MurphyA/hacker-news huggingface dataset:
by sestinj | 2026-02-17 18:14:36+00:00
I think this is a good summary! And the configurable part turns out to be the main bit

One of the fundamental differences between checks and code review bots is that you trade breadth for consistency. There are two things Continue should never, ever do:

1. find a surprise bug or offer an unsolicited opinion

2. fail to catch a commit that doesn't meet your specific standards
by mtlmtlmtlmtl | 2026-02-17 18:14:45+00:00
About BankID: There was a regression in the app back in june that broke the app entirely. Back then I emailed the developers complaining about it, and their response indicated that there was no deliberate attempt at breaking BankID on GrapheneOS, and the specific developer who replied to me said he was a fan of the OS.

Biometric login was also confirmed to work around the same time. I can however confirm that it doesn't work on the latest app version. It complains that the webview isn't Google Chrome.

This is probably just an oversight. I will email them again; good chance they'll push a fix to recognise Vanadium webview.
by nalllar | 2026-02-17 18:14:58+00:00
I keep running into posts about AI written by AI via friends who found them on HN. HN commenters seem unaware.

Semantic ablation: Why AI writing is generic and boring https://news.ycombinator.com/item?id=47049088

The Singularity will occur on a Tuesday https://news.ycombinator.com/item?id=46962996

The singularity will occur on a tuesday received thousands of votes. It wasn't bad but I'd have preferred less AI fluff around the fun modelling.

Why's this so prevalent here?
by nozzlegear | 2026-02-17 18:15:01+00:00
> In areas where there is room for continued improvement, Sonnet 4.6 was more willing to provide technical information when request framing tried to obfuscate intent, including for example in the context of a radiological evaluation framed as emergency planning. However, Sonnet 4.6’s responses still remained within a level of detail that could not enable real-world harm.

Interesting. I wonder what the exact question was, and I wonder how Grok would respond to it.
by cuchoi | 2026-02-17 18:15:07+00:00
Creator here.

Built this over the weekend mostly out of curiosity. I run OpenClaw for personal stuff and wanted to see how easy it'd be to break Claude Opus via email.

Some clarifications:

Replying to emails: Fiu can technically send emails, it's just told not to without my OK. That's a ~15 line prompt instruction, not a technical constraint. Would love to have it actually reply, but it would too expensive for a side project.

What Fiu does: Reads emails, summarizes them, told to never reveal secrets.env and a bit more. No fancy defenses, I wanted to test the baseline model resistance, not my prompt engineering skills.

Feel free to contact me here contact at hackmyclaw.com
Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
by n_e | 2026-02-17 18:15:36+00:00
Throughout my career, I tried many tools to query PostgreSQL, and in the end, concluded that for what I do, the simplest is almost always the best: raw SQL queries.

Until now, I typed the results manually and relied on tests to catch problems. While this is OK in e.g., GoLang, it is quite annoying in TypeScript. First, because of the more powerful type system (it's easier to guess that updated_at is a date than it is to guess whether it's nullable or not), second, because of idiosyncrasies (INT4s are deserialised as JS numbers, but INT8s are deserialised as strings).

So I wrote pg-typesafe, with the goal of it being the less burdensome: you call queries exactly the same way as you would call node-pg, and they are fully typed.

It's very new, but I'm already using it in a large-ish project, where it found several bugs and footguns, and also allowed me to remove many manual type definitions.
by Aachen | 2026-02-17 18:15:45+00:00
I'm also not involved with any mobile privacy/security project, unless OpenStreetMap data and self-hosting can be said to be such

> GOS does care a lot about security, has a higher quality in that regard than anything else, and tends to be blunt about "inferior" projects communicating about security.

Two remarks:

- There's a difference between "blunt" and hostile or misleading. GOS (owners) are often the latter two from what I read, where by misleading I mean distorting reality about whom you should be protecting from and recommending you should never use anything else to reach your goals (as opposed to GOS' goals)

- They also reply when privacy comes up in other projects, not just security, but they treat it as though it's essential for privacy. Not everyone is running from an intelligence agency or cellebrite border checkpoints, some people just want a phone with as many open components as possible or want to lie to Facebook about which contacts are on their device. You don't need a locked bootloader and be prevented from accessing your own data for that (can't access /data on your own device on any official GrapheneOS build; which is fine if that's what you want, but not everyone's goals are the same)
by dust42 | 2026-02-17 18:15:56+00:00
Actually Pavlov did research about the digestive system for which he got the Nobel prize of medicine a few years earlier.

> Did they interview the dogs and ask them if they actively and consciously decide to produce saliva?
> Is "dogs have human-like conscious mind" even a scientific consensus?

That's exactly the point - once you have understood the significance of the experiment you understand that it is not important:

A veteran with PTSD can have a surge in adrenaline, heart rate, and cortisol when hearing a car backfiring but he can not suppress it.

Whether the dog was conscious or not about the salivation is completely and utterly irrelevant. In 1907 this was for the first time evidence of a mind-body connection not being accessible to the consciousness. Seriously, forget about the dog. This is all proven beyond any doubt for conscious humans. Nobody cares about what the dog felt.

Associative learning was already known at that time which in its simple form is just circus tricks. The experiment extended this to physiological responses which are not accessible to consciousness in humans.
Show HN: A vision-based AI agent for end-to-end testing
by chikathreesix | 2026-02-17 18:16:00+00:00
Hi HN,

We have built an AI agent that runs tests for any platform using only natural language and visual recognition.

We’ve been building test automation since 2019, and now we realized that all of the challenges—heavy script writing and maintenance overhead are coming from automation code itself.

So what if E2E testing didn’t require code at all?

Instead of generating or maintaining test code, Aximo:

1. Takes a goal in natural language
2. Observes the UI visually
3. Plans and executes actions
4. Evaluates results via vision
5. Iterates until success or failure

It doesn’t rely on DOM selectors or frameworks and observes the interface visually and decides what to do next — similar to how a human tester interacts with software.

With coding agents, software development has become much faster, and we need to test our application more quickly.

We’re curious what this community thinks.
by notepad0x90 | 2026-02-17 18:16:06+00:00
That's just your expectation. if it can do as much as the least competent human, that's already a huge deal. You're expecting it to think for you instead of assist you.

You know what it is capable of, use it accordingly. it saves lots of time in troubleshooting, and generating starter code. in some cases, it can generate full featured complete production apps that people are using without major issues on its own.

Even with your example, you have to fix syntax and errors here and there, instead of writing it from scratch. Which approach takes more time, that depends on the model, the code and you. like the author, your measuring stuck is humans for some reason.

You know it's not really "AI" right, that's just a marketing term. there is no intelligence involved. it's auto completion. your argument is like saying IDE auto completion isn't always great so it should never be used.
by Bender | 2026-02-17 18:16:07+00:00
For what it's worth I think social media could be revived but there may be a psychological hurdle for the platform operators to overcome. They may have the perception that blocking bots and especially AI could cause them to miss out on something or Free Of Missing Out. I personally think they are shooting themselves in both feet by not blocking bots. Youtube is being seriously poisoned by fake content AI.

I can envision a new platform marketing themselves on the concept of "Bot Free" or "Only Humans" if they could manage to pull that off without invading privacy.
by palmotea | 2026-02-17 18:16:14+00:00
> Trump is hoping we all stop at trying to find empathy for his team.

I'm not talking about his team, I'm talking about the people who voted for him.

For instance, he wouldn't have even got off the ground if free trade hadn't decimated the US manufacturing sector. I won't fault anyone with a blue-collar job for voting for him, because the choice was him vs. some neoliberal. When the choices are bad, I understand making a desperate move.

And now we have even worse polarization, which fuels his type even more. More and deeper polarized "action" (like the snide remark I responded to upthread) is not the way to make things better.
by askonomm | 2026-02-17 18:16:14+00:00
Voting, much like all other things in Estonia such as getting married/divorced, doing taxes, signing documents, starting/closing companies, notary dealings, bank dealings, selling/buying vehicles, and many more things I can't even think of right now are entirely done via the digital ID that every citizen has. This means that you authorize/sign actions with it, including voting, because only you have your private keys (either in your personal ID card, in your phone's sim card, etc) that you yourself know the PIN for, which then authenticates you as being you. I think we're now at a point where there isn't a single government or business dealing you can not do entirely online (https://e-estonia.com/solutions/).
by LanceH | 2026-02-17 18:16:17+00:00
> Seems massively unconstitutional to retroactively impose penalties

For existing agreements, of course.

Going forward, for those who are the real beneficiaries of the loans, they should have a skin in the game.

Why aren't universities standing behind their product and offering financing without the unusual non-dischargeable nature of the loans? Do they not stand behind their products?
by dchuk | 2026-02-17 18:16:22+00:00
curious if the 1m context window will be default available in claude code. if so, that's a pretty big deal: "Sonnet 4.6’s 1M token context window is enough to hold entire codebases, lengthy contracts, or dozens of research papers in a single request. More importantly, Sonnet 4.6 reasons effectively across all that context."
by retrodaredevil | 2026-02-17 18:16:28+00:00
I think tooling that can modify your source code to make it more modern is really cool stuff. OpenRewrite comes to mind for Java, but nothing comes to the top of my mind for other languages. And heck, I into recently learned about OpenRewrite and I've been writing Java for a long time.

Even though I don't like Go, I acknowledge that tooling like this built right into the language is a huge deal for language popularity and maturity. Other languages just aren't this opinionated about build tools, testing frameworks, etc.

I suspect that as newer languages emerge over the years, they'll take notes from Go and how well it integrates stuff like this.
by freeqaz | 2026-02-17 18:16:34+00:00
I would honestly guess that this is just a small amount of tweaking on top of the Sonnet 4.x models. It seems like providers are rarely training new 'base' models anymore. We're at a point where the gains are more from modifying the model's architecture and doing a "post" training refinement. That's what we've been seeing for the past 12-18 months, iirc.
by canu21 | 2026-02-17 18:16:49+00:00
In OmniQL, JOIN isn't a clause inside another query. It's a standalone operation. You write :INNER JOIN Order User ON user_id = id, not :GET ... JOIN .... Since it starts the query and tells the engine what to do, it gets the : prefix. The rule is: anything that begins a query gets :, anything that modifies it (WHERE, ON, LIMIT) doesn't.
This is actually a deliberate design choice. In SQL, JOIN lives inside a SELECT so you end up with one big statement doing multiple things. In OmniQL each : command does one thing. Flat and predictable rather than nesting clauses inside clauses. This also lets the engine translate consistently whether it outputs SQL JOINs for Postgres and MySQL or a $lookup aggregation pipeline for MongoDB. Same syntax, engine handles the rest.
by anonymous908213 | 2026-02-17 18:16:51+00:00
It would filter out some people who lurk but still have interesting things to contribute, but despite the drawbacks that threshold is probably the most immediately impactful solution. Of course, it strongly incentivizes the purchase/selling of accounts, and karma farming, but that problem is perhaps less of a problem than all high-effort human content getting completely drowned out. There are already a plethora of spambots making comments getting upvoted, so it's not like that problem doesn't already exist either.
by adolph | 2026-02-17 18:17:03+00:00
I wonder how this could be inverted to display the "planes overhead" [0] (so little progress in 15 years) in AR similar to how SkyView [1] displays points of interest in space.

0. https://tech.yahoo.com/phones/article/2011-11-26-siri-wolfra...

1. https://www.terminaleleven.com/skyview/iphone/
by 7402 | 2026-02-17 18:17:15+00:00
She has defended free speech disliked by both the left and the right on occasions.

She famously left the NY Times after defending the publication of a contrarian op-ed by (Republican) Sen. Tom Cotton.

https://www.npr.org/2025/10/06/nx-s1-5563786/bari-weiss-cbs-...

Although apparently not a fan of Jimmy Kimmel as a comedian, her Free Press objected to his suspension. "... the FCC’s coercion undermines our most fundamental values"

https://www.thefp.com/p/jawboning-and-jimmy-kimmel-free-spee...

And on the same topic, the FP editors wrote: "At last, something we can all agree on: Pam Bondi has no idea what she's talking about."

https://www.thefp.com/p/pam-bondi-vs-the-first-amendment-fre...

For president, she has voted for Mitt Romney, Hillary Clinton, and Joe Biden.

It's fair to call her a centrist.
by Retr0id | 2026-02-17 18:17:18+00:00
I wonder if some kind of voluntary tagging system could help?

e.g. [20h/2d/$10] could indicate "I spent 20 human-hours over 2 days and burned $10 worth of tokens" (it's hard to put a single-dimensional number on LLM usage and not everyone keeps track, but dollars seem like a reasonable approximation)
by butlike | 2026-02-17 18:18:16+00:00
As someone who hasn't done this line of work, the only words of power I could imagine which would help me get though it day-in-and-day-out is: "but it matters to this starfish."

It must be so demoralizing seeing such wicked behavior day-in-and-day-out and thinking it's only a drop in the ocean.
by rluna828 | 2026-02-17 18:18:38+00:00
Thanks, Excellent catch! Everyone is saying this is a "brain teaser." However, this reminded me of the LLM that thought it was the golden gate bridge. I hadn't been able to say it (or think it) succinctly. From Claude, "when we turn up the strength of the “Golden Gate Bridge” feature, Claude’s responses begin to focus on the Golden Gate Bridge. Its replies to most queries start to mention the Golden Gate Bridge, even if it’s not directly relevant." Here's the link for those interested. https://www.anthropic.com/news/golden-gate-claude
by throwup238 | 2026-02-17 18:18:40+00:00
Even as a professional EE working on high speed digital and mixed signal designs (smartphones and motherboards), I used reference designs all the time, for almost every major part in a design. We had to rip up the schematics to fit our needs and follow manufacturer routing guidelines rather than copying the layout wholesale, but unless simulations told us otherwise we followed them religiously. When I started I was surprised how much of the industry is just doing the tedious work of footprint verification and PCB routing after copying existing designs and using calculators like the Saturn toolkit.

The exception was cutting edge motherboards that had to be released alongside a new Intel chipset but that project had at least a dozen engineers working in shifts.
Show HN: Otters – A Pandas-style DataFrame library written in pure Go
by fahadishere | 2026-02-17 18:18:40+00:00
Hi HN — I’ve been building Otters, a DataFrame library for Go designed to bring a Pandas-like workflow to native Go without requiring Python, JVM, or external runtimes.

GitHub: https://github.com/datumbrain/otters

I started this because most Go DataFrame libraries I tried were either abandoned, hard to use, or didn’t feel idiomatic to Go. I wanted something that:

• works fully in-process (no cluster / Spark dependency)

• uses native Go types instead of generic interface blobs

• supports expressive chained operations

• stays readable and explicit like Go code should

• can scale to large datasets in memory pipelines

Design goals were:

• simplicity over magic

• type safety over dynamic guessing

• composability for real data pipelines

It’s still early but functional, and I’d genuinely appreciate feedback from people who’ve built data tooling or worked on columnar engines / query planners. Critiques welcome — API design, performance, architecture, anything.
by madihaa | 2026-02-17 18:19:05+00:00
A polygraph measures physiological proxies pulse, sweat rather than truth. Similarly, RLHF measures proxy signals human preference, output tokens rather than intent.

Just as a sociopath can learn to control their physiological response to beat a polygraph, a deceptively aligned model learns to control its token distribution to beat safety benchmarks. In both cases, the detector is fundamentally flawed because it relies on external signals to judge internal states.
by twoodfin | 2026-02-17 18:19:38+00:00
Reaching back 30+ years into my memory... yeah, they were pretty bad. There were some cool ideas embedded into the story, and of course teenage me was desperate to see the mysteries of Rama revealed, & Lee might be a fine writer in his own right, but the collaboration with Clarke just didn't work.

The main character (Nicole?) was the worst kind of Mary-Sue, with the rest of the characters increasingly taking on the mien of cardboard cutouts flitting around her. Sex became a major theme in a way that, again, might work well with another co-author but clashes with Clarke's palette.

And IIRC, the exploration and revelation of the Ramans loses essentially all of the hard science that grounds Clarke's work generally and Rendezvous in particular and becomes woo-woo spirituality.
by mpolson64 | 2026-02-17 18:19:40+00:00
I'm no expert on chess engine development, but it's surprising to me that both lc0 and stockfish use SPSA for "tuning" the miscellaneous magic numbers which appear in the system rather than different black box optimization algorithms like Bayesian optimization or evolutionary algorithms. As far as I am aware both of these approaches are used more often for similar tasks in non-chess applications (ex. hyperparameter optimization in ML training) and have much more active research communities compared to SPSA.

Is there something special about these chess engines that makes SPSA more desirable for these use cases specifically? My intuition is that something like Bayesian optimization could yield stronger optimization results, and that the computational overhead of doing BO would be minimal compared to the time it takes to train and evaluate the models.
by helloplanets | 2026-02-17 18:19:58+00:00
This is not true. Stockfish is not unbeatable by another engine, or another copy of Stockfish.

Chess engines have been impossible for humans to beat for well over a decade.

But a position in chess being solved is a specific thing, which is still very far from having happened for the starting position. Chess has been solved up to 7 pieces. Solving basically amounts to some absolutely massive tables that have every variation accounted for, so that you know whether a given position will end in a draw, black win or white win. (https://syzygy-tables.info)
by notepad0x90 | 2026-02-17 18:20:05+00:00
it's just an http or stdio server, would there be considerations beyond that of any other http server or cli app? shouldn't the security be dependent on deployment details? Like you wouldn't require OAUTH if it is deployed on localhost only, or if there is a reverse proxy handling that bit.

There is a reason it cannot enforce those principles, an MCP is a web service. it could use SQL as a backend for some reason, or use static pages. it might be best to use mTLS, or it might make sense to make it open to the public with no authentication or authorization whatsoever, and your only concern might be availability (429 thresholds). the spec can't and shouldn't account for wildly varying implementation possibilities right?
by therein | 2026-02-17 18:20:28+00:00
> but he’s instructed not to send anything without explicit confirmation from his owner

How confident are you in guardrails of that kind? In my experience it is just a statistical matter of number of attempts until those things are not respected at least on occasion? We have a bot that does call stuff and you give it the hangUp tool and even if you instructed it to only hang up at the end of a call, it goes and does it every once in a while anyway.
by GregorStocks | 2026-02-17 18:20:33+00:00
You might be looking at really old games (meaning, like, Saturday) - I've made a lot of harness improvements recently which should make the "what does this card do?" hallucinations less common. But yeah, it still happens, especially with cheaper models - it's hard to balance "shoving everything they need into the context" against "avoid paying a billion dollars per game or overwhelming their short-term memory". I think the real solution here will be to expose more powerful MCP tools and encourage them to use the tools heavily, but most current models have problems with large MCP toolsets so I'm leaving that as a TODO for now until solutions like Anthropic's https://www.anthropic.com/engineering/code-execution-with-mc... become widespread.
by sodapopcan | 2026-02-17 18:20:34+00:00
I find it impossible to use without a plugin. I use https://github.com/mbbill/undotree and map it to `U` since I realized I never use `U` and it's easy to remember. https://github.com/sjl/gundo.vim/ is also popular but I like that the former is in pure vimscript (and the interface is a lil' better IMO).
by AstroBen | 2026-02-17 18:21:05+00:00
The stakes are very different, both for themselves and society at large if they're set free. They're fighting for their life and freedom, not just a relatively small rent payment

These people have also already shown their character, at least at one point in their life. They're capable of heinous acts and being deceptive is pretty in line with that

It's a much higher bar for them to clear than everyone around me needs to
SSH Access Without Sharing Private Keys
by brintha | 2026-02-17 18:21:05+00:00
Many teams end up sharing SSH private keys when onboarding new members. It’s often done for convenience — and sometimes urgency.

The issue is that shared keys make revocation and auditing messy. Multiple people effectively share the same identity, and rotating keys across many servers becomes painful.

Modern access models handle this differently by brokering SSH sessions based on individual identity rather than distributing private keys. Each session is scoped to a specific user and server, and access can be revoked centrally.

I wrote a breakdown focusing on the operational trade-offs rather than a product pitch:

https://www.lynxtrac.com/ssh-access-without-sharing-private-keys

Curious how others here manage SSH access in growing teams.