledge that some percentage of minors were evading their algorithm, they would be pulled in front of Congress again.

There is no way to reasonably look at these laws and think that it would not result in ID check requirements. We don't even have these laws yet and platforms like Discord are already rolling out ID verification.
by Rapzid | 2026-02-18 16:58:57+00:00
> The value of human thinking is going down. You probably knew this. The corollary is rarely mentioned: the value of a human eyeball is going up, because there are only so many of them and there are now infinite things that want to be looked at.

Hey, so I'm thinking about getting my car washed..

This article reads as overly hyperbolic; cashing in on the AI hysteria. AI derangement.
by iamnothere | 2026-02-18 16:58:59+00:00
Quick tldr summary from the end:

the source code reveals a platform that:

- files Suspicious Activity Reports directly with FinCEN

- files Suspicious Transaction Reports with FINTRAC

- tags STRs with intelligence program codenames (Project SHADOW, Project LEGION…)

- maintains biometric face databases with 3-year retention

- runs 269 distinct verification checks against every user

- compares your selfie to political figures with facial similarity scoring

- flags you as a “suspicious entity” based on your face alone

- classifies selfie spoof risk with hardcoded rejection thresholds

- screens against 14 categories of adverse media from terrorism to espionage

- lets operators upload custom FinCEN screening lists and run them against everyone

- continuously re-screens on configurable intervals

- tracks you across 13 types of lists from browser fingerprints to geolocations

- screens crypto wallets against sanctioned addresses via Chainalysis

- runs experimental unnamed ML models on your biometric data

- encrypts data with shared symmetric keys while admitting they “depend on obfuscation”

- runs two parallel PEP screening systems with known incompatibilities

and the company that runs all of this is the same one that takes your passport photo when you sign up for ChatGPT. same codebase. same platform. different deployment. same facial recognition. same screening algorithms. same data model.
by TekMol | 2026-02-18 16:59:03+00:00
P.S. `curl -fsSL https://claude.ai/install.sh | bash` works.
You can run real Claude Code and it can use Shiro's tools
like a normal Linux system.

Are you sure? I am getting this:

user@shiro:~$ curl -fsSL https://claude.ai/install.sh | bash
Installing Claude Code...
Installing packages globally...

Resolved 1 package(s):
+ @anthropic-ai/claude-code@2.1.45
22 files extracted
Created 1 bin symlink(s) in /usr/local/bin

Packages installed globally.

Claude Code installed successfully!
Run: claude
user@shiro:~$ claude
anonymous/q2<@https://shiro.computer/ line 991 > AsyncFunction:57:43

y/<@https://shiro.computer/ line 991 > AsyncFunction:9:688
anonymous/hYA<@https://shiro.computer/ line 991 > AsyncFunction:57:11323
y/<@https://shiro.computer/ line 991 > AsyncFunction:9:688
anonymous/hF<@https://shiro.computer/ line 991 > AsyncFunction:57:15356
y/<@https://shiro.computer/ line 991 > AsyncFunction:9:688
anonymous/CS<@https://shiro.computer/ line 991 > AsyncFunction:803:1103
E/<@https://shiro.computer/ line 991 > AsyncFunction:9:854
anonymous/MNq<@https://shiro.computer/ line 991 > AsyncFunction:7524:13621
E/<@https://shiro.computer/ line 991 > AsyncFunction:9:854
@https://shiro.computer/ line 991 > AsyncFunction:7526:244

And then I am back on the normal command line.
by petcat | 2026-02-18 16:59:20+00:00
Code is, I think, rapidly becoming a commodity. It used to be that the code itself was what was valuable (Microsoft MS-DOS vs. the IBM PC hardware). And it has stayed that way for a long time.

FOSS meant that the cost of building on reusable components was nearly zero. Large public clouds meant the cost of running code was negligible. And now the model providers (Anthropic, Google, OpenAI) means that the cost of producing the code is relatively small. When the marginal cost of producing code approaches zero, we start optimizing for all the things around it. Code is now like steel. It's somewhat valuable by itself, but we don't need the town blacksmith to make us things anymore.

What is still valuable is the intuition to know what to build, and when to build it. That's the je ne sais quois still left in our profession.
by qdotme | 2026-02-18 16:59:56+00:00
Or „just enough” for the subset of users that is „enough” to ensure product viability. The absolutism of „all or nothing” is rooted in the strictly-better mentality for replacing something.

For Wine/Proton, the core demographic is essentially gamers, who tend to overlap heavily with engineering population later on, and thus core population for Microsoft to capture and retain. Once Steam removed that vendor lock-in, the corporate discussion became more flexible.

For Asahi (proud Asahi user for 4y now), the added value of „most powerful Linux/Arm64 laptop on the market” outweighs the few things that don’t work on Asahi (HDMI out is probably the only one that occasionally matters for me, but screencasting works well enough). Yes, there are gaps, but they are smaller than things from Linux that are missing on OSX or Windows for me.
by PaulDavisThe1st | 2026-02-18 17:00:00+00:00
> However, many of the AI products do solve problems and serve needs.

Every solution to a problem comes with its own costs. It is entirely possible that most solutions that are rooted in modern computing technology have actual or perceived costs that exceed the value of "solving the problem".

The problems that most people have that they really want to solve are not addressable by AI, or computers, or software.
by devsda | 2026-02-18 17:00:32+00:00
> But why wouldn't they interpret it that way, when that's exactly what it says

I assumed online by default because honestly 79% of all trafficking happening on Meta's platform sounded so implausible I didn't even consider it.

I mean if that number were really true then FB/Insta would rival the dark web or whatever it is called these days. Didn't think they were gone that far along.
by dnlzro | 2026-02-18 17:00:43+00:00
> Upgrading today should save more money vs. upgrading down the road.

Ehh, I’m not sure about that. It depends what trend the resale value follows. Generally, if you’re upgrading every 3 years instead of every 6 years, you’re going to be spending twice as much on new phones, but it’s not always the case that you’re getting twice as much resale value.
by strcat | 2026-02-18 17:00:48+00:00
> The (desktop) Linux security model is different.

Desktop Linux distributions lack a viable privacy and security model for applications and far more. They don't have comparable protections against exploitation or comparable privacy protection as a systemic part of the OS either. The approaches are very incomplete and apps generally aren't contained unless they're run in another OS in a virtual machine such as the approach in QubesOS which is not really a Linux distribution but rather a Xen distribution acting as a meta-Linux-distribution. It can use Windows too.

> user accounts

This isn't an application sandbox and doesn't provide similar isolation for desktops.

> containers

Containers do not directly work for sandboxing desktop applications. It still requires that the UI and application layer of the OS provides sandboxing. Containers can be used to isolate things at the filesystem level, etc. as part of a sandbox but are not a sandbox for desktop applications on their own.

> VMs to protect personal information

GrapheneOS has hardware accelerated virtualization on all supported devices. Running a separate OS in a VM is a much different thing from providing a working privacy and security model within the OS. Using virtualization as part of an app sandbox that's integrated into the OS itself with a separate VM for each app is a far different thing than just running another OS in a VM.

> The Android security model makes sense in the context of laypeople using mostly commercial malware on the stock OS however.

Android has a far larger open source app ecosystem for mobile than those operating systems. Open source applications still need to be sandboxed to provide reasonable privacy and security. Otherwise, you're not only trusting those applications and their supply chains to not do anything privacy invasive which does happen extremely frequently but also to avoid having vulnerabilities. The vast majority of applications do not take privacy and security very seriously so an OS not containing them and protecting them against exploits with modern exploit protections won't provide good privacy and security itself. Application vulnerabilities are the main attack vector for remote attacks. Open source software as an overall ecosystem is also not nearly as privacy respecting as you make it out to be. Most is not focused on privacy or security, which means they regularly do things which are privacy invasive to provide functionality and also aren't providing strong privacy or security protections at all.
by spacecadet_ | 2026-02-18 17:00:50+00:00
> Very few instructions even allowed interaction between the top and bottom 128 bits

That would be plain AVX, AVX2 has shuffles across the 128-bit boundary. To me that seems like the main hurdle for emulation with 128-bit vectors, in my experience compilers are very eager to emit shuffle instructions if allowed, and emulating a 256-bit shuffle with 128-bit operations would require 2 shuffles and a blend for each half of the emulated register.
by corysama | 2026-02-18 17:00:52+00:00
In gamedev it takes 7-10 years before you can require a new tech without getting a major backlash. AMD came out with AVX2 support in 2015. And, the (vocal minority) petitions to get AVX2 requirements removed from major games and VR systems are only now starting to quiet down.

So, in order to make use of users new fancy hardware without abandoning other users old and busted hardware, you have to support multiple back-ends. Same as it ever was.

Actually, a lot easier than it ever was today. Doom 3 famously required Carmack to reimplement the rendering 6 times to get the same results out of 6 different styles of GPUs that were popular at the time.

Path Name Target Hardware Passes per Light Key Feature
ARB Basic Fallback (R100) Multi-pass Minimal effects, no specular.[2]
NV10 GeForce 2 / 4 MX 5 Passes Used Register Combiners.
NV20 GeForce 3 / 4 Ti 2–3 Passes Vertex programs + Combiners.
R200 Radeon 8500–9200 1 Pass Used ATI_fragment_shader.
NV30 GeForce FX Series 1 Pass Precision optimizations (FP16).
ARB2 Radeon 9500+ / GF 6+ 1 Pass Standard high-end GLSL-like assembly.

https://community.khronos.org/t/doom-3/37313
by bpodgursky | 2026-02-18 17:01:07+00:00
If you inflate severity, people simply ignore incident warnings.

What's the actual action needed here by a security team? None. You can hate it or not care but the end of the day there's no remediation or imminent harm, just a potential issue with DLP policies. Don't make it look like a 0-day that they actually have to deal with.
by alex1138 | 2026-02-18 17:01:11+00:00
Mark Zuckerberg also lied to Aaron Greenspan (thinkcomp on here) and the Winklevosses and, oh, users (https://news.ycombinator.com/item?id=4151433, https://news.ycombinator.com/item?id=14147719) and the public (https://news.ycombinator.com/item?id=10791198) multiple times
by DoesntMatter22 | 2026-02-18 17:01:24+00:00
Not sure what relevance Musk selling shares has to do with profit they've made. That seems completely irrelevant.

That being said, yeah, profits were down a bit but a lot of that was stock compensation and other things. In practical terms they went from a cash position of 36 billion to 44 billion.

They are in a phenomenal position financially as they have very little debt. By comparison GM made 2.7 billion and Stellantis lost 20 billion.

Tesla is in such a great cash position that Apple only has about 10 billion more than them in cash.

The future looks fantastic.
by neom | 2026-02-18 17:01:39+00:00
I worked during the digital revolution in film, I've told the story a zillion times on HN but basically, I went through the first pure digital film program in Canada, by the time I graduated 70% had dropped out, as far as I know I'm the only one who made a proper go at it, and even then when my startup was taking off, a new hot shot would show up every month and be gone the next when they got bored or frustrated when nobody thought they were special. Tools are tools.
by butterbomb | 2026-02-18 17:01:49+00:00
I knew a guy who was a digital verification engineer for intel. He was unceremoniously laid off and ended up taking work doing some sort of compliance at a very low paying state agency I was a developer at.

Pretty sharp guy, we worked together a few times on problems far outside both our responsibilities/domain. I always wondered why he ended up taking that gig. Must have been horrible doing compliance work on what was likely at least a 100% pay cut.
by rvz | 2026-02-18 17:02:42+00:00
> "I think today coding is practically solved for me, and I think it'll be the case for everyone regardless of domain," Cherny said in the interview, published Tuesday. "I think we're going to start to see the title 'software engineer' go away. And I think it's just going to be maybe builder, maybe product manager, maybe we'll keep the title as a vestigial thing."

Why do we continue to listen to anyone that has a direct vested interest in selling a tool that still requires you to check if it's outputs are correct or not?

Replace "Software engineer" with "Lawyer" or "Doctor" and his prediction will still not make any sense:

I think today practicing law and medicine is practically solved for me and I think it'll be the case for everyone regardless of domain.

They don't care if they are wrong even when this article is just sales nonsense for Anthropic.

> Andrej Karpathy, a founding member of OpenAI and Tesla's ex-head of AI, said in January that he has noticed his ability to manually code has started to "atrophy."

Well maybe we can have lawyers and doctors have their skills atrophy, and they can listen use chatbots all day long because the AI is always correct.
by pragma_x | 2026-02-18 17:02:45+00:00
I can't say that I've used gitflow in hate. That said, I always saw the full complexity of the approach to address tracking multiple concurrent releases of a product. It's extremely uncommon in our increasingly SaaS world, but I imagine having so many branches with commits moving laterally between them to be invaluable for backporting security fixes and the like.

For the rest of us, trunk-based development with feature/fix branches is more than enough.
by MattRos | 2026-02-18 17:02:50+00:00
I’m Matt, and I run a small MSP in Colorado.

I built Irondiff because I was tired of staring at notepad sessions at 2 AM trying to spot a single line of configuration drift that took down a client site. While diff is great for code, it’s a pain for scrolling through massive Cisco IOS or Juniper config dumps, especially for our Tier 1 techs who aren't CLI wizards.

Irondiff is a visual tool to solve that specific headache.

What it does: It takes two config files (yesterday vs today), normalizes them, and highlights exactly what changed. It supports the weird syntax nuances of Cisco, Juniper, pfSense, Fortinet, etc.

Why I turned it into a SaaS: I originally scripted this for internal use, but we realized we needed better visibility across our team. I added an API and webhooks so we could pipe alerts directly into Slack and Microsoft Teams whenever a config changed. Now, if an engineer makes a change, the whole team sees the diff in chat instantly.

Pricing: There is a free tier for basic diffs. The paid plans ($49/mo and $190/mo) are for the API access, team notifications, and longer history retention. I’m bootstrapping this, so the pricing is designed to sustain the infrastructure without VC money.

I’d love to hear your thoughts on the diff visualization or any edge cases with specific hardware vendors we might have missed.

Thanks!
by mberlove | 2026-02-18 17:03:01+00:00
As a concept, it's intriguing. In practice, a lot of pieces need to work out just right for this particular instance of the idea to gain traction.

IMHO a few factors need to be met:

* Truthfulness -- granted that many topics have opinions and schisms.

* Reliability (self-healing articles?)

* Ease of use -- I think this needs the most improvement. Search is iffy and navigation unfriendly, IMO.

If nothing else I think the growth of something like a competitor is beneficial on its own. A single "source of truth" is nice, but that's not the age we live in, for better or worse.