MurphyA/hacker-news huggingface dataset:
Forge – Automate 3NF Schema Generation from Nested JSON in BigQuery/Snowflake
by brady_bastian | 2026-02-11 14:05:04+00:00
I've built a product that completely parses highly nested JSON data in cloud data warehouses. Forge works by methodically dissecting each subcollection and each field of Json data, one by one, and creates 3NF tables for each json sub-object. This completely flattens Json data of any complexity and depth and fully accounts for any schema changes in the entire dataset.

While hand crafted scripts work once and ok for a quick look, a systematic deconstruction and rebuild of the entire Json object is required to truly understand the structure. Some companies have Json data coming from MongoDb or Firestore which has undergone hundreds of even thousands of changes from changing data types to abstract manipulations such as changing Json object to array. A simple parsing script won't cut it. You will either sacrifice some data in order to get something out of it or spend weeks writing dozens of scripts and manipulations to correctly process it. Repeat this for each API and each schema that your company utilizes.

Forge doesn't stop at just unnesting. With the included AI schema classifier, Excalibur, we automatically identify which API your data is coming from based upon tens of thousands of examples. From Stripe to hubspot to segment, we detect it, classify it, and automatically apply field mappings. Additionally, Forge uses advanced AI and ML techniques to document and identify PII fields in your data. No more painstaking scrubbing and parsing of your data, just quick and ready analytics.

How does Forge handle schema changes?
Automatic detection and adaptation. When new fields appear, Forge regenerates models while maintaining backward compatibility. Zero downtime.

Does my data leave my warehouse?
SaaS: Forge connects via service account to process data in-place. Only schema fingerprints (not actual data) sent for AI classification. Enterprise: Everything runs in YOUR VPC. Zero data egress.

What warehouses do you support?
BigQuery, Snowflake, Databricks, and Redshift. One parse generates native models for all four simultaneously.

How accurate is PII detection?
Pridwen uses a 3-layer hybrid system (rules + ML + crowd) with 95%+ accuracy. Context-aware and supports 20+ languages.

Do you replace Fivetran/Airbyte?
No, we're complementary. Use Fivetran/Airbyte to load raw JSON → Use Forge to transform it into analytics tables.

How much engineering time does this save?
Conservative estimate: 2-4 weeks initial build + 10 hours/month maintenance = $50,000-100,000/year for mid-size teams.
by rglover | 2026-02-11 14:05:25+00:00
No, because the goal isn't to make things work. The goal is to make money by appearing to make things work. People who actually know don't tend to take ridiculous sums of money just to go tinker for a few years—they just build the damn thing and move on. The game here is perception and money—not necessarily competent engineering or legible products.
by unconed | 2026-02-11 14:05:32+00:00
Sorry but this post is the blind leading the blind, pun intended. Allow me to explain, I have a DSP degree.

The reason the filters used in the post are easily reversible is because none of them are binomial (i.e. the discrete equivalent of a gaussian blur). A binomial blur uses the coefficients of a row of Pascal's triangle, and thus is what you get when you repeatedly average each pixel with its neighbor (in 1D).

When you do, the information at the Nyquist frequency is removed entirely, because a signal of the form "-1, +1, -1, +1, ..." ends up blurred _exactly_ into "0, 0, 0, 0...".

All the other blur filters, in particular the moving average, are just poorly conceived. They filter out the middle frequencies the most, not the highest ones. It's equivalent to doing a bandpass filter and then subtracting that from the original image.

Here's an interactive notebook that explains this in the context of time series. One important point is that the "look" that people associate with "scientific data series" is actually an artifact of moving averages. If a proper filter is used, the blurryness of the signal is evident.
https://observablehq.com/d/a51954c61a72e1ef
by whynotminot | 2026-02-11 14:06:11+00:00
> Be careful here. I have more coworkers contributing slop and causing production issues than 10x’ing themselves.

Sure, many such cases. We'll all have work for a while, if only so that management has someone to yell at when things break in prod. And break they will -- the technology is not perfected and many are now moving faster than they can actually vet the results. There is obvious risk here.

But the curve we're on is also obvious now. I'm seeing massive improvements in reliability with every model drop. And the model drops are happening faster now. There is less of an excuse than ever for not using the tools to improve your productivity.

I think the near future is going to be something like a high-speed drag race. Going slow isn't an option. Everyone will have to go fast. Many will crash. Some won't and they will win.
by satgate | 2026-02-11 14:06:13+00:00
I've spent 27 years in enterprise cybersecurity — firewalls, IDS, access control, the usual stack. When I started running AI agents against production APIs last year, I had a familiar feeling: this looks exactly like the early internet before we figured out network security.

Agents make outbound calls with real dollar costs attached. The tooling to control that spend mostly comes down to "set an alert and hope someone's watching." I've seen agents in tight loops burn through $400 in minutes on tool calls nobody intended. One prompt injection away from draining a prepaid API balance.

The security stack has authentication, authorization, rate limiting — but nothing that understands cost as a first-class constraint. You can't express "this agent can spend $50/day across these tools" in a WAF rule.

So I built SatGate. It's a policy enforcement point for economic decisions. It reads cost metadata from MCP tool manifests, tracks cumulative spend per agent, and hard-blocks calls that would exceed budget.

We use macaroon tokens instead of API keys because they support attenuation — an agent can delegate a sub-token with tighter constraints without any server round-trip. A parent agent gives a child agent a token that says "you can spend $10 on search_database in the next hour." The child can't escalate.

The L402/Lightning piece came later — it turns out micropayments are a natural fit for agent-to-API commerce where you want per-call settlement without monthly invoices or API key management.

I looked at the existing landscape: Bifrost has soft budgets (alerts, no enforcement). Zuplo and Kong are solid API gateways but have no concept of economic controls. Nothing combined hard limits + per-tool costs + payments in one layer.

It's open source because I think this needs to be infrastructure, not a product. <50ms overhead, single Go binary, runs anywhere.

Happy to answer questions about the architecture, the macaroon auth model, or the problem space.
by anthk | 2026-02-11 14:07:04+00:00
Emacs has EMMS for music, reusing mpg123/mpv/ffplay and the like, but it can emulate Vim well enough too ;)

Altough now I'm using 9front, Sam and Acme. I feel myself weird not using the keyboard but at least I understood structural expressions for Sam/Acme really fast, first with 'Vis' and next under Acme. Oh, Acme can do mail and news and a bunch more... because it has I/O since the beginning, you can plug anything into it, from commands to the text buffer to sockets. Even a crude HN client if you dare.
by netfortius | 2026-02-11 14:07:54+00:00
I thought the same, when my US bank (capital one) decided to change my debit card to their newly acquired Discover network. Sure enough, CIC and La Poste accept it for cash withdrawals, which preserves the advantage of great exchange rate, and no currency exchange fees (unlike wise, for example). Credit cards seem to stay on Mastercard (e.g. capital one) and visa (e.g. Chase), so still some life left with those, also. Wish the European solution will eventually have a rewards/points system, to bring it up to par with the US cards.
by RupertSalt | 2026-02-11 14:07:56+00:00
> it was certainly the official position of the Catholic church that witchcraft did not and could not exist.

That is definitely not true and it is impossible that an "official position" would be held and revoked later. This is not something that happens with doctrine or dogma.

https://www.newadvent.org/cathen/15674a.htm

Supposing that the belief in witchcraft were an idle superstition, it would be strange that the suggestion should nowhere be made that the evil of these practices only lay in the pretending to the possession of powers which did not really exist.

Feel free to cite a refutation. Your assertion means nothing. You've made many assertions about church/European history and you must consider yourself well-read in the topic, so surely you know sources that support your (crazy, unfounded) assertion?

But before you refute anything, I urge you to carefully examine the article I cited, which in turn cites primary sources, and gives a thorough overview of condemnations throughout the "Dark" and "Middle" Ages we're discussing! No impossible or nonexistent practice could be condemned or punished, right?

Christian teaching has always insisted that magic, witchcraft, or occultism was "false" or superstitious and dangerous, but "false" does not mean "nonexistent" or "impossible".

Bottom line. The hostility of science against religion, and the perception of hostility of religion vs. science, is very new. It is completely novel. Christianity (and Islam and Hinduism alike) all encouraged scientific inquiry into the natural world, discover, architecture, engineering, and many projects stood atop the support of church patronage. Many engineering projects in the Middle Ages were accomplished by religious orders (cf. Carmelites built aqueducts in Spain, etc.) and if you ask Wikipedia for a list of scientists who were also clergymen, you'll see just how intertwined were faith and reason for the entire history of religion and science itself.
by datsci_est_2015 | 2026-02-11 14:08:50+00:00
This admin is focused on the message of stopping the inflow of drugs to the US. There are probably some true believers, and there are probably some reactionary accelerationists. There’s also significant evidence of amateurism, misinformation, and incompetence.

All of that coming together, I see this action coming out of meeting where

- one party was convinced that this would solve the fentanyl epidemic
- one party was hoping this would escalate military action in Mexico
- one party was convinced that America had lost its masculine bravado and taking swift and unprecedented action like this would make their wife respect them again
- one party was busy making “bets” on Kalshi
by BSDobelix | 2026-02-11 14:08:54+00:00
I talk about the past, your university FTP-Server was the central point to get your Software/Manuals also publish your work (today's Github/Sourceforge?). Your university Email Server was the primary central point to exchange Information mostly inside your university.

Again i talk about the past when email was primarily used to talk to other peoples often not even over a net but inside a mainframe thing.

I though i was clear talking about the past hence not including Facebook or GitHub, and btw. Email just became "federated" when everyone agreed to use smtp when talking over the internet.
by infecto | 2026-02-11 14:09:10+00:00
“Dude”, murdering a us citizen in Mexico is different than murdering an entire bus of people on US soil.

You say it’s happening all the time but then say it’s .01%.

Looked it up myself, maybe 40 to 300 people annually. Hard to discern how many of those are pure tourism vs visiting family. I suspect you have a greater risk visiting family, especially if it’s a border town.

13.5mm US citizens visit d Mexico in 2024 so .00002% got kidnapped. I bet that number is even lower when you separate pure tourism vs dual nationals or similar going back home to visit.

The point is any action taken on US soil in a large capacity would be seen as an attack by any administration.
by galangalalgol | 2026-02-11 14:09:22+00:00
Not a bad theory actually. None of the stuff they have done to distract from the files has been without other purpose, but that is how it is done. You have a backlog of things you want to do ranked by unpopularity, and you try to only do one of them when you are being grilled over a worse one already. I'm sure it is down to a science and probably has a name.
ArXiv Endorsement for Paper on Neuro-Symbolic Architecture for Financial Agents
by shatzakis | 2026-02-11 14:09:47+00:00
Hi Everyone,

I’m an independent researcher (and professionally, the Global Director of Research at Reink Media) looking for an endorsement for the cs.AI (Computer Science/Artificial Intelligence) category on arXiv.

The Context I didn't start by writing a paper; I started by building a system. Over the last year, I developed a production-grade Model Context Protocol (MCP) server for the forex market. It’s currently live with 45 distinct tools and renders 28 different dynamic widgets across Claude, ChatGPT, and a custom web app.

The Paper The paper is titled Protocol-Constrained Agentic Systems: A Neuro-Symbolic Architecture for Hallucination-Resistant Financial Execution.

My core argument is that in high-stakes domains like finance, we cannot rely on LLMs to be "smart enough" to avoid critical errors. Instead, I propose an architecture that uses MCP as a "hallucination firewall." This strictly decouples the probabilistic layer (the LLM parsing intent) from the deterministic layer (the tool executing the trade). It effectively treats the protocol schema as a type system for agent actions, guaranteeing by construction that invalid tool calls cannot reach the execution layer.

You can read the full paper and see the architecture in the PDF here: https://www.stevenhatzakis.com/research/protocol-constrained-agentic-systems

The Request If you are a registered endorser for cs.AI and find this work relevant, I would appreciate your support so I can submit this paper on arXiv.org.

Endorsement Code: LZRTFH Link: https://arxiv.org/auth/endorse?x=LZRTFH

Thanks for your time.

Steven Hatzakis
by zerkten | 2026-02-11 14:09:51+00:00
Even if you talk to users, you can do it the wrong way. Big companies are incentivized by the stock market to care more about new users than existing ones because their only focus is growth. Growth can't be rooted in your existing users is a common feeling in product management circles. If you try to do things for people other than your existing users, then you end up doing odd stuff that at best is a mild annoyance. More likely you hurt their ability to continue using the app.
by xantronix | 2026-02-11 14:10:02+00:00
I hadn't made more solid connections between the current state of software and industry, the subjugation of immigrants, and the death of the American neoliberal order until this comment thread but it here it lies bare, naked, and essentially impossible to ignore. With regards to the whole picture, there's no good or moral place to "RETVRN" to in a nostalgic sense. The one question that keeps ringing through my head as I see the world in constant upheaval, and my one refuge in meaning, technical craftsmanship, tumbling, is: Why did I not see this coming?
by svnt | 2026-02-11 14:10:07+00:00
Parent says “I taught my 5yo how to” — this means their 5yo learned a process.

OP says “I taught LLM how to see” and this should mean the LLM (which is capable of being taught/learning) internalized how to. It did not, it was given a tool that does seeing and tells it what things are.

People are very interested in getting good local LLMs with vision integrated, and so they want to read about it. Next to nobody would click on the honest “I enabled an LLM to use a Google service to identify objects in images”, which is what OP actually did.
by guerrilla | 2026-02-11 14:10:16+00:00
Dropping nuclear bombs on Japan was in an entirely different context which has no relevance here. We're not in the middle of a global war (nor is anyone even at war with Mexico), nor in a nuclear arms race asserting nuclear capabilities for the first time in history.

You're forgetting all the times the US failed too, and those cases weren't even on its own border. Iraq, Afghanistan, Vietnam... the list is very long. Creating an existential threat on your own border is a bad move for anyone. Remember how bad Columbia got? I guess not. The current situation has the potential to be much more dangerous.
by schiffern | 2026-02-11 14:10:33+00:00
I really wanted to like the iD4.

iD4 feels like they took every lesson of predictable UX design and then intentionally reversed it to make the most frustrating UI possible.

The window controls, touch buttons, screen, steering wheel controls, etc. They all seem designed to answer the question, "how could we make this unnecessarily difficult and distracting to use? How could we possibly cram in yet another State Machine for the user to keep (lose) track of?"

It also has the "try to kill the asthmatic by randomly switching off recirculate while driving through dense wood smoke" feature, naturally.

Considering how much money VW makes on EVs[0], I suppose I'm not surprised by this 'nudge' toward gas cars.

[0] https://www.motor1.com/news/758377/vw-making-less-money-sell...
by coldtea | 2026-02-11 14:11:17+00:00
Can extensions:

be scoped, meaning only allowed to read/access when you visit a particular domain whitelist (controlled by the user)?

be forced (by the extension API) to have a clear non-obfuscated feed of whatever they send that the user can log and/or tap onto and watch at any time?

If not, I wouldn't touch them with a 10000ft pole.
by timbritt | 2026-02-11 14:11:27+00:00
An architect knows the difference between this window and that, this door and another, a partition wall and a firewall, a tile roof and a metal one. The architect understands how to orient them and work the materials together.

But the architect does not have to make the windows, or the doors, or the walls…or the roof to create the house.

There are lots of things that autonomous agents are not so good at. Most of the things it took away from me are things that were holding me back in the first place.
by qcontinuum1 | 2026-02-11 14:11:44+00:00
Without any doubt the research could continue on this. We had many opportunities to make the scan even wider and almost certainly we would uncover more extensions. The number of leaking extensions should not be taken as definite.

There are resource constrains. Those extensions try to actively detect if you are in developer mode. Took us a while to avoid such measures and we are certain we missed many extensions due to for example usage of Docker container. Ideally you want to use env as close to the real one as possible.

Without infrastructure this doesn't scale.

The same goes for the code analysis you have proposed. There are already tools that do that (see Secure Annex). Often the extensions download remote code that is responsible for data exfiltration or the code is obfuscated multiple times. Ideally you want to run the extension in browser and inspect its code during execution.
by jfaganel99 | 2026-02-11 14:11:46+00:00
Author here. We built a security scanner called Kolega that does semantic analysis instead of pattern matching. To see if it actually worked, we ran it against 45 open source projects and reported what it found through responsible disclosure.

225 vulnerabilities. 41 reviewed by maintainers so far, 37 accepted, 4 rejected. 90% acceptance rate.

The bugs weren't exotic. They were things like:

if not user_id is not None - a double negative in Phase that means the permission check never runs. Nine auth bypasses total.

torch.load() without weights_only=True in vLLM - RCE via pickle deserialization in one of the most popular inference frameworks.

RestrictedPython sandbox in Agenta where __import__ was explicitly added to safe_builtins. Four different escape routes to arbitrary code execution.

SQL injection in NocoDB's Oracle client - Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives, and missed this one entirely.

The interesting part to me wasn't that we found bugs. It's that these are all syntactically correct - the code compiles, runs, looks fine in review. The problems are semantic. No pattern matcher catches not X is not None because it's valid Python. You have to understand what the developer intended.

Every finding is published with full details - code locations, CWEs, PR numbers, disclosure timelines: https://www.kolega.dev/security-wins/

135 findings are still waiting on maintainer response. 4 were rejected - some we thought were exploitable, maintainers disagreed. We document those too.

Happy to discuss specifics on any of the projects or argue about methodology.
by optymizer | 2026-02-11 14:12:07+00:00
"why won't other people make sacrifices for me?"

Because the society in US is arranged as a competition with no safety net and where your employer has a disproportionate amount of influence on your well being and the happiness of your kids.

I'm not going to give up $1M in total comp and excellent insurance for my family because you and I don't like where AI is going.
by wlesieutre | 2026-02-11 14:12:22+00:00
Exemplified by every website with a massive SIGN UP button and then a little 8 pt font log in tucked away somewhere underneath.

Gee thanks for helping me find the button I'll use literally once and making me hunt for the one I'll need the other 99999 times I use this service.

Existing users can go fuck themselves as long as new people are registering. Line go up!
by mythz | 2026-02-11 14:12:31+00:00
It's looking like we'll have Chinese OSS to thank for being able to host our own intelligence, free from the whims of proprietary megacorps.

I know it doesn't make financial sense to self-host given how cheap OSS inference APIs are now, but it's comforting not being beholden to anyone or requiring a persistent internet connection for on-premise intelligence.

Didn't expect to go back to macOS but their basically the only feasible consumer option for running large models locally.
by giarc | 2026-02-11 14:12:37+00:00
My daughter, in grade school, uses a Chromebook at school and access Google Classroom through Chrome. The school has very few restrictions on extensions and when I log into her account, Chrome is littered with extensions. They all innocuous (ex. change cursor into cat, pets play around on your screen etc). However, without fail, each time I log in and go to the extension page, Chrome notifies me that one or more of the extensions was removed due to malicious activity or whatever.
by tolien | 2026-02-11 14:12:38+00:00
I did see a Reddit thing where some tourists were planning to stay in the Lake District and visit Edinburgh and Stonehenge, all during winter.

Could've been ragebait, to be fair - they weren't interested when people pointed out that things like weather, hours of daylight, travel time were all going to be against them (or even that the Lake District is a pretty tourist-friendly place to start with).
by nacozarina | 2026-02-11 14:12:43+00:00
part of the all-in-on-AI strategy is killing open computing. wintel is dead and companies need to convert that change momentum into a strategic shift.

They will eat the entire supply chain. AI demand has already captured memory and video component vendors, they’re gone. AI service providers will increasingly shift to proprietary chips and toolchains that cannot be replicated by end users. Checkmate.

The intent is to create a generational shift. Soon open computing toolchains won’t work on any ‘current’ hw, they’ll be just boot sale curiosities.

That’s why goog ms et al feel comfortable doing what appears to be crazy things historically. They know the end game.