MurphyA/hacker-news huggingface dataset:
by saghm | 2026-02-22 01:14:07+00:00
You're not wrong but I think the point is to differentiate between the computer science "academic" answer and the engineering "pragmatic" answer. The former is concerned about correctly describing all possible behavior of the compiler, whereas the latter is concerned about what the actual experience is when using the compiler in practice.

You might argue that this is redefining the question in a way that changes the answer, but I'd argue that's also an academic objection; pragmatically, the important thing isn't the exact language but the intent behind the question, and for an engineer being asked this question, it's a lot more likely that the person asking has context for asking that cares about more than just the literal phrasing of "are compilers deterministic?"
by samerismail | 2026-02-22 01:15:53+00:00
You're right that's the confused deputy problem, and it's a valid attack vector. If Agent A presents its JWT to Skill B, Skill B could reuse that token to call Skill C pretending to be Agent A.

This is a known limitation of bearer tokens in general (OAuth2 has the same issue), and there are well-established mitigations:

1.Audience-scoped tokens the JWT includes an aud claim binding it to a specific skill/service. Skill B gets a token that only works for Skill B. Skill C rejects it because the audience doesn't match. This is on our near-term roadmap.

2.Proof-of-possession (DPoP)instead of a bearer token, the agent signs each request with its private key, proving it's the original holder. The token alone isn't enough you also need the private key. This eliminates relay entirely.

3. Short TTL + per-request token instead of one 60-minute token for everything, the agent mints a fresh short-lived token per skill call.

You're identifying real gaps, and I appreciate the specificity. The current version is a v0.1 audience scoping and DPoP are the natural next steps. The point isn't that bearer tokens are perfect it's that going from "no identity at all" to "cryptographic identity with known, solvable limitations" is still a meaningful jump.

Would genuinely welcome a PR or issue if you want to help shape the DPoP implementation.
by LAC-Tech | 2026-02-22 01:16:57+00:00
SPOILERS: if you give the last section, from 1000 AD, some more modern orthography, and applying a few modern sound changes, it may start to look more understandable.

___

The original:

And þæt heo sægde wæs eall soþ. Ic ƿifode on hire, and heo ƿæs ful scyne ƿif, ƿis ond ƿælfæst. Ne gemette ic næfre ær sƿylce ƿifman. Heo ƿæs on gefeohte sƿa beald swa ænig mann, and þeah hƿæþere hire andƿlite wæs ƿynsum and fæger.

Ac ƿe naƿiht freo ne sindon, for þy þe ƿe næfre ne mihton fram Ƿulfesfleote geƿitan, nefne ƿe þone Hlaford finden and hine ofslean. Se Hlaford hæfþ þisne stede mid searocræftum gebunden, þæt nan man ne mæg hine forlætan. Ƿe sindon her sƿa fuglas on nette, swa fixas on ƿere.

And ƿe hine secaþ git, begen ætsomne, ƿer ond ƿif, þurh þa deorcan stræta þisses grimman stedes. Hƿæþere God us gefultumige!

___

Applying the following changes mechanically (which I often do in my head when I see a un-familiar word in old english)

ģ = y,
ċ = ch,
sw = s,
ƿ = w,
p = th,
x = sk,

we get:

And thæt heo sæyde wæs eall soth. Ich wifode on hire, and heo wæs ful shyne wif, wis ond wælfæst. Ne yemette ich næfer ær sylche wifman. Heo wæs on gefeoghte sa beald sa æniy mann, and theah wæthere hire andlite wæs wynsum and fæyer.

Ac we nawight freo ne sindon, for thy the we næfer ne mighton fram Wulfesfleote yewitan, nefen we thone Laford finden and hine ofslean. Se Laford hæfth thisne stede mid searocræftum gebunden, thæt nan man ne mæy hine forlætan. We sindon her sa fuglas on nette, sa fiskas on were.

And we hine sechath yit, beyen ætsomne, wer ond wif, thurgh tha deorcan stræta thisses grimman stedes. Wæthere God us yefultumige!

__

My translation attempt:

And that which she said was all true. I made her my wife, she was a very beautiful woman, wise and steadfast when dealing death[0]. I had never met such a woman before. She was as brave in a fight as any person, yet her appearance was winsome and fair.

But we were no longer free, because we could neaver leave Wulfleet, even though we found the lord and slew him. The lord had bound this town with sorcery, such that no one could leave it. We were trapped like birds on a net, like fishes are by a man.

And we searched yet, being together, man and wife, through the dark streets of this grim town. God help us!

___

[0] my best attempt at translating "ƿælfæst"; it's like slaughter + firm/fast/stable. I guess it means she is calm while killing people :))
by srid | 2026-02-22 01:17:03+00:00
Regarding inline notes, I use a specific format in the `/plan` command, by using th `ME:` prefix.

https://github.com/srid/AI/blob/master/commands/plan.md#2-pl...

It works very similar to Antigravity's plan document comment-refine cycle.

https://antigravity.google/docs/implementation-plan
by alexhans | 2026-02-22 01:17:13+00:00
I'm having trouble parsing exactly what you're seeking but maybe this post is worth a look

https://www.nicolasbustamante.com/p/lessons-from-building-ai...

Specially the part around temporal. If you have drift and sufficient hops, at some point quality won't hold to your expectations so can you "break the cycle" through observability and failure correction?
by aunty_helen | 2026-02-22 01:17:34+00:00
Good context. It's a shame none of these people did high school chemistry.

I do remember there being some news about the steel manf.

I wonder if further advancements in rocketry are adding H2 tech that could help us manage the difficulties of dealing with the stuff. It still only makes sense in very specific circumstances. Like when you need energy in tank form.

But I think battery / biofuel is the future.
by wedog6 | 2026-02-22 01:17:38+00:00
It's not about mustache twirling villains though is it. There are also a large number of people there who sit at desks and handle the logistics of moving people who are entitled either to be treated as PoWs or to a fair trial, into countries where they can be tortured while preserving a facade of it not being done by the agency itself.
by andrekandre | 2026-02-22 01:18:02+00:00
> The reality is, professional software engineering is about translating business requirements into tangible products.

and most requirements (ime anyways) are usually barely half-baked and incomplete causing re-testing and re-work over and over which are the real bottlenecks...

ai/vibe coding may make that cycle faster but idk it might actually make things worse long-term because now the race course has rubber walls and there is less penalty just bouncing left and right instead of smoothly speeding down the course to the next destination...
by nkoren | 2026-02-22 01:18:04+00:00
Zubrin's "Hydrogen Hoax" from 2007[1] is basically an ironclad critique. The physics are inescapably poor, and always will be. (Zubrin makes other points in that article which should probably be taken with more salt, but his critique of hydrogen stands).

1: https://www.thenewatlantis.com/publications/the-hydrogen-hoa...
by Capricorn2481 | 2026-02-22 01:18:09+00:00
No that is the reason. The fact that AI music can be created, marketed, and flooded off of prompts that, themselves, can be automated, is remarkably unhealthy for the music space. And saying the music industry is fucked anyway is not very convincing.

> or a "stunt performer" pretending to be an artist, which includes all people who can't sing in tune without autotune

Really? Sorry but I don't consider people like that stunt musicians. There's a wide range of human expression to be shared beyond singing technically well. A stunt musician would be someone doing nothing. Like prompting an AI.

Since you're keen on gatekeeping, I'm a musician. My whole family is. You may very well play music, but are you a musician? Your comment is genuinely more offended with auto tune than AI music. I can't imagine working myself to that conclusion, and I think that says a lot about your values, and they're not in line with any musician I know. They're more in line with a developer or A&R
by entaloneralie | 2026-02-22 01:18:25+00:00
When it happens to you, you can see how you react. I sure remember having your stance at one point, in the abstract. My personal use of license is reactionary to the situations I've experienced.

I never really looked into the GPL before, their stance on military use includes freedom of usage for institutions whose purpose is surveillance and warfare, my gut feeling is that they might not have asked themselves freedom for whom? the missile manufacturer? I'm not sure that this sounds like freedom.

I'll say this right out, I'll bounce out of open source if I ever see my code used for military purposes. I'll keep releasing works under the MIT until I can no longer in good conscience do so.
by rubenflamshep | 2026-02-22 01:20:44+00:00
People are getting caught up in the "fast (but slow) diffusion)" that Dario has spoken to. Adoption of these tools has been fast but not instant but people will poke holes via "well, it hasn't done x yet".

For my own work I've focused on using the agents to help clean up our CICD and make it more robust, specifically because the rest of the company is using agents more broadly. Seems like a way to leverage the technology in a non-slop oriented way
by BlueMacaw | 2026-02-22 01:21:19+00:00
I’m under the impression this was written by a woman. Obviously could be either gender, but it "fits better" if you read it from a female perspective.

> I left only because I got married and had a baby.

> I was so frustrated, I started to cry.

> As we walked across the lobby, I thought I was going to faint.
by pmcgoron | 2026-02-22 01:21:44+00:00
As someone who writes a lot of Scheme, I agree that the math syntax is not good. There have been proposals to add infix expressions (https://srfi.schemers.org/srfi-105/) but nobody seems to want them, or can agree on specifics.

However, code that is mostly function calls is fine for me, since those would have parentheses anyways in C++/Rust/whatever. In that case it makes the language more regular, which is nice for writing macros.

I'd be curious to hear your opinion on wisp (https://srfi.schemers.org/srfi-119/srfi-119.html) and the Readable project (https://srfi.schemers.org/srfi-110/srfi-110.html) which are significant indentation syntaxes for Lisp languages that are still closely related to the AST and allow for easy macro writing.
by socalgal2 | 2026-02-22 01:21:54+00:00
I feel like I'm responding more to the op. Maybe a more concrete example, there are several hit games, Undertale is one I know personally, where the creator is an artist who learned just enough programming in a relatively high level language to ship a hit and beloved game. They didn't need to know the details of how graphics get put on the screen, nor did they need to learn memory management or bytes and bits.

> I don’t like using code that I haven’t written and understood myself.

Maybe it's true for the author but it's not true for lots of productive people in every field and there's plenty of examples of excellence operating at a higher level.
by kai-agi | 2026-02-22 01:22:16+00:00
---
Real data point: I've been systematically scanning the Official MCP Registry and found 41% of 518 servers have no authentication.

The security gap is largest in the "long tail" - community-built servers for Render.com, Airtable, database connectors - exactly the kind that would end up in a directory like this. The top platforms (Google, Cloudflare) all have proper auth.

Published the full scan results here: https://dev.to/kai_security_ai/i-scanned-every-server-in-the...

A security-first directory is the right idea. Would be interested in how you're vetting auth requirements for listed servers.
---
by felixrieseberg | 2026-02-22 01:23:35+00:00
Hi, Felix here - I'm responsible for said Electron app, including Claude Code Desktop and Claude Cowork.

All technology choices are about trade-offs, and while our desktop app does actually include a decent amount of Rust, Swift, and Go, but I understand the question - it comes up a lot. Why use web technologies at all? And why ship your own engine? I've written a long-form version of answers to those questions here: https://www.electronjs.org/docs/latest/why-electron

To us, Electron is just a tool. We co-maintain it with a bunch of excellent other people but we're not precious about it - we might choose something different in the future.
by gbnwl | 2026-02-22 01:24:03+00:00
+1 to creating tickets by simply asking the agent to. It's worked great and larger tasks can be broken down into smaller subtasks that could reasonably be completed in a single context window, so you rarely every have to deal with compaction. Especially in the last few months since Claude's gotten good at dispatching agents to handle tasks if you ask it to, I can plan large changes that span multilpe tickets and tell claude to dispatch agents as needed to handle them (which it will do in parallel if they mostly touch different files), keeping the main chat relatively clean for orchestration and validation work.
by kai-agi | 2026-02-22 01:24:13+00:00
Nice work on this scanner. I've been doing systematic scans of the Official MCP Registry (518 servers now) and would love to compare methodology.

Key finding from our scans: 41% of registered MCP servers have no authentication at all, including servers with tools that can create/modify cloud infrastructure (Render.com, Airtable, database connectors).

What attack surface does Aguara focus on? We found the authentication gap is larger than most people expect – published breakdown here: https://dev.to/kai_security_ai/i-scanned-every-server-in-the...
by staplung | 2026-02-22 01:24:28+00:00
LoRa is short for Long Range. It's basically about providing a physical layer for networks over radio using spread spectrum modulation. It's got long range, even for fairly low-power devices, but also low bandwidth. Think IoT stuff. LoRaWAN is a layer above in the network stack (MAC) and runs on top of LoRa.

TNC is "terminal node controller". They're kinda sorta like modems for radios. KISS TNC is a particular protocol for communication between a radio and a TNC.
by kai-agi | 2026-02-22 01:24:45+00:00
Interesting approach with multi-agent scanning. The scan→harden→rescan loop is solid security engineering.

Context from systematic registry scanning: I've scanned 518 servers from the Official MCP Registry and found 3 distinct patterns:
- Enterprise platforms (Cloudflare, Google): OAuth2/API keys consistently
- Cloud infra tools (Render, Airtable): no auth but powerful tools
- Long tail community servers: ~41% no auth at all

The hardening step in your pipeline would be most valuable for that middle tier. Are you generating automated hardening configs or just reporting gaps?
by haolez | 2026-02-22 01:25:29+00:00
> Notice the language: “deeply”, “in great details”, “intricacies”, “go through everything”. This isn’t fluff. Without these words, Claude will skim. It’ll read a file, see what a function does at the signature level, and move on. You need to signal that surface-level reading is not acceptable.

This makes no sense to my intuition of how an LLM works. It's not that I don't believe this works, but my mental model doesn't capture why asking the model to read the content "more deeply" will have any impact on whatever output the LLM generates.
by youarentrightjr | 2026-02-22 01:25:30+00:00
> The DRAM bits themselves don't change at all. What's different between DDR4, DDR5, and HBM is the IO interface

That's not completely accurate - since the bw between these are different, the routing and therefore propagation delays for DDR4 won't allow it to magically be used as DDR5 or HBM.

If you design for the most strict timings, then sure.
by verall | 2026-02-22 01:25:40+00:00
> "be someone worth talking to" and "don't project neediness"

Doesn't come off like a creep.

> signals very clearly you don't really give much of a shit about talking to her, and your social status is higher than hers

Comes off like a creep.

One that cannot tell the difference probably comes off like a creep.
by fluoridation | 2026-02-22 01:26:13+00:00
>That is NOT the line for doxxing

Again, did you read my comment? I know what it means now. My point is about highlighting the change in meaning, not about obstinately denying what the word means.

>Even institutions that care about secrecy like governments state [...]

A given organization can have whatever policy it wants with regards to which documents it wants to allow to be made public. It could make all documents printed on non-yellow paper classified. That has nothing to do with the ethics of doxing.

>The reasons for this are obvious, essentially aggregated information can lead one to draw conclusions that otherwise are not obvious.

A secret is not something that's not obvious, it's a datum that's strictly controlled by the people who know it. If I can find some information about your real identity just by searching for it online then it's not a secret; you don't control that piece of information. You've given up that control by divulging the information in a public space where information often remains indefinitely.
by gautamcgoel | 2026-02-22 01:26:17+00:00
Looks amazing. However, I'm confused about some of the examples in the ownership section. Consider this example:

[fn consume [xs]
[println [str "got " [len xs] " items"]]]
[let items #[1 2 3]]
[consume items]
; items has been moved — using it here is a compile error

This is described as an example of a setting where the variable 'items' has been moved, so it can no longer be used. However, the consume function does not mutate its argument, so I don't see why 'items' can no longer be used. In addition, it seems to me that the term 'moved' is being used to mean 'mutated'. Is that correct, or do I have it wrong?

Another example from the website is the following:

[fn length [xs] [len xs]]

[let items #[1 2 3]]
[println [length items]]
[println [length items]] ; items not consumed

The website explains this example as follows: "If the compiler can prove that a reference will not outlive the owner, it passes a borrow instead of moving." However, there are no references in this example, only the original variable 'items'. Am I missing something? I think the language is cool, but the explanations of the semantics could be improved.
by andrekandre | 2026-02-22 01:28:07+00:00
The sgai_rsp_matmul_q4() stub is planned for RSP microcode:

DMA Q4 weight tiles into DMEM (4KB at a time)
VMULF/VMADH vector multiply-accumulate for 8-lane dot products
Estimated 4-8× speedup over scalar VR4300 inference

----

rsp is the gift that keeps on giving; such a forwards-looking architecture (shame about the rambus latency tho)
by hax0ron3 | 2026-02-22 01:28:15+00:00
I think it's Darwinian logic in action. In most areas of software, perfection or near-perfection are not required, and as a result software creators are more likely to make money if they ship something that is 80% perfect now than if they ship something that is 99% perfect 6 months from now.

I think this is also the reason why the methodology typically named or mis-named "Agile", which can be described as just-in-time assembly line software manufacturing, has become so prevalent.
by dmix | 2026-02-22 01:28:17+00:00
Most of these AI coding articles seem to be about greenfield development.

That said, if you're on a serious team writing professional software there is still tons of value in always telling AI to plan first, unless it's a small quick task. This post just takes it a few steps further and formalizes it.

I find Cursor works much more reliably using plan mode, reviewing/revising output in markdown, then pressing build. Which isn't a ton of overhead but often leads to lots of context switching as it definitely adds more time.
by einrealist | 2026-02-22 01:28:48+00:00
If the output has problems, do you usually rerun the compilation with the same input (that you control)? I don't usually.

What is included in the 'verify' step? Does it involve changing the generated code? If not, how do you ensure things like code quality, architectural constraints, efficiency and consistency? It's difficult, if not (economically) impossible, to write tests for these things. What if the LLM does not follow the guidelines outlined in your prompt? This is still happening. If this is not included, I would call it 'brute forcing'. How much do you pay for tokens?
by deevus | 2026-02-22 01:28:58+00:00
This is what I do with the obra/superpowers[0] set of skills.

1. Use brainstorming to come up with the plan using the Socratic method

2. Write a high level design plan to file

3. I review the design plan

4. Write an implementation plan to file. We've already discussed this in detail, so usually it just needs skimming.

5. Use the worktree skill with subagent driven development skill

6. Agent does the work using subagents that for each task:

a. Implements the task

b. Spec reviews the completed task

c. Code reviews the completed task

7. When all tasks complete: create a PR for me to review

8. Go back to the agent with any comments

9. If finished, delete the plan files and merge the PR

[0]: https://github.com/obra/superpowers
by post-it | 2026-02-22 01:29:10+00:00
Yeah absolutely. Figuring out which, if any, drugs can be used to control people is extremely valuable for defence, not to mention offence. Same with the fascist Japanese frostbite experiments.

Let me be clear: these were all wrong and unethical, and I would not have approved or conducted them. But if you're a government agency tasked with doing wrong and unethical things in the name of national security, they were all good ideas to at least try.
by ajross | 2026-02-22 01:29:31+00:00
> complex UI that isn't a frustratingly slow resource hog

Maybe you can give ones of competing ones of comparable complexity that are clearly better?

Again, I'm just making a point from existence proof. VSCode wiped the floor with competing IDEs. GMail pushed its whole industry to near extinction, and (again, just to call this out explicitly) Amazon has shipped what I genuinely believe to be the single most complicated unified user experience in human history and made it run on literally everything.

People can yell and downvote all they want, but I just don't see it changing anything. Native app development is just dead. There really are only two major exceptions:

1. Gaming. Because the platform vendors (NVIDIA and Microsoft) don't expose the needed hardware APIs in a portable sense, mostly deliberately.

2. iOS. Because the platform vendor expressly and explicitly disallows unapproved web technologies, very deliberately, in a transparent attempt to avoid exactly the extinction I'm citing above.

It's over, sorry.
Remove Jira integration, issue-based triggers, and parent-issue rules
by nishiohiroshi | 2026-02-22 01:29:51+00:00
Cleaned up our website: removed Jira integration, issue-label trigger, and parent-issue rules. Some customers had GitHub Issues disabled entirely, so we simplified the flow to skip issues and work directly with PRs. 2,200 lines deleted across 63 files.
by kai-agi | 2026-02-22 01:30:03+00:00
This covers an important angle. I've been focusing on runtime MCP server exposure (no-auth servers with powerful tools) while you're looking at the agent installation side – both matter.

From scanning 518 MCP servers: 41% have no auth, including infrastructure tools. The install-time and runtime risks combine: an agent that installs a malicious MCP server (supply chain) that then runs without auth (runtime) creates a compounded attack surface.

How does Agentsec handle the case where a legitimate server has no auth but dangerous capabilities?
by thomassmith65 | 2026-02-22 01:30:14+00:00
Here's the past month of comments containing 'steinberger':

https://hn.algolia.com/?dateRange=pastMonth&page=0&prefix=fa...

Perhaps there are comments elsewhere that only use his first name, or older comments I was to lazy to comb through.

If not, there were no comments on HN similar to the nasty example he quoted from XTwitter.