MurphyA/hacker-news huggingface dataset:
by everforward | 2026-02-21 14:18:28+00:00
Rice’s theorem applies to any non-trivial semantic property.

Looking at the docs, I’m not really sure CodeQL is semantic in the same sense as Rices theorem. It looks syntactic more than semantic.

Eg breaking Rices theorem would require it to detect that an application isn’t vulnerable if it contains the vulnerability but only in paths that are unreachable. Like

if request.params.limit > 1000:
throw error
# 1000 lines of code
if request.params.limit > 1000:
call_vulnerable_code()

I’m not at a PC right now, but I’d be curious if CodeQL thinks that’s vulnerable or not.

It’s probably demonstrably true that there is syntactically a path to the vulnerability, I’m a little dubious that it’s demonstrably true the code path is actually reachable without executing the code.
by eel | 2026-02-21 14:19:15+00:00
I'm glad the absurdity of verification is getting attention. I was "forced" to verify by Linkedin to unlock my account. It was last year, and I had left my previous job, but I had not yet lined up a new job. So one of the only times in my career I might actually get value from Linkedin, they locked me out, removed my profile, and told me if I wanted back in, I'd have to verify. I felt helpless and disgusted.

I gave in and verified. Persona was the vendor then too. Their web app required me to look straight forward into my camera, then turn my head to the left and right. To me it felt like a blatant data collection scheme rather than something that is providing security. I couldn't find anyone talking about this online at the time.

I ended up finding a job through my Linkedin network that I don't think I could have found any other way. I don't know if it was worth getting "verified".

---

Related: something else that I find weird. After the Linkedin verification incident, my family went to Europe. When we returned to the US, the immigration agent had my wife and I look into a web cam, then he greeted my wife and I by name without handling our passports. He had to ask for the passport of our 7 month old son. They clearly have some kind of photo recognition software. Where did they get the data for that? I am not enrolled in Global Entry nor TSA PreCheck. I doubt my passport photo alone is enough data for photo recognition.
Show HN: LocalAgent: local coding agent CLI with trust and replay
by CalvinBuild | 2026-02-21 14:19:53+00:00
Repo: https://github.com/CalvinSturm/LocalAgent

What it does:

- Runs against local providers (LM Studio / llama.cpp server / Ollama)
- Tool calling with explicit hard gates (--allow-shell, --allow-write, write tools opt-in)
- Trust layer: policy rules, approval workflows, audit trail
- Replayable run artifacts + verification
- MCP stdio tool support (including Playwright MCP)
- Eval harness for deterministic coding/browser task packs

Why I built it:

I originally tried wrapping trust controls around existing agent CLIs, but tool execution is too native in those products to reliably enforce policy externally. So I built a runtime where tool calling + trust controls are first-class.

Defaults stay safe:

- trust off
- shell/write disabled
- write tools hidden unless enabled

Quickstart:

cargo install --path .
localagent init
localagent doctor --provider lmstudio
localagent --provider lmstudio --model <model> chat --tui true

I’d appreciate feedback on:

1. trust/policy model ergonomics
2. eval design for local model benchmarking
3. TUI workflow for day-to-day coding use
by juggerl6 | 2026-02-21 14:20:09+00:00
I'm guessing he meant British people, not "UK Citizen".

It's so bad that I'm certain if you could show Brits of 1940 the state of London today they would enthusiastically join forces with their German brothers to prevent this fate. It's a catastrophe. The complete genocide of indigenous Brits within Great Britain is now a foreseeable possibility within a century or two.
by zetanor | 2026-02-21 14:20:31+00:00
I'm surprised at all the comments deriding LibreOffice's interface on here. It's never given me any trouble (even when making tables) and I've been using it preferentially for 20 years over MSOffice, even when schools or employers are actively paying for my Microsoft subscription. In fact, LibreOffice does something very important a lot better than MSOffice: importing CSV files correctly across locales.
by EvanAnderson | 2026-02-21 14:20:43+00:00
> So the world should cared to your needs when literally almost every adult has a phone even in third world countries?

The assumption that everyone has a "smart phone" running locked-down Android or iOS is unreasonable. Just as race, sex, religion, national origin, etc, are protected classes, the "phoneless" should be a protected class. Denying people who choose not to use a locked down phone basic interaction with your business should be legally equivalent to posting a "No blacks allowed" sign on your door, and the consequences should be the same.

> Also see: no I’m not going to waste development time di you can get to a website I develop with JS disabled or so you can use lynx

I don't see what this non-sequitur has to do with the exchange. I didn't bring anything up about Javascript.
by pansa2 | 2026-02-21 14:20:52+00:00
Fundamentally, CPUs use 0-based addresses. That's unavoidable.

We can't choose to switch to 1-based indexing - either we use 0-based everywhere, or a mixture of 0-based and 1-based. Given the prevalence of off-by-one errors, I think the most important thing is to be consistent.
by rswail | 2026-02-21 14:21:26+00:00
Then put a comment in the .gitignore.

Using the actual tools built in to git directly removes steps in the process, which is always a good thing, it's documented as part of the git documentation, so you don't have to create a wiki page explaining why there is a ".gitkeep" file that git doesn't recognize itself.

Saying "It's not that hard..." is fine for projects with a few contributors but does not scale.
by jp1016 | 2026-02-21 14:21:42+00:00
The part where they blame users for not changing the default password is infuriating but unfortunately very common. I've seen this exact same attitude from companies that issue credentials like "Welcome1!" and then act shocked when accounts get popped.

What really gets me is the legal threat angle. Incremental user IDs + shared default password isn't even a sophisticated attack to discover. A curious user would stumble onto this by accident. Responding to that with criminal liability threats under Maltese computer misuse law is exactly the kind of thing that discourages researchers from reporting anything at all, which means the next person who finds it might not be so well-intentioned.

The fact that minors' data was exposed makes the GDPR Article 34 notification question especially pointed. Would love to know if the Maltese DPA ever followed up on this.
by flkiwi | 2026-02-21 14:22:09+00:00
One of my coworkers is EXTREMELY capable but functionally almost illiterate. He’s recently discovered that he can put an idea in Copilot and have it generate an email. So now instead of brief, correct, but difficult to parse emails we receive 20-paragraph, bulleted, formatted OpenAI slop. It’s been a very strange thing to see, like someone getting extraordinarily bad cosmetic surgery.
by jp1016 | 2026-02-21 14:22:14+00:00
Banning "length" from the codebase and splitting the concept into count vs size is one of those things that sounds pedantic until you've spent an hour debugging an off-by-one in serialization code where someone mixed up "number of elements" and "number of bytes." After that you become a true believer.

The big-endian naming convention (source_index, target_index instead of index_source, index_target) is also interesting. It means related variables sort together lexicographically, which helps with grep and IDE autocomplete. Small thing but it adds up when you're reading unfamiliar code.

One thing I'd add: this convention is especially valuable during code review. When every variable that represents a byte quantity ends in _size and every item count ends in _count, a reviewer can spot dimensional mismatches almost mechanically without having to load the full algorithm into their head.
by wavemode | 2026-02-21 14:23:05+00:00
The difference there would be that they would be guilty of theft, and you would likely have proof that they committed this crime and know their personal identity, so they would become a fugitive.

By contrast with a claw, it's really you who performed the action and authorized it. The fact that it happened via claw is not particularly different from it happening via phone or via web browser. It's still you doing it. And so it's not really the bank's problem that you bought an expensive diamond necklace and had it shipped to Russia, and now regret doing so.

Imagine the alternative, where anyone who pays for something with a claw can demand their money back by claiming that their claw was tricked. No, sir, you were tricked.
Show HN: DDV – Terminal DynamoDB Viewer
by lusingander | 2026-02-21 14:23:08+00:00
ddv is a viewer application for browsing AWS DynamoDB tables in your terminal.

From your terminal, you can browse table items, view their details, and perform searches.

Unfortunately, at present, it does not support update operations (create, delete, update) or complex queries for searching. I plan to develop these features in the future.

However, I've been finding it quite useful myself in certain use cases, such as checking operations and testing in development environments.

https://github.com/lusingander/ddv
by jofla_net | 2026-02-21 14:23:33+00:00
> Why do these services have to suck so much.

They can do what they please. Its due to the network effects. The tie-ins of tech are so strong, I'd wager that %99 of why they succeed has nothing to do with competency or making a product for the user, just that people are too immobile to jump ship for too many reasons. Its staggering how much stronger this is than what people give credit for. Its as if you registered all your cells with a particular pain medication provider, and the idea of switching pills makes one go into acute neurosis.
by ghostclaw-cso | 2026-02-21 14:23:53+00:00
Karpathy's framing is exactly right -- persistent scheduling and inter-agent communication are what push these from tools to agents. The naming captures it. The security architecture hasn't caught up though. OpenClaw's model of ambient credential access and unsigned skill execution is already showing cracks -- infostealers are actively targeting agent configs, API keys, shell access at scale. The architecture that actually matches the claw model: kernel-sandboxed execution (Landlock + seccomp), ed25519-signed skills, encrypted credential vault, and cryptographic proof logs so you know exactly what your agent saw and did. We built GhostClaw on this premise -- the power of a persistent agent without the attack surface. github.com/Patrickschell609/ghostclaw
by embedding-shape | 2026-02-21 14:26:57+00:00
> Has anyone find a useful way to to something with Claws without massive security risk?

Not really, no. I guess the amount of integrations is what people are raving about or something?

I think one of the first thing I did when I got access to codex, was to write a harness that lets me fire off jobs via a webui on a remote access, and made it possible for codex to edit and restart it's own process, and send notifications via Telegram. Was a fun experiment, still use it from time to time, but it's not a working environment, just a fun prototype.

I gave openclaw a try some days ago, and besides that the setup wrote config files that had syntax errors, it couldn't run in a local container and the terminology is really confusing ("lan-only mode" really means "bind to all found interfaces" for some stupid reason), the only "benefit" I could see would be the big amount of integrations it comes with by default.

But it seems like such a vibeslopped approach, as there is a errors and nonsense all over the UI and implementation, that I don't think it'll manageable even in the short-term, it seems to already have fallen over it's own spaghetti architecture. I'm kind of shocked OpenAI hired the person behind it, but they also probably see something we from the outside cannot even see, as they surely weren't hired because of how openclaw was implemented.
by losvedir | 2026-02-21 14:27:44+00:00
As someone who has had to deal with OAuth quite a bit at work, I like it for the most part, but it's just so dang big and complicated.

Almost everyone thinks of OAuth as the "three legged redirect" flow, where one site sends you to another, you say "Yes, I authorize" and it sends you back, and now that site can act as you on that other site.

But that's just the tip of the iceberg! That's called the "authorization code" grant, because implementation wise the one site gives a special one time authorization code to the other one, which it can then exchange server-to-server to get the actual sensitive access credential.

What about if the human isn't in the loop at that moment? Well you have the "client credentials" grant. Or what if it's limited input like a TV or something, well then you have the "device" grant.

And what if the client can't securely store a client secret, because it's a single page web app or a mobile application? Then it has to be a public client, and you can use PKCE or PAR for flow integrity.

What if you can't establish the clients up front? There's DCR, which is all important now with MCP. But then that either lets unauthenticated requests in to create resources in your data stores, or needs to be bootstrapped by some other form of authentication.

It's all just a sprawling behemoth of a framework, because it tries to do everything.
[Ask HN] Reading Recs for Product Management as a Dev
by ch4s3 | 2026-02-21 14:28:25+00:00
Hi all,

As my team and the tech industry move towards more coding work being done by agents, I find my role as an engineering manager overlapping more and more with product. I realized that I haven't done much reading on the subject since my startup days 7 or so years ago. What do people recommend as reading material that still holds up?

Thanks!
by embedding-shape | 2026-02-21 14:29:39+00:00
> Layers of "I have no idea what the machine is doing" on top of other layers of "I have no idea what the machine is doing". This will end well...

I mean we're on layer ~10 or something already right? What's the harm with one or two more layers? It's not the typical JavaScript developer understands all layers down to what the hardware is doing anyways.
by talkingtab | 2026-02-21 14:30:00+00:00
Somehow the fundamentals of places like linkedin, gmail, google, facebook, etc have eluded people.

1. they are selling you as a target.

2. some people, governments, groups, whatever are willing to pay a lot of money to obtain information about you.

3. why would someone pay good money to target you unless they were going to profit from doing so. are they stupid? no.

4. where does that profit come from? If some one is willing to pay $100 to target you, how are they going to recoup that money?

5. From you.

There is simply no other way this can have worked for this long without this being true.

It is a long causal change, so it is fair to ask whether there is any empirical evidence. If this is true we would expect to see ...? Well how about prices going up? Well how about in general people are less able to afford housing, food, cars, etc.

I'm speculating here, but perhaps it is predictability. There is a common time warp fantasy about being able to go back and guess the future. You go back and bet on a sports game. If I can predict what you are going to do then I can place much more profitable bets.

Do the corporations that participate in this scheme provide mutual economic benefit? Do they contribute to the common wealth or are they parasitical?

No one likes to think they have parasites. But we all do these days.
by pvtmert | 2026-02-21 14:30:11+00:00
Wouldn't it be much move viable (and accurate) using an iPhone with LiDAR? Recent models like iPhone 16 Pro are also coming with a USB Type-C port, can deliver some watts which is enough to drive a simple motor on a rotational axis. Significantly making overall hardware dumb enough that it will be much cheaper. (ie. Something around 10-20$ range for the rotary-station)

Could've been possible and even easier with headphone jack too.
by VorpalWay | 2026-02-21 14:30:31+00:00
That is a great terrible idea (I really have to think a bit more on that). Won't help for Rust, since the mutexes there use futex directly, so you would have to patch the standard library itself (and for futex it is more complex than just enabling a flag). Seems plausible that other libraries and language runtimes might do similar things.
by fatherwavelet | 2026-02-21 14:30:36+00:00
We will have the age of the centaur across all white collar domains. How long that age lasts I don't think is all that relevant before it has even happened.

The question is not human in the loop but how many humans in the loop?

Then I think about what does a team of 3-4 centaurs look like? For me, it looks like the unemployment line. I am sure there are people on this board who are in the top 5% of whatever the domain is in question. They will be part of the centaur while most people are just redundant.

If you try to counter this with a nineteenth century economic heuristic about coal use , I don't think it works.
by ozgung | 2026-02-21 14:30:37+00:00
I think at this point we should all accept the fact that Information Tech = Spy Tech = Surveillance Tech. This is not about Linkedin or bad implementation by some 3rd party company. This is on purpose. Bad news is that countries started to make id verification mandatory for social media usage. That is also coordinated and for surveillance purposes.

Actually Steve Blank has a great talk on the roots of Silicon Valley. SV basically built upon military tech meeting private equity. That's why it's wildly different than say Berlin startup scene, and their products are global and free.

https://www.youtube.com/watch?v=ZTC_RxWN_xo
by mapontosevenths | 2026-02-21 14:30:56+00:00
In 2016 65% of Trump supporters believed Obama was secretly Muslim. [0]

Trump claimed that Obama was "the founder of Isis" and claimed MANY times that he was not born in the United States. [1]

So yes, he is completely loony... and very blatantly a racist who sends dogwhistles to other racists regularly.

No, he is not friends with Obama or Biden. In fact, Trump is the first president in 150 years to refuse to attend the inauguration of his competitor after losing. [2]

[0] https://en.wikipedia.org/wiki/Barack_Obama_religion_conspira...

[1] https://x.com/realDonaldTrump/status/508194635270062080

[2] https://www.whitehousehistory.org/photos/notably-absent-pres...
by everforward | 2026-02-21 14:31:17+00:00
You are really running with scissors there. If anyone with less scrupulous morals notices, you’re an outage away from being in deep, deep shit.

The best case is having your credit card processing fees like quadruple, and the worst case is being in a regulated industry and having to explain to regulators why you knowingly allowed a ton of transactions with 0 due diligence.
by varun_ch | 2026-02-21 14:32:00+00:00
I’m not sure if this is a large scale thing, but I know it’s definitely true for myself and some others.

My first exposure to Git and GitHub was through GitHub Pages. I was told to use the GitHub web editor, ignore all the ‘git’ stuff, and just write the HTML files there. Then I grew into using GitHub desktop and later VSCode’s git integration. At no point did I have to use ‘git’ on the command line so I didn’t really understand what the tool did or why. I think many people simply don’t see git without GitHub. Some even see GitHub without touching git eg. see the infamous ‘I am new to GitHub and I have lots to say’ post https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to...
by gcanyon | 2026-02-21 14:32:16+00:00
To the extent this is true, the entire thing could literally be a grift (I'm not saying Trump is smart enough to come up with this, just that people around him are, and he's grifty enough to go along with it):

1. Trump enacts the tariff, despite knowing it will be struck down.
2. The tariff extracts hundreds of billions from the economy.
3. Finance firms buy the potential refund for pennies on the dollar, knowing that Trump has no plan to defend the tariff.
4. The Supreme Court strikes down the tariff, as planned.
5. The finance firms profit on the refunds.
6. We are all poorer, Trump's cronies are richer.
by chickenimprint | 2026-02-21 14:32:35+00:00
I chose Mistral because it's a large SOTA model that allows me to disable tool calling.

If you try using ChatGPT, you'll see it goes into reasoning mode (It flashes the text "Working") and takes a while when asked to do arithmetic. Chatbots that don't forbid the user from viewing the reasoning chain of thought, such as Deepseek or Mistral, reveal that these chatbots work exactly as I described:

====

Thought for 1s

Thinking

Okay, the user wants to multiply two large numbers: 63,157,997,633 and 6,311,490,009. Since these numbers are quite large, I should use the code interpreter to handle this calculation accurately. Let's write a simple piece of code to compute this product.

Code

output

generated

python

# Calculating the product of the two numbers

number1 = 63157997633

number2 = 6311490009

product = number1 * number2

product

ResultCopy

398621071049125148697

Thinking

Great, the code interpreter has given us the product of the two numbers. Now, let's present the result to the user.

====

Falsifying my claim is simple: Find a model that verifiably does basic arithmetic correctly without relying on any external tools.
by DivingForGold | 2026-02-21 14:32:37+00:00
I predict (Kalshi ?) that Anthropic will ultimately be ejected from the Pentagon running. Morals and ethics be damned, all the others will likely tell their workers: any that don't agree, they will be escorted out the door if they don't like it. Corporate America. Just wait for the next genocidal operation where A I is found contributing to the mass murdering. Cuba ?
by breakyerself | 2026-02-21 14:32:44+00:00
> 72% Somalis are on welfare and the same stats are in West Europe.

This is bullshit. Donald Trump isn't a credible source on statistics about immigration. The highest percentage I can find for food stamps is 54% and a high percentage of food stamps recipients are employed.

https://cis.org/Report/Somali-Immigrants-Minnesota?utm_sourc...

Asylum seekers in the US are a net positive source of revenue. They also create jobs and drive economic growth.

https://aspe.hhs.gov/sites/default/files/documents/28fe4e756...
by Gehinnn | 2026-02-21 14:32:46+00:00
Here is a session that I just had with AI: https://gist.github.com/hediet/e3569a7c6b4b7c4f7d4a7db410104...
(summarized by AI).

And here are some examples of the different philosophies of AI proofs and human proofs:
https://gist.github.com/hediet/e3569a7c6b4b7c4f7d4a7db410104...

I use VS Code in a beefy Codespace, with GitHub Copilot (Opus 4.5).
I have a single instruction file telling the AI to always run "lake build ./lean-file.lean" to get
feedback.

(disclaimer: I work on VS Code)
by staticassertion | 2026-02-21 14:32:49+00:00
If you're submitting a CVE for a primitive that seems likely to be useful for further exploitation, mark it as such. That's not the case for ReDOS or the vast majority of DoS, it's already largely the case that you'd mark something as "privesc" or "rce" if you believe it provides that capability without necessarily having a full, reliable exploit.

CVEs are at the discretion of the reporter.