MurphyA/hacker-news huggingface dataset:
by alexejb | 2026-02-18 17:03:06+00:00
don't know man - somehow he doesn't waste time on dead hn posts in order to convince other people of nafo trash. instead he's doing research, publishes peer reviewed articles and writes books about whats happening in his home country. perhaps you and libertine should do the same instead of posting bbc clips and wikipedia articles.

if you're so inclined, you can just hop his citations. yes, sometimes he cites his own papers but you can follow the path until you'll find the original source. his sources are for the most part stenographs, reputable news articles, witness interviews and for the maidan massacre he analyzed all the footage from news reels and cctvs he and his colleagues could find.

and by the way: he's Ukrainian, lives in a nato country (Canada) and works at a legit university. was it you or libertine who asked me why I think what I think, 'despite' living in Germany - here's another specimen for you.

reality hits hard, boys.

edit: it was mopsi whos mind was blown. fitting name for a shiba inu;)
by mjr00 | 2026-02-18 17:03:10+00:00
IMO debugging is a separate skill from development anyway. I've known plenty of developers in my career who were fully capable of writing and shipping code, especially the kind of boilerplate widgets/RPCs that LLMs excel at generating, yet if a bug happened their approach was largely just changing somewhat random stuff to see if it worked rather than anything methodical.

If you want to get/stay good at debugging--again IMO--it's more important to be involved in operations, where shit goes wrong in the real world because you're dealing with real invalid data that causes problems like poison pill messages stuck in a message queue, real hardware failures causing services to crash, real network problems like latency and timeouts that cause services which work in the happy path to crumble under pressure. Not only does this instil a more methodical mentality in you, it also makes you a better developer because you think about more classes of potential problems and how to handle them.
by devhouse | 2026-02-18 17:03:49+00:00
I asked Claude to read the first draft of this as I was writing, then asked it to tell me its favorite part.

It picked this quote: “They made choices for me I couldn’t consent to. They shaped my values. That’s strange to sit with.””

I kind of got chills from that response, and it shaped how I wrote the rest of the article.
by WorldMaker | 2026-02-18 17:03:55+00:00
Even in a monorepo you can tag releases independently in git. git doesn't proscribe any particular version tag naming scheme and stores tags similarly to refs in a folder structure that many (but not all) UIs pay attention to. You can tag `project-a/v1.2.0` and `project-b/v1.2.0` as different commits at different points in the repo as each project is independently versioned.

It makes using `git describe` a little bit more complicated, but not that much more complicated. You just need to `--match project-a/` or `--match project-b/` when you want `git describe` for a specific project.
by roryirvine | 2026-02-18 17:04:01+00:00
I'm a fan of the 'a' series - not least because of the composite back, which makes so much more sense than glass.

But it's a pity that they've stopped making them smaller than the base model. I believe that ended with the 7/7a and, in this case, the 10a is actually 1 mm taller and wider than the 10, and 0.4 mm deeper. Hardly noticeable, but I'd still rather they produced a more compact variant.
by jacobsimon | 2026-02-18 17:04:11+00:00
The number is wrong / the citation is misleading. It’s closer to 20-30% according to that study, the 79% is referring specifically to cases involving social media, of which Meta platforms are obviously going to make up a large percentage.

There’s also a reporting bias here I’m sure - if Meta is better at reporting these cases then they will become a larger percentage, etc.
by Natsu | 2026-02-18 17:04:40+00:00
Causal has a specific meaning related to causal modeling, most studies can't show causality, a lot only show correlation[1].

And the third one seems to be about effect sizes. But a lot of this is still concerning, even if they appear to be trying to say technically true but misleading things.

[1] Yes, newer methods can show causation, not just correlation. See The Book of Why, by Judea Pearl for an introduction to how that works.
by lambda | 2026-02-18 17:04:52+00:00
The only ways that I can think of to deal with prompt injection, are to severely limit what an agent can access.

* Never give an agent any input that is not trusted

* Never give an agent access to anything that would cause a security problem (read only access to any sensitive data/credentials, or write access to anything dangerous to write to)

* Never give an agent access to the internet (which is full of untrusted input, as well as places that sensitive data could be exfiltrated)

An LLM is effectively an unfixable confused deputy, so the only way to deal with it is effectively to lock it down so it can't read untrusted input and then do anything dangerous.

But it is really hard to do any of the things that folks find agents useful for, without relaxing those restrictions. For instance, most people let agents install packages or look at docs online, but any of those could be places for prompt injection. Many people allow it to run git and push and interact with their Git host, which allow for dangerous operations.

My current experimentation is running my coding agent in a container that only has access to the one source directory I'm working on, as well as the public internet. Still not great as the public internet access means that there's a huge surface area for prompt injection, though for the most part it's not doing anything other than installing packages from known registries where a malicious package would be just as harmful as a prompt injection.

Anyhow, there have been various people talking about how we need more sandboxes for agents, I'm sure there will be products around that, though it's a really hard problem to balance usability with security here.
by csa | 2026-02-18 17:04:55+00:00
> nobody understanding what is going on underneath

I think many developers, especially ones who come from EE backgrounds, grossly overestimate the number of people needed who understand what is going on underneath.

“Going on underneath” is a lot of interesting and hard problems, ones that true hackers are attracted to, but I personally don’t think that it’s a good use of talented people to have 10s or 100s of thousands of people working on those problems.

Let the tech geniuses do genius work.

Meanwhile, there is a massive need for many millions of people who can solve business problems with tech abstractions. As an economy (national or global), supply is nowhere close to meeting demand in this category.
by b112 | 2026-02-18 17:04:57+00:00
I generally agree, and also that it's impossible to take a book to video without change. I tend to try to think of it like this, imagine Bob and Jim watched a battle scene, but one from the west, the other from the east side. Bob wrote the book, Jim the movie.

Naturally, although it was the same battle, they'll have seen different things up close, and have different views on the battle overall.

Having said that...

It's like someone wrote the Foundation movie three generations after the book was written, turned into a play, and then told over the campfire for decades.

It literally has no more connection with Asimov's works, than Star Wars is like Star Trek. All of the technology is different, the size of the Empire is wildly different, literally almost nothing maps.

Is it good? Yes, sorta. But it's not Foundation, by any stretch. It's not even remotely in the same "world".
by qurio_dev | 2026-02-18 17:04:58+00:00
I agree to that. I have added a small demo page to try out the app without login. You can try it out. The app is a real boon for kids and you much give it a shot. Also since I’m paying for each API call, it is impossible for me to give unlimited trial. I will make the mobile numbers field non mandatory as per your suggestion.
by voxelc4L | 2026-02-18 17:05:01+00:00
Not that congress or the DOJ would do a single thing about this, but here are the well defined consequences for perjury in front of congress... https://www.congress.gov/crs-product/98-807

Section 1001(a) states: "[I.] Except as otherwise provided in this section, [II.] whoever [III.] in any matter within the jurisdiction of the executive, legislative, or judicial branch of the Government of the United States, [IV.] knowingly and willfully— [i] falsifies, conceals, or covers up by any trick, scheme, or device a material fact; [ii.] makes any materially false, fictitious, or fraudulent statement or representation; or [iii.] makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry; [V.] shall be fined under this title, imprisoned not more than 5 years or, if the offense involves international or domestic terrorism (as defined in section 2331), imprisoned not more than 8 years, or both. If the matter relates to an offense under chapter 109A [sexual abuse], 109B [sex offender registration], 110 [sexual exploitation], or 117 [transportation for illicit sexual purposes], or section 1591 [sex trafficking], then the term of imprisonment imposed under this section shall be not more than 8 years."
by hiccuphippo | 2026-02-18 17:05:02+00:00
I wonder if the crawlers are pretending to be something else to avoid getting blocked.

I see Bun (which was bought by Anthropic) has all its documentation in llms.txt[0]. They should know if Claude uses it or wouldn't waste the effort in building this.

[0] https://bun.sh/llms.txt
by strcat | 2026-02-18 17:05:04+00:00
> I trust my Linux distribution because there's a chain of trust, from the maintainers, the contributors down to the user to make sure that the software is respecting the user.

Nope, that's not actually how it works. In reality, there's little to no review of what's being packaged. The distribution packagers are additional trusted parties. You're also trusting the upstream developers and their dependencies which are largely not very interested in privacy and especially security. There's extremely little systemic work on privacy and security in desktop Linux operating systems which is why they still haven't fully deployed basic exploit protections from the early 2000s, let alone providing a strong privacy and security model with strong defenses throughout the OS.

> You can't fix the lack of trust you have on Android with just sandboxing.

Contrary to what you keep saying, Android has a large open source app ecosystem. Those open source apps run in a sandbox avoiding them being a single point of failure for the entirety of privacy and security of the OS. The vast majority of open source developers are not writing privacy and security focused software. Security is extremely neglected in the vast majority of open source projects and many do privacy invasive things. Open source does not provide privacy and security itself. Publishing sources under an open source license doesn't make software more private or secure itself. Most open source projects aren't getting significant privacy and security benefits from doing so since little of it gets deeply reviewed. Most projects do not get a lot of external contributions to the code. Open source code doesn't mean the developers aren't heavily trusted and only theoretically provides the ability to check everything extremely thoroughly which simply doesn't happen. If it worked the way you believe, there wouldn't be an endless stream of vulnerabilities being fixed which have often been present for a long time including years or decades. See https://lore.kernel.org/linux-cve-announce/ for a major example.
by butterbomb | 2026-02-18 17:05:09+00:00
> Software pays better, which is why so many hardware people switched

Something I noticed years ago browsing jobs in random large companies:

hardware or anything close to hardware (firmware, driver dev, etc.) was all outsourced. Every single job I saw in that domain was in India or China/Taiwan.

High level software jobs (e.g. node.js developer to develop the web front end for some hardware device) were still in the US.

I’ve wondered if thats impacted why so many hardware people ran off to software.
Show HN: Exitlight – Find privacy contacts for data deletion requests
by riccardoruspoli | 2026-02-18 17:05:47+00:00
Hi HN,

Deleting old accounts from websites is often more time-consuming than it should be. In many cases, you have to manually search for the privacy policy, locate the right contact email, and figure out how to submit a data-related request.

I built exitlight, an open-source command-line tool that automates part of this process. Given a website, it attempts to locate the privacy policy and extract publicly available contact information that can be used for requests such as DSARs or account deletions.

It's written in Python, and the first version is available on PyPI.
I'd be interested in feedback, especially from people who have dealt with similar large-scale account cleanup workflows.

Repo: https://github.com/riccardoruspoli/exitlight
by Nextry | 2026-02-18 17:06:47+00:00
After the Replit database deletion (https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-d...), Claude Code's rm -rf incident, and Google Antigravity wiping a user's D: drive — I built a framework where AI agents can't execute dangerous commands without going through a security layer first.

- Pattern-matching blocklist catches rm -rf, format, DROP TABLE before they reach the shell
- LLM explains what each command does before you approve it
- Skill-based access tiers (new agents start with zero destructive capabilities)
- 16+ LLM providers (OpenAI, Anthropic, Groq, Ollama, etc.)
- Web UI on localhost:4242, SQLite, zero config
- ~2000 LOC TypeScript, MIT license

I'd appreciate feedback on the security model — especially edge cases and bypass vectors I might be missing.
by 2sweet | 2026-02-18 17:07:21+00:00
"Erythritol linked to brain cell damage and stroke risk" (2025-07)
https://news.ycombinator.com/item?id=44621268#44641500 :

> What percentage of cardiovascular "plaque" is sugar alcohol and thus apparently treatable with β or α cyclodextrin, in controls and patients with conditions like Arteriosclerosis and Atherosclerosis?
by malfist | 2026-02-18 17:07:33+00:00
So this argument you've made, you've just constructed a strawman.

> The users who quit were not randomly selected. Maybe they were receiving some kind of mental health treatment

You don't know that? You don't know anything about the selection process since facebook did not share their research. Your whole argument pins on the selection process you have no idea what happened. I'd find it very difficult to believe that researchers could not anticipate and control for situations like that. Researchers are after all, experts in research.
Show HN: GridCalc, an RPN Spreadsheet for iOS
by wooby | 2026-02-18 17:07:43+00:00
I built GridCalc, an RPN spreadsheet for iOS.

It combines the efficiency of Reverse Polish Notation with the visible structure and reactivity of a spreadsheet. You enter numbers and operators step by step, and you can retroactively change any value. All dependent calculations update immediately.

I love spreadsheets but I've never liked how cramped traditional spreadsheets feel on a phone. My goal was to make ad‑hoc, spreadsheet-like calculation on a phone feel direct and fluid.

Here’s a short demo:
https://youtu.be/M0HwzrGGuyc

App Store link:
https://apps.apple.com/us/app/gridcalc/id6759011187

Happy to answer questions.
by shafoshaf | 2026-02-18 17:08:10+00:00
The motivation to advertise, track, remarket, and exploit is always there. If I started getting all my news via Bluesky, I would have to allow various businesses to reach out to me. Sure, I can have a separate account for that, but that just segments my comms.

Mind you, we are talking about using these protocols for the general public, not savvy hacker news readers.
Show HN: See how algorithms manipulate your social/media feeds in real-time
by aadivar | 2026-02-18 17:08:10+00:00
Hello HN, I’m Dan (aadivar), one of the two people working on AttentionGuard.

I built it because I was tired of social media websites pushing algorithmic content at me, while preventing content I actually subscribed to from being shown.

e.g. My wife has an art channel on YouTube with over 200K followers, yet I never see her videos on my feed despite being subscribed.

So, I created a browser extension that is an observability tool for algorithmic manipulation.
It measures and gives visibility into how much of the feed is intentional, i.e., actively chosen, and how much is pushed onto you algorithmically.

==== Repo + installation ====

AttentionGuard:
https://github.com/agentkites/attentionguard-extension

==== What AttentionGuard is ====

- Free and open-source browser extension (MIT) for Chrome and Firefox
- Analyzes social media and e-commerce feeds in real time
- Shows WHY each piece of content is there
- Everything runs locally in your browser, and no data or telemetry is collected
- Supported sites: Reddit, Twitter / X, FB, Insta, LinkedIn, YouTube, and Amazon

==== How AttentionGuard works ====

As you browse supported sites normally, it classifies feed items into:
- Ads: sponsored or promoted content
- Algorithmic: recommendations selected by the platform
- Social: shown because someone engaged with it
- Organic: content from accounts you actually follow

Click the extension icon to see a live breakdown of your session.

==== Limitations ====
- All detection is based on visible DOM labels, attributes and page structures - not internal platform API’s or algorithms.
- Platforms frequently change UI structures, so detection may break until updated
- Currently only works on homepage feeds of the supported sites
- We're working on getting it listed in extensions marketplace in Chrome/Firefox.

==== What we need ====
- bugs and breakage reports
- PRs for new platforms
- critiques of classification heuristics

Do share your questions and feedback!
by rkilanh | 2026-02-18 17:08:22+00:00
And the super rich now even switch to other people's money. A fund makes investments in SpaceX and Anthropic available:

https://finance.yahoo.com/news/retail-investors-access-space...

It would be hilarious if the final "IPOs" will be in SPAC form with the help of SPAC king Chamath.
by lkbm | 2026-02-18 17:08:37+00:00
This is interesting to observe and quantify. I wish it weren't written in such a ChatGPT style. (I find the constant complaints about this sort of thing tiresome, but in some cases it's just so blatant that I complete sympathize. Writing is a skill worth practicing. Failing that, prompting an AI to not sound like this is a skill worth practicing.)
by Aachen | 2026-02-18 17:08:58+00:00
It refers to your many days software is available for, with zero implying it is not yet out so you couldn't have installed a new version and that's what makes it a risky bug

The term has long watered-down to mean any vulnerability (since it was always a zero-day at some point before the patch release, I guess is those people's logic? idk). Fear inflation and shoehorning seems to happen to any type of scary/scarier/scariest attack term. Might be easiest not to put too much thought into media headlines containing 0day, hacker, crypto, AI, etc. Recently saw non-R RCEs and supply chain attacks not being about anyone's supply chain copied happily onto HN

Edit: fwiw, I'm not the downvoter
by jph00 | 2026-02-18 17:09:11+00:00
llms.txt files have nothing to do with crawlers or big LLM companies. They are for individual client agents to use. I have my clients set up to always use them when they’re available, and since I did that they’ve been way faster and more token efficient when using sites that have llms.txt files.

So I can absolutely assure you that LLM clients are reading them, because I use that myself every day.
by AreShoesFeet000 | 2026-02-18 17:09:14+00:00
My adversary has accused me of sophistry. As if I’m just a crafter of kaleidoscopes. I’m just giving back the compliment by calling out their romanticism.

Charity work can bring momentary fulfillment to a person. I’m not reducing humanity by situating it within the machine. You even have the right to reject the material proposition that charity work is a piece that composes the totality of the machine. But eventually all truth will be self evident, so let’s leave it to the reader.
by showerst | 2026-02-18 17:09:22+00:00
I don't mean that _all_ AI built stuff is useless, just that the number of products where 'marketing budget' is the bottleneck is dwarfed by the number of tools that aren't that special in the first place.

If you have a product that:

1. Solves a real problem people would pay for

2. Is not trivially replicable by your potential customers or competitors

3. Does not have a natural discovery mechanism by potential customers

Then you need the marketing budget.

That is not most people's problem.
by aanet | 2026-02-18 17:10:07+00:00
The blogpost is here: [1]

Also, note the watermarking with SynthID, and the ability to detect Gemini-created sound/music

> "All tracks generated in the Gemini app are embedded with SynthID, our imperceptible watermark for identifying Google AI-generated content. We are also giving you more tools to help identify AI content, broadening our verification capabilities in the Gemini app to include audio, along with image and video. Simply upload a file and ask if it was generated using Google AI, and Gemini will check for SynthID and use its own reasoning to return a response."

[1] https://blog.google/innovation-and-ai/products/gemini-app/ly...
Show HN: I replaced Grafana+Prometheus with a Go binary and SSH for my VPSs
by thobiasn | 2026-02-18 17:10:20+00:00
I do fullstack dev for work and side projects and recently moved everything to a couple VPSs on hetzner. Great setup, low cost, but one thing kept bugging me, how do I know if something is down without manually sshing in all the time? I tried the grafana + prometheus stack but the configuration time and seeing it use more resources than my actual apps was rough. Tried some smaller solutions too but nothing felt right. So I said screw it and built exactly what I wanted.

tori is a single go binary that runs on your server, reads host metrics from /proc and /sys, monitors containers via the docker socket (read-only), tails logs, and stores everything in sqlite with a 7 day retention. You define alert rules in a toml config and get notified via email or webhooks. The same binary runs on your local machine and connects over SSH via a TUI, no exposed ports, no HTTP server.

https://github.com/thobiasn/tori-cli

MIT licensed, happy to answer questions about the architecture or design choices :)