MurphyA/hacker-news huggingface dataset:
by sebazzz | 2026-02-09 05:56:40+00:00
> it turned out that the version in source control wasn't the version running in production and it would have been quite a lot of work to reverse engineer the production version

When I started at my work, a previous software dev with practices more like a mechanic than a software dev didn't use tags and all binaries deployed to production were always the default version 1.0.0.0 of the C# project templates in Visual Studio. To make matters worse, variants of the software were just copy pasted in CVS with their core code checked in as binaries and not their original C# projects. Fun times finding out what actually ran on production, and patching anything in it!
by wahern | 2026-02-09 05:56:41+00:00
Lexical parsing C is simple, except that typedef's technically make it non-context-free. See https://en.wikipedia.org/wiki/Lexer_hack When handwriting a parser, it's no big deal, but it's often a stumbling block for parser generators or other formal approaches. Though, I recall there's a PEG-based parser for C99/C11 floating around that was supposed to be compliant. But I'm having trouble finding a link, and maybe it was using something like LPeg, which has features beyond pure PEG that help with context dependent parsing.
by geocar | 2026-02-09 05:58:28+00:00
I think the problem is what is an image?

I made an attempt to enumerate them[1], and whilst I catch this issue with feImage over a decade ago by simply observing that xlink:href attributes can appear anywhere, Roundcube also misses srcset="" and probably other ways, so if the server "prefetched every image" it knew about using the Roundcube algorithm the one in srcset would still act as a beacon.

I feel like the bigger issue is the W3 (nee Google). The new HTML Sanitizer[2] interface does nothing, but some VP is somewhere patting themselves on the back for this. We don't need an object-oriented way to edit HTML, we need the database of changes we want to make.

What I would like to see is the ability to put a <pre-cache href="url"><![CDATA[...]]></pre-cache> that would allow the document to replace requests for url with the embedded data, support what we can, then just turn off networking for things we can't. If networking is enabled, just ignore the pre-cache tags. No mixing means no XSS. Networking disabled means "failures" in the sanitizer is that the page just doesn't "look" right, instead of a leak.

[1]: https://github.com/geocar/firewall.js

[2]: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...
by prateekdalal | 2026-02-09 06:01:09+00:00
This resonates a lot, and I think your example actually captures the core failure mode really well.

What your PM asked for isn’t an “agentic pipeline” problem - it’s an organizational knowledge and accountability problem. LLMs are being used as a substitute for missing context, missing ownership, and missing validation paths.

In a system like that (30+ years, COBOL, interdependent routines), the hardest parts are not parsing code — they are understanding why things exist, which constraints were intentional, and which tradeoffs are still valid. None of that lives in the code, and no model can infer it reliably without human anchors.

This is where I have seen LLMs work better as assistive tools rather than autonomous agents: helping summarize, cluster, or surface patterns — but not being expected to produce “the” design document, especially when there is no stakeholder capable of validating it.

Without determinism around inputs, review, and ownership, the output might look impressive but it’s effectively unverifiable. That’s a risky place to be, especially for early-career engineers being asked to carry responsibility without authority.

I don’t think the problem is that LLMs are not powerful enough — it is that they are often being dropped into systems where the surrounding structure (governance, validation, incentives) simply isn’t there.
by NamlchakKhandro | 2026-02-09 06:01:39+00:00
So you're walking into this hoping that it's an actual AI and not just an LLM?

interesting.

how much planning do you put into your project without AI anyway?

Pretty much all the teams I've been involved in:

- never did any analysis planning, and just yolo it along the way in their PR
- every PR is an island, with tunnel vision
- fast forward 2 years. and we have to throw it out and start again.

So why are you thinking you're going to get anything different with LLMs?

And plan mode isn't just a single conversation that you then flip to do mode...

you're supposed to create detailed plans and research that you then use to make the LLM refer back to and align with.

This was the point of the Ralph Loop
by yanhangyhy | 2026-02-09 06:02:19+00:00
Taiwanese politicians, like those under American-style democracy in many regions, only care about safeguarding their own interests and have no concern for how to protect the interests of the public. Once TSMC’s factories are completed in Japan and the United States and the technology is secured, Taiwan will no longer have any value worth protecting. Of course, the politicians can always take planes and leave in advance.
by soulofmischief | 2026-02-09 06:03:08+00:00
In my experience, it is often the other way around. Enthusiasts are tasked with trying to open minds that seem very closed on the subject. Most serious users of these tools recognize the shortcomings and also can make well-educated guesses on the short term future. It's the anti crowd who get hellbent on this ridiculously unfounded "robots are just parrots and can't ever replace real programmers" shtick.
by the-grump | 2026-02-09 06:03:43+00:00
I feel so weird not being the grumpy one for once.

Can't relate to GP's experience of one-shotting. I need to try a couple of times and really hone in on the right plan and constraints.

But I am getting so much done. My todo list used to grow every year. Now it shrinks every month.

And this is not mindless "vibe coding". I insist on what I deploy being quality, and I use every tool I can that can help me achieve that (languages with strong types, TDD with tests that specify system behaviour, E2E tests where possible).
by JayDustheadz | 2026-02-09 06:05:59+00:00
You clearly have no idea how people with ADHD / parents of ADHD kids feel like.
Just because you can "overcome your cognitive dissonance" doesn't mean that everybody has the same freedom/will/strength to do so.
Adding the weight of the "drugs" tag is not a way to help those who need medication to barely function like a normal person.
by prateekdalal | 2026-02-09 06:07:14+00:00
That sounds very aligned. I like the way you phrased it - deterministic policy that agents can not bypass is exactly the right boundary, especially once you assume prompt injection and misalignment are not edge cases but normal operating conditions.

On the use case side, what we have been seeing (and discussing internally) isn’t one narrow workflow so much as a recurring pattern across domains: anywhere an LLM starts influencing actions that have irreversible or accountable consequences.

That shows up in security, but also in ops, infra, finance, and internal tooling - places where “suggesting” is fine, but executing without a gate is not. In those environments, the blocker usually isn’t model capability; it is the lack of a deterministic layer that can enforce constraints, log decisions, and give people confidence about why something was allowed or stopped.

Security tends to surface this problem first because the blast radius is obvious, but we are starting to see similar concerns come up once agents touch production systems, money, or compliance-sensitive workflows.

I am curious from your side — are you finding that security teams are more receptive to this model than other parts of the org, or are you still having to convince people that “agent autonomy” needs hard boundaries?
by thegrim000 | 2026-02-09 06:07:14+00:00
In addition to never providing examples, the other common theme is when you dive into the author's history almost 100% of the time they just happen to work for a company that provides AI solutions. They're never just a random developer that found great use for AI, they're always someone who works somewhere that benefits from promoting AI.

In this author's case, they currently work for a company that .. wait for it .. less than 2 weeks ago launched some "AI image generation built for teams" product. (Also, oddly, the author lists himself as the 'Technical Director' at the company, working there for 5-6 years, but the company's Team page doesn't list him as an employee).
by unsnap_biceps | 2026-02-09 06:07:15+00:00
Like for example: I don't know, sometimes I'm cooking for my partner. Do they hear a one-sided conversation between me and the "Live AI" about what to do first, how to combine the ingredients? Without the staged demo's video-casting, this would have been the demo: a celebrity chef talking to himself like a lunatic, asking how to start.

I think this is one of those things that society just adapts to. Some people will be in the kitchen talking to "themselves" but that's okay, people understand why. My Mom would often talk to herself when cooking anyway. She was a verbal processor. You just get used to it and eventually it doesn't seem weird anymore.
by utopiah | 2026-02-09 06:07:48+00:00
I have a dozen VR headsets, more of them doing passthrough, I have AR glasses and even a monocle. I prototype in the field. The technology is amazing... but you don't need it to get value. Bring your tablet to the kitchen, add a webcam if you want to try to get visual feedback, display the recipe and... just cook.

I think there is a big gap between :

- how messy the World is (imagine a "normal" kitchen, not a prop for a demo)

- how good existing low-tech solutions are (e.g. just a book or a printed page for a recipe)

meaning that to provide marginally more value the tech has to be excellent at handle a messy World. Sure the tech is radically improving but we are vastly underestimating, as we did for robotics for decades now, how challenging seemingly menial task can be and how to do so reliably.

I always think of my Roomba in this kind of situation, namely when one tries to imagine a future where tech works outside of the computer. Basically my little vacuum robot mostly sits idling in the corner because... a basic broom or a normal vacuum cleaner is radically more efficient, even if it means I have to do so myself.

So... yes I'm techno-optimist but the timescale is IMHO not as close as we hope for.

PS: AR setups (glasses or not) do NOT have to be connected to be useful. Do not get footed by Meta slick ads to imply that only they can make glasses, heck I'm taped a pair together 5 years ago with a RasberryPi Zero. It wasn't slick https://twitter-archive.benetou.fr/utopiah/status/1449023602... but it worked.
by worldsavior | 2026-02-09 06:07:52+00:00
Seeing that Claude can code a compiler doesn't help anyone if it's not coded efficiently, because getting it to be efficient is the hardest part, and it will be interesting seeing how long it will take to make it efficient. No one is gonna use some compiler that makes binaries run 700x longer.

I'm surprised that this wasn't possible before with just a bigger context size.
by Dylan16807 | 2026-02-09 06:07:55+00:00
> 1. Equality under the law is important in its own right. Even if a law is wrong, it isn’t right to allow particular corporations to flaunt it in a way that individuals would go to prison for.

We're talking about the users getting copyright-laundered code here. That's a pretty equal playing field. It's about the output of the AI, not the AI itself, and there are many models to choose from.
by decimalenough | 2026-02-09 06:08:12+00:00
That assumes there are chargers and that they're available. Not a problem in big cities, but it will complicate road trips, and "range anxiety" remains a real concern for first time EV buyers.

Battery swapping is talked about a lot but AFAICT it hasn't really been successful anywhere. It just seems like a lot more hassle than plugging in, and with charging speeds constantly increasing the payoff is shrinking too.
by prateekdalal | 2026-02-09 06:08:23+00:00
I don’t disagree with the underlying concern. In practice, “probabilistic” often does translate to unreliable when you put these systems in environments that expect reproducibility and accountability.

Where I think the framing matters is in how we respond architecturally. Treating LLMs as “just another unreliable program” is reasonable — but enterprises already have patterns for dealing with unreliable components: isolation, validation, gates, and clear ownership of side effects.

The problem we’re seeing is that LLMs are often dropped past those boundaries — allowed to directly author decisions or actions — which is why the downstream damage you mention (journals, courts, OSS) feels so chaotic.

The “suggestion engine” framing isn’t meant to excuse that behavior; it’s meant to reassert a familiar control model. Suggestions are cheap. Execution and publication are not. Once you draw that line explicitly, you can start asking the same questions enterprises always ask: who approves, what’s logged, and what happens when this is wrong?

Without that separation, I agree — you’re effectively wiring an unreliable component straight into systems that assume trust, and the failure modes shouldn’t surprise anyone.
by anupamchugh | 2026-02-09 06:08:34+00:00
Agents don't need full logs to learn from failures — they need structured error patterns. Compact
logs older than 7 days into summaries (status, errors, token count, 1-line context). Saves 80-90%
tokens for 30-day trend analysis. Like materializing aggregates instead of re-querying raw tables.

Opened an RFC for this: https://github.com/github/gh-aw/issues/14603
by hibikir | 2026-02-09 06:09:17+00:00
Highlighting this as a good thing is just... not great

> Code you did not write is code you do not understand
> You cannot maintain code you do not understand

We need no AI for this one: If I could only maintain code I wrote, I'd have to work alone. Whether I am reviewing code written by AI or by a human is irrelevant here. The rest of the comments on the human we know having more trust is in itself a smell on your development process: This is how we get cliques, and people considering repos hostile, because there's clear differences in behavior for well known contributors, who are just as capable of writing something bad as anyone else. If there's anything I have seen in code review processes, regardless of where I've worked for the last couple of decades, is that visual inspections rarely get us anywhere, and no organization is willing to dedicate the time to double check anything. Bugs that happily go through inspection come in too even when the organization commits to extreme programming: Full time TDD and full pairing.

There is a question on how fast we can merge code in a project safely, regardless of the identity of the author of the PRs. A systematic approach to credible, reliable development. But the answer here has very little to do with what the article's author is saying, and has nothing to do with whether a contribution was made by an AI, a human, or a golden retriever with access to a keyboard and a lot of hope.
by prateekdalal | 2026-02-09 06:09:46+00:00
I doubt ISO-9000 gets “replaced” so much as interpreted more strictly in the presence of LLMs. ISO-9000 isn’t about how work is done — it’s about whether processes are defined, repeatable, auditable, and improvable.

From that lens, LLMs actually create tension rather than an escape hatch. A system whose outputs can’t be reproduced, explained, or bounded makes it harder to demonstrate compliance, not easier. Saying “we use AI” doesn’t satisfy requirements around traceability, corrective action, or process control.

My guess is that ISO-style frameworks will push organizations toward explicitly classifying where LLMs are allowed to operate: as advisory inputs, as drafting aids, or as automation under defined controls — with clear ownership and validation steps around them.

In other words, the pressure probably won’t be to loosen standards, but to reassert them: define where probabilistic components sit, what checks exist before outputs become authoritative, and how failures are detected and corrected. Without that structure, it’s hard to see how certification survives unchanged.
by kiennt26 | 2026-02-09 06:10:01+00:00
https://github.com/ntk148v/clicklens

It's a modern, powerful, and user-friendly web interface for managing and monitoring ClickHouse databases. It provides a comprehensive suite of tools for developers, analysts, and administrators to interact with their ClickHouse clusters efficiently.

- Effective and Native RBAC: Use ClickHouse grants to control the data access and UI permissions.
- Discover - Flexible, Kibana-like data exploration for any table granted access.
- SQL Console, Monitoring and Logging, ... all in just one place.
by fc417fc802 | 2026-02-09 06:10:58+00:00
> I've explained the same point three different ways now.

But you're demonstrably wrong. The purpose of a PKI is to map keys to identities. There's no CA located across the network that gets queried by the Android boot process. Merely a local store of trusted signing keys. AVB has the same general shape as SecureBoot.

The point of secure boot isn't to involve a third party. It's to prevent tampering and possibly also hardware theft.

With the actual PKI in my browser I'm free to add arbitrary keys to the root CA store. With SecureBoot on my laptop I'm free to add arbitrary signing keys.

The issue has nothing to do with PKI or TOFU or whatever else. It's bootloaders that don't permit enrolling your own keys.
by nvrmnd | 2026-02-09 06:11:25+00:00
> It's not fair to compare them like this!

As someone who leans pro in this debate, I don't think I would make that statement. I would say the results are exactly as we expect.

Also, a highly verifiable task like this is well suited to LLMs, and I expect within the next ~2 years AI tools will produce a better compiler than gcc.
by jameshush | 2026-02-09 06:11:34+00:00
@cootsnuck, if I didn't really love working with the people/company I'm at now, I'd also start my own consulting company.

Once I realized you really only need 3-5 consistent customers (well, you only REALLY NEED one customer), and you can generally keep customers and employees happy by responding quickly and doing what you say you'll do (aka not taking on work you can't handle) I'm confident I could branch out on my own if I ever wanted to.
Who Approved This Agent? A book on authorizing AI-generated code
by humanatsetc | 2026-02-09 06:11:57+00:00
I moved my IoT compiler to test something from an AI vibe coding standpoint. The result is SETC a compiler and permit system and a free book that documents what I learned along the way.

The book starts with the problem, AI agents are writing and executing code with minimal oversight. Databases deleted, drives wiped, dozens of CVEs across every major AI coding tool. Usage is up, trust is down.

Then it walks through one approach, Ed25519 signed permits, Secure Enclave integration, M of N team approval, capability gated runtimes, and an ECDH killswitch. It stirs ideas about what the future may look like but doesn't necessarily have to but stirs the idea of what the gates might be then.

Would appreciate feedback from anyone working on similar problems & your approach.

Book: https://book.se.tc
page: https://se.tc
Docker: docker pull humanatsetc/setc:book-edition
by lelanthran | 2026-02-09 06:11:59+00:00
> One side is demanding we keep giving hundreds of billions to them and at the same time promising the other side's unemployment.

That's a valid take. The problem is that there are, at this time, so many valid takes that it's hard to determine which are more valid/accurate than the other.

FWIW, I think this is more insightful than most of the takes I've seen, which basically amount to "side-1: we're moving to a higher level of abstraction" and "side-2: it's not higher abstraction, just less deterministic codegen".
by gaigalas | 2026-02-09 06:14:36+00:00
> I'm terrified that our craft will die, and nobody will even care to mourn it.

Mourn it? Overall, people seem to hate tech workers in general (of all kinds). The death of the craft will not be mourned as a tragedy, it's already being celebrated as a triumph (whether it's true or not, doesn't matter).

I must admit there's a part of me that wants it to die. I want people to remember what was good about it in retrospect, then realize there is no chance of ever getting it back. Permanent losses are important lessons.
by jsiepkes | 2026-02-09 06:14:37+00:00
> The system validating the authentication needs only to verify that the credentials are correct. If users want to use TPMs, HSMs,etc.. or none at all, that's up to them.

That's not up to the user in a corporate environment. If you use company supplied hardware keys for FIDO2 you don't want users using some software emulator on their phone because they think it's easier.
by all2 | 2026-02-09 06:14:40+00:00
I'm on my 5th draft of an essentially vibe-coded project. Maybe its because I'm using not-frontier models to do the coding, but I have to take two or three tries to get the shape of a thing just right. Drafting like this is something I do when I code by hand, as well. I have to implement a thing a few times before I begin to understand the domain I'm working in. Once I begin to understand the domain, the separation of concerns follows naturally, and so do the component APIs (and how those APIs hook together).
by acjohnson55 | 2026-02-09 06:14:43+00:00
I disagree with the characterization as "slop", if the tools are used well. There's no reason the user has to submit something that looks fundamentally different from what they would handwrite.

You can't simply throw the generated code over the wall to the reviewer. You have to put in the work to understand what's being proposed and why.

Lastly, an extremely important part of this is the improvement cycle.
The tools will absolutely do suboptimal things sometimes, usually pretty similar to a human who isn't an expert in the codebase. Many people just accept what comes out. It's very important to identify the gaps between the first draft, what was submitted for code review, and the mergeable final product and use that information to improve the prompt architecture and automation.

What I see is a tool that takes a lot of investment to pay off, but where the problems for operationalizing it are very tractable, and the opportunity is immense.

I'm worried about many other aspects, but not the basic utility.
by 0xbadcafebee | 2026-02-09 06:14:57+00:00
Five hours ago I was reviewing some failed tests in a PR. The affected code was probably 300 lines, total source for the project ~1200 lines. Reading the code, I couldn't figure out what the hell was going on... and I wrote all the code. Why would that be failing? This all looks totally fine. <changes some lines> There that should fix it! <runs test suite; 6 new broken tests> Fuck.

When you write code, your brain follows a logical series of steps to produce the code, based on a context you pre-loaded in your brain in order to be capable of writing it that way. The reader does not have that context pre-loaded in their brain; they have to reverse-engineer the context in order to understand the code, and that can be time-consuming, laborious, and (as in my case) erroneous.
by throwup238 | 2026-02-09 06:15:06+00:00
At $120/mo might as well just get a big propane tank and have a tanker come refill it every six to twelve months. If they’re not using it to heat the house a 500 gallon tank lasts a long time. Bonus points because you can use it as a generator fuel source for the inevitable California power outage and possible earthquake disaster.