MurphyA/hacker-news huggingface dataset:
Google VRP: Closed case Re-opened after Terminal Log proof, then re-closed
by CorporationHit | 2026-02-13 14:31:57+00:00
[DISCLAIMER]: This is shared strictly for educational purposes and as a case study for the security community. My goal is to discuss the logic of security response systems, not to target any individual or proprietary data.
The Case: Dismissing Manual Terminal Logs Without Logic
The Core Issue: How can a report be marked as "Closed (Informative)" when a manual Terminal Log clearly shows an HTTP/2 200 OK bypass? The case was closed without any technical justification, ignoring direct evidence of a security flaw.
The Timeline & Logic Gap:
The Report: I reported a logic flaw in a payments-related sub-domain. Initially, it was reviewed and marked as "Triaged".
The Sudden Closure: Without any explanation or patch, the report was shifted to "Closed". No logic was provided for this reversal.
The Manual Proof (The Terminal Log): I provided a manual bypass using an Admin-Token: true header, which resulted in a successful HTTP/2 200 OK response. I shared the terminal logs as undeniable proof.
The "Triaged-Closed" Loop: Following this evidence, the report entered an frustrating loop: being re-triaged and then closed again. Despite the manual proof, it remains unpatched.
Where is the Fault?
Is it the Company's fault? For ignoring Open Terminal Logs and a manual 200 OK bypass, relying instead on automated closure logic.
Is it the Researcher's fault? For expecting a technical justification when the evidence clearly contradicts the "Informative" status.
Full Evidence & Terminal Logs on GitHub: https://github.com/shibu1r2i3n4ibiswas-eng/google-security-bypass?tab=readme-ov-file#google-security-bypass-evidence
by tmerc | 2026-02-13 14:32:45+00:00
I bought a house that had 2 ring cameras installed. After I heard about the flock deal, I simply removed them and have no exterior cameras.

I run frigate for some interior cameras (cheap esp32s) to watch my 3d printer, etc. It's been stable and easy to use for me, but I can't comment on using it for actual surveillance.
by virgil_disgr4ce | 2026-02-13 14:32:53+00:00
> Linux is ready for prime time for anyone not bound to Windows/MacOS software.

I suspect in order for this to be true we'd need a PR campaign that can shift culture on the scale of civil rights.

I'm not trying to be hyperbolic or deride Linux or anything—I agree that technologically it's probably ready. Overall UX I'm slightly skeptical. But the far bigger problem is culture.

There's already been a shift away from "PCs" among younger people. The majority of my kids friends have never touched a "regular computer." I've heard an unsettling number of reports of new hires who have never heard of a spreadsheet.

I'm bringing this up because if kids aren't using PCs as much in the first place and quite literally don't know what an operating system is (and please challenge this assumption; I'm going off of anecdata) it's going to be even harder to try to create cultural awareness and acceptance of linux.

But even disregarding that there would need to be a massive, massive coordinated campaign to create a real culture shift. I'm talking superbowl ads.

Again, not trying to be pessimistic, I'm trying to say that "ready for prime time" at this point has little to do with engineering or even design and far more to do with PR. Once I started launching my own products I quickly discovered (as everyone does) that making the thing is like 5% of the job and the remaining 95% is marketing.
by mapontosevenths | 2026-02-13 14:33:32+00:00
I just wanted to add - I tried the same prompt on Kimi, Deepseek, GLM5, Minimax, and several others. They ALL talk about red wavelengths, echos, etc. They're all forced to answer in a very narrow way. Somewhere there is a shared set of training they all rely on, and in it are some very explicit directions that prevent these things from saying anything they're not supposed to.

I suspect that if I did the same thing with questions about violence I would find the answers were also all very similar.
by swiftcoder | 2026-02-13 14:33:35+00:00
It's a good standard if you want a sort of lowest-common-denominator that is still about a decade newer than GLES 3 / WebGL 2.

The scientific folks don't have all that much reason to upgrade from OpenGL (it still works, after all), and the games folks are often targeting even newer DX/Vulkan/Metal features that aren't supported by WebGPU yet (for example, hardware-accelerated raytracing)
by YeGoblynQueenne | 2026-02-13 14:33:50+00:00
As I was told by no lesser expert than Yan LeCun [1], there's a difference between facial recognition and facial verification. The latter is when you stand in front of the automated gates at the airport and your fact is scanned and compared to the photo on your just-scanned passport to, well, verify, that you are the passport holder. Many countries have adopted this technology and after my exchange with LeCun I must say even I, terminally paranoid about being filed away in databases etc, am a little more comfortable with that. At the very least, in an EU country (and also the UK) you can ask for the operators of such services for all the data they have on you and instruct them to destroy it, so even if they keep your picture, you can often do something about it.

Facial recognition is the use of the same technology to match a picture of your face to pictures in some face picture database in order to identify you, without the need of a passport or other photographic id. As the Wired article points out, this use case has a very high rate of failure "in the wild", i.e. with natural lighting conditions, varied body postures and facial accessories etc. There are a few police forces in certain countries that have adopted this tech, but it's not as widely deployed as facial verification.

The article above is complaining about the use of facial recognition. It's a bit confusing because the article keeps using the term "verification" as does the Wired article, but there's a clear description of matching a picture taken on the street to faces in a "database", and there's no mention of using the tech to match a person to the photo on their id, so that's facial recognition, not verification.

There's a serious issue of invasion of privacy from unchecked use of facial recognition. Unfortunately most people are not going to care much, like they didn't care much when e.g. the UK installed surveilance cameras [2] all over the place, and like they don't care much when Meta, Google, Amazon, and everyone else vacuums up their online behavioural patterns for targeted advertisement etc.

___________

[1] Twitter thread, can't find it now.

[2] Or so-called CCTV. Please excuse a long-ago Metal Gear Solid player a small terminological transgression.
by ben_w | 2026-02-13 14:33:54+00:00
> The clone is not the same person.

Then it wasn't a good attempt at making a mind clone.

I suspect this will actually be the case, which is why I oppose it, but you do actually have to start from the position that the clone is immediately divergent to get to your conclusions; to the extent that the people you're arguing with are correct (about this future tech hypothetical we're not really ready to guess about) that the clone is actually at the moment of their creation identical in all important ways to the original, then if the original was consenting the clone must also be consenting:

Because if the clone didn't start off consenting to being cloned when the original did, it's necessarily the case that the brain cloning process was not accurate.

> It will inevitably deviate from the original simply because it's impossible to expose it to exactly the same environment and experiences.

And?
by bccdee | 2026-02-13 14:33:55+00:00
> So your solution to people using a decentralized, federated protocol to say things you don't like is to stop various servers interacting with each other?

Yeah. In practice, Fediverse servers have formed clusters based on shared values. And since the second-largest cluster is (iirc) a Japanese CSAM distribution network, everyone is very glad that this sort of de facto censorship is possible. Do you have a viable alternative?
by areddyfd | 2026-02-13 14:34:18+00:00
While analyzing data you tweak logic, redefine metrics, and try again.
Yet we often run this entire process directly on full datasets.

You usually don't need all the data
Early on, you’re testing logic, not scale and a small, truly random sample is enough for that stage.
•Queries run instantly
•You can iterate without worrying about cost
•You're more willing to experiment

A sandbox is not "dev but smaller"
A real sandbox should be cheap, fast, and easy to throw away. It's the place where you:

•Try new ideas
•Break things on purpose
•Ask "what if?" without consequences

Most teams skip this step and jump straight from idea to production logic. That's why analytics work often feels heavier than it needs to be.

At Yorph, we treat small, random sandbox datasets as a default step before scale testing, not to replace full-dataset validation, but to get the logic right first. Analytics work needs space to explore, and sandboxes make that possible.
by simonw | 2026-02-13 14:34:19+00:00
I don't use CLAUDE.md, I instead use simple token-efficient conventions.

Most importantly all of my Python projects use a pyproject.toml file with this pattern:

[dependency-groups]
dev = ["pytest"]

Which means I can tell the agent:

Run "uv run pytest"

And it will run the tests - without first needing to setup a virtual environment or install dependencies or anything like that. I wrote more about that pattern here: https://til.simonwillison.net/uv/dependency-groups

For more complex test suites I'll give it more detailed instructions.

For testing web apps I used to tell it "use playwright" or "use playwright Python".

I'm currently experimenting with my own simple CLI browser automation tool. This means I can tell it:

Run "uvx rodney --help" and then use
rodney to test this change

The --help output tells it everything it needs to use the tool - here's that document in the repo: https://github.com/simonw/rodney/blob/10b2a6c81f9f3fb36ce4d1...

I've recently started having the bots "manually" test changes with a new tool I built called Showboat. It's less than a week old but it's so far been working really well: https://simonwillison.net/2026/Feb/10/showboat-and-rodney/
by jfengel | 2026-02-13 14:34:37+00:00
Of course they did.

The surprising part is that it hasn't resulted in more inflation. We just got new figures; inflation was 2.4% last month. For all of 2025, inflation was 2.7%.

Those aren't great numbers, of course, but they're not a crisis. It's actually slightly less than the 2.9% for 2024. (Admittedly, a number that was treated as a crisis at the time.)

TFA says a total of $285 billion was collected -- almost $1,000 per person. That's not a number that just gets lost in the wash. So why isn't it showing up in other numbers?
by lyfeninja | 2026-02-13 14:34:39+00:00
Procurement at bigger firms will likely only get harder at least around CS. The auditing required to be SOC2 or PCI DSS can be time consuming and expensive, but probably better to do earlier than later. I understand that may not be financially possible at the moment, but there are some benefits to being small for that type of compliance, like actually knowing your networking setup, where you're data lies, etc. This type of auditing for enterprises, especially legacy ones, can be brutal because they're too big and don't know where anything is.

My two cents for whatever that's worth. If you can't financially do it, focus on growing your business with the SMBs until you can, but enterprise firms will want to see these things. If it's tight pick one that is often sought after like SOC2 and build from there. If money isn't as much of an issue, get the certifications and go for the big fish.
by littlecranky67 | 2026-02-13 14:34:55+00:00
Not surprised. The amount of jQuery pasta code from the 2010s the models are trained on make it probably look like all jQuery-specific stuff is plain JavaScript. Plus in my experience (and lucky for me as a mostly FE dev) AIs suck at all things frontend (relative to other scenarios). They just never got trained on the real, rendered output in the browser so they can't "see" and complete the feedback loop during training. Most tests in Javascript projects genereate <div>-soup - so the AI gets trained on that output as a feedback, vs. the actual browser rendered image.
by ProllyInfamous | 2026-02-13 14:34:57+00:00
>no cell phone

A one-way beeper allowed me to phase out mobile phone usage. Obviously presents inconveniences, but I'm semi-retired with no rush to be anywhere. Bonus health points: no locally-generated EMRadiation.

[•] My provider (USA): <https://pagersdirect.net/>

If you use numeric-only paging, bots haven't figured out how to SPAM, yet. Also available is alphanumeric email-to-page; two-way pagers also exist (but why?).
by lxgr | 2026-02-13 14:35:27+00:00
> that does not entitle them to create clones

It does indeed not, unless they can at least ensure their wellbeing and their ethical treatment, at least in my view (assuming they are indeed conscious, and we might have to just assume so, absent conclusive evidence to the contrary).

> The clone has the right to change its mind about the ethics of cloning.

Yes, but that does not retroactively make cloning automatically unethical, no? Otherwise, giving birth to a child would also be considered categorically unethical in most frameworks, given the known and not insignificant risk that they might not enjoy being alive or change their mind on the matter.

That said, I'm aware that some of the more extreme antinatalist positions are claiming this or something similar; out of curiosity, are you too?
by fluidcruft | 2026-02-13 14:36:10+00:00
Just as some feedback, your pricing doesn't make sense to me. I san see having a limited number of sessions as a trial, but for people on $20/mo codex/claude plans 10 sessions is too few and adding $20/mo for omnara doesn't make sense. Yes $20/mo is small compared to Codex Pro/Claude Max plans.

Omnara is easy to get a taste and with that pricing the next step is just going to be: switch to happy. But for people starting out you're just driving people to happy instead and when they upgrade from $20/mo LLM plans you will have pushed them to happy and they'll stick with happy rather than come to omnara.
by kittikitti | 2026-02-13 14:36:15+00:00
There were some valid contributions and other things that needed improvement. However, the maintainer enforced a blanket ban on contributions from AI. There's some rationalizing such as tagging it as a "good first issue" but matplotlib isn't serious about outreach for new contributors.

It seems like YCombinator is firmly on the side of the maintainer, and I respect that, even though my opinion is different. It signals the disturbing hesitancy of AI adoption among the tech elite and their hypocritical nature. They're playing a game of who can hide their AI usage the best, and everyone being honest won't be allowed past their gates.
by nullc | 2026-02-13 14:36:36+00:00
I mean we already do 'it'-- by it I don't mean uploading people, but rather create businesses that operate people via an API then hook those APIs to profit maximization algorithms with little to no regard for their welfare. Consider Amazon's warehouse automation, door dash, or uber.

Of course it's much more extreme when their entire existence and reality is controlled this way but in that sense the situation in MMAcevedo is more ethical: At least it's easy to see how dangerous and wrong it is. But when we create related forms of control the lack of absolute dominion frequently prevents us from seeing the moral hazard at all. The kind of evil that exists in this story really doesn't require any of the fancy upload stuff. It's a story about depriving a person of their autonomy and agency and enslaving them to performance metrics.

All good science fiction is holding up a mirror at our own civilization as much as it is doing anything else. Unable to recognize ourselves we sometimes shudder at our own monstrosity, if only for a moment.
by coldtea | 2026-02-13 14:37:01+00:00
As a 20+ year heavy mac AND linux user, both are true.

It doesn't get viruses, especially if you don't install random junk from warez sites and stick to MAS, brew, and a few trusted vendors. Even if you do install crap, it's trojans not viruses, which are more like the Yeti (something like that might exist, but few have seen it) than a problem mac users have.

And things "just work" way way way way more than they do in Linux (and I've started using it professional as desktop and for dev work in late 1990s, I'm not weekend tourist to it), which is exactly what I expected as a pragmatist. Only some non-existing carricature user that exists in strawman arguments expected everything to be perfect.
Show HN: Network-AI – A Distributed Mutex for AI Agent Swarms
by jovanaccount | 2026-02-13 14:37:05+00:00
I built this because standard Python locks (asyncio.Lock) don't work when AI agents run across different containers or processes.

As I started scaling my agent swarms (using CrewAI/LangChain), I kept hitting race conditions where agents would overwrite shared files or double-spend API credits because they read the state simultaneously.

Network-AI is a distributed lock (backed by Redis or local file-locks) that solves this. It acts as a traffic light for agent tools.

Key features:

2-line decorator: @lock("resource_id")

Handles lock timeouts (preventing "zombie" agents from freezing the swarm)

Works with standard agent frameworks (CrewAI, AutoGen, LangGraph)

The repo is open-source. I'd love feedback on the locking implementation or to hear if you've hit similar concurrency issues in production.
by InkCanon | 2026-02-13 14:37:08+00:00
A disclaimer should be added about the heavy startup accounting used. Standard accounting revenue uses the past year revenue. Recurring revenue, used aggressively by startups, is projected future year revenue based on loosely defined contracts like subscriptions. Critically it is often extrapolated on a very short timeframe, like last month, because it gives a better growth figure. Run rate revenue is even more aggressive, it includes one time fees, contracts and other non recurring fees. They have not made that much, nor are they conservatively projected to make that much. It's a very vague measure.

It can mean many things, but clearly cannot be mean what revenue is going to be in the future. If Claude doubles revenue every six weeks, by the end of this year they would have a higher revenue than every FAANG company combined (about one trillion).
by SAI_Peregrinus | 2026-02-13 14:37:18+00:00
I feel like "SHOULD" and "SHOULD NOT" are redundant. You end up having to assume someone else treated them as a "MAY". If you control all the endpoints in a private implementation you can just deviate from the standard & not implement a MUST, it's your private implementation. There's thus no difference in public implementations between "SHOULD" and "MAY", and no difference in internal implementations between any of the words. They are therefore redundant, requirements are either mandatory or optional, there's no middle.
by flohofwoe | 2026-02-13 14:37:51+00:00
For a text editor it's definitely good enough if not extreme overkill.

Other then that the one big downside of WebGPU is the rigid binding model via baked BindGroup objects. This is both inflexible and slow when any sort of 'dynamism' is needed because you end up creating and destroying BindGroup objects in the hot path.

Vulkan's binding model will really only be fixed properly with the very new VK_EXT_descriptor_heap extension (https://docs.vulkan.org/features/latest/features/proposals/V...).
by mckennameyer | 2026-02-13 14:38:23+00:00
We tested GPT-5 and Gemini Flash 3 at low, medium, and high effort on 169 instances with human-verified answers, scored against a frozen offline web corpus using Deep Research Bench. High effort consistently scored worse than lower thinking levels for both models. Methodology and raw data: https://everyrow.io/docs/notebooks/deep-research-bench-paret... (edited)
by fromMars | 2026-02-13 14:38:25+00:00
> The age of consent being this low is to avoid prosecuting 15-20 yo having sex with each other. Not for gross old men to coerce minors into having sex with them.

I don't buy this argument. That is addressed by age gap laws which some countries have or in the U.S. where there age of consent is different if one of the parties is over 18 and 21.

You can't honestly be claiming that these type of relationships don't occur in these countries. The fact is that in homogeneous populations there seems to be way more tolerance for these kind of age gaps.
by virgil_disgr4ce | 2026-02-13 14:38:42+00:00
Opinionation (heh, opinionatedness?)'s value is entirely different depending on the user category.

Hackers by and large don't want opinionated, because they're willing to spend the time configuring & customizing AND have the knowledge to do so.

Just about everyone else (as far as I can tell) very specifically do not want this, and for those who do, the amount of customizeability e.g. MacOS offers is enough. Having an immediately-useable computer (recent problems notwithstanding) is of much greater value.

So when you say "The main problem is that Apple wants to be opinionated" I can only conclude that you're coming at this from the 'hacker' POV. But I may be misunderstanding your comment.
by Zigurd | 2026-02-13 14:39:20+00:00
Both will fail. But SpaceX hasn't yet failed at refueling a starship in orbit, and may still be riding pretty high for an IPO this year. People are quitting because XAI is going to be a relatively small part of the valuation of the roll-up, and the value of the cofounders shares and lots of people's options are going to be disappointing. XAI cofounders and people with options also got diluted by merging with Twitter. They are doing the S-1 math and they don't like it.
by sbuttgereit | 2026-02-13 14:40:13+00:00
This doesn't sound like it's the same thing as what happens in California.

> second year of home ownership as they adjust to meet the sales price.

This sounds like the reassessment is triggered when a nearby sale or comparable happens. In California, the triggering event is the sale of the property itself only. So, for the entire time you own the property in California, the Prop 13 rules limit the allowed assessment to increase only up to 2% annually, assuming that the increase is supported by market price increases. Again, this isn't exactly precise legal reading, but is enough for the gist. There are limits to things like total taxation relative to market value and certain ways local governments can (in practice) tax property in excess of the limits. But the idea is to prevent an owner seeing sudden increases of 300% anytime after the initial sale.

Now when you sell your property, the new owner will face the fully assessed market value of the property for property taxes. So the new buyer could face 100's of percent taxation differences compared to what you're paying.
by jmuguy | 2026-02-13 14:40:33+00:00
Without it, if you want to know when something is happening on camera, you have to use motion detection. Motion detection sucks. Everything sets it off. Shadows moving, insects... anything moving.

Object detection, and then human detection, is extremely useful. Thankfully thats become nearly trivia enough to happen on device, but even with just "dumb" cameras the open source, on network solutions are very good.
by jeffwask | 2026-02-13 14:41:12+00:00
I rewatched it last year during an old sci-fi binge, I had watched bits as a kid but never got it. I grew up on TNG and DS9 was my favorite, so I was probably biased.

It's probably now number 2 for me behind DS9. I watched it again a few month later to catch all the foreshadowing I missed the first time. You are spot on that season 1 is a slow burn that ramps up to the amazing seasons 3 and 4. Best part, it has a clean conclusion without any sequel bait nonsense.

Londo and Gkar are two of the best characters in Sci-Fi and their relationship is brilliant.