MurphyA/hacker-news huggingface dataset:
by jmyeet | 2026-02-19 12:28:57+00:00
I honestly had no idea about the French fascination with the Mongols. People tend to admire people who have traits they aspire to. I wonder if this stems from France, being a major imperial power at the time, admiring the Mongols as an imperial power.

This timeline coincides with the Crusades with, which the article talks about at length. I find the Crusades fascinating because they've shaped the modern world in so many ways.

Dan Carlin (of Hardcore History fame) once said that why he cares about military history is it shapes the world. If you look at the lightbulb, it doesn't really matter who invented it. Somebody would've. But take the Battle of Marathon, which shaped the entire history of Western Europe as the Greeks repelled the Persians. History would've been completely different. Or how Cyrus II (IIRC) essentially saved Judaism by rebuilding the Temple. Without that, Judaism may well have died out and, with it, all the Abrahamic religions may never have existed.

So the Crusades are fascinating because they've often portrayed as a religious war but they were anything but. Religion was simply the excuse. Instead medieval powers wanted to control the Levant to enrich themselves.

The Crusades essentially created international banking, making the Knights Templar incredibly wealthy [1]. One wonders if this was a necessary condition to the rise of the mercantile class that eventually displaced feudalism and brought on capitalism.

But back to the French. It's interesting that they were fascinated with the Mongols with everything else that was going on. During this same period, the Eastern Roman Empire still existed and the Moors occupied the Iberian peninsula. In many ways, the Mongols were more distant whereas the Arab "threat" was closer and more real. So why the Mongols?

[1]: https://bigthink.com/the-past/knights-templar-crusades-finan...
by staticassertion | 2026-02-19 12:29:50+00:00
> Chromium is filled with sloppy and old code. Some of the source code (at least if dependencies are included) is more than 20 years old, and a lot of focus has been on performance, not security.

Chromium is also some of the most highly invested in software with regards to security. Literally entire technologies that we now take for granted (seccomp-ebpf comes to mind) exist to make Chrome safe. Sanitizers were a Google project that Chromium was an aggressive adopter and contributor towards. I could go on.

> Using Rust does not necessarily solve this. First, performance-sensitive code can require 'unsafe', and unsafe allows for memory unsafety, thus going back to square one, or further back.

This isn't really true? I have no idea what "further back" means here. The answer seems to just be "no". Unsafe does allow for memory unsafety but it's hilarious to me when people bring this up tbh. You can literally `grep unsafe` and ensure that your code in that area is safe using all sorts of otherwise insanely expensive means. Fuzz that code, ensure coverage of that code, run `miri`, which is like a sanitizer on steroids, or literally formally verify it. It's ridiculous to compare this to C++ where you have no "grep for the place to start" capability. You go from having to think of 10s of millions of lines of code that holds a state space vastly greater than the number of particles of this universe 100000000x over, to a tiny block.

With the level of investment that Google puts into things like fuzzing, Rust would have absolutely made this bug harder to ship.

> And second, memory safety isn't the only source of vulnerabilities.

It's the source of this one and every ITW Chromium exploit that I can recall off of the top of my head.
by frm88 | 2026-02-19 12:30:13+00:00
The budget for USAID in 2024 was $25.6 billion [0]. $ 9.5 billion were allocated to health programs and $ 1.1 billion to agriculture, education and infrastructure [1]. You can do the math.

[0] https://factually.co/fact-checks/politics/usaid-budget-2024-...

[1] https://factually.co/fact-checks/health/usaid-2024-food-medi...
by somenameforme | 2026-02-19 12:31:04+00:00
Why do you think it would be the case about e.g. swapping to thick carpet would throw things off? Intuitively it seems like they must have a tremendous amount of dynamic adjustment going on. For instance think of how much variance, driven by dynamics, that there's going to be in the scene at 2:48 [1] where the robot [intentionally] falls over and then aerobically picks itself back up.

The motion is certainly scripted, but the exact mechanics in play there almost certainly vary radically from take to take. Imagine something simple like a pool/billiards break. Even if you set up a machine to rack the balls and break them in as close to identical as possible, you'd get wildly different results each time. And the dynamics in this motion is going to dwarf that.

[1] - https://youtu.be/mUmlv814aJo?t=168
by dspillett | 2026-02-19 12:31:20+00:00
> But notice the pattern: SQLite’s wins are on simple, single-row operations where both databases are already sub-millisecond. Stoolap’s wins are on the analytical and complex queries where the difference is 10x to 100x+.

So for a great many workloads, particularly multi-user, SQLite will be faster overall, as most application workloads will have many simple single/few row lookup operations per single/few row update operations, and an order of magnitude less complex analytical queries.

But this should be much faster for genuine analytical operations, and better suited to them due to support for things like temporal storage and queries.

Basically the age-old distinction between optimising for OLTP or OLAP operations.
by amelius | 2026-02-19 12:31:21+00:00
Is the material description part of the language the same as in PBRT?

I'm asking because I had a lot of trouble trying to describe interfaces between materials, only to find out that what I wanted to do was not possible in PBRT without modifying the code. Apparently, in PBRT a material can only have one other material touching it. So, for example rendering a glass filled with water and ice is not possible without hacks. From a user's point of view this is a bit of a let-down, of course.

Context: https://news.ycombinator.com/item?id=45668543
by cranberryturkey | 2026-02-19 12:31:24+00:00
Nice project. The SQLite-on-cloud-drive approach mentioned in another comment is actually pretty solid — if the encryption is done client-side before the file hits the cloud, it doesn't matter where it's stored. The key thing is making sure the key derivation is robust enough that a compromised cloud account doesn't compromise journal contents.

One thing I'd push back on regarding the "what if you stop maintaining it" concern: SQLite with AES-256-GCM is about as future-proof as you can get. Both are standards with multiple implementations. The real risk isn't the format dying — it's losing the password. A recovery key export (even just a paper backup of the key material) would go a long way.

For the cross-device case, you might also consider something like Syncthing for sync without any cloud intermediary. Keeps the threat model simpler.
by i_am_a_peasant | 2026-02-19 12:32:03+00:00
same. i thought it would have been as quick to pick up as rust. nowhere near. i spent weeks trying to go through every feature of the language at least once. time in which i could’ve read several rust books and already start hacking up some interesting projects. so much in swift is pointless syntax sugar. why do i need 50 ways to do exactly the same thing, it’s just nonsense. then i have to look up the language reference whenever i read a new codebase
Show HN: Open-source security scanner for MCP (Model Context Protocol) servers
by neuralweaves | 2026-02-19 12:32:17+00:00
MCP servers let AI assistants (Claude, Copilot, Cursor) interact with databases, APIs, and filesystems. I've been reviewing a lot of these — both open-source and internal — and keep finding the same issues: hardcoded API keys, eval() on user input, SQL injection via string concatenation, wildcard permissions, disabled TLS.

So I built a static analysis scanner specifically for MCP servers. It runs 7 analyzers (secrets, static code, prompt injection, SQL/command injection, permissions, network, dependencies) and takes ~45ms on a typical server.

Usage:

npx mcp-security-auditor scan ./my-mcp-server

No account, runs locally. Outputs text, JSON, SARIF (for GitHub Security tab), HTML, or Markdown. Has a CI mode that exits non-zero above a severity threshold.

Available on both npm and PyPI. MIT licensed.

npm: https://www.npmjs.com/package/mcp-security-auditor
PyPI: https://pypi.org/project/mcp-security-auditor/
Dev.to writeup with examples: https://dev.to/prabhu_raja_fe2261464cb8e/how-to-scan-your-mc...

Would love feedback on detection patterns — there are definitely gaps I haven't covered yet.
by orwin | 2026-02-19 12:33:34+00:00
But are you gaining a meaningful amount of time, and are your coworkers that thorough.

Honestly I just don't read documentation three of my coworkers put on anymore (33% of my team). I already spend way to much time fixing the small coding issues I find in their PRs to also read their tests and doc. It's not their fault, some of them are pretty new, the other always took time to understand stuff and their children de output always was below average in quality in general (their people/soft skills are great, and they have other qualities that balance the team).
by cardanome | 2026-02-19 12:33:44+00:00
I don't think saving a few keyboard strokes is a worthwhile design goal for most languages. You have to keep the types in your head anyway so it just increases the mental burden when reading the code.

At least with dynamic typing you might be in a flow state and care more about the shape of data than the types so it might be valid. But in static type land, not so sure.

But yeah as I said, definitely infer trivial things like variable types based on initializing. I am more against inferring parameter and return types and the like. The auto keyword is super useful but also can be abused when overused.
by throwaway2037 | 2026-02-19 12:34:10+00:00
Wow, that is a great catch. I looked at the Kaggle page. It has been up for two years. From the hamburger menu (top right), I tried: Report Dataset. When I click the button "Report illegal content", I am redirected to a Google page (huh?): https://support.google.com/legal/troubleshooter/1114905?prod...

When I try to fill the questionaire, my request is rejected with this message:

We understand that you are not legally authorized to file a copyright complaint on behalf of the copyright owner.

In accordance with applicable copyright laws, we only accept copyright complaints from copyright owners or their authorized representatives. If you have legal questions about copyright law, please consult your own legal counsel.

We are sorry we cannot assist you further.

Hysterical. What a farce. That data set is pure theft.
by joseda-hg | 2026-02-19 12:35:05+00:00
It (CC) does have a /models command, you can still decide to route everything to Opus if you just want to burn tokens
I guess it's not default so most wouldn't, but still, people willing to go to a third party client are more likely that kind of power user anyway

They still have the total consumption under their control (*bar prompt caching and other specific optimizations) where in the past they even had different quotas per model, it shouldn't cost them more money, just be a worse/different service I guess
by cedws | 2026-02-19 12:35:50+00:00
My pet theory is that consciously or unconsciously, democracies are being forced into identifying individuals behind speech online and controlling certain ideas. The status quo is a vulnerability, it makes it too easy for adversaries to manipulate public opinion and sway elections. China and Russia have no such vulnerability. No doubt social media for children is a bad thing, but this is just a convenient excuse to make you hand over your ID.
by networked | 2026-02-19 12:38:10+00:00
51% doesn't tell you much by itself. Benchmarks like this are usually not graded on a curve and aren't calibrated so that 100% is the performance level of a qualified human. You could design a superhuman benchmark where 10% was the human level of performance.

Looking at https://www.tbench.ai/leaderboard/terminal-bench/2.0, I see that the current best score is 75%, meaning 51% is ⅔ SOTA.
by wartywhoa23 | 2026-02-19 12:38:43+00:00
Sure thing, the data grab stage is complete, models are trained, the bulk of the global data is in the pocket and whatever new arrives can be spoon-fed to them without the need to fund all this huge "free" data funneling infrastructure, and however much money was thrown into that must be recouped.

"Free internet" was but a business strategy, both as in beer and in freedom.
by TheFlya7c | 2026-02-19 12:40:10+00:00
I think there are two different concerns mixed together:

1) Can I still read my data in 10 years? That’s mostly about open, well-documented formats + an export path. A journaling app can still be “safe” here if it can export to Markdown/plain-text (or at least JSON) and the on-disk schema is documented.

2) Can I decrypt it in 10 years? That’s about using boring primitives (AES-GCM, Argon2/scrypt/PBKDF2) and keeping the crypto layer simple. If it’s standard crypto, you’re not locked to one vendor the way you might be with a bespoke format.

The “plain files in an encrypted folder” approach (Cryptomator/VeraCrypt) is totally reasonable—and arguably the simplest threat model—but you do give up a lot of what makes a journal app nice (full-text search, tags, structured metadata, conflict handling, etc.). SQLite + client-side encryption is a fine compromise if there’s a solid export and the KDF/password story is strong.

The biggest real risk is still: losing the password. A printable recovery key / key export would help more than switching formats.
by cpursley | 2026-02-19 12:40:14+00:00
Very nice, Oban is great. I effectually found a similar approach with pgflow.dev (built around pgmq) - but the stateless deno "workers" are pretty unreliable and built an elixir worker (https://github.com/agoodway/pgflow) that can pick up and process jobs that were created by pgflow's supabase/typescript client. I wonder if another approach vs the python workers picking things up is to have elixir workers call/run python/lua, etc code or is that too limiting?
by kristopolous | 2026-02-19 12:40:46+00:00
it's a 3b model. Fire it up. If you have ollama just do this:

ollama create nanbeige-custom -f <(curl day50.dev/Nanbeige4.1-params.Modelfile)

That has the hyperparameters already in there. Then you can try it out

It's taking up like 2GB ram on my mac mini

my test query is always "compare rust and go with code samples". I'm telling you, the thinking token count is ... high...
by alabhyajindal | 2026-02-19 12:41:09+00:00
Here's another approach using Rclone and an editor of your choice. Rclone has a built in crypt library that can encrypt your data and store it in a cloud provider. I use it along with Sublime Text to journal, and store my encrypted data on Dropbox.

More here: https://alabhya.me/rclone
by crossroadsguy | 2026-02-19 12:41:30+00:00
Let alone the cloud, SQLite in iCloud Drive is the reason I am not using Bear notes app. After losing to convoluted file formats a couple of times I do not consider any journal or notes app that doesn’t let me see/edit plain text files on the disk. I will deal with encryption, storage, etc on my own. Those are too personal files to be either locked or go behind any amount of friction. I still have tons of files locked from Dyrii that was abandoned
by pro-vi | 2026-02-19 12:41:51+00:00
I pondered deeply about what self-reflection means in an agentic loop like Claude Code and a framework eventually came out of it which I named cc-reflection.

Reflection is about meta observations, going above a dimension. Confucius reflects thrice daily (吾日三省吾身). Each day is like a single human session. Agentic reflection maps similarly, and the deeper the session, the more material to reflect upon.

In this blog post I dived into the design of the framework.
by SolubleSnake | 2026-02-19 12:42:01+00:00
I think a lot are feeling a bit like this...Also pile in all the web frameworks etc...on top of 'crypto' then 'AI'...then who knows what...

There'll be another overhyped buzzword in a few years and we will all be expected to get excited about it and I just can't anymore. Realistically the actual business value of software has barely changed in about 20 years except for niche things in finance and R&D engineering (and I know because i've worked in R&D engineering with embedded guys).

I am just not interested in learning to deploy largely pointless AI chatbots or learn yet another web framework to make largely the same ERP or PLM etc related stuff I've done before in the 'framework d'hier'
by adrian_b | 2026-02-19 12:42:08+00:00
The cases that are not close to a multiple are handled by the rejection of a part of the generated random numbers.

Let's say that you have a uniform random number generator, which generates with equal probability anyone of N numbers. Then you want to choose with equal probability one of M choices.

If M divides N, then you can choose 1 of M by either multiplication with taking the integer part, or by division with taking the remainder.

When M does not divide N, for unbiased choices you must reject a part of the generated numbers, either rejecting them before the arithmetic operation (equivalent to diminishing N to a multiple of M), or rejecting them after the arithmetic operation (diminishing the maximum value of the integer part of product or of the division remainder, to match M).

This is enough for handling the case when M < N.

When M is greater than N, you can use a power of N that is greater than M (i.e. you use a tuple of numbers for making the choice), and you do the same as before.

However in this case you must trust your RNG that its output sequence is not auto-correlated.

If possible, using from the start a bigger N is preferable, but even when that is impossible, in most cases the unreachable parts of the space of random number tuples will not make any statistical difference.

To be more certain of this, you may want to repeat the experiment with several of the generators with the largest N available, taking care that they really have different structures, so that it can be expected that whichever is the inaccessible tuple space, it is not the same.
by squeefers | 2026-02-19 12:42:16+00:00
> I don’t know why God doesn’t make His existence more obvious to those that don’t seek Him

i didnt ask that and you know it. why doesnt he do headline magic tricks like feeding the five thousand or sending beasts down from heaven or raising zombie jesus from the dead? is it because those stories arent true?

> Like I quoted above, his ways are above our ways.

youre religion does calim to know however... how do they claim to such privileged knowledge? what do they know that we dont?
by Brajeshwar | 2026-02-19 12:42:41+00:00
For some reason, the website is down for me. I have always been fascinated by the Mongols after reading “Genghis Khan and the Making of the Modern World” by Jack Weatherford.

Recently, I stumbled upon the 6:40+ hour YouTube video, “The Mongols - Terror of the Steppe.” You might like it https://www.youtube.com/watch?v=PdFwMDuAnS4
by saberience | 2026-02-19 12:43:06+00:00
One major problem, I don't want a journal with unbreakable encryption where I lose all my data if I ever lose the key.

I already pay for a journaling website where I know I can always recover my journals as long as I have access to my Gmail.

So, while I appreciate this security first mindset, for me it actually becomes less interesting. I want my journal to sync to the cloud, I want to be able to unlock it, I don't want to risk losing years of journals if I forget a single key.
by brookst | 2026-02-19 12:43:44+00:00
Is there any service in the world that gives you complete freedom on how you consume it? I can’t think of one.

Netflix: limits number of devices and stream quality and offline use.

AWS: does not allow any number of applications (spamming, crypto mining, adult content)

Airlines: do not allow smoking, boom boxes

Is there any service that gives complete freedom?
by matsemann | 2026-02-19 12:43:46+00:00
You're wrong. They even explicitly call out that it's not about weight. Everyone has different proportions.

> Once I compared my personalized sloper to commercial patterns and retail garments, I had a revelation: clothes were never made to fit bodies like mine. It didn’t matter how much weight I gained or lost, whether I contorted my body or tried to buy my way into styles that “flatter” my silhouette, there was no chance that clothes would ever fit perfectly on their own. Finally I understood why.

Later they show how J.Crew has a certain ration between hip/waist for all sizes. Even if you had the same sized waist, chances are you wouldn't have the same sized hips as they expect. Most bodies just aren't that shape.
by bombcar | 2026-02-19 12:43:56+00:00
They wanted everything on bedrock but they can’t do it, and losing the Java modding ecosystem would literally kill the game, which remains popular because of all the YouTube content, 90% of which is Java (even unmodded).

Much of the cashflow is from kids watching a YouTuber doing something in Java Minecraft and attempting it themselves in bedrock, which is why feature parity is the only thing they’re really working on anymore.
by K0balt | 2026-02-19 12:44:00+00:00
I can’t speak for others, but as the op of that quoted segment, I say it as a person who has lost their job several times in my life. The first time was traumatic because my expectations were of stability. Never again. Really, it was the best thing that could have happened to me because it taught me the proper way to think about employment. At this point I can’t imagine putting that level of control of my life in anyone else’s hands.
by sarchertech | 2026-02-19 12:44:11+00:00
Yeah I’d definitely take that knife thing with a grain of salt. I have most of a history degree, took a lot of Econ classes (before later going back for CS), and it’s a topic I’m very interested in and I’ve never heard that (and some digging didn’t find anything).

It’s also false that the technology has changed very little.

The jumps from bronze to iron to steel to modern steel and sometimes to stainless steel all result in vastly different products. Not to mention the advances in composite materials for handles.

Then you need to look at substitute goods and the what people actually used knives for.

A huge amount of the demand for knives evaporated thanks to societal changes and substitute goods like forks. A few hundred years ago the average person had a knife that was their primary eating utensil, a survival tool, and a self defense weapon. Knives like that exist today but they’re not something every household has or needs.

This is a good example of why learning from ChatGPT is dangerous. This is a story that sounds very plausible at first glance, but doesn’t make sense once you dig in.