MurphyA/hacker-news huggingface dataset:
by umairnadeem123 | 2026-02-17 01:31:54+00:00
Interesting idea. The “permissions-first” bit feels like it wants to be capability-based: you don’t get a raw model/table handle, you get a scoped handle whose type encodes (read|write|delete) + row/domain constraints.

Two pitfalls I’d watch:
1) Don’t pretend you can out-ORM the DB: ultimately enforce in the database (RLS/GRANTs/policies), and treat ORM permissions as a compile-time/ergonomic layer.
2) Make privilege boundaries explicit at function boundaries (who creates the scoped handle?) so you don’t end up with ambient auth context leaking everywhere.

If you can generate SQL that is provably policy-complete (or at least auditable), that’s a big win.
by cyanydeez | 2026-02-17 01:32:13+00:00
Base model is content. If it reads to much it becomes the content.

What you want is a harness that continually inserts file portions until a sufficiently bright light bulb goes off.

When they say agentic AI, ITS BASICALLY:

<command><content-chunk-1/></command>

its the ugliest string mashing indeterministic garbage the bearded masters would face palm.
by so-cal-schemer | 2026-02-17 01:32:25+00:00
Talk by Allan Schougaard from RacketCon 2024

"In this talk I present a linguistic comparison of language choices in Racket and LISP vs. a number of other computer languages. LISP is by far the programming language with the simplest syntax: only using parenthesis as delineations. However, the Racket and LISP communities have over time added a great variety of semantics on this simple mechanism, some of which have proven great inventions, and some of which other languages may have better solutions to, and that the Racket and LISP communities may learn from. The talk will directly compare elements of yaml, SmallTalk, Ruby, Java, regular expressions, visual programming, and shell programming with Racket."
by xvxvx | 2026-02-17 01:34:18+00:00
Related: A researcher for Meta, the parent company of Facebook and Instagram, warned executives at the tech giant that there may be upward of 500,000 cases of sexual exploitation of minors per day on the social media platforms.

https://www.foxbusiness.com/lifestyle/meta-researcher-warned...

Who needs the dark web when Meta exists and is protected by the US government?

Edit: downvotes? Lol
by kerkeslager | 2026-02-17 01:35:00+00:00
I've got a few open source projects out there, and I've almost never received any PRs for them until AI, simply because they were things I did for myself and never really promoted to anyone else. But now I'm getting obviously-AI PRs on a regular basis. Somehow people are using AI to find my unpromoted stuff and submit PRs to it.

My canned response now is to respond, "Can you link me to the documentation you're using for this?" It works like a charm, the clanker doesn't ever respond.
Show HN: Task Automation Analysis of Labor Statistics and O*Net Jobs Data
by Falimonda | 2026-02-17 01:35:42+00:00
I've built my own take on a job market and career intelligence tool. Instead of generic "AI will replace X jobs" articles, it analyzes 700 odd U.S. occupations at the task level breaking down exactly which parts of a job are automatable and why - all seeded from government-reported data.

What it does that other tools don't is give you a way forward to navigate the job market. There's a Career GPS that maps stepping-stone paths between your current role and a safer target, as well as a resume x JD analyzer.

It also tracks real-time layoff events and runs a daily news pipeline that links AI developments back to specific occupations.

You can check it out at https://www.jobs.voxos.ai/
by lovich | 2026-02-17 01:36:52+00:00
Why would people/companies donate more money to open source in the future that they don’t already donate today?

It’s a tragedy of the commons problem. Most of the money available is not tied up to decision makers who are ideologically aligned with open source, so I don’t see why they’d donate any more in the future.

They usually do so because they are critically reliant on a library that’s going to die, think it’s good PR, makes engineers happy(don’t think they care about that anymore), or they think they can gain control of some aspect of industry(looking at you futurewei and the corporate workers of the Rust project)
by umairnadeem123 | 2026-02-17 01:36:53+00:00
I buy the thesis that “plateau” depends on what you measure. If your benchmark is single-shot QA, you’ll hit saturation faster than if your benchmark is end-to-end work (search+tool use+verification).

A thing that feels under-discussed: systems improvements (retrieval, caching, distillation, better evals, tighter feedback loops) can move the frontier even if raw pretrain scaling slows. That looks like progress to users even if it’s not a new giant model.

I’m more worried about a plateau in reliability than in average capability: the last 5% of error rate is brutally expensive.
by unodonut | 2026-02-17 01:39:18+00:00
According to the wiki, a one-click exfiltration vulnerability has existed for more than half a year and hasn't been fixed:

> In their default configurations, these extensions were shown to be exposed to a DOM-based extension clickjacking technique, allowing attackers to exfiltrate user data with just a single click. LastPass version 4.146.8 (September 12, 2025), which was intended to address the issue, remains vulnerable

https://en.wikipedia.org/wiki/LastPass#Security_incidents
by xtreak29 | 2026-02-17 01:39:41+00:00
Reviewing code was also a big bottleneck. With lot more untested code where authors don't care about reviewing their own code it will take even more toll on open source maintainers. Code quality between side projects and open source projects are different. Ensuring good code quality enables long term maintenance for open source projects that have to support the feature through the years as a compatibility promise.
by avaer | 2026-02-17 01:39:51+00:00
But locally, dollars are a zero-sum game. Your dollars came from someone else. If you make a project better for yourself without making it better for others you can possibly one-up others and make more dollars with it. If you make it better for everyone that's not necessarily the case. You're just diluting your money and soon enough you won't have money and you're eliminated from the race.

While I'd like to believe in the decency and generosity of humans, I don't get the economic case of donating money to the agent behind an OS project, when the person could spend the money on the tokens locally themselves and reap the exclusive reward. If it really is just about money that only makes sense.

Obviously this is a gross oversimplification, but I don't think you can ignore the rational economics of this, since in capitalism your dollars are earned through competition.
by cyanydeez | 2026-02-17 01:39:53+00:00
Good abstractions only get you easy wins for some percent of the desirable tasks. They never guarantee 100% edge case unless trivial.

Choosing wrong means huge tech debt. Choosing righr just means most of your code will be happy path, and a few will need escape hatches. Not because of the abstract but because the target problem shifts uncontrollably. Because the problems you are solving typically require multiple abstractions and they are going to meet at the edges in the best case.
by umairnadeem123 | 2026-02-17 01:40:05+00:00
Skimming papers like this I always try to map findings to a user threat model.

If the attacks are mostly “malicious/compromised client + browser extension” or “malicious local process”, then the uncomfortable takeaway is that any vault in the same trust zone is in trouble (the manager can’t defend secrets from the machine that’s currently decrypting them).

If there are server-side / sync-layer attacks that let a provider or MitM cause unsafe behavior (rollback, confused deputy, malicious item injection, etc.), then that’s where vendors can materially improve: stronger integrity checks, monotonic versioning, explicit trust prompts, safer parsing, independent verification.

Would love a quick taxonomy summary from someone who’s read the whole PDF: which category dominates?
by loeber | 2026-02-17 01:40:38+00:00
Because donating to open source projects today has an extremely unclear payoff. For example, I donate to KDE, which is my favorite Linux desktop environment. However, this does not have a measurable impact on my day-to-day usage of KDE. It's very abstract in that I'm making a tiny, opaque contribution to its development, but I have no influence on what gets developed.

More concretely, there are many features that I'd love to see in KDE which don't currently exist. It would be amazing if I could just donate $10, $20, $50 and submit a ticket for a maintainer to consider implementing the feature. If they agree that it's a feature worth having, then my donation easily covers running AI for an hour to get it done. And then I'd be able to use that feature a few days later.
by Nextgrid | 2026-02-17 01:41:30+00:00
Note: the "agent" the title refers to has nothing to do with an AI/LLM agent. Originally I thought this had something to do with an AI agent, as if someone put an AI agent in charge of identifying dark web pictures for clues. It's a good story nevertheless and I'm glad the victim was rescued, but nothing to do with AI/LLMs.
by qingcharles | 2026-02-17 01:41:57+00:00
Me too. I'm going to be reverse-engineering Elite PC (original version) and I can't help but think the source is lost. The developer seems to have totally dropped off the face of the Earth. I've contacted others who might know and nobody knows where they are.

Even the game I was a developer on which was published by Eidos in ~1998 is probably lost source. I can't think that anyone has the Visual Source Safe database backup CDs lying around, but I could be wrong.
by kerkeslager | 2026-02-17 01:42:00+00:00
> AI agents mean that dollars can be directly translated into open-source code contributions, and dollars are much less scarce than capable OSS programmer hours.

I think this is true, but misses the point: quantity of code contributions is absolutely useless without quality. You're correct that OSS programmer hours are the most scarce asset OSS has, but AI absolutely makes this scarce resource even more scarce by wasting OSS programmers' time sifting through clanker slop.

There literally isn't an upside. The code produced by AI simply isn't good enough consistently enough.

That's setting aside the ethical issues of stealing other people's work and spewing even more carbon into the atmosphere.
by umairnadeem123 | 2026-02-17 01:43:06+00:00
For “family members who struggle with tech”, I’d optimize for:
- cross-device autofill that Just Works
- account recovery you can actually manage (but not so weak it defeats the point)
- sharing a small set of household logins cleanly

In practice that usually means either:
1) 1Password Families (best UX/recovery/sharing, paid), or
2) Bitwarden (good balance, cheaper, can self-host if you want, but UX is a bit more fiddly).

If everyone is already all-in on Apple (or Google), the built-in Passwords/Google Password Manager are honestly hard to beat for simplicity.

Regardless of manager: enable 2FA on the manager account itself, and start migrating important accounts to passkeys where possible.
by zmgsabst | 2026-02-17 01:43:10+00:00
I always need to contextualize these numbers:

- there are 2.4B under 18 globally

- which means 500k is 0.02% of all children

- or around 1 in 5000 children globally, per day

- if evenly distributed (which is unlikely), then roughly 7-8% of all kids would feature in Meta exploitation yearly

That suggests very high reoccurrence; but even reoccurrence suggests the total rate remains quite high. A reoccurrence rate of 100x would suggest that roughly 1 in 1000 kids is exploited on Meta, yearly.

Anyway, disturbing.
by michelsedgh | 2026-02-17 01:44:10+00:00
I think I have seen more open source projects get released since LLMs came out and the rate seems to be increasing. The cost of making software and open sourcing it has gone down a lot. We see some slop but as the models get better, the quality will get better and from the pace I have seen we went from gpt-3.5 to now opus4.6 i dont think it will be long before the LLMs get much better than humans in coding!
by 1024core | 2026-02-17 01:44:20+00:00
Facial recognition is very powerful these days. My friend took a photo of his kid at the top of Twin Peaks in SF, with the city in the background. Unfortunately, due to the angle, you could barely see the eyes and a portion of the nose of the kid. Android was still able to tag the kid.

I feel like Facebook really dropped the ball here. It is obvious that Squire and colleagues are working for the Law Enforcement. If FB was concerned about privacy, they could have asked them to get a judicial warrant to perform a broad search.

But they didn't. And Lucy continued to be abused for months after that.

I hope when Zuck is lying on his death bed, he gets to think about these choices that he has made.
by nihalwashere | 2026-02-17 01:44:25+00:00
Distributed rate-limiting is intentionally not in the core library, Reader focuses on the scraping primitives and stays unopinionated about orchestration.

For multi-node rate limiting, you'd layer that on top: Redis + a simple limiter that gates calls to reader.scrape().

For k8s resource settings, the Docker guide is a good starting point: https://docs.reader.dev/documentation/guides/deployment

But I will add some reference examples on how to build a rate-limiting and K8s orchestration layer on top of Reader...

Thanks for sharing this :)
by iosifnicolae2 | 2026-02-17 01:44:40+00:00
The idea behind this spec is to give users full access to their own data. For example, ORM-backed data could be consumed by an MCP server, an autonomous agent, or a vibe-coded app. The goal is to make the data layer flexible and interoperable so that any client can build on top of it.
Looking ahead, I believe the best product managers will be the end users themselves. They'll want to vibe-code their own frontends and connect them to a secure backend.

That raises a key question: how do we design a backend that's secure, safe, and robust enough to support a wide range of use cases while still being extensible enough for user-driven customization?
by abrookewood | 2026-02-17 01:45:00+00:00
There are a few valid arguments that I see to support the pessimism:

1. When people use LLMs to code, they never read the docs (why would they), so they miss the fact that the open source library may have a paid version or extension. This means that open source maintainers will receive less revenue and may not be able to sustain their open source libraries as a result. This is essentially what the Tailwind devs mentioned.

2. Bug bounties have encouraged people to submit crap, which wastes maintainers time and may lead them to close pull requests. If they do the latter, then they won't get any outside help (or at least, they will get less). Even if they don't do that, they now have a higher burden than previously.
by qingcharles | 2026-02-17 01:45:55+00:00
In the 2000s I had a service with a couple of million registered users and plaintext passwords. One day a couple of us ran a SQL script to group and order all the passwords. The top ones are what you would expect, 12345678, Password, etc. One of the top three was "trustno1", though. The X-Files was probably still running on TV at the time.
by nebezb | 2026-02-17 01:46:04+00:00
I’ve spent just a teeny bit of time helping international ICE investigators (not that one; internet child exploitation) postpone PTSD with technology. It seems like after two years of their job, they’re going to have a mental break. So postponing is all you can really do.

It’s disheartening how underfunded these agencies are compared to, what feels like at least, the severity of the crimes they’re up against.

These folks are heroes. This is one place AI has a lot of potential (but very little commercial value).
by zhendong2000 | 2026-02-17 01:46:39+00:00
Robal — An AI workforce that works like a real team

Robal combines three powerful ideas to create AI that can actually get things done on their own.

* Agent Teams — Give Robal a complex task and it breaks it down into subtasks, spins up parallel AI workers, and coordinates them like a CEO

* Ralph Loop — Every worker follows a Plan → Execute → Review cycle. This means quality output fully autonomously.

* Claw — Workers have full system and browser integration to handle any tasks

robalai.com
by saghm | 2026-02-17 01:47:11+00:00
When I got married, my spouse and I told people to wear whatever they wanted because we didn't really care. I also never cared at all about what we were wearing on our dates because what I enjoy about spending time with people is not seeing them present themselves in a way that I tell them to. I would go to a restaurant in sweats if I were allowed to.

I fundamentally do not understand what reason everyone else should have to dress to please you compared to themselves. Seeing everyone else as props to fit your preferred aesthetic rather than people who's desires about their own appearances are more important than what you want them to look like just seems selfish to me.
by matteotom | 2026-02-17 01:49:17+00:00
I did. Your argument seems to be that LLMs allow users who want specific features to direct a donation specifically towards the (token) costs of developing that feature. But I don't see how that's any different from just offering to pay someone to implement the feature you want. In fact, this does happen, eg in the case of companies hiring Linux devs; but it hasn't worked as a general purpose OSS-funding mechanism.
by akoboldfrying | 2026-02-17 01:49:33+00:00
An analogy for cryptocurrency that I like is lasers. I remember reading an Usborne book about lasers as a kid and thinking they were the coolest thing ever and would doubtless find their way into every technology because glowing beams of pure light energy, how could they not transform the world!

Lasers turn out to be useful for... eye surgery, and pointing at things, and reading bits off plastic discs, and probably a handful of other niche things. There just aren't that many places where what they can do is actually needed, or better than other more pedestrian ways of accomplishing the same thing. I think the same is true of crypto, including NFTs.
by Onavo | 2026-02-17 01:49:39+00:00
When people on hacker News talk about requiring cops to do traditional police work instead of doing wide ranging trawls using technology, this is exactly what they meant. I hope you don't complain when the future you want becomes reality and the three letter agencies come knocking down your door just because you happened to be in the same building as a crime in progress and the machine learning algorithms determined your location via cellular logs and labelled you as a criminal.
by ggm | 2026-02-17 01:50:16+00:00
periodically the various forces tackling CSAM release images which are ENTIRELY SFW, and are purely of a jersey, a backpack, a location, a tea setting, and ask people to tell them things: Was this available in Belgium? Did you ever see this in a second hand shop? Do you recognise the logo on this bag?

Information inside images is useful for this kind of struggle to identify victims of crime.
by vzaliva | 2026-02-17 01:50:23+00:00
First of all, sorry to hear about the poor girl’s ordeal, and I’m glad she was rescued. But after reading about all that complicated digital sleuthing, it basically comes down to this:

"The team realised that in the household with Lucy was her mother’s boyfriend - a convicted sex offender."

I feel like the police should’ve started there: cross-referencing people in her close circle against a list of known sex offenders.
by reactordev | 2026-02-17 01:50:49+00:00
There should be ways for a corporation to vet based on severity of the role to match the severity of the candidate, backgrounds included. Cases like, you wouldn’t want to hire a CFO who has been convicted of fraud. Likewise you wouldn’t want a president who’s been convicted of crimes either.

But if you don’t need access to sensitive information, you aren’t dealing with corporate funds or accounting, just a cog in the machine, I don’t think it should matter.

The issue is now, even the smallest issue from years ago is flagged by an AI, which in turn rejects you from a downstream workflow, which doesn’t put you in the hiring managers lap.
by tpierce89 | 2026-02-17 01:51:30+00:00
Hi HN! I’ve been building Shard, a browser-powered distributed AI inference network designed to let users contribute compute (via WebGPU) while powerful verifier nodes finalize outputs.

What it is right now

Shard is a functioning early-stage system that lets:
• Browsers act as Scout nodes to contribute WebGPU compute
• A libp2p mesh for P2P networking
• Verifier nodes run stronger local models to validate and finalize inference
• A demo web app you can try live today
• Clients fall back gracefully if WebGPU isn’t available
• Rust daemon + Python API + web UI all wired together

It’s essentially a shared inference fabric — think distributed GPU from volunteers’ browsers + stronger hosts that stitch results into reliable responses. The repo includes tooling and builds for desktop, web, and daemon components.

Why it matters

There’s a growing gap between massive models and accessible compute. Shard aims to:
• Harness idle WebGPU in browsers (scouts)
• Validate and “finish” results on robust verifier nodes
• Enable decentralized inference without centralized cloud costs
• Explore community-driven compute networks for AI tasks

This isn’t just a demo — it’s a full stack P2P inference system with transport, networking, and workflow management.

Current limitations
• Early stage, not production hardened
• Needs more tests, documentation, and examples
• Security and incentive layers are future work
• UX around joining scheduler/mesh could improve

Come build with me

If you’re into decentralized compute, AI infrastructure, web GPU, or mesh networks — I’d love feedback, contributions, and ideas. Let’s talk about where shared inference networks could go next.

Repo: https://github.com/TrentPierce/Shard
by theptip | 2026-02-17 01:51:43+00:00
I’ve idly toyed with this problem as well, I think there’s a good opportunity to build a nice framework in Python with monkeypatching (or perhaps in other languages using DB/ORM middleware) so you don’t need to modify the code under test.

I think you can do better than explicit barrier() calls. My hunch is the test middleware layer can intercept calls and impose a deterministic ordering.

(There are a few papers around looking into more complex OS level frameworks to systematically search for concurrency bugs, but these would be tough to drop into the average web app.)
by Aurornis | 2026-02-17 01:51:50+00:00
Am I reading this correctly that the address where they found the child was where her mother’s boyfriend was living?

> "So we narrowed it down to [this] one address… and started the process of confirming who was living there through state records, driver's licence… information on schools," says Squire.

> The team realised that in the household with Lucy was her mother's boyfriend - a convicted sex offender.

There’s a lot of focus on Facebook in the comments here, but unless I’m missing something the strangest part about this story was that the child’s mother was dating a convicted sex offender and they had to go through all of this process to arrive at this? It’s impressive detective work with the brick expert identifying bricks and the sofa sellers gathering their customer list, but how did this connection not register earlier?