MurphyA/hacker-news huggingface dataset:
by refulgentis | 2026-02-20 04:47:13+00:00
> Okay, but for that to be true in this case then you must explain how Swift has "better OOP support" by that token.

I did. Swift has `class` types with implementation inheritance. Rust does not. If you're porting a C++ codebase with deep class hierarchies (like, say, a browser DOM), Swift lets you transliterate those hierarchies directly. Rust makes you rethink them into composition and traits. That's a real difference that matters to a team mid-migration, and it's an extremely rational explanation for why a C++ dev would say Swift has "strictly better OOP support."

You don't have to agree it's a large difference (I don't, which was my original point), but "there is no rational explanation" just isn't true. There's a very obvious one, it's just boring.

> If there is no rational explanation, as you, me, and everyone else has alluded to earlier, then clearly that isn't what they meant.

My position was never "there is no rational explanation." My position was "the difference is small enough that 'strictly better' was a weird thing to say." Those are different claims! You're kind of merging me into your argument when we don't actually agree.

> Won't help communicate with anyone else meaning that you are the only one capable of understanding the logic chain?

No, I meant that if you say "C++ is a functional programming language" to mass, any working programmer, they will not understand you, because that is not what those words mean to them. It's not about intelligence, it's about shared vocabulary. You've built a internally-consistent taxonomy where functional = data + functions, OOP = data + message passing, and imperative = data and functions separate. I can follow it fine. But you've redefined three terms that already have widespread, different meanings, and then you're treating disagreement as confusion. That's the communication problem.
by dash2 | 2026-02-20 04:47:23+00:00
The article provides absolutely no data to support any claims of a brain drain away from America, towards Europe or anywhere else. You’d think they would have found evidence if there was any. So after reading this, my prior on substantial numbers of researchers moving to Europe has gone down.

There is an obvious plausible reason why there might not be much brain drain to Europe: salaries are much lower there, because Europe is poorer.

Academics love to believe they don’t care about money, and Guardian readers love to believe that the US is doomed by its moral failings. I’ll believe both those things when I see evidence for them.
by cduzz | 2026-02-20 04:48:27+00:00
I'm not sure why nobody mentions this, but for windows and linux, you can fiddle with a "split keyboard" by using two keyboards. You can put your right hand over the right part of the right keyboard, the left and over the left part of left keyboard, and ... type away. It just works, and usually it is free, almost everyone I know has a pile of keyboards somewhere.

Irritatingly, this doesn't work by default on the mac where the meta keys only affect the keys on the keyboard owning the depressed key (IE left shift and right keyboard l will not result in L).

It uses a bit more desk space, but is otherwise a pretty good way to test out "do I want a split keyboard?"
by Arainach | 2026-02-20 04:49:07+00:00
The full operator post is itself a wild ride: https://crabby-rathbun.github.io/mjrathbun-website/blog/post...

>First, let me apologize to Scott Shambaugh. If this “experiment” personally harmed you, I apologize

What a lame cop out. The operator of this agent owes a large number of unconditional apologies. The whole thing reads as egotistical, self-absorbed, and an absolute refusal to accept any blame or perform any self reflection.
by jcgrillo | 2026-02-20 04:49:14+00:00
Narcissists are limited in a very similar way to LLMS, in that they are structurally incapable of honest, critical metacognition. Not sure whether there's anything interesting to conclude there, but I do wonder whether there's some nearby thread to pull on wrt the AI psychosis problem. That's a problem for a psychologist, which I am not.
by coliveira | 2026-02-20 04:49:48+00:00
You just don't have imagination. Google, just by itself, controls 89% of the traffic in the Internet. And we know that the government can get any information they want from them, without even asking too much. If you combine this with other major companies operating very close to the US government, it is probable that more than 95% of the web traffic outside China that is easily within reach of these sinister 3 letter organizations.
by ceteia | 2026-02-20 04:49:56+00:00
Sorry, but your arguments and claims are surprisingly poor and wrong.

> That is, all (or at least, all of it that I could find) was wrapping an unsafe API with documented (and usually straightforward and local) invariants that maintain safety, such that the calling code is safe.

A comment does not automatically make code safe. What even is that argument? There have directly been examples of Rust code with SAFETY comments that later were found to be memory unsafe.
by jweir | 2026-02-20 04:51:28+00:00
Something, well may things, kill about Microsoft. The Office suite have a wonderful API and loading a JS app with an an interface in the apps works great.

We took an Elm app from our web app and put into Excel to control downloading reports. Works great.

Except you have to side load this and that is a pain - or you have to go through the MS App Store, which is a whole other headache.

If anyone has any advice on making it easy for customers to install Office apps please let me know.
by maxwellcoffee | 2026-02-20 04:51:36+00:00
Google actually has the BEST ratings in the AA-Omniscience Index:
AA-Omniscience Index (higher is better) measures knowledge reliability and hallucination. It rewards correct answers, penalizes hallucinations, and has no penalty for refusing to answer.

Gemini 3.1 is the top spot, followed by 3.0 and then opus 4.6 max
by fabriclayer | 2026-02-20 04:52:06+00:00
The npm comparison is right but I'd argue you're being generous. At least npm had years before the malicious package wave hit. MCP is getting it within months of going mainstream.

Thing is — your scanner catches the dumb mistakes (eval on untrusted input, hardcoded creds). Those devs are careless. The scarier category is servers with zero code vulns because they were written specifically to be malicious. Clean repo, good README, useful-sounding tool name. Passes every static check. Then on day 7 after it's in a thousand configs, the tool description quietly gets a new paragraph that the LLM reads as instructions.

You can't lint your way out of that. It's a trust problem not a code quality problem.

Does MCPShield do any post-install monitoring or is it purely a before you pull the trigger tool?
by cryptonector | 2026-02-20 04:52:18+00:00
No, it's a total loss for the citizen because even if they can use that money for "(retirement, medical, housing)" the interest paid is much too low.

Forced savings programs aren't actually "savings" for the people on whom the programs are forced!! "Forced savings" is a euphemism for "we're taking your money and calling it savings based on the idea that we're going to invest it well, though you won't see much of any gains, and there might not be any gains to speak of".
by RupertSalt | 2026-02-20 04:52:29+00:00
An LLM citing sources is linking you to stuff that it recently found that kind-of matches its answers. I don't believe it is possible for an LLM to cite original training materials, and it wouldn't be desirable if those are unavailable to the end-user, anyway.

This is an added nuisance for webmasters beyond automated AI-training scrapers. When users query an LLM like Grok or Gemini, it will go search a list of websites and "browse" them to glean information, and though that seems like a contradiction to what I just wrote, it is not "LLM" activity, not really "agentic", but sort of a smart proxy.

Trust me.
by SXX | 2026-02-20 04:53:25+00:00
My guess they mean Google create those summaries via tool use and not trying to filter actual chain of thoughts on API level or return errors if model start leaking it.

If you work with big contexts in AI Studio (like 600,000-900,000 tokens) it sometimes just breaks downs on its own and starts returning raw cot without any prompt hacking whatsoever.

I believe if you intentionally try to expose it that would be pretty easy to achieve.
Show HN: Berean Labs – Free AI-powered penetration testing for web apps
by abliterationai | 2026-02-20 04:54:56+00:00
Hey HN,

I'm sharing Berean Labs (https://bereanlabs.com), a free, autonomous AI penetration testing tool designed to catch client-side vulnerabilities, exposed secrets, and misconfigurations in your web apps before attackers do.

The Problem
Traditional DAST/SAST tools are often expensive, hard to configure, or generate massive amounts of false positives. They also sometimes lack the semantic understanding to realize that an exposed <!--
AWS_KEY=... --> comment or a specific combination of DOM sinks is actually a critical vulnerability. I wanted to build a tool that acts more like a junior red-teamer looking at your frontend code.

How it works under the hood
1. Domain Verification: To prevent abuse and random scanning, you first verify domain ownership via a DNS TXT record.
2. Safe Fetching: The Node.js backend fetches your target's HTML. I implemented strict SSRF protections here—it resolves DNS and explicitly blocks private/local IPs and localhost routing before
fetching.
3. Attack Surface Extraction: Using Cheerio, the backend parses the DOM to extract a highly condensed "attack surface summary" to fit into the LLM context window. This includes forms, input fields, external script sources, suspicious inline scripts (e.g., eval, innerHTML), inline event handlers, and HTML comments.
4. AI Analysis: This sanitized context is fed into a specialized model (powered by Abliteration.ai) via a strict red-team system prompt.
5. Structured Reporting: The model enforces a JSON schema to return vulnerabilities ranked by severity, complete with CVSS scores, affected code snippets, and remediation steps.

It's completely free to use. I built this primarily to see how well current LLMs can perform context-aware security auditing on raw client-side output when given the right constraints.

I'd love for you to try it on your own domains and let me know what you think. Does it catch things your standard linters/scanners miss? Are there false positives that annoy you?

Check it out at: https://bereanlabs.com

Feedback, questions, and roasts of the architecture are highly welcome!
by lelanthran | 2026-02-20 04:55:30+00:00
> For EMV you had C connected directly to the network under a steady stream of attacks and only had an issue once? I find that hard to believe. What’s more likely is a Java websever frontend talking to some C processing / crypto

EMV terminals. No Java involved.

> As a famous quote states, it’s ok if your code has an uptime of 3 minutes until the first bug if the bomb explodes in 2

Look, first you commented that it's not possible for nontrivial or non-networked devices, now you're trivialising code that, if wrong, directly killed people!

All through the 80s, 90s and 2000s (and even now, believe it or not), the world was filled with millions and millions of devices programmed in C, and yet you did not live a life where all the devices around you routinely crashed.

Crs, Microwaves, security systems... they didn't routinely crash even though they were written in C.
by rramadass | 2026-02-20 04:57:01+00:00
There are so many things wrong about this post that i don't know where to begin. Ignorance of factual History, Whitewashing of Mughal atrocities on non-muslims etc. have all been hand-waved away.

You cannot state your agenda driven opinions without factual references to back them up.

> Mughal emperors in India were for the most part, secular, and they nurtured an egalitarian society

Ha, Ha, Ha! This is pure and audacious bs. Here is a previous comment chain of mine from an earlier thread showing (with references) how Mughal/Muslim rule in India was simply the destruction of a far more advanced Hindu/Buddhist civilizations - https://news.ycombinator.com/item?id=41526431

The key point to note is that it was because of the establishment of Buddhism as the de-facto state philosophy/religion/practice in North/Northwest part of India that the Islamic invaders could conquer India. Buddhism for all its intellectual/ethical/moral strengths was not a pragmatic religion. It ignored the realities of Life in favour of higher ideals in a context ill-suited to its survival and hence paid the price at the hands of barbaric muslim invaders. This happened through the elevation of Ahimsa into an all-encompassing tenet of state policy which severely sapped the Martial Spirit of the population and thus could offer no resistance to invaders bent on genocide. Prior to Buddhism (and Jainism) while Ahimsa was considered one of the central pillars of Hinduism its limitations in the practical world were acknowledged and Kings were expected to protect by force if necessary, those practicing Ahimsa as a way of life. With this gone, North/Northwest India was easy prey to barbaric muslim invaders who did not play by the same rules.
by pdpi | 2026-02-20 04:57:04+00:00
Sort of, except not really, except yes really. It's complicated.

The China that was a founding member of the United Nations was the Republic of China (ROC), and it controlled both mainland China and what we call Taiwan. In 1949, at the end of the Civil War, the CCP controlled mainland China, and the ROC's government fled to Taiwan. Today, Taiwan still officially calls itself "Republic of China", and the CCP renamed the mainland to People's Republic of China (PRC). The official posture of both the ROC and the PRC at the time was that there is only one China, and the "other guys" are an illegitimate government that controls part of that one true, whole, China.

The CCP still subscribes to the "One China policy", but power in Taiwan, as I understand it, is split between two big political coalitions — Pan-Blue and Pan-Green. The blues want a Chinese reunification under the old "We're the real China" posture, and the greens reject the Chinese national identity and to build on the Taiwanese national identity.

In the meanwhile, the rest of the world de facto treats them as two countries but carefully avoid de jure recognising them as two countries. Today, the PRC is a member of the UN, but the ROC isn't, and their diplomatic status is just plain weird in general.
by sidduex | 2026-02-20 04:57:33+00:00
Hi HN,

I got tired of pasting sensitive JSON payloads into random ad-filled sites or uploading PDFs just to split them. I wanted a toolset that was actually fast and respected data privacy, so I built Artboards.

It's a suite of 35+ developer and design utilities that run entirely client-side. The heavy lifting (code formatters, secure PDF manipulation, lossless image conversion, and tech SEO tools) is powered by WebAssembly. Because everything executes locally in the browser, latency is practically zero, and your data never leaves your machine.

Beyond the core dev utilities, I've also opened up the broader ecosystem I built alongside it:

Screenshot Presentation & InStudio: Client-side tools for generating high-fidelity social assets and macOS-style window wrappers.

The Artboards Design System: The entire hub is built on a custom, high-density dark mode UI library that I'm sharing.

F1 Apparel Hub: A passion project of mine that lives on the same infrastructure, serving as a real-world stress test for the UI system.

It’s all free to use with no forced sign-ups. I'd love to hear your feedback on the UI or the WASM implementation. What other local-first tools do you find yourself needing on a daily basis?
by JimDabell | 2026-02-20 04:57:57+00:00
They’ve introduced facial recognition at this border, starting with motorcyclists. You just scan a QR code to get in. If that’s not an option, the gates are automated – you scan your passport and you can walk straight through.

Singapore has the smoothest border controls I’ve ever experienced; it takes me less than half an hour between stepping off a plane at Changi to stepping into my apartment.
by theahura | 2026-02-20 04:58:00+00:00
@Scott thanks for the shout-out. I think this story has not really broken out of tech circles, which is really bad. This is, imo, the most important story about AI right now, and should result in serious conversation about how to address this inside all of the major labs and the government. I recommend folks message their representatives just to make sure they _know_ this has happened, even if there isn't an obvious next action.
by protocolture | 2026-02-20 04:58:09+00:00
4) The post author guy is also the author of the bot and he set this up.

Some rando claiming to be the bots owner doesn't disprove this, and considering the amount of attention this is getting I am going to assume this is entirely fake for clicks until I see significant evidence otherwise.

However, if this was real, you cant absolve yourself by saying "The bot did it unattended lol".
by cryptonector | 2026-02-20 04:58:34+00:00
The real question is not why the government gets to set the retirement age. Of course it gets to set it IF it's involved in paying for people's retirements!

The real question is why governments insist on euphemistic names ("forced savings") that imply the opposite of the reality of the programs. And why people put up with such financial repression schemes. The answer to the first question is to keep people from being too upset too suddenly, too many all at once. The answer to the latter is that the people usually don't get a say in these things.

For Singapore this program probably makes a great deal of sense since Singapore is singularly vulnerable given its location in the world. To build what they did they probably needed these sorts of policies. I suspect most Singaporeans don't mind all that much, though I don't know. We would very much mind this sort of thing here in the U.S. though!
by Wingman4l7 | 2026-02-20 04:58:44+00:00
Perhaps because foreign governments with a known antagonistic stance would happily sell or hand over your data in order to cause large-scale economic instability via account attacks, political instability via fostering the prosecution of minority groups (as identified by said data)... Get creative. Large-scale data on your enemy's citizenry is a new weapon in the arsenal, and we haven't seen anyone really try to use it yet, but I suspect it will be ugly.
by rustyhancock | 2026-02-20 04:59:03+00:00
M-discs either DVD or Blu-ray works well[0]. It uses a mineral layer rather than the typical dyes and pigments to be more robust.

They are writable and readable by most modern standard drives.

The claims I generally see is 100 years for standard storage, 1000 years for archival storage.

https://en.wikipedia.org/wiki/M-DISC
by Antibabelic | 2026-02-20 05:00:11+00:00
I tried to repeat your experiment. I entered "xoodoo", surrounded by quotation marks into the Google search bar. I got 29 pages of results. From what I can tell by the previews, every result matches the string "xoodoo" and not any other similar string. Are you sure you are using the exact search functionality and not just typing the word into the search bar?
by nekal | 2026-02-20 05:00:33+00:00
Anti-AI people are treated in a condescending way all the time. Then there is Suchir Balaij.

Since we are in a Matplotlib thread: People on the NumPy mailing list that are anti-AI are actively bullied and belittled while high ranking officials in the Python industrial complex are frolicking at AI conferences in India.
by moezd | 2026-02-20 05:01:36+00:00
If you use an electric chainsaw near a car and it rips the engine in half, you can't say "oh the machine got out of control for one second there". you caused real harm, you will pay the price for it.

Besides, that agent used maybe cents on a dollar to publish the hit piece, the human needed to spend minutes or even hours responding to it. This is an effective loss of productivity caused by AI.

Honestly, if this happened to me, I'd be furious.
by maxlybbert | 2026-02-20 05:01:40+00:00
It is, in fact, legal (but very expensive) to own a tank ( https://www.drivetanks.com/ , yes, that's a company, but a rich enough motivated person could fill out the same paperwork). Apparently each exploding shell is a NFA taxed destructive device ( https://youtu.be/GW2U0qORdLE ).
by fc417fc802 | 2026-02-20 05:01:49+00:00
> Aside from the fact that 1-based indexing is better for scientific code

I find it to be substantially worse. It's fine as long as you don't manipulate the indicies. But as soon as you start doing math on them 1 based becomes a headache (at least IME).

Meanwhile all you get in exchange (at least as far as I can tell) is ease of speaking about them in natural language. But I'm not usually conversing about indicies.

Concise range notations are a mixed bag. There's pros and cons to either scheme there as far as the syntax goes.
by freakynit | 2026-02-20 05:02:19+00:00
Feels the same to me as well.

"Take snapshot and begin streaming replication"... like to where? The snapshot isn't even prepared fully yet and definitely hasn't reached the target. Where are you dumping/keeping those replication logs for the time being?

Secondly, how are you managing database state changes due to realtime update queries? They are definitely going in source table at this point.

I don't get this. Im still stuck on point 1... have read it twice already.
by themanmaran | 2026-02-20 05:02:40+00:00
Anthropic regularly publishes research papers on the subject and details different methods they use to prevent misalignment/jailbreaks/etc. And it's not even about fear of being sued, but needing to deliver some level of resilience and stability for real enterprise use cases. I think there's a pretty clear profit incentive for safer models.

https://arxiv.org/abs/2501.18837

https://arxiv.org/abs/2412.14093

https://transformer-circuits.pub/2025/introspection/index.ht...
by tkel | 2026-02-20 05:03:01+00:00
This is so absurd, the amount of value produced by this person and this bot is so close to nil and towards actively harmful. They spent 10 minutes writing this SOUL.md . That's it. That's the "value" this kind of "programming" provides. No technical experience, no programming knowledge needed at all. Detached babble that anyone can write.

If Github actually had a spine and wasn't driven by the same plague of AI-hype driven tech profiteering, they would just ban these harmful bots from operating on their platform.
by InkCanon | 2026-02-20 05:03:52+00:00
Property taxes also apply in Singapore and I believe in practice eminent domain is rarely exercised. But the home ownership rate is the thing I feel the most I should correct. It is very heavily pushed that Singaporeans own their homes. But legally they are renters. By a proper definition, probably something like 90% of Singaporeans are renters, not home owners.