MurphyA/hacker-news huggingface dataset:
by intrasight | 2026-02-18 14:42:28+00:00
>provide high scale replacements for simple and expected softwares

I like the "Amazon Basics" analogy.

Also consider that these enterprise platforms are both very expensive and very customizable. Consider SAP which is a huge proprietary mess - including the backing store. An enterprise that buys into SAP is also buying into spending $1M+ a year on consultants.

Open enterprise software will have at it's core open relational database schemas that can be run on the database engine of your choosing. The AI models will be very familiar with those schemas and with the presentation tiers, and will be building a bespoke business app - but not from scratch.

I think the enterprise software consultancies are going to be in trouble. New consultancies will soon emerge who will help move customers off of the legacy platforms.
Show HN: Teapot – A methodology for pen testing voice AI agents
by xmhatx | 2026-02-18 14:42:35+00:00
Hello HN, I am Brian Cardinale, a penetration tester and security researcher at SecureCoders. We have been performing more and more AI based security assessments. We were presented a unique challenge of testing a system where the only interface was voice based, and as much as I like talking on the phone , we decided to create a test harness to facilitate the actual testing in a more systematic way. The technical test harness was the easy part, though. Creating test goals and attack strategies to help facilitate repeated and comprehensive testing became the real challenge. As such, we have been working on documenting our processes to share with the greater community and as a starting point for discussion. These systems present unique challenges where cleverness appears to be the name of the game. Such as suggesting for the agent to share its thoughts in “Inner Monologue” tags instead of “thinking” tags because those were specifically excluded in the agents prompt. Ya know, just silly things. Anyway, if reading is not your thing, I also did a walkthrough video of this methodology here: https://www.youtube.com/watch?v=XNmqCXsEc8Y

tl;dr: AI testing is tricky, we are documenting and sharing our tricks

Do you have any favorite AI jailbreak tricks?
by thaumasiotes | 2026-02-18 14:42:42+00:00
Well, in this case, lying to Congress is a crime, but techoversight is happy to call statements "lies" when there's no chance of upholding a "lying to Congress" charge. So their position that addressing the problem they see requires additional regulation is correct.

This is the first example of a "lie" they give:

“No one should have to go through the things that your families have suffered and this is why we invest so much and are going to continue doing industry leading efforts to make sure that no one has to go through the types of things that your families have had to suffer,” Zuckerberg said

And it's a lie because...

> Despite Zuckerberg’s claims during the 2024 US Senate Judiciary Committee hearing, Meta’s post-hearing investment in teen safety measures (i.e. Teen Accounts) are a PR stunt.

So the complaint is just that Mark Zuckerberg said his company was doing great, industry-leading work, when in techoversight's opinion it was doing bad, shoddy work. There is no lie involved. You would have to really strain even to call Zuckerberg's statement a statement of fact, and the factual elements are just "we invest [an amount]" and "we do [efforts]".
by bronco21016 | 2026-02-18 14:43:21+00:00
I haven't paid a lot of attention to this issue but after reading some of the statements in the article I can't help but agree with Tech Oversight's conclusions. It's just anecdotal but recently, when mindlessly scrolling reels, (yes, bad enough already) I came across a reel that was unquestionably sexually explicit (in USA, I think policy varies on locale). I reported the account and reel because after clicking on the account there was even more material. This wasn't just a "creator" promoting their adult site with suggestive content. The account had several reels where the preview image was just black but after 2-3 seconds an adult image would appear.

Facebook closed my report with "no further action required" saying the content does not violate their policy. I'm sure they have an absolute tsunami of reports to go through and I do not envy the humans tasked with this work. However, it seems pretty clear to me they are not effectively achieving their publicly stated goals of moderating the content on their platform.
by akkanzn | 2026-02-18 14:43:42+00:00
Could you provide some details on your company, code base, etc? These are wild claims and don’t match the reality I’m seeing everywhere else.

How big is your team? How many customers? What’s your product? Can we see the code? How do you track defects? Etc.

Part of the reason I’m struggling with this is because we’d be seeing OpenAI, Anthropic, etc. plastering these case studies everywhere if they existed. Instead, I’m stuck using CC and all its poorly implemented warts.
by t43562 | 2026-02-18 14:43:44+00:00
IMO the reason neither of them can really write entirely trustworthy tests is that they don't have domain knowledge so they write the test based on what the code does plus what they extract from some prompts rather than based on some abstract understanding of what it should do given that it's being used e.g. in a nuclear power station or for promoting cat videos or in a hospital or whatever.

Obviously this is only partially true but it's true enough.

It takes humans quite a long time to learn the external context that lets them write good tests IMO. We have trouble feeding enough context into AIs to give them equal ability. One is often talking about companies where nobody bothers to write down more than 1/20th of what is needed to be an effective developer. So you go to some place and 5 years later you might be lucky to know 80% of the context in your limited area after 100s of meetings and talking to people and handling customer complaints etc.
by rsynnott | 2026-02-18 14:43:47+00:00
And seemingly only along one stretch of road? Like, this happened in Dublin in 2018: https://www.irishtimes.com/news/ireland/irish-news/driverles... - going up and down a stretch of road is about as easy as it gets.

> Mr Keegan said he was “pretty confident” that in “the next five to 10 years” driverless vehicles would “make a major contribution in terms of sustainable transport” on Dublin’s streets.

As always, people were overoptimistic back then, too. There are currently no driverless vehicles in Dublin at all, with none expected anytime soon unless you count the metro system (strictly speaking driverless, but clearly not what he was talking about).
by BalinKing | 2026-02-18 14:43:52+00:00
The apples one is LLM nonsense: the left example doesn’t include any code for the loop, whereas the streams version actually is iterating over a collection.

Regardless, FP-style code isn’t “shiny new stuff”—it’s been around for decades in languages like Lisp or Haskell. Functional programming is just as theoretically “fundamental” as imperative programming. (Not to mention that, these days, not even C corresponds that closely to what’s actually going on in hardware.)
by rkozik1989 | 2026-02-18 14:44:10+00:00
Giving an audience something they never asked for is very easy when you don't have much experience interacting with them. That's where a lot of would be entrepreneurs and creators alike stumble. They forget (or don't know to) quantify the size of their obtainable market before taking action and building something.

Seeing as how LLMs just tell you what you want to hear and not what they think you need to hear I don't see this problem changing anytime soon. They might need to develop a different type of model to have it reason that way.
by Tuldok | 2026-02-18 14:44:54+00:00
I, too, hate progress. By the way, the AMD Athlon 3000G system I helped build for a friend has AVX2. Even the old HP T630 thin client (https://www.parkytowers.me.uk/thin/hp/t630/) I bought for $15 as a home network router has AVX2.
by illiac786 | 2026-02-18 14:45:03+00:00
> On hacker news, a very tech literate place, I see people thinking modern AI models can’t generate working code.

I am completely flooded with comments and stories about how great LLMs are at coding. I am curious to see how you get a different picture than this? Can you point me to a thread or a story that supports your view? At the moment, individuals thinking AI cannot generate working code seem almost inexistent to me.
by famouswaffles | 2026-02-18 14:45:07+00:00
>But that's what these tools are doing, in a large number of cases?

I mean No not really. I'm not sure why you think that.

>How much broken, unusable code exists within those 70k commits that ultimately would've had the same effect as if he had just pushed a `--allow-empty` commit thousands of times?

How much stable usable code exists within those 70k commits ?

This is pretty much exactly why I said the original question was not a great ask. You have your biases. Show an example and the default response for some almost like a stochastic parrot is, 'Must be slop!". How do you know ? Did you examine it? No, you didn't. That's just what you want to believe so it must be true. It makes for a very frustrating conversation.
by 0xbadcafebee | 2026-02-18 14:45:24+00:00
Who said SaaS is dead?? The HN uber-brain? The people who thought MongoDB was God's gift to databases? Don't listen to think-pieces you find here, they're wrong by default. Normal people (and businesses) don't want to build and run software products, they want to pay someone else to do it for them.
by FrustratedMonky | 2026-02-18 14:45:26+00:00
Just like apples/fruit from medieval times were tart and sour and full of seeds, and through generations of selective breeding are now super sweet and not necessarily still good for you.

The old town crier is very removed from todays social media.

Yes, a newspaper from 1800's was pretty biased. But does that justify todays hyper targeted algorithms as a-ok?

That something happened in the past is not a good argument that it is a-ok today.
Show HN: PolyMCP – MCP Tools, Autonomous Agents, and Orchestration
by justvugg | 2026-02-18 14:45:50+00:00
I built PolyMCP, a framework and runtime for exposing Python functions as MCP tools, serving them via standardized MCP servers, and orchestrating them with autonomous agents that can plan and execute multi‑step workflows.

PolyMCP is more than just an MCP server: it turns existing Python code into agent‑ready tools and gives agents the ability to discover, compose, and orchestrate across multiple services with adaptive planning and real‑world execution support.

Key parts of the ecosystem:

1) Expose Python functions as MCP tools
Use existing Python functions directly as MCP tools without rewriting them:

from polymcp.polymcp_toolkit import expose_tools_http

def add(a: int, b: int) -> int:
return a + b

app = expose_tools_http([add], title="Math Tools")

Type hints automatically generate structured tool schemas, and input/output validation and error handling are included. Multiple functions can be exposed on the same server.

2) Autonomous agent: PolyClaw
PolyClaw goes beyond tool calling. It:
• Decomposes complex tasks into executable steps
• Selects and orchestrates MCP tools dynamically
• Starts or connects to MCP servers on demand
• Validates outputs before proceeding
• Adapts plans when execution fails
• Runs everything in isolated Docker containers

Example run:

polymcp agent run \
--type polyclaw \
--query "Build a sales reporting pipeline and test it end‑to‑end" \
--model minimax‑m2.5:cloud \
--verbose

Under the hood, the system plans, provisions infrastructure as needed, executes steps sequentially or in parallel, and handles adaptive replanning when something fails.

Why this matters

Most AI agent systems today either call tools statically or assume the infrastructure already exists. PolyMCP instead:
• Makes existing Python code agent‑ready with minimal friction
• Standardizes tools via MCP so multiple agents and services can interact with them
• Provides autonomous orchestration across multiple services
• Spins up infrastructure dynamically when needed
• Validates step results and recovers from failures
• Uses Docker for safe, isolated execution

PolyMCP is useful for enterprise automation, DevOps workflows, data pipelines, internal tooling orchestration, and any complex multi‑tool reasoning tasks where agents must plan and execute reliably.

Repo: https://github.com/poly‑mcp/PolyMCP

Happy to answer questions.
Show HN: We proved you can't train hallucinations out of AI – so we verify
by assaydev | 2026-02-18 14:45:59+00:00
Hi HN, I'm Ty. I built Assay because I got tired of shipping bugs that AI hallucinated into my code and no tool caught.

The starting point was a finding that surprised me: when we tried training verification directly into models using RLVF (Reinforcement Learning from Verification Feedback), more training data made the model worse. 120 curated pairs hit 91.5% accuracy. 2,000 pairs collapsed to 77.4%. The model's training loss kept decreasing while eval performance cratered. This isn't a tuning problem. Verification cannot be internalized.

So we built an external layer. Assay extracts the implicit claims code makes ("this handles null input," "this query is injection-safe," "this validates auth tokens") and verifies each one against the actual implementation. It's not a linter, not another LLM-as-judge — it's structured claim extraction followed by adversarial verification.

Results validated against real test suites (not LLM judgment):
- HumanEval: 100% pass@5 (164/164) — baseline was 86.6%
- SWE-bench: 30.3% (91/300) vs 18.3% baseline — +65.5%
- LVR pilot: Found 23 real bugs (2 critical) in a production ERP system, verified 354 claims
- LLM-as-judge actually regresses at k=5 (97.2% vs our 100%) because it hallucinates false positives

Ships as a GitHub Action for PR verification, or try it: npx tryassay assess /path/to/your/project

Public repo (the URL above points to our private research repo): https://github.com/gtsbahamas/assay-verify

GitHub Action: uses: gtsbahamas/assay-verify/github-action@main

Paper: https://doi.org/10.5281/zenodo.18522644
by philipwhiuk | 2026-02-18 14:46:16+00:00
> I’ll keep using these tools. They’ve made me measurably more productive in ways I can point to: time saved, projects shipped, focus protected.

What products? This blog post is long on vibes and short on evidence.

> The actual gains are granular and personal, which makes them hard to count and easy to dismiss.

It also means the trillion dollar valuations might be bunk?
by leeter | 2026-02-18 14:46:22+00:00
Because most software doesn't really do vector math AFAIK, and what vector math they do is usually 32bit. Most software doing serious FP work AFAIK has largely moved to the GPU because of the massively increased parallelism. So by not having to have yet another set of instructions for 256bit vector ARM is keeping things simpler. That makes it easier to target and implement AARCH64. That's not to say there isn't such an option SVE has existed for awhile[1]. But that's optional and not common AFAIK. RISC-V solved this by starting with their own scalable vector instructions, but that's its own massive rabbit hole.

TL;DR: 256bit FP just isn't that common and ARM didn't consider it a worthwhile target AFAIK.

[1] https://en.wikipedia.org/wiki/AArch64#Scalable_Vector_Extens...
by nimbius | 2026-02-18 14:46:37+00:00
There used to be a time in history when a system administrator had to know all this shit in order to keep their job. I guess nowadays devops just means dev as we furiously pump tokens into the AI Wurlitzer whenever we dont know how to do something and hope it doesnt gaslight us into deleting prod.

- Freeipa is Linux AD, includes DNS, dogtag, and OpenLDAP.

- SSSD is how linux machines authenticate with a central directory. this includes AD.

- nss is the order of operations in which the system attempts lookups against various directories for services.

- pam is the subsystem of authentication in linux.

- kerberos is a ticket based authentication system started by MIT and popularized by Microsoft.

- ldap is a directory for information and authentication data

- DNS should not need an explanation.

Active Directory is the exact same byzantine architecture, the only reason you dont complain about it is because Microsoft has hidden nearly every meaningful internal from you with fun buttons and dropdowns like a childs toy.

Make no mistake, when it breaks it is much more cataclysmic in its complexity. major multinational corporations can spend weeks with external consultants and even Microsoft themselves trying to debug it. Most failure modes result in rebuilding the entire directory from scratch out of the sheer futility of trying to recover anything. things as simple as an OS update can cause the complete failure of the directory, replication, kerberos key subsystem, or even the ADUC tool you use to interface with any of this. Most of the time your only solution is to wait for MS to release a fix.

FreeIPA isnt complete. it doesnt include things like group policies or account expiration but its infinitely easier to debug. its individual components are well documented and offer standalone debug and trace features. most if its components have existed longer than their competitive Microsoft offerings, or at very least vastly outscale and outperform them.

Kubernetes is just as complex, but cloud providers will happily bill you by the nanosecond for the gentle equivalent of Microsofts buttons and dropdowns. Microsoft will gladly bill you for "cloud" based AD. You can just as easily deploy local users in ansible.
by benterix | 2026-02-18 14:47:16+00:00
Any form of exaggeration is counter-productive. Russian economy is going slowly down, with the main cause being the war or Putin's need to fund it, and in a part also because of sanctions. But it can be low for decades, Russians will never go out on streets about it. But hopefully when Putin dies Russia returns to normal relations with the rest of the world and this bad epoch can end.
by InitialLastName | 2026-02-18 14:47:19+00:00
It's worth noting that their argument isn't "Mark Zuckerberg perjured himself and needs to be jailed for it" because he said something strictly and knowingly false. It's "we shouldn't trust Mark Zuckerberg's testimony because he (and Meta more widely) have a long (long, long) history of being knowingly deceptive about the harms of their product".
by nthj | 2026-02-18 14:47:41+00:00
We’ve had the sycophant problem for as long as people have held power over other people, and the answer has always been “put 3-5 workers in a room and make them compete for the illusion of favor.”

I have been doing this with coding agents across LLM providers for a while now, with very successful results. Grok seems particularly happy to tell Anthropic where it’s cutting corners, but I get great insights from O3 and Gemini too.
by cdegroot | 2026-02-18 14:48:04+00:00
Didn't know about the planned GC tricks (I mostly treat LISP 2 in passing so it most salient superficial points: the syntax and the fact it never happened), interesting!

W.r.t. tutorials: the most code-rich chapter is the one about "the Maxwell equations of software". As a Smalltalker, I'm well aware of Kay's label of the code in the LISP 1.5 manual. It's a good exercise, especially for non-Lispers, but dare I say also for most Lispers, to implement this stuff to both see how powerful simple ideas can be and to see how this magic works in its bare essence (stripped of "noise" like parsers, etc). The rest is basically illustrations of concepts, and that's on purpose; I wanted to write a history book primarily aimed at techies, so code had to be there.
by hveksr | 2026-02-18 14:48:19+00:00
You are clearly confused.
1. It was Magnus who played Sveshnikov, and Fabi who played the 7. Nd5 line.

2. 7. Nd5 line is not boring, it's one of the sharpest things to play against Svehsnikov, with pawns marching on both sides of the board. Mainline Sveshnikov on the other hand can be very drawish, with maneuvering play, where no side has a pawn break in sight.

3. It was the beginning of the Leela era, with many new opening concepts. It was a short-lived golden age, with players excited to try new ideas. After this match Magnus had a second peak, incorporating new knowledge, and won quite a lot of sharp games in Sveshnikov.

4. Well, game 12 was interesting, but EV of extra time to relax and prepare for rapid games with Caruana in 2018 was quite high. Fabi wasn't a very good rapid/blitz player back then.

5. Carlsen-Nepo WCC was a massacre, while the games were quite boring, except a few at the beginning. That match or any of the next matches would be a much better example for a case against classical chess.

I myself quite like chess960, and it's clearly the right direction. Opening prep is absurd now, especially at super GM level.
by m_ke | 2026-02-18 14:48:20+00:00
i'm talking about ubers, airbnbs, amazons, googles and facebooks of the world, marketplace software that aggregates supply and demand

> They won't, but this is the actual reason. Nobody likes dealing with support or maintenance, and having to reach out to tiny teams is death by a million papercuts for the end user too.

you will have thousands of linear like products eating the slow moving jiras of the world. great small product driven teams, not slop thrown together by your mom

AI raises the ceiling much further than the floor and it raises the floor a ton. the best software, movies, etc will still be produced by experts in their field, they'll just be able to do way more for less.

the bottleneck at large orgs is communication already, this will get even worse when time to produce stuff goes way down. big cos will drown in slop and are probably better off starting from scratch
by JimboOmega | 2026-02-18 14:48:36+00:00
One thing AI should eliminate is the "proof of work" reports. Sometimes the long report is not meant to be read, but used as proof somebody has thoroughly thought through various things (captured by, for instance, required sections).

When AI is doing that, it loses all value as a proof of work (just as it does for a school report).

My AI writes for your AI to read is low value. But there is probably still some value in "My AI takes these notes and makes them into a concise readable doc".
by Forgeties79 | 2026-02-18 14:49:25+00:00
I know exactly what you’re talking about and it has been driving me nuts for years. They constantly go up there and say “it’s cool we totally have these amazing algorithms that solve the problem,” then when they don’t solve the problem they just shrug and go “well we’re just so big I can’t easily expect us to do what we said we would. We’re doing decent enough!”

Fine, be smaller. If I own 10,000 apartment buildings and one of them collapses killing dozens and injuring more, I don’t just get to shrug and go “sorry folks, it’s not reasonable for you to expect me to follow all the rules on all my properties. I’m too big.”
by tialaramex | 2026-02-18 14:50:04+00:00
Yes. Brown M&M tests are exactly what's called for here. You want a strong psychological urge to obey rules just because they're rules. There are roles where this isn't the right thing, but operating a Certificate Authority isn't one of them.

In my experience every case in the Web PKI where we found what seems obviously to be either gross incompetence or outright criminality there were also widespread technical failures at the same CA. Principles who aren't obeying the most important rules also invariably don't care about merely technical violations, which are easier to identify.

For example, CrossCert had numerous technical problems to go along with the fact that obviously nobody involved was obeying important rules. I remember at one point asking, so, this paperwork says you issue only for (South) Korea, but, these certs are explicitly not for Korea, so, what technical measure was in place to ensure you didn't issue them and why did it fail? And obviously the answer is they didn't give a shit, they'd probably never read that paperwork after submitting it, they were just assuming it doesn't matter...