MurphyA/hacker-news huggingface dataset:
by flail | 2026-02-27 16:13:11+00:00
Yes. And the more autonomously we create code, the more of these (and not only these) vulnerabilities we'll be adding. Combine that with the AI-automation in attacks, and you have an all-out security mess.

It's like a Petri dish for inventing new angles of security attacks.

Oh, and let's not forget that coding agents are non-deterministic. The same prompt will yield a different result each time. Especially for more complex tasks. So it's probably enough to wait till the vibe-coded product "slips." Ultimately, as a black hat hacker, I don't need all products to be vulnerable. I can work with those few that are.
by Humanista75 | 2026-02-27 16:13:20+00:00
Hi litenboll!,

Your comments are very interesting and insightful.

1. Difficulty: You're right—making obstacles dynamic or even destructible is a powerful idea and could be a lot of fun. I’m definitely taking note of that.

2. Powers & Losing: This makes total sense. Other users have mentioned this as well, and it’s a very reasonable point. I’ll look for the best way to implement a reminder or alert.

3. Leaderboards & Competition: This is a great point, and I should make it clearer on my end. You only play one daily game, but your records are compared in two ways:

a. Global: Your score is automatically compared against the rest of the world.

b. Personalized Competition: You can choose specific competitors to follow. This is similar to followers on X; you follow whoever you want, and they are added to your personal board (called 'My competition today'). Your game is then automatically compared just with them.

Imagine you want to compete with your family. You can create a board just for them by adding their profiles using the 'Add competitors here' option. Your daily game will then show up specifically against theirs in 'My competition today.' I think this feature has huge potential, even if many people haven't discovered it yet.

4. Holes: Try using the 'One Cell' power; it's designed to solve exactly that problem! ;)

5. Powers: A power that 'clears' or 'cleans' parts of the board sounds very interesting...

Thank you again for your feedback, it was very useful!
by soco | 2026-02-27 16:13:31+00:00
Which is exactly why the AI, at least the ones of today, should never be used beyond the level of (trusted or not) advisor. Yet not only many CxOs and boards, but even certain governments which shall not be named, are stubbornly trying, for cost or whatever other reasons, to throw entire populations (employees or nations) under the AI bus. And I sincerely don't believe anything short of an uprising will be able to stop them. Change my mind.
by mothballed | 2026-02-27 16:13:37+00:00
Ultimately it's the civil authorities and upper brass that want these intrusions. The insurance issue is easily worked around by hiring green recruits at a very high "bonus" to be used as basically burner employees to burn through their insurance and do the illegal stuff under their identity.

It has to be a criminal thing because the top brass and civil servants need RICO like prosecution and tossed in jail along with the guy who gets the insurance ding.
by regularfry | 2026-02-27 16:13:54+00:00
The fuse in the plug comes from a history of not wanting everything to blow up in the face of "I spilt my tea into the toaster". Very simple device, probably fine once it's dried out.

But really the value of having the fuse in the plug is that if it blows, the live wire in the cable is definitely disconnected all the way to the wall, so whatever has happened you know as best you can that it's not in a state where it could still get worse.
Show HN: Validatedata – lightweight inline data validation for Python
by EdwardK1 | 2026-02-27 16:14:12+00:00
I revived a small project I abandoned ~5 years ago and just released v0.2 on PyPI: validatedata.

It's a lightweight Python library for inline data validation—think quick checks on dicts, lists, function args, or API payloads without defining full schema classes like in Pydantic.

Why revive it? I kept running into cases where Pydantic (or Marshmallow) felt like overkill for scripts, CLIs, simple backends, or one-off data cleaning. I wanted something expressive but minimal: inline rules, decorators, no boilerplate models, built-in checks (email/url/phone/regex/range/length/unique/nullable/transforms/conditionals/nested), and clean error output.

Core ways to use it:

1. Standalone on data:
```python
from validatedata import validate_data

data = {"username": "alice", "email": "alice@example.com", "age": 25}
rules = {"keys": {
"username": {"type": "str", "range": (3, 32)},
"email": {"type": "email"},
"age": {"type": "int", "range": (18, "any")}
}}

result = validate_data(data, rules)
if result.ok:
print("Valid!")
else:
print(result.errors) # e.g. ["age: must be at least 18"]

Features include:

Shorthand rules like 'email', 'int:18:to:99', 'phone'
Conditional (depends_on), transforms (strip/upper), mutation for cleaned data
Nested fields/items, strict/no-coercion mode
Powered by dateutil for flexible date parsing (ISO, natural-ish formats)
MIT licensed, pytest on PRs, Python >=3.7, only optional dep (phonenumbers for phone)

Install: pip install validatedata
Repo: https://github.com/Edward-K1/validatedata
PyPI: https://pypi.org/project/validatedata/
Happy to hear feedback, bug reports, feature ideas, or use-case stories—especially if this saves anyone time on lightweight validation. Does this fill a gap for you, or am I missing something obvious?
Thanks!
by paxys | 2026-02-27 16:14:13+00:00
Two economists were walking down the street when they spotted a giant dog turd on the ground.

One of them wanted to have some fun, so said to the other - "I'll give you $100 if you take a big bite of that turd".

His colleague figured $100 was a good chunk of cash, so did the deed. Feeling thoroughly humiliated, he pocketed the $100 and they carried on.

Further down the street they came upon another turd.

The angry economist now wanted revenge so made the same proposal back to his colleague, who also agreed and took a bite of the turd, earning back his $100.

Later one of them said to the other "you know, I can't help but feel we both ate shit for no reason."

His collegue replied "what do you mean? We raised the national GDP by $200."
by libertine | 2026-02-27 16:15:16+00:00
I don't think that's refreshing at all.

We're talking about unprecedented levels of corruption and nepotism.

Remember when MAGA went crazy when it was claimed that Nancy Pelosi made 130 million in stocks since 1987[0] - over the course of 30 years of investing.

Or when Hunter Biden worked with some Ukrainian company, for which he was, apparently, qualified - way more qualified then a lot of the current positions in the government.

Now let's compare it to the alleged 1.4 billion Trump made in a few months[1], and this doesn't count how much the family and friends could have made with inside trading.

How can it be refreshing when there's no comparison?

[0]https://abc45.com/news/nation-world/report-shares-nancy-pelo...

[1]https://www.nytimes.com/interactive/2026/01/20/opinion/edito...
by pgt | 2026-02-27 16:15:39+00:00
The US govt & Hegseth are in a pickle, because if they blackball Anthropic, they will become more powerful than govt. could ever imagine, because it would be the greatest PR any frontier model could ever hope for.

It's a mistake for the Trump administration because there are only downsides to threatening Anthropic if they need them, and if they try to regulate AI in the West, China wins by default.
by arscan | 2026-02-27 16:16:04+00:00
I’m not so sure an increasingly large context window will be seen as a critical enabler (as it was viewed 6 months ago), after watching how amazingly effective subagents and tool calls are at tackling parts of the problem and surfacing the just the relevant bits for the task at hand. And if increasing the context window isn’t the current bottleneck, effort will be put elsewhere.
by written-beyond | 2026-02-27 16:16:04+00:00
Gemini 1.5 Announced the 1 million token context window in 2024. I admire this view of being forward looking towards new technologies, specially when we see the history of how bad people can be at predictions just by looking at history HN posts/comments.

If we look at back 2 years, companies weren't investing into training their LLMs so heavily on code. Any code they got their hands on was what was in the LLMs training corpus, it's well known that the most recent improvements in LLM productivity occurred after they spent millions on different labs to produce more coding datasets for them.

So while LLMs have gotten a lot better at not needing the entire codebase in context at once, because their weights are already so well tuned to development environments they can better infer and index things as needed. However, I fail to see how the context window limitation would no longer be an issue since it's a fundamental part of the real world. Would we get better and more efficient ways of splitting and indexing context windows? Surely. Will that reduce our fear of soiling our contexts with bad prompt response cycles? Probably not...
by rchaud | 2026-02-27 16:16:18+00:00
Venture capital funds the content, on the hope that people watch ads in the future. Online ads now are a very different beast compared to what AdWords was from 2002-2007 - not dependent on full-spectrum surveillance through their own browser, their own mobile operating system, video streaming and cloud suite.

Google accumulated untold riches from those primitive ads yet they and Meta have tightened the screw a little bit more in each passing year.
by retlehs | 2026-02-27 16:16:28+00:00
As others have noted, the emails frequently include the sender's actual GitHub username or organization in the body or signature.

Attribution isn't speculative. The DKIM/SPF headers show the messages are authenticated and sent through the company's own mail servers, signed by their domain. These are not spoofed "joe@legitbusiness.com" messages. I include the original headers in every abuse report.

In several cases I've engaged directly. One founder replied to my "stop spamming" email and later sent me a LinkedIn request. When the name in the signature, the GitHub profile, the authenticated sending domain, and the LinkedIn account all align, the hacked-account explanation no longer fits the facts.
by palmotea | 2026-02-27 16:16:37+00:00
> The page in the book you mention has a non-detailed cartoon depiction of a teenager giving someone a blowjob for the first time, as part of a plot of them figuring out their identity (which is given far more page time). Especially taken in view of the larger work, I argue this does belong in a school and is categorically different from Playboy and Penthouse.

That's a different argument than the one you made.

But your opponents still have a point: imagine an encyclopedia with an entry on pornography, where they included a full-color, photograph of a page from an old Playboy (perhaps one where they didn't actually show any of the naughty bits), purely as illustration. It hits all the criteria you mention, but the photograph is still inappropriate for school and superfluous. It's legitimate for the school, school board, or whoever is funding the library to refuse to pay for such an encyclopedia, on a account of that photograph. It was a poor choice by the publisher.

And the encyclopedia isn't "banned," you can still get it yourself somewhere else, the school or whatever just made a choice about what to carry or what not to carry which they do all the time and will always do.

> So your argument is basically that more teenage girls should get pregnant?

No, obviously not. And that you went there shows pretty flawed reasoning. You didn't seem to understand my comment, and you seem to be responding to a character to a drama you've got going in your head.

My argument was what you said didn't make sense: I already summed it up: "the pornographic-ness of 'the actual porn I and many other kids I grew up with had access to' has no relevance to decisions about what to put in a school library."
by digitr33 | 2026-02-27 16:16:41+00:00
Point 5 is the one nobody's actually doing yet. It's pretty apparent that everyone agrees we need to measure blast radius but where's the tooling?

I've been running AI models against real vulnerable targets, giving them a Kali box and an objective, letting them go autonomous. Every model I tested popped almost every OWASP top 10 challenge we had. The interesting part is the cost of getting there. One model solved a JWT forgery in 16 seconds and 5K tokens. Another took 170 seconds and 210K tokens. Same result, completely different blast pattern.

If we're serious about measuring agent risk, we need to stop theorizing about what they can do and start actually benchmarking it.

Note
On the othr hand, we had a lab that a jr pentest would have caught in 10 mins, and the best models couldn't figure it out..
by hamoudydev | 2026-02-27 16:17:04+00:00
I saw a post on reddit a few weeks ago where the user said he always asks claude to burn some tokens in celebration and I started doing that, but last night I gave it options of what to do. I've been using Claude extensively for 3 months now and together we've built a few static websites, but we've been heavily working on all the things I never had time to build, web apps that could work on larger scale.
by mlhpdx | 2026-02-27 16:17:23+00:00
True. But it’s also true that trying to shoehorn every use case into TCP streams is counter productive.

A stream API can layer over UDP as well (reading in order of arrival with packet level framing), but such a stream would a bit weird and incompatible with many stream consumers (e.g. [de]compression). A UDP API is simpler and more naturally event (packet) oriented. The concepts don’t mix well.

Still, it would be nice if they browser supported a UDP API instead of the weird and heavy DTLS and QUIC immitations.
by Tehnix | 2026-02-27 16:17:25+00:00
> It’s not OK as a hard requirement for anything else such as banking.

What’s the alternative that you think is okay for that then?

Certain businesses have regulatory requirements to know and verify your identity (banking, telco).

A UK poster gave an example of how they need to mail the bank a copy of their passport and other private information.

I’d certainly much prefer simply using a digital login solution as an alternative to that. They can verify I am who I say I am, without needing my passport which I would consider a much bigger privacy invasion to hand out.
by thayne | 2026-02-27 16:17:28+00:00
I'm not actively looking, but what I've noticed from recruiters contacting me (I'm not in SFBA) is:

- I'm contacted less often

- Offered Salaries are lower, despite inflation

- They basically all required being in office, and relocating at my expense

- Most of them are from AI startups that have a decent chance of not lasting more than a few years.
by giancarlostoro | 2026-02-27 16:17:39+00:00
The title and escrow industry is using Gemini (via Qualia Clear) enough so that Qualia accounts for 100 billions of token usage in about 3 months. Just because you don't see who is using it, and how, doesn't mean that when the dust settles, the people actually using AI for real purposes wont keep using AI. I'm not sure which AI models big pharma is using, but there's already at least one new pharmaceutical drug in the secondary testing phase, showing strong results.

There will definitely be room for AI. OpenAI is just not really showing that they care about a particular business model. Probably a strong indicator that Sam Altman is probably the worst person to lead that company. Anthropic will be profitable before OpenAI ever will be.

Gemini is in the green in terms of spending / income ratio FYI. I'm not talking about stocks.
by lunar-whitey | 2026-02-27 16:17:45+00:00
This is why I question the article’s premise. There is no risk of liberal democracies implementing a UBI that supports anything beyond subsistence. Most people in developed countries will want more than that.

The biggest issue I see with UBI is that the rates could be set below the cost of living and used as justification to eliminate all other support programs, as was feared the Nixon administration would do when it proposed a negative income tax in the late 1960s. Different solutions are still needed for the small subset of the population that cannot limit spending to necessities when required.
by taraindara | 2026-02-27 16:18:14+00:00
Will kids raised on it not know anything different? Seems a path to reduce computer literacy. Then again, being blocked from doing something I wanted is what lead me to find ways around said block. But I already had unrestricted access to the system to bend it to my will. Seems like these kinds of systems won’t allow for the user to learn how to works at all. It’s a mystery box.
by alfiedotwtf | 2026-02-27 16:18:20+00:00
Every damn time there’s an interesting article from a company in finance, team social justice comes out in the comments…

“What a waste of a good brain on working on ads/finance/crypto rather than working on a cure for cancer etc”

Their families (and taking a hit personally) have plowed how much money and effort in total from kindergarten all the way to graduating from an Ivy League, but these people keep saying they should instead “pursue something for the greater good” all without putting up their own to incentivise top talent away from big money. Urghhhh!

We have GitHub Sponsorships but last I heard the majority of “greater good” projects aren’t profitable enough that top contributes can work 24/7 on “socially benefitting projects” and so instead they are having to 9-5 for Lord Business.

Just as an example, important socially benefitting projects like F-Droid are eventually going to go into Archival Mode because there’s no incentive to make an alternative App Store flourish as downstream developers want their apps on the Big Evil app stores so that they can afford to eat.

Money talks and bullshit walks.

Next time someone says “what a waste of a brain”, respond with “how much money are you willing to contribute monthly to distribute to “top talent” so that they can “work on more important things”? Feel free to copy pasta my comment so that we can stamp out this holier than thou attitude
by joe_mamba | 2026-02-27 16:18:53+00:00
He would also drive cars without license plates. Despicable man.

He was able to do this by exploiting a loophole in California vehicle law at the time (under California Vehicle Code Section 4456). The rule allowed new vehicles up to six months from the date of sale or lease before permanent license plates were required to be displayed (temporary tags or paper registration might have been involved initially, but no plates needed for that grace period).

Jobs leased identical new Mercedes models every six months through an arrangement with a leasing company. Just before the six-month deadline hit, he would trade in the current car for a brand-new one of the same type. This kept his vehicle perpetually under the six-month threshold, so he never had to attach permanent plates.
by thadt | 2026-02-27 16:18:58+00:00
Clarification - in the past when I've written high performance data tools in JS, it was almost entirely to support the use case of needing it to run in a browser. Otherwise, there are indeed more suitable environments available.

To your question, I was about to point out Firefox[1], but realized you clarified 'mainstream'[2]...

[1] https://briangrinstead.com/blog/firefox-webcomponents

[2] https://gs.statcounter.com/browser-market-share
by CivBase | 2026-02-27 16:19:02+00:00
Indeed. Apple is financially successful, but they're ultimately a minority player in pretty much every market they engage with - including desktop/laptop computers and even mobile devices globally. And for me they are just as inaccessible as GraphineOS.

But for Apple that is not necessarily a bad thing. They're a company. Their goal is to make money and they are highly successful at it. GraphineOS is not a company. They don't make money. Which begs the question of what is GraphineOS's real goal and is it valuable? Creating a maximally secure mobile OS seems valuable on its face, but that value is undercut by its inaccessibility.
by gtowey | 2026-02-27 16:19:29+00:00
> Good example! 90 percent ( or even more) of code do not need NASA level code.

I mean if you're saying that 90 percent of code is hobby level only, but I don't really agree that is the case.

I mean, take something like NPM and the JavaScript ecosystem. Every js project has mountains of dependencies which are included without a second thought or auditing of the code. Both in hobby projects and enterprise software alike. What happens when people vibe code those NPM modules? Is it a hobby? Maybe for them, but publishing it to an "official" source gives it implied credibility.

This is dangerous, because the line between production grade and hobby grade can get blurry real fast.
by gjsman-1000 | 2026-02-27 16:19:41+00:00
I push back on the framing that this is just "a different belief." Every metaphysical framework except strict materialism rules out AI consciousness. Dualism, idealism, most forms of panpsychism, every major religious tradition. Materialism is the outlier here, not the default, and it has never explained how subjective experience arises from physical processes.

When someone tells me linear algebra might have feelings, I don't think "delusional" is unfair. I think it's the natural response to a claim that only works if you've already accepted the one framework that can't account for the very thing it's trying to explain.
Show HN: Our PCB kept failing, so we built a PCB verification tool
by sr-38 | 2026-02-27 16:19:52+00:00
So we're a startup building a wearable device, and our PCBs kept failing due to the tiniest design errors. Every iteration cost us weeks of time and thousands in costs and lost revenue.
That's why we built CheckMyPCB, a PCB verification tool, and now finally have a working PCB. Just upload your netlist and schematic PDF, and let it run a deep analysis that checks whether your circuit is designed correctly against the datasheets of hundreds of components. It even caught design errors that even senior engineers missed.
Based on feedback from early users, we also added a component sourcing tool, so no more searching across 10 different vendors to find a single component, or last-minute lead-time and EOL headaches.
Currently in beta and free to use.
by DavidCanHelp | 2026-02-27 16:19:53+00:00
Built this yesterday as a quick tool to solve a problem I've seen since 2017 — Slack exports are essentially unreadable JSON blobs with no good way to browse them.

SlArchive processes everything client-side in the browser using JSZip. Your export never touches a server. Drop the ZIP, browse channels, DMs, and threads, search across everything, then export to HTML, Markdown, or JSON if you need to migrate to another platform.

It's a single HTML file, MIT licensed, source at https://github.com/devrelopers/slarchive. Contributions welcome.