MurphyA/hacker-news huggingface dataset:
by einr | 2026-02-24 14:52:05+00:00
People give away their freedoms all the time. Most people are walking around with facebook and tiktok tracking their every move. they don't care.

This is absolutely true. I'm saying someone should care, because it does matter.

Some linux users aren't going to stop this sort of thing from happening. If Chase Bank wants to only allow MacOS and Windows 11 computers to access their website, the 1% of their userbase that uses something else isn't going to move the needle, and 99% of their users won't care (or even notice).

For some businesses, losing 1% of your customers is actually a lot of customers and a lot of money, and all else being equal they would prefer to not lose them.

If this was going to happen, it would have already happened. The pieces are all there already.

No, they really aren't. Again, it's perhaps technically feasible to flip the switch, but it doesn't make business sense yet.

How many people are doing online banking without running on a fully cryptographically verifiable/attestable OS? This means everyone not using a TPM, Secure Boot, etc. This means grandpa with an old Windows 10 machine or an old Mac that perhaps he should not still be using but he doesn't care, he just wants to pay his bills. I don't have numbers of course but I bet you this starts looking like a hell of a lot more than 1% of the userbase.

There are web APIs for this sort of thing in all major browsers but no one is really using them yet. But they exist for a reason, much like Windows 11 requires a TPM for a reason, and this tech will at some point be deployed for things like online banking. Of course it will.
Show HN: Bruce – AI signal radar for Reddit/HN that learns what matters to you
by rklosowski | 2026-02-24 14:52:17+00:00
I built Bruce because I was drowning in noise while trying to launch my own SaaS.

I had F5Bot set up for keywords, but it was sending me 50+ alerts a day —
mostly irrelevant. I'd spend 20 minutes triaging to find 2 threads worth
responding to. The problem wasn't lack of monitoring, it was lack of signal.

Bruce is different: instead of matching keywords, it scores every item 0-100
against your product context, ICP, and competitor list. It understands why
something is relevant, not just that a keyword appeared.

The part I'm most excited about: it learns. Every time you act on a signal
or dismiss one, Bruce adjusts. By week 2, it's surfacing very different
(better) things than week 1.

What it monitors: Reddit, Hacker News, RSS feeds, ProductHunt, and anything
with an RSS endpoint via RSSHub (YouTube channels, newsletters, etc.)

Stack: Next.js 15, PostgreSQL, Drizzle, Better Auth, my self-built AI runtime,
RSSHub.

Live at https://smartbruce.com

Happy to answer questions about the scoring model or architecture.
by nthj | 2026-02-24 14:52:34+00:00
We didn’t fire all our developers when we invented compilers either, and for much the same reason we didn’t stop hiring laborers when we first built ships and established overseas trade routes: business will always expand to meet its reach

Many enterprises are currently exploring to see if they can invite developers to leverage AI tools—like they leveraged the compiler—to be more productive. To operate on a higher plane of agency, collaborating on what we should be building and not just technical execution. Those actively hostile or just checked out with the idea of relearning skills are being laid off. (Some unprofitable business sections are being swept up opportunistically too.) The idea that all developers would be fired if AI tools can write good code doesn’t meet the lessons of history
by pornel | 2026-02-24 14:52:40+00:00
BTW, HTML allows inline SVG with an XML-flavored syntax that interprets <script/> and <title> differently. It's a goldmine for sanitizer escapes. There are completely bonkers syntax switching and error recovery rules that interact with parsing modes (there's even an edge case where a particular attribute value switches between HTML and XML-ish parsing rules).

Don't even try to allow inline <svg> from untrusted sources! (and then you still must sanitise any svg files you host)
by elliotbnvl | 2026-02-24 14:52:42+00:00
Amidst all the ‘claw hype, folks have lost sight of the fact that we already have a high quality, trusted coding agent that with a few lines of code can become proactive, recursively self improving, and is supported by a large dedicated engineering organization who are commercially incentivized to improve it.

Claude Code is all you need.

Well, that and a persistent transport layer that exposes a messaging endpoint you can text from your phone. And that’s bareclaw: just ~1200 LOC of TypeScript and you’re off to the races on the Claude Max plan with no OAuth token theft hijinks.
by horsawlarway | 2026-02-24 14:52:54+00:00
The agent has ambient access because it makes it more capable.

For the same reasons we go to extreme measures to try to make dev environments identical with tooling like docker, and we work hard to ensure that there's consistency between environments like staging and production.

Viewing the "state of things" from the context of the user is much more valuable than viewing a "fog of war" minimal view with a lack of trust.

> Usually because it inherited the developer's shell, env, and network. That's the actual problem. Not the file format.

I'd argue this is folly. The actual problem is that the LLM behind the agent is running on someone else's computer, with zero accountability except the flimsy promise of legal contracts (at the best case - when backed by well funded legal departments working for large businesses).

This whole category of problems goes out of scope if the model is owned by you (or your company) and run on hardware owned by you (or your company).

If you want to fix things - argue for local.
by Pxtl | 2026-02-24 14:53:29+00:00
That's what we have now, but mandatorily, and without the anti-sockpuppet protection a true ID would provide.

I have conspiracy theories about the conspiracy theories about digital ID. The people who benefit the most from fake people posting are spambots, sockpuppets, disinfo peddlers, and astroturfers.

And either way, I firmly believe that a site should be free allow you to log in without a digital ID... I just would like to be able to know who doesn't have one so I can know who's a real human being and who is an appendage.
by msteffen | 2026-02-24 14:53:36+00:00
In the recent HN thread announcing the new Gemini coding agent (https://news.ycombinator.com/item?id=47074735), a lot of people complained about Gemini’s tendency to do unwanted refactors, not perform requested actions, etc.

It made me cautiously optimistic that all of Anthropic’s work on alignment, which they did for AI safety, is actually the cause of Claude code’s comparatively superior utility (and their present success). I wonder if future progress (maybe actual AGI?) lies in the direction of better and better alignment, so I think this is super cool and I’m suddenly really interested in experiments like this
by dfxm12 | 2026-02-24 14:53:38+00:00
The agency has lost more than a quarter of its staff, withdrawn directives to auditors to crack down on aggressive tax shelters and permitted other auditing efforts to falter.

Remember the fear mongering ads [0] Republicans ran during the 2022 midterms about arming IRS agents to act as a shadow army to go after every day law abiding people? As it turns out, Republicans were just talking about their own plans for ICE. Remember, every accusation from Republicans is an admission. Additionally, they don't care about crime, as they are specifically turning a blind eye to rich people and corporations breaking the law.

0 - https://www.cbsnews.com/news/republicans-87000-irs-agents-mi...
Show HN: TypeGraph – Type-safe graphs on Postgres/SQLite (no graph DB required)
by pdlug | 2026-02-24 14:54:10+00:00
Hi HN, I built TypeGraph, a type-safe knowledge graph library that runs on your existing Postgres or SQLite.

After years of building knowledge graphs and other graphy things, I had the same issues whenever an application’s relationship modeling (permissions, RAG context, recommendations) outgrew standard ORMs: deploy a dedicated graph database (heavy ops, separate infra, data syncing headaches), or roll a graph-in-SQL implementation by hand.

I've hand-rolled enough of these to know the drill: same table structures, same traversal boilerplate, same performance surprises. I wanted graph semantics without graph infrastructure so I built TypeGraph as that pattern packaged as a library. It runs on anything from in-memory SQLite to a full Postgres cluster, using Zod for a single source of truth (driving your DB schema, API validation, and TS types).

You query it with a fluent builder that's fully typed through traversals:

const results = await store
.query()
.from("Person", "p")
.traverse("worksAt", "e")
.to("Company", "c")
.whereNode("c", (c) => c.industry.eq("Tech"))
.select((ctx) => ({
person: ctx.p.name,
company: ctx.c.name,
role: ctx.e.role,
}))
.execute();

Eject at any time and you're left with clean, well-structured SQL tables and nothing proprietary to untangle.

A few things that set it apart from rolling your own:

* Ontology reasoning: subClassOf, implies, inverseOf — query for "Media" and automatically get Podcasts and Articles. Define "Admin implies Editor" and permission checks expand automatically.

* Vector + graph queries: combine embedding similarity search with graph traversal in one query. Uses pgvector on Postgres, sqlite-vec on SQLite.

* Incremental adoption: builds on Drizzle. Add graph capabilities to an existing project without replacing your ORM or migrating your database.

Where it works well: knowledge graphs for RAG (vector similarity + graph context), relationship-based access control, recommendations, social features, any domain where multi-hop relationships are core.

Where it doesn't: billions of edges (use a graph database), heavy graph algorithms like PageRank (use specialized tools), distributed graph processing.

Docs: https://typegraph.dev

GitHub: https://github.com/nicia-ai/typegraph/

Happy to answer questions about the design, implementation, or tradeoffs.
by delaminator | 2026-02-24 14:54:12+00:00
It happens all the time.

You should always be mindful that your role is to create something that someone junior can take over. And to grow your business so that junior is your employee.

You could have outsourced maintenance to that junior freelancer yourself and dropped your charges a bit.

That's how all businesses grow. The farmer eventually employs a farmhand, the storekeeper employs a shelf filler.
by somenameforme | 2026-02-24 14:54:20+00:00
It's still meritocratic even with dramatic genetic differences between individuals. A peer comment mentioned an anecdote of Terence nearly failing his orals because he ended spending all of his time playing Civ instead of studying anything.

It's basically the Gattaca story. Somebody can have the most brilliant mind in the world, but without actually applying it, they're not going to do great in life. If you give a person of average intellect Tao's life of dedication and work ethic, then he's going to end up a world class mathematician. He probably won't end up at the top of the top, as that's going to be reserved for those that hit the mega-lottery of genetics + dedication, but will also have no problem leaving his mark on this world and living a comfortable life.
by embedding-shape | 2026-02-24 14:54:22+00:00
> Shouldn't use innerText anyway (nonstandard, worse performance, tries to parse the HTML and gives you unexpected behavior if e.g. a style is set that makes an element invisible but still has text inside, doesn't work on all DOM nodes...)

Maybe you meant .innerHTML? .innerText AFAIK doesn't try to parse HTML (why would it?), but I don't understand what you mean with nonstandard, both .innerHTML and .innerText are part of the standards, and I think they've been for a long time.

> but I didn't understand what the point of this default could be and so why it exists (a sibling comment proposed a plausible answer: hardening on top of another solution) [...] the question "what's the use-case for this"

I guess maybe third time could be the charm: it's for preventing XSS holes that are very common when people use .innerHTML
by b112 | 2026-02-24 14:55:00+00:00
Solution (for big corp)?

Mega is big enough to buy entire islands, and be its own country. A corporate country. One with a very specific constitution, enshrining rights, but also?

No corporate taxes.

If done right, you could lure away Western judges, police, and more as they retire. Or retire early. You could lure them away not with high salaries, but with shorter work days, AI assistance, and with it being a tropical paradise.

Compared to the billions Meta would pay in taxes annually, this endeavour would be far cheaper. And citizens would still pay taxes, of course.

Now imagine if Google, Musk Corps, Meta, and others all created a consortium to do just this, and, to build and fund the initial island.

I agree, not fully plausible. But... these guys can do a lot of interesting things, and I think if it was truly a tropical paradise, and land and housing was cheap and aplenty, lots might be interested in moving there.

Certainly, hiring the "glue" of society would be easy. I know so many people who retire to third world nations, but anyhow...

Yes, holes but, maybe something to ponder.

Corporate towns have existed, why not corporate nations?
by reactordev | 2026-02-24 14:55:17+00:00
Thus creating a concentration on which is the best personal Google clone and thus, creating another Google. Walled paywall and all. It’s a cycle.

Free and open marketplace, crapware. Crapware for long enough, goodware. Goodware so good, it needs hardware, it needs integrations, it solves world hunger, but no one uses anything else anymore.

No, the best are marketplaces that are open but moderated for quality.
by lp4v4n | 2026-02-24 14:55:38+00:00
As you said, it's impossible to determine how many of the current layoffs are caused by AI, they probably also have a lot to do with the broader economic downturn. But you’re still missing the point, if companies truly have a black box that can produce cheap, high‑quality code as the GP put it, why don't they just fire 95% of their developers and keep only a small core of AI orchestrators?
by tristor | 2026-02-24 14:55:38+00:00
> I just wanted to upload photos.

You can absolutely still do this. I'm still a Flickr Pro subscriber since 2015, and I still regularly upload photos to Flickr. I don't think there was a set of changes that reduced Flickr to an also-ran, the entire market shifted. First, there was a shift away from photography being focused on what I will short hand as "quality" towards being focused on what I'll short hand as "moments" with services like Instagram, which had 100m users by the end of 2013 and continued growing exponentially from there, which was deeply interconnected with the introduction of reliable fairly high-quality phone cameras built into smart phones.

Flickr was, and continues to be, a place where people who use actual camera equipment post photos that are taken not just to capture a moment, but to express a scene, using technique and artistry to do so. That type of high quality photography doesn't really get much traction in more contemporary social media, because the photos of moments shared on Instagram weren't about the photo, they were about the moment. It was about proving that you were in a place or experienced a thing, and the place or thing giving you social value. "Pics or it didn't happen."

Instagram has now largely been supplanted by TikTok, because short video is now much more of a common, engaging, and desired format than photography, and thankfully this means Flickr in 2026 is once again a refuge of die-hard photographers sharing their works, and not seeing much attempt to change it into Instagram 2.0. Many (maybe most) of the photos on Flickr are now taken with smartphones, but there is still an expectation from the community to focus on expressing a scene using technique and artistry, and modern smartphones now have good enough cameras to do just that without detracting from what you're trying to express.
Show HN: I built a $5 AI tool to stop me from overthinking startup ideas
by schmommy | 2026-02-24 14:56:14+00:00
Hi HN — I built Satisfice.app because I’m a chronic overthinker and kept getting stuck in idea loops instead of shipping.

The problem:
I’d get an idea, research it to death, tweak the concept endlessly, and lose momentum before building anything.

What Satisfice does:
It helps you pressure-test an idea quickly so you can decide whether to:
- ship now
- simplify
- pivot
- or stop wasting time on it

The goal isn’t “perfect analysis” — it’s helping founders move forward with enough clarity to act.

Why the name:
“Satisficing” = choosing an option that’s good enough to meet the goal, instead of optimizing forever.

Who it’s for:
- indie hackers
- side-project builders
- founders with too many ideas and not enough launches

I’d love feedback on:
1. What makes you personally stop overthinking and start shipping?
2. What signals do you use to validate an idea fast?
3. What would make a tool like this actually useful in your workflow?
by casey2 | 2026-02-24 14:56:28+00:00
Conscious, or at least sentience is just the meta system that allows one to mesh multiple sensory input (all of which is generated by the brain itself, maybe using some real information).

Whether AI needs consciousness is a totally separate question. LLMs are the great Chinese room, I'd say they have unconscious understanding, the distinction is like c vs list and similarly meaningless but may become meaningful in a constrained self-learning robotics context.

AI will never need to be conscious, AI isn't a moth flying to an open flame, but people will try anyway
by Aachen | 2026-02-24 14:57:32+00:00
When browsers implement a variant that lets you separate data and code perhaps. That's what I expected when opening this article: setHtml(code, data, data, ...), just like parameterised SQL works: prepare("select rowid from %s", data)

This new method they've cooked up would be called eval(code,options) if html was anything other than a markup language
by kube-system | 2026-02-24 14:57:50+00:00
Dude, you're arguing with a straw man.

I'm not arguing about fatalities or relative percentages of contributing factors, nor am I arguing that alcohol/speeding/attention are not all also issues. They are, you're right.

The only thing I argued is that "lapses in human visual perception are responsible for some crashes", which is a fact.
by snarf21 | 2026-02-24 14:58:31+00:00
I design games and have been working on a Red Riichi variant where one of each number is red and this drives scoring instead of all the myriad of Yaku. All the Yaku are hard for beginners to onboard and a lot of hands have to good path to an interesting Yaku and just depend on luck to be able to call Riichi. I'm still testing it but I find it more interesting.

I also have a card game version that implements some of these ideas (although it doesn't have a Furiten concept).
by MisterTea | 2026-02-24 14:58:54+00:00
> When I was a kid, my parents installed Net Nanny on our home computer.

Putting up artificial walls is inviting someone to look behind them.

Back in 1999 I was attending a city university and their computer labs were a mix of older Pentium machines running Windows 98 secured by netnanny. They disabled floppy booting in the BIOS and password protected it. Thing is, the old Dell cases were real easy to pop open and pull the CMOS battery out. That killed the BIOS password so I was able to floppy boot the machine and rename netnanny.exe to nutnanny.exe and Win 98 ran unimpeded. When I was done I would rename the exe, reboot and go on about my day. Nice try, uni admins.
by shagie | 2026-02-24 14:58:57+00:00
> If most people are not using a tool properly, it is not their fault; it is the tool's fault.

I would say that is a reasonable criticism of git ... but I've seen the same thing in svn, perforce, cvs, and rcs. Different variations of the same issue of people not caring about the version history.

Since it's been a problem since the dawn of version control, it is either something that is part of all version control being a tool's fault that has been carried with it since doing ci, or it is something that people aren't caring about.

I feel this is more akin to a lack of comments in code and poor style choices and blaming the text editor for not making it easier to comment code.
by ChesterHsu | 2026-02-24 14:59:01+00:00
Hi HN, I'm Chester.

Not actually a programming language — it's a workflow runner
with 412 built-in modules.

name: price-monitor
steps:
- module: browser.goto
params: { url: "https://competitor.com/pricing" }
- module: browser.extract
params: { selector: ".price-card" }
- module: api.slack.send
params: { channel: "#pricing", text: "${extract.data}" }

$ pip install flyto-core && flyto run monitor.yaml

Modules cover browser (38), Docker (6), K8s (5), SSH (3),
S3 (4), image (9), crypto (4), 78 categories total.

Every run gets an execution trace and state snapshots.
If step 3 fails, replay from step 3 — no re-run.

Also usable as Python library, HTTP API, or MCP server.
by virgil_disgr4ce | 2026-02-24 14:59:09+00:00
HAHAHAHAHA I DID TOO!!!!!

Ahhhh this makes me so happy. My brother and I, like many, were so obsessed with all the LucasArts adventures, so naturally I mailed them in my idea. I also got a letter back. IIRC it wasn't from a lawyer, but it was definitely a soft "no." There's a chance I still have that letter somewhere.

Man, I am not a "good old days" kind of person but the 80s (well, late 80s early 90s) really were a different time.
by benregenspan | 2026-02-24 14:59:11+00:00
It seems like the goal of the default configuration is preventing script injection while being otherwise very permissive. Basically, "safer than innerHTML, even when used very lazily". But I would expect guidance to evolve saying that it almost never makes sense to use the default and instead to specify a configuration that makes contextual sense for a given field.

The default might be suitable for something like an internal blog where you want to allow people to sometimes go crazy with `<style>` tags etc, just not inject scripts, but I would expect it to almost always make sense to define a specific allowed tag and attribute list, as is usually done with the userland predecessors to this API.
Show HN: Mici – CLI framework that uses your filesystem as the command tree
by rwxdash | 2026-02-24 14:59:21+00:00
I'm an SWE/SRE, and I've spent a lot of time building and maintaining internal CLI tools for the teams I've worked with. On top of that, there were always scattered scripts that needed organization. I got tired of the overhead involved in packaging, distribution, and writing parsers every single time I wanted to automate a new workflow.

I built mici to solve this for myself, both at work and for personal projects. It's a very trivial tool but it gets the job done for me.

It is a Rust-based runner that turns your directory structure into a CLI. You just drop a YAML file in the mici folder and the command is ready to run. If you have worked with GitHub Actions, the syntax will feel very familiar.

It handles the "boring" parts like input validation, help documentation, command registration, and more out of the box so you can focus on the actual logic/script you want to write. It also works on both Unix and Windows systems.

It is still early (v0.x), but I am working toward a v1.0 with features like parallel execution and better step isolation. Hopefully the README and the examples are thorough enough for fresh eyes. I would love some feedback on the approach.

Repository can be found here: https://github.com/rwxdash/mici