MurphyA/hacker-news huggingface dataset:
by fractallyte | 2026-02-16 15:19:33+00:00
Because your first comment is inflammatory, and wrong.

Ukraine is far from being a "weaker neighbor" – it's proven to have more of a backbone than all of NATO.

And that "loosing land" part which seems so compelling: those are strategic withdrawals, forcing russians to haemorrhage men and equipment for Pyrrhic advances. Right now, those advances are being reversed: AFU is making significant gains around Zaporizhzhia, and massing troops near Kharkiv for possibly another major offensive.
by mbreese | 2026-02-16 15:19:53+00:00
> My post argues that the demand has permanently shifted

The time horizon for this is murky at best. This is something you think, but can’t know. But, you’re putting money behind it, so if you’re right, you’ll make a good profit!

But for the larger companies (like WD), over building capacity can be a big problem. They can’t plan factory expansion based on what might be a short term bubble. That’s how companies go out of business. There is plenty to suggest that you’re right, that AI will cause permanently increased demand for computing/storage resources. Because it is useful and does consume and produce a lot of new data and media.

But I’m still skeptical.

The massive increase in spending can’t be sustainable. We can’t continue to see the AI beast at this rate and still have other devices. Silicon wafer fabs can’t be built on demand and take time. SSD/HD factories take time. I think we are seeing an expansion to see who the big players will be in the next 3-5 years. Once that order has been established, then I think we will fall back to more sustainable rates of demand. This isn’t collusion, it’s just market dynamics at play in a common market. Sadly, we are all part of the same pool and so everything is expensive for all of us. At some point though, the AI money will dry up or get more expensive. Then I think we’ll see a reversion back to “normal” demand, maybe slightly elevated, but not the crazy jump we’ve seen for the past two years.
by rajish | 2026-02-16 15:19:59+00:00
Forgot the GitHub link: https://github.com/rajish/cc-hdrm

Quick technical notes since a few things tend to come up:

How does it get credentials? It reads the OAuth tokens that Claude Code stores in macOS Keychain. No login flow, no API keys, no config file. If Claude works in your terminal, cc-hdrm works automatically. Tokens are read fresh from Keychain every poll cycle — nothing cached to disk.

What API does it hit? GET /api/oauth/usage — the same endpoint the web dashboard uses for the quota bars. It returns your current utilisation percentages and reset times for both the 5-hour and 7-day windows. This is not the chat completions API, so it doesn't consume any tokens or count toward your
limits.

How does the "subscription intelligence" work without an LLM? It's just math. The pattern detector looks at your usage history in SQLite and applies heuristics — e.g., if your average utilisation has been under 5% for two consecutive weeks, it flags "forgotten subscription." Tier recommendations compare your actual usage against known tier limits and pricing. The natural-language summaries are template-based, not generated. No API calls, no inference.

Privacy: Everything stays on your machine. The only network traffic is the usage polling endpoint (same as opening claude.ai/settings) and token refresh when your OAuth token expires. No telemetry, no analytics, no phoning home.

Why native Swift instead of Electron? Menu bar utilities should be invisible. cc-hdrm uses about 30 MB of memory and negligible CPU. The analytics charts are SwiftUI Charts. No web views anywhere.

The whole thing started because I kept getting rate-limited during long Claude Code sessions and had no visibility into how close I was to the limit. The 5-hour window resets are especially hard to track mentally when you're deep in a coding session.
by quux0r | 2026-02-16 15:20:36+00:00
So a couple things. Bruce Dang’s book, while a little old, is still a great spot to get started. Another great book is Blue Fox by Maria Markstedter for ARM. From there, finding small binaries and just trying to get the “flow” is a good next step, for me this is largely renaming functions and variables and essentially trying to work the decompiled code into something readable, then you can find flaws.

So for the second thing, pulling the data off chips like that typically involves some specialized hardware, and you have to potentially deal with a bunch of cryptographic safeguards to read from the chip’s memory. Not impossible though, and there are not always good safeguards, but might be worth checking out some simpler programs and working up to it, or learning some basic hardware hacking to get an idea of how that process works.
by gib444 | 2026-02-16 15:20:56+00:00
Congratulations, you've corrected us on the usage of the word immigrant. Now can we return to the topic?

Whilst we're on Rotherham:

"...by men predominantly of Pakistani heritage" [0]

https://www.bbc.com/news/uk-england-south-yorkshire-61868863

Their parents or grandparents were immigrants...
by dist-epoch | 2026-02-16 15:21:36+00:00
I know you are an audio guy, I also wrote low-latency audio software. I was just saying that setting HIGH_PRIORITY on the audio running thread and it's feeding threads is enough, you don't need QNX. Python has the GIL problem, but that is another story.

For a simple audio app like this synth on a modern CPU it's kind of trivial to do it in any language if the buffer is >40 ms. I'm talking about managing the buffers. Running the synth/filter math in pure Python is still probably not doable.
by somenameforme | 2026-02-16 15:21:46+00:00
I think these sort of claims of excessive competence are challenged by the October 7th attacks. Think about the massive amount of planning and organization that went into that attack over a period of years. There were thousands of forces engaging in some specialized and unusual strategies. Hamas even released a propaganda video more or less showing their plan with paragliders and everything. And they carried it out the day after the 50th anniversary of the Yom Kippur War. And somehow this all caught Israel completely by surprise. So either you have to go down a very dark rabbit hole, or accept that these claims of excessive competence are, at the minimum, exaggerated.

Similarly this would make things like evading law enforcement pretty much impossible, while in reality there are countless people, at least thousands, who have been photographed in relation to e.g. a crime, but never found, and never identified.
by YeGoblynQueenne | 2026-02-16 15:22:17+00:00
>> I've learned from a former college colleague that got into cyber security that Israeli intelligence facial recognition is virtually error free.

What does "virtually error free" mean? There's no "error free" in facial recognition, or any other application of machine learning.

More to the point, who says all this, besides yourself in this thread? Why should anyone believe that "virtually error free" is a factual description of real technological capabilities rather than state propaganda?
by bell-cot | 2026-02-16 15:22:19+00:00
> Parents are typically asked to sign paperwork at enrollment granting consent for the schools to give their kids laptops. Nicki Petrossi said when she initially refused to sign it in 2024, the school district in Fullerton, California, told her that she was legally barred from doing so.

IANAL, but the legal status of a coerced signature seems problematic.
by jccc | 2026-02-16 15:23:01+00:00
Great. I’ve just returned a WD drive to Amazon after it arrived crushed in a torn-open paper bag.

The replacement arrived also in a paper bag and went straight back, this time for a refund.

I guess I should have kept that one and hoped for the best.

Good alternatives? I’ve only recently been enlightened on how profoundly sh__ty SSD is for long-term storage and I have a whole lot of images my parents took traveling the last few years of their lives.
by brightmonkey | 2026-02-16 15:23:22+00:00
MCP (Model Context Protocol) requires RFC 8414, RFC 7591, and short-form scopes. Microsoft Entra ID supports none of them. I built a lightweight OAuth compatibility layer that bridges the gap, letting AI IDEs like Cursor authenticate against Azure-hosted MCP servers using standard Entra ID credentials. Includes a Zero-Trust hardening pass covering SSRF, open-redirect, and path traversal mitigations.
by LeifCarrotson | 2026-02-16 15:23:29+00:00
Totally agreed! This is yet another example of reduced friction due to improved technology breaking a previously functional system without really changing the qualities it had before. I don't understand why this isn't obvious to more people. It's been said that "quantity has a quality all its own", and this is even more true when that quantity approaches infinity.

Yes, license plates are public, and yes, a police officer could have watched to see whether or not a suspect vehicle went past. No, that does not mean that it's the same thing to put up ALPRs and monitor the travel activity of every car in the country. Yes, court records should be public, no, that doesn't mean an automatic process is the same as a human process.

I don't want to just default to the idea that the way society was organized when I was a young person is the way it should be organized forever, but the capacity for access and analysis when various laws were passed and rights were agreed upon are completely different from the capacity for access and analysis with a computer.
by kldg | 2026-02-16 15:23:52+00:00
The LLM is probably also not going to launch into a rant about how they incorporate religious and racial beliefs into their life when asked about current heads of state. You ask the LLM about a solar configuration, and I think it must be exceptionally rare to have it instead tell you about its feelings on politics.

We had a big winter storm a few weeks ago, right when I received a large solar panel to review. I sent my grandpa a picture of the solar panel on its ground mount, covered in snow, noting I just got it today and it wasn't working well (he's very MAGA-y, so I figured the joke would land well). I received a straight-faced reply on how PV panels work, noting they require direct sunlight and that direct sunlight through heavy snow doesn't count; they don't tell you this when they sell these things, he says. I decided to chalk this up to being out-deadpanned and did not reply "thanks, ChatGPT."
by quux0r | 2026-02-16 15:24:06+00:00
While on the topic, I want to highlight two incredible plugins for Ghidra:
https://github.com/jtang613/GhidrAssist
And
https://github.com/jtang613/GhidrAssistMCP

Being able to hook Claude code up to this has made reversing way more productive. Highly recommend!
by jwr | 2026-02-16 15:24:08+00:00
Anthropic is walking a very thin line here. The competition between models is intense and the only differentiator right now is the so-called harness that gets put over them. Anthropic needs a niche and they tried to find one by addressing developers. And they have been doing very well!

What I think they are forgetting in this silly stubbornness is that competition is really fierce, and just as they have gained appreciation from developers, they might very quickly lose it because of this sort of stupidity (for no good reason).
by agos | 2026-02-16 15:24:26+00:00
it's not a really unbiased view. React's team has made very clear that they won't even start considering a different approach, and this (and other) is just their narrative to support their stance (which never seemed under discussion), and it borders on gaslighting the community which still has to deal at least with the two giant issues of:

1) knowing why something rendered is almost impossible
2) even for skilled developers who know what they are doing it's quite easy to introduce performance regressions. In other words, it's not a pit of success performance wise

Meanwhile (and this is also never addressed by the React team) if you use other frameworks some issues (for one: effect dependencies) simply are not issues
by loudmax | 2026-02-16 15:24:29+00:00
It's not relevant to coding, but we need to be very clear eyed about how these models will be used in practice. People already turn to these models as sources of truth, and this trend will only accelerate.

This isn't a reason not to use Qwen. It just means having a sense of the constraints it was developed under. Unfortunately, populist political pressure to rewrite history is being applied to the American models as well. This means its on us to apply reasonable skepticism to all models.
by JeremyNT | 2026-02-16 15:24:30+00:00
I feel like you could have correctly stated this a few months ago, but the way this is "solved" is by multiple agents that babysit each other and review their output - it's unreasonably effective.

You can get extremely good results assuming your spec is actually correct (and you're willing to chew through massive quantities of tokens / wait long enough).
by notahacker | 2026-02-16 15:24:37+00:00
You can also insinuate that decisions completely unrelated to immigrants (issue #3) are a coverup to "protect immigrants" in order to use the popularity of bigotry towards immigrants (issue #1) to make the issue salient to bigots that have literally no interest in the rights or wrongs of third party court databases, which anyone with the slightest level of political understanding can see is going on here.
by nradov | 2026-02-16 15:25:24+00:00
What a silly comment. You're literally describing the plot of several sci-fi movies. Nuclear command and control systems are not taken so lightly.

And as for the Chinese spy balloon, there was never any risk of a war (at least not from that specific cause). The US, China, Russia, and other countries routinely spy on each other through a variety of unarmed technical means. Occasionally it gets exposed and turns into a diplomatic incident but that's about it. Everyone knows how the game is played.
by amdivia | 2026-02-16 15:25:47+00:00
The thing is, in this context "editing text" is seen as the one job, that one tool should do.

So when you're working with multiple applications, all of which are trying to force you to use their own way of editing text, it feels highly fragmented and un-unixy

I do understand what you're saying, it's just that I wish the text editing portion of most of these tools is abstracted to a degree that allows for my text-editing tool of choice to be used within it
by Aurornis | 2026-02-16 15:26:29+00:00
I’m still waiting for real world results that match Sonnet 4.5.

Some of the open models have matched or exceeded Sonnet 4.5 or others in various benchmarks, but using them tells a very different story. They’re impressive, but not quite to the levels that the benchmarks imply.

Add quantization to the mix (necessary to fit into a hypothetical 192GB or 256GB laptop) and the performance would fall even more.

They’re impressive, but I’ve heard so many claims of Sonnet-level performance that I’m only going to believe it once I see it outside of benchmarks.
by wat10000 | 2026-02-16 15:26:33+00:00
That's a lovely idea but it's just not possible to have tests that are guaranteed to catch everything. Even if you can somehow cover every single corner case that might ever arise (which you can't), there's no way for a test to automatically distinguish between "this got 2x slower because we have to do more work and that's an acceptable tradeoff" and "this got 2x slower because the new code is poorly written."
by YeGoblynQueenne | 2026-02-16 15:26:34+00:00
It's really unbelievable how much data most people put online about themselves. "Valentina" has probably shared all the information about here the alleged system dashboard showed. Any interested party would only have to search the open internet (and some walled gardens like Facebook) and aggregate the information found in there.

Spy agencies and spyware companies don't have some magickal tech nobody else knows anything about. They take advantage of peoples' careless style of interacting online.
by mountainb | 2026-02-16 15:26:43+00:00
Regulation would be preferable for OpenAI to the tort lawyers. In general the LLM companies should want regulation because the alternative is tort, product liability tort, and contract law.

There is no way without the protections that could be afforded by regulation to offer such wide-ranging uses of the product without also accepting significant liability. If the range of "foreseeable misuse" is very broad and deep, so is the possible liability. If your marketing says that the bot is your lawyer, doctor, therapist, and spouse in one package, how is one to say that the company can escape all the comprehensive duties that attach to those social roles. Courts will weigh the tiny and inconspicuous disclaimers against the very large and loud marketing claims.

The companies could protect themselves in ways not unlike the ways in which the banking industry protects itself by replacing generic duties with ones defined by statute and regulation. Unless that happens, lawyers will loot the shareholders.
by debo_ | 2026-02-16 15:26:48+00:00
On the flipside, there are a lot of businesses that don't open their digital product to multiple markets or verticals because the cost (in money or focus) is too high. Distribution just got a lot easier, arguably about as easy as it should have been in the first place. If you already have a reasonable moat for your product in a smallish market, going broad is a lot more feasible now. I'm doing it now (with partners who own the core product) and its going very well.
by fredley | 2026-02-16 15:26:51+00:00
This is an interesting development. I would predict some of the biggest losers in the AI boom will be Indian (and similar) outsourcing companies. Companies like Wipro and Infosys have thrived off richer countries' businesses wanting grunt work done cheap, not caring necessarily about quality, as long as it meets some baseline functionality. LLMs are very good at this.

In addition, support volume must be taking a hit from AI agents too. When pricing stabilises, will Indian outsourcing still be competitive? Maybe. Maybe less so. If I were working for Infosys right now I'd be a more than a little worried.

Perhaps Anthropic anticipates a glut of engineers in the near future.
by aktau | 2026-02-16 15:27:14+00:00
+1

I once tried learning how to RE with radare2 but got very frustrated by frequent project file corruption (meaning radare2 could no longer open it). The way these project files work(ed?) in radare2 at the time was that it just saved all the commands you executed, instead of the state. This was brittle, in my experience.

I don't have a lot of free time, so I have to leave projects for long periods of time, not being able to restart from a previous checkpoints meant I never actually got further.

IIUC, one of the first things Rizin did was focus on saving the actual state, and backwards/forwards-compatibility. This fact alone made me switch to Rizin. To its credit, my 3-year old project file still works!

Now for the downside: there is apparently a gap in Windows (32-bit) PE support, causing stack variables to be poorly discovered: https://github.com/rizinorg/rizin/issues/4608. I tested this on radare2, which does not have this bug. I'm hoping this gets fixed in Rizin at some point, at which point I'll continue my RE adventure. Or maybe I should give an AI reverse engineer a try... (https://news.ycombinator.com/item?id=46846101).
by al_borland | 2026-02-16 15:27:37+00:00
How much time will someone realistically dedicate to this if they need to have a separate day job? How good will they get without mentors? How much complexity will they really need to manage without the bureaucracy of an organization?

Are senior software engineers of the future going to be waiting tables along side actors for the first 10+ years of their adult life, working on side projects on nights and weekends, hoping to one day jump straight to a senior position in a large company?

The questions I instinctively ask myself when looking at a new problem, having worked in an enterprise environment for 20 years, are much different than what I’d be asking having just worked on personal projects. Most of the technology I’ve had access to isn’t something a solo hobbyist dev will ever touch. Most of the questions I’m asking are influenced by having that access, along with some of the personalities I’ve had to deal with.

How will people get that kind of experience?

There is also the big issue of people not knowing what to build. When a person gets a job, they no long need to come up with their own ideas. Or they generate ideas based on the needs of the environment they’re in. In the context of my job, I have no shortage of ideas. For solo projects, I often draw a blank. The world doesn’t need a hundred more todo apps.
by bri3d | 2026-02-16 15:28:15+00:00
For UI based manual reversing of things that run on an OS, IDA is quite superior; it has really good pattern matching and is optimized on this use case, so combined with the more ergonomic UI, it’s way way faster than Ghidra and is well worth the money (provided you are making money off of RE). The IDA debugger is also very fast and easy to use compared to Ghidra’s provided your target works (again, anything that runs on an OS is probably golden here).

For embedded IDA is very ergonomic still, but since it’s not abstract in the way Ghidra is, the decompiler only works on select platforms.

Ghidra’s architecture lends itself to really powerful automation tricks since you can basically step through the program from your plugin without having an actual debug target, no matter the architecture. With the rise of LLMs, this is a big edge for Ghidra as it’s more flexible and easier to hook into to build tools.

The overall Ghidra plugin programming story has been catching up; it’s always been more modular than IDA but in the past it was too Java oriented to be fun for most people, but the Python bindings are a lot better now. IDA scripting has been quite good for a long time so there’s a good corpus of plugins out there too.
by microtonal | 2026-02-16 15:28:17+00:00
Every phone is hackable but Pixel with GrapheneOS generally seems the hardest. See e.g. the leaked Cellebrite support matrix:

https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju...

iOS generally seems harder than non-GrapheneOS Android, taking a few months for Cellebrite to catch up with. All the other Android phones/variants should make people cry because device security is so bad.
by rokhlan | 2026-02-16 15:28:31+00:00
I built CASM (Continuous Attack Surface Monitoring) to solve attack surface monitoring problems I faced in my work.

Commercial EASM tools are very expensive and are black boxes. You get dashboards but no evidence trail, no transparency, and no way to verify findings. Manual scripting with dig/curl/nmap works but is time-consuming and error-prone.

CASM is an open source EASM tool that:
- Discovers DNS subdomains (passive + active sources)
- Verifies HTTP security (headers, TLS, redirects)
- Tracks changes (automatic baseline comparison)
- Provides evidence (complete audit trail in JSONL)
- Generates professional reports (PDF, SARIF to be integrated to CI pipeline, Markdown)

It's licensed AGPL v3 so you can verify what it does and use it freely.

For the technical stack, I used Python for orchestration, Go for scanning tools. It works on Linux/macOS. It's designed to be scriptable and automation-friendly.

As a DevSecOps engineer, I often needed to answer: "Do we know our complete external attack surface?". I needed something transparent, evidence-based, and accessible. So I built it.

GitHub: https://github.com/g2cv/casm

Thank you for taking the time to read me, I hope you'll like it and I'd be happy to answer questions or hear feedback!