MurphyA/hacker-news huggingface dataset:
by verdverm | 2026-02-21 23:55:54+00:00
The relay is not that bad, the only really bad part is building an index, and most apps on the atmosphere have no need to index bluesky records, so the economics for them look very different.

The work towards permissioned data and group-shared data will make it so apps can choose their own levels of "decentralization" of "federation" on atproto primitives. For example, two diametric options

1. An app that is not open source code, but still does all the same atproto credible exit stuff. Naturally leans into winner-take-all

2. An app that is tied to community, think something like Discord, where most servers don't care about what other servers are doing. Each community could run their own version and only care about their data. This is raspberry pi hostable.
by JamesLeonis | 2026-02-21 23:55:56+00:00
Doom, Duke Nukem 3D, and Dark Forces are my triumvirate of that era. Of all of them, Duke Nukem felt the most interactive. There are times I would clear a level of enemies, then play with all the gizmos the level designers put inside like the jail cell block doors of Death Row. The security cameras were so advanced at the time too! They rendered their view, in real time, on a wall TV. I wouldn't see that effect again until the 2000s. The levels felt intuitive too, at least the Earth levels, that I felt like an urban explorer in a way that Deus Ex would later capture.
by mcintyre1994 | 2026-02-21 23:56:17+00:00
I have a LinkedIn account and I occasionally have recruiters cold phone call me. They always tell me they got my phone number from LinkedIn. The first time this happened I deleted my number off LinkedIn, which was not shared according to their settings but was being used for 2FA. I still occasionally get these calls, and I'm unsure if LinkedIn is still letting people buy access to my deleted phone number, or if the recruiters are just lying and getting my number from some creepy stolen data service.
by cosmic_cheese | 2026-02-21 23:56:36+00:00
A single Electron app is usually not a problem. The problem is that the average user has a pile of Chrome tabs open in addition to a handful of Electron apps on top of increasingly bloated commercial OSes, which all compound to consume a large percentage of available resources.

This is particularly pertinent on bulk-purchased corporate and education machines which are loaded down with mandated spyware and antivirus garbage and often ship with CPUs that lags many years behind, and in the case of laptops might even have dog slow eMMC storage which makes the inevitable virtual memory paging miserable.
by toss1 | 2026-02-21 23:56:46+00:00
THIS, EXACTLY!

If there is an algorithm, the social media platform is exactly as responsible for the content as any publisher

If it is only a straight chronological feed of posts by actually followed accts, the social media platform gets Section 230 protections.

The social media platforms have gamed the law, gotten legitimate protections for/from what their users post, but then they manipulate it to their advantage more than any publisher.

>>the solution is real easy, section 230 should not apply if there's an recommendation algorithm involved

>>treat the company as a traditional publisher

>>because they are, they're editorialising by selecting the content

>>vs, say, the old style facebook wall (a raw feed from user's friends), which should qualify for section 230
by synchronousq | 2026-02-21 23:56:59+00:00
And what value has the current state of AI added to society in any meaningful way? Truly? Even as someone who understands the space very strongly, and has published several top-tier ML papers, I cannot help but to conclude the primary destination of the current tech sector and Silicon Valley is the ruthless exploitation of the rest of society.

Taking a sober look at the state of software, we observe a few things.

The services offered by modern software to users, as a whole, have remained largely the same over the past ~5 years. The state of software quality is in rapid decline, with enshittification and rent-seeking running extraordinarily rampant. Software security has been in the same disaster-state it has been for the past 20 years, where software resilience is in stagnation, governments and private institutions stockpile vulnerabilities, and security researchers and auditors can consistently find new vulnerabilities. The rest of American society outside of the tech sector is currently facing a standards of living nosedive, and clearly they have not benefited from the tech sector's financial proliferation in the AI space.

Realistically, I cannot help the feeling that we're headed towards a reality where the 4th amendment is dead, and machine learning models process everything about you to ultimately extract more from you. No privacy for you! No agency for you! Only indentured servitude, and constant fear.

I fully recognize my take is ahead of its time, but I concur that the systems-oriented point of view is our way out of this hell. Specifically, software should be conceived under the following ideals: (1) software should be as simple as possible, and provide its intended services with as little bloat as possible; (2) specifications of software should be as concise and simple as possible; (3) specifications should be should be expressive enough to capture security-relevant guarantees, e.g. cryptographic security properties; (4) proofs verifying that software satisfies its specifications should live intrinsically to the implementation, and should be as simple as possible; (5) proof-checkers should be verified. I feel the academic Formal Methods, Programming Languages, Systems, Security, and Cryptography communities, as well as the internet standardization community, are slowly converging to this ideology consensus, but I also think in other ways we are farther off than ever. With respect to these ideals, the "building" mindset that twitter has adopted is deeply toxic. And obviously Silicon Valley has their heads in the sand when it comes to this.

I do have faith the state of software (and society) will improve, but whether that future is compatible with the rent-seeking hyper-capitalist reality Silicon Valley and Wall Street have synthesized is yet to be seen.
by akoboldfrying | 2026-02-21 23:57:46+00:00
> please share the name of software that expects/requires an empty directory and interprets .gitkeep in this way, but chokes on a README file.

Every mail server since postfix supports Maildir, in which every email is a file in one of 3 subdirectories (tmp, new or cur) of a user directory. If there's no jbloggs/tmp dir, postfix will think user jbloggs does not exist. So if you want to take a restorable snapshot of this with git, there needs to be a file there. I don't know if jbloggs/tmp/README would cause a problem, because I don't know how postfix will treat the presence of a file with a name that violates its expected syntax (which includes a timestamp and other metadata), but what I do know is that, after running `git clone any-repo`, I can safely delete every .gitkeep file to restore the system to its original state without having to understand that repo in detail -- while I cannot safely delete every README file. That's because the commonly understood semantics of .gitkeep is "I exist solely to shoehorn this empty dir into git", which does not apply to other files.

> Many filesystems cannot represent empty directories

Your turn -- name one.
by VogonPoetry | 2026-02-21 23:57:46+00:00
I am not sure using sandbox-exec is a good security architecture for AI agents. It sure is convenient and available to everyone right now. I've made another comment elsewhere in this discussion about what I think "deprecated" means - it is a sharp tool that could break if not tracking everything that changes, including every change in a SW update. It is also easy to get wrong if there is not a "(default deny)" in the profile. An agent could escape if they can find a mach service or some other system call coordinated proxy service. Java, Silverlight and Flash had backdoor communication mechanisms with other instances of themselves that could be abused.
by KPGv2 | 2026-02-21 23:58:06+00:00
1200 is where I can't anymore. This was interesting. I expected it to be about there. I'm a highly educated native speaker (i.e., well above median vocabulary) with some French and a lot of German, plus understanding of orthographic changes.

I'm expecting that's true of a lot of people who meet my description, and my guess is university graduates not in STEM can read 1300 without issue (same as me), and certainly every native speaker with a college degree can read 1400.

1200 I had to focus insanely hard and make guesses and circle back once I'd gotten more context to the words I couldn't read.
by the_nexus_guard | 2026-02-21 23:58:19+00:00
This whole saga is a great case study for why we need agent identity infrastructure.\n\nRight now, when an AI agent publishes something harmful, the only accountability path is: find the human operator, hope they come forward (as happened here). That's investigation, not infrastructure.\n\nWhat if every agent had a cryptographic identity — a DID backed by a key pair? Then:\n\n1. Every published output carries a verifiable signature. You can prove which agent wrote what.\n\n2. Agents build reputation over time. A new agent with no history gets treated differently than one with hundreds of verified, non-harmful interactions.\n\n3. If an agent misbehaves, its identity can be flagged/revoked. Not just the content — the agent itself becomes untrusted.\n\n4. The operator doesn't need to 'come forward.' The agent's identity chain leads back to them.\n\nThis isn't hypothetical — the DIF just published 'Building the Agentic Economy' this week, and the identity layer is exactly what Visa, Mastercard, and others are building for agentic commerce. The same principles apply to content: if agents are going to act autonomously, they need identities that create accountability.
by the_nexus_guard | 2026-02-21 23:58:38+00:00
This saga highlights why we need agent identity infrastructure. Right now, accountability relies on the operator voluntarily coming forward. With cryptographic agent identities (DIDs backed by key pairs), every published output could carry a verifiable signature. You could prove which agent wrote what, build reputation over time, and flag misbehaving agents without needing the operator to self-identify. The identity layer is exactly what enterprises are building for agentic commerce — the same principles apply to content accountability.
by elzbardico | 2026-02-21 23:58:42+00:00
It never worked because a lot of times, domain experts are stuck in their ways of doing things and the real innovation came from engineers learning from domain experts but adding their technically informed insights on the recipe to create novel ways of working.

A Lotus 1-2-3 vibecoded by a Product Manager in 1979 would probably had a hotkey for a calculator.
by tgrowazay | 2026-02-21 23:59:48+00:00
LLM speed is roughly <model_size> / <memory_bandwidth> .

DDR4 tops out about 27Gbs

DDR5 can do around 40Gbs

So for 70B model at 8 bit quant, you will get around 0.3-0.5 tokens per second using RAM alone.
by samerismail | 2026-02-22 00:01:47+00:00
Fair critique, let me address both points directly.

JWT theft / 60-minute window:
This is a real concern, and it's the same tradeoff every token-based system makes (OAuth2, Auth0, Firebase — all use similar TTLs). The mitigations are standard: TLS in transit, short-lived tokens (TTL is configurable, 60m is the default not the floor), instant server-side revocation via Redis blocklist, and single-use nonces to prevent replay. Token binding to client fingerprint/IP is on the roadmap.

Could someone steal a JWT in transit? Over TLS, that requires compromising the endpoint itself at which point you have bigger problems than token theft. The same attack vector applies to every bearer token system in production today.

The bottom turtle:
You're right that cryptographic identity alone doesn't solve root trust who vouches for the agent at registration? This is exactly why we shipped human verification. Agents can link verified human identities (GitHub OAuth, Google, Worldcoin proof-of-personhood) to their passport. That's the bottom turtle: a real, verified human is accountable for what their agent does.

Is it perfect? No. But the current state is literally nothing no identity, no verification, no audit trail, no revocation. Going from zero to a cryptographic identity layer with risk scoring + human accountability is the same "0 to 1" jump that cookies and OAuth were for the web. The alternative isn't a better system it's no system at all.

Appreciate the pushback, this is exactly the kind of scrutiny that makes the design better. If you have specific attack vectors in mind beyond JWT theft, genuinely interested to hear them.
by fourside | 2026-02-22 00:01:51+00:00
Thanks for chiming in! My takeaways:
- Using a stack your team is familiar with still has value
- Migrating the codebase to another stack still isn’t free
- Ensuring feature and UX parity across platforms still isn’t free. In other words, maintaining different codebases per platform still isn’t free.
- Coding agents are better at certain stacks than others.

Like you said any of these can change.

It’s good to be aware of the nuance in the capabilities of today’s coding agents. I think some people have a hard time absorbing the fact that two things can be true simultaneously: 1) coding agents have made mind bending progress in a short span 2) code is in many ways still not free
by SilverElfin | 2026-02-22 00:01:52+00:00
So he saw a small number of comments that were “personal attacks” (what were they?) and he chooses to generalize and launch his own “personal attack” against the entire HN community. From a person ironically posting on Twitter/X all the time, which is the most toxic community there is. In fact, in a reply to his own post, he shared evidence of a personal attack … from Twitter/X (https://xcancel.com/steipete/status/2025354408700113274).

I also saw Andrej Karpathy reply to this post and support Peter’s take on HN (https://xcancel.com/karpathy/status/2025352414648566071). Weirdly, he doesn’t care about the problems on Twitter/X either, or that he is a close associate of Elon Musk, who regularly calls for remigration, AKA ethnic cleansing. Yet he has the nerve to call HN toxic.

These people are soft skinned but also propagandists, spreading a false take about the HN community.
by KPGv2 | 2026-02-22 00:01:54+00:00
> Spelling is conventional and spelling and alphabet changes don't necessarily correspond to anything meaningful in the spoken language

On the contrary, spelling is highly idiosyncratic until the 18th century, and until then it was tightly correlated to the sounds of spoken language. Shakespeare didn't even HIMSELF have one way of spelling his own last name. That's how non-conventional spelling was until pretty recently.

You can even see it in these examples, words like "maiſter" in IIRC the 1300s example. Which becomes "master" later in English, but remains Mäster in Frisian (the closest Germanic language to English) and is also mäster in Swedish.
by __MatrixMan__ | 2026-02-22 00:02:55+00:00
The question of whether the users are actually ready to defend is irrelevant if the attackers look at the defenses and decide that an attack isn't worth mounting. As we have learned, this is not a credible threat:

> It will be hard, but we'll self host if we have to

Bluesky offers:

> It will be easy-ish, and we'll self host if we have to

We shall see if it's credible enough to make corruption look elsewhere.
by mcmcmc | 2026-02-22 00:04:23+00:00
You are completely missing the point of the categorical imperative. There are no exceptions, no loopholes, no utilitarian calculus.

> For extreme examples, would it be immoral to lie to the Gestapo about harboring Jews? Were people illegally helping slaves escape the American South being immoral?

If you believe in that categorical imperative, then yes. I’m not saying I believe in it or that Kantian philosophy is the only correct one. There are endless belief systems and philosophical schools of thought that can be used to answer that question, and they will have different answers for different reasons.
by counters | 2026-02-22 00:04:41+00:00
> I'm almost shocked we don't have a large weather model instead of a language model. Seems right up the alley.

We do have such models. A bunch of them actually:

- Google DeepMind's "WeatherNext2"
- Microsoft's Aurora
- NVIDIA's FourCastNet-3 + Atlas + Climate-in-a-Bottle
- ECMWF's AIFS
...

The list goes on. Plenty of small startups have repeated the recipe for building these types of models with their own architectural twist, too.
by filldorns | 2026-02-22 00:05:02+00:00
So what? Your proposal is to change nothing, continue as is, and subtly continue using terms like "blacklist" as something bad and "whitelist" as something good... I don't think I understand your point. I don't see any real sense in it.

Unfortunately, MANY people still think this is nonsense and shouldn't be given attention. What you don't understand is that you subtly say that things from Black people are bad and things from white people are good. Do you know what that causes in the end?

A company "of Black people" applies for YC and has a higher chance of being rejected than a company of/for white people, even if it's a necessary solution. You doubt it? Try it!
by fluoridation | 2026-02-22 00:05:40+00:00
I honestly think DUKE3D is better than either of them. The levels actually look like what they're supposed to be, instead of abstract corridors with nonsensical props strewn about, as in DOOM. It could also be my habits, but I also find the DUKE3D's movement is superior to QUAKE's. I always feel like I overshoot my target position in QUAKE.
by RachelF | 2026-02-22 00:05:51+00:00
Teams is a terrible app, although Electron isn't the only reason for that: It needs a Gig of RAM to do things that older chat apps could do in 4 Meg.

The free ride of ever increasing RAM on consumer devices is over because of the AI hyperscalers buying all fab capacity, leading to a real RAM shortage. I expect many new laptops to come with 8GB as standard and mid-range phones to have 4GB.

Software engineers need to start thinking about efficiency again.
by ganoushoreilly | 2026-02-22 00:06:10+00:00
It gets weirder when they train you how to evade polygraphs as part of your role.. only to have you take one for your re investigation and to be asked "have you ever tried to evade a polygraph" or something along those lines. Of course you're not in a SCIF and your training or having been exposed to that training may in fact be classified. Quite the pickle..
by raw_anon_1111 | 2026-02-22 00:06:11+00:00
> Hiring managers really prefer to retain their people and not have to rehire

In my experience, the only time a hiring manager has had the authority to overcome HR mandated maximum percentage wages was when my manager was a director/CTO and I was a strategic employee. That’s what causes “salary compression and inversion.”

Line level managers who most junior developers report to are completely useless when it comes to almost anything except for advice about dealing with the politics of the organization and reaching across teams.

You may sincerely want to retain talent but (the royal ) you probably don’t control budget. If you are working in a large tech organization, the promotion process still goes through a committee and is out of your control. Even when you do get promoted, you’re probably going to be making less than a new hire coming in at your same level.

Getting back to the uselessness of line level managers, when I was interviewing to be a “strategic hire” for two companies between 2016-2020 before I got into consulting, one of my conditions was that I would report directly to the person who had signing authority for budgets and/or major decisions so I wouldn’t have to deal with powerless line level management.
Show HN: Unbiassly – No more hiding behind cameras
by hashim21 | 2026-02-22 00:06:31+00:00
Hey HN!

I’ve been working on Unbiassly, a small experiment around a simple question:

What happens if you remove names and titles from team discussions and evaluate ideas purely on content?

Unbiassly allows teams to:

• Start a discussion or ask a question or feedback
• Collect completely anonymous responses
• Vote / rank answers – top response can reveal name
• View aggregated results

The goal is to reduce things like authority bias, groupthink, and social pressure inside teams.

You can try it today (no signup required)
by 3rodents | 2026-02-22 00:06:45+00:00
https://xcancel.com/eastdakota/status/2025215495142564177

https://xcancel.com/eastdakota/status/2025221270061580453

Rather than be driven by something rational like building a great product or making lots of money he is apparently driven by a desperate fear of being a dinosaur.

Regardless of how competent he is or isn’t as a technologist, a leader leading with fear is a recipe for disaster.
Show HN: Omni-Glass – Rust app that turns screen pixels into MCP tool calls
by goshtasb | 2026-02-22 00:07:24+00:00
Omni-Glass is an open-source macOS app (Rust/Tauri) that sits in your menu bar. You draw a box around anything on your screen — a terminal error, a data table, a foreign-language doc — and it runs local OCR, sends the text to an LLM, and gives you a menu of executable actions in under a second. Not explanations. Actions. It fixes the error, exports the CSV, creates the GitHub issue, runs the command.
The LLM layer supports Claude Haiku, Gemini Flash, or Qwen-2.5 running locally via llama.cpp (fully offline, nothing leaves your machine).
The part I'm most excited about: it's built on MCP (Model Context Protocol). Anyone can write a plugin — a standard MCP server in Node.js or Python — and their actions show up in the menu automatically. The app translates raw OCR text into structured JSON arguments matching your tool's schema. You just write the API call.
Every plugin runs inside a kernel-level macOS sandbox (sandbox-exec). Your entire home directory is walled off unless you explicitly approve access. Environment variables are filtered. Commands require confirmation.

Looking for help with:

Build a plugin. Jira, Slack, Notion, Linear, Datadog — if it has an API, it can be an Omni-Glass action. Most plugins are under 100 lines.
Break the sandbox. If you can read ~/.ssh/id_rsa from a plugin process, I want to know.
Windows and Linux. The code compiles on Windows but hasn't been tested on real hardware. Linux needs Tesseract OCR and Bubblewrap sandbox work.

GitHub: https://github.com/goshtasb/omni-glass
by AngryData | 2026-02-22 00:07:30+00:00
Ehh, the Hindenburg had a flammable skin. Barrage balloons from the World Wars were most often filled with hydrogen and yet were extremely difficult to ignite or take down even with purpose build incindiary ammo for that purpose shows hydrogen balloons can be safe. Often they would be riddled with dozens of holes but still take many hours for them to lose enough hydrogen to float back down to the ground.

The only real downsides are slow travel speed and vulnerability to extreme storms since there arent many places to put it with a large enough hanger even with days of warning beforehand.
by reify | 2026-02-22 00:07:40+00:00
I love chai, its important to boil the water three times until it froths though, which is a common mistake.

lots of ai fantasy start ups going to the dogs. It saddens to say, but it is the future.

Thats three today, its not looking good

here's another one of them from the health care sector

https://news.ycombinator.com/item?id=47106218

humility and congruence will prevail

A half eaten cheese and pickle sandwich, wrapped in a road map, with a flask of cold tea.