MurphyA/hacker-news huggingface dataset:
by deepsquirrelnet | 2026-02-21 15:03:36+00:00
The DoDs recent beef with Anthropic over their right to restrict how Claude can be used is revealing.

> Though Anthropic has maintained that it does not and will not allow its AI systems to be directly used in lethal autonomous weapons or for domestic surveillance

Autonomous AI weapons is one of the things the DoD appears to be pursuing. So bring back the Skynet people, because that’s where we apparently are.

1. https://www.nbcnews.com/tech/security/anthropic-ai-defense-w...
by AntonFriberg | 2026-02-21 15:03:56+00:00
Came across this at work as well during the early days of Kubernetes. At that time all VM storage was entirely backed by NFS or Network attached iSCSI, there was no local disk at all. We noticed intermittent issues that caused kube API to stop responding but nothing serious.

Then all the sudden there was a longer lasting outage where the ETCD did not really recover on its own. The kube API buffered requests but eventually crashed due to OOM.

The issue was due to the Kubernetes distro we picked (rancher) which runs a separate cluster in front of the deployed ones for the control plane. Large changes happening in the underlying clusters needed to be sent to the control plane. After we hit the latency threshold it started failing at regular intervals and the control plane started drifting more and more and needing more and more changes at start up. Until it could not recover.

Solving it took some time and confidence. Manually cleaning up large unused data in the underlying ETCD instances so that they did not cause upstream errors.

It was later during post-mortem investigation that I understood the RAFT algorithm and the storage latency issue. Convincing the company to install local disks took some time but I could correlate kube API issues to disk latency by setting up robust monitoring. Fun times!

The requirements are well documented nowadays! https://etcd.io/docs/v3.1/op-guide/performance/
by 13pixels | 2026-02-21 15:04:31+00:00
The explicit ads angle is only half the story. Even without paid placements, these models already have implicit recommendations baked in.

We ran queries across ChatGPT, Claude, and Perplexity asking for product recommendations in ~30 B2B categories. The overlap between what each model recommends is surprisingly low -- around 40% agreement on the top 5 picks for any given category. And the correlation with Google search rankings? About 0.08.

So we already have a world where which CRM or analytics tool gets recommended depends on which model someone happens to ask, and nobody -- not the models, not the brands, not the users -- has any transparency into why. That's arguably more dangerous than explicit ads, because at least with ads you know you're being sold to.
by avastel | 2026-02-21 15:04:36+00:00
Author here.

I first built FPScanner during my PhD around 2017–2018, when I was doing research on browser fingerprinting and bot detection. After that I did not really maintain it for years.

I recently decided to revive it because things changed a lot. Automation is much easier now. With free automation libraries like Puppeteer/Playwright/Selenium + headless Chrome and cheap proxies, you can build decent bots very quickly. At the same time, open source defensive tooling is still quite limited, or very basic.

To be clear, FPScanner is not trying to be a silver bullet.

It is a small, self-hosted library that focuses on deterministic client-side signals:
- webdriver and automation flags
- CDP-related artifacts
- automation framework markers (Selenium, Playwright, etc.)
- JS cross-context inconsistencies: main JS context, iframes and workers

It also generates a JA4-inspired fingerprint ID for clustering sessions, and includes encrypted payload + simple anti-replay protections.

There is no ML here, no "AI detection", and no claim to block 100% of bots. The idea is just to expose strong, explainable signals and make automation a bit more expensive. I assume attackers can read the source code.

I tested it on different devices and browsers to avoid JS errors and obvious false positives, but I’m sure there are edge cases. If you try it on less common browsers or hardened setups and it breaks, please let me know or open an issue.

Happy to answer questions or discuss design choices / limitations.
by froggit | 2026-02-21 15:05:24+00:00
> If the light switch you bought, has a little daylight sensor on it, and turns off when the sun is out, and that's what it does.. you may not like that light switch. You might want one that "does what you want, because you paid for it!" but then you should have purchased a different one, or made a light switch you actually liked.

Not sure this analogy works as it gives prospective light switch buyers a choice of different light switch types. What google is doing seems more like forcing EVERY light switch to have daylight sensors, thus forcing you to save power (even if you're pro-global warming and just trying to do your part for the cause), then telling people with vision problems relating to suboptimal indoor illumination or suffer from sunlight frequency melting disorder or think they've got some other random "daylight makes life suck" bullshit to create a student/hobbyist account.
by iamnothere | 2026-02-21 15:06:07+00:00
There is no answer except to sever yourself from the network. If you could somehow undo all of computing history and rebuild the internet on different principles, using completely locked down and centralized machines, then you could accomplish what you want to. But the tools to escape control are out there and are widely available. The skills to open new avenues outside of control are distributed among millions. The structure of the current network is woven into everything from banking to dishwashers.

You can make certain digital behavior illegal for your citizens, but enforcement is always going to be difficult. If you invasively spy on them to try and force them into your model digital behavior, it will cause unrest. If you try to block specific sites at the border, you will take down unrelated sites and breed contempt for the law. By pushing people farther and farther underground, you eventually connect them with organized crime and foreign governments.

In the long run, your insistence that the network be controlled is going to lead to either civil breakdown or totalitarianism. Perhaps that’s the inevitable consequence of connecting humanity as we’ve done. But I suspect that countries who are more digitally permissive will not face the same dilemma.

(Note that people usually accept laws where a victim can be identified. A digital crime with a real victim is still a crime, and standard policing methods can often track down the perpetrator. No need to break the internet for these cases.)
by laszlojamf | 2026-02-21 15:06:12+00:00
I agree that DPA:s, as they are written today, aren't good. I was just pointing out that the reality probably isn't as bad as the article made it sound.

> If you don't see this as a problem, you are a part of the problem

I think you're misunderstanding me. I'm just saying that there are way bigger fish to fry in terms of privacy on the internet than passport data. In the end, your face is on every store's CCTV camera, your every friends phone, and every school yearbook since you were a kid. Unless you ask all of them to also delete it once they are done with it.
by mooreds | 2026-02-21 15:06:32+00:00
> It's all just a sprawling behemoth of a framework, because it tries to do everything.

I also interact with OAuth quite a bit at work. I also have dealt with SAML.

I'd pick OAuth over SAML any day of the week, and not just because OAuth (v2 at least) is 7 years younger.

It's also because OAuth, for all its sprawl, lets you pick and choose different pieces to focus on, and has evolved over time. The overall framework tries to meet everyone's needs, but accomplishes this via different specs/RFCs.

SAML, on the other hand, is an 800 page behemoth spec frozen in time. It tried to be everything to everyone using the tools available at the time (XML, for one). Even though the spec isn't evolving (and the WG is shut down) it's never going to go away--it's too embedded as a solution for so many existing systems.

I also don't know what could replace OAuth. I looked at GNAP but haven't seen anything else comparable to OAuth.
by logicprog | 2026-02-21 15:06:42+00:00
There are so many papers now showing that LLM "reasoning" is fragile and based on pattern-matching heuristics that I think it's worth considering that, while it may not be an in principle limitation — in the sense that if you gave an autoregressive predictor infinite data and compute, it'd have to learn to simulate the universe to predict perfectly — in practice we're not going to build Laplace's LLM, and we might need a more direct architecture as a short cut!
by kruffalon | 2026-02-21 15:06:43+00:00
Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores such as Google Play. Currently Keenadu is used for ad fraud, with attackers using infected devices as bots to deliver link clicks on ads, but it can also be used for malicious purposes, with some variants even allowing full control of the victim’s device.
by alexjplant | 2026-02-21 15:07:47+00:00
I'd like to deploy it to trawl various communities that I frequent for interesting information and synthesize it for me... basically automate the goofing off that I do by reading about music gear. This way I stay apprised of the broader market and get the lowdown on new stuff without wading through pages of chaff. Financial market and tech news are also good candidates.

Of course this would be in a read-only fashion and it'd send summary messages via Signal or something. Not about to have this thing buy stuff or send messages for me.
by logicprog | 2026-02-21 15:08:04+00:00
Yeah, in the interest of full disclosure, while Claws seem like a fun toy to me, I tried ZeroClaw out and it was... kind of awful. There's no ability to see what tools agents are running, and what the results of those tools are, or cancel actions, or anything, and tools fail often enough (if you're trying to mind security to at least some degree) that the things just hallucinate wildly and don't do anything useful.
by einrealist | 2026-02-21 15:08:04+00:00
Why not show a summary of who actually received the data? It should be easy to implement. You could also add what data is retained and an estimate of how long it is kept for. It could be a summary page that I can print as a PDF after the process is complete.

I'd consider that a feature that would increase trust in such a platform. These platforms require trust, right?
by eel | 2026-02-21 15:08:18+00:00
At Amazon, their travel trainings always recommended giving out your laptop password if asked by law enforcement or immigration, regardless of whether it was legal in the jurisdiction. Then you were to report the incident as soon as possible afterwards, and you'd have to change your password and possibly get your laptop replaced.

That kind of policy makes sense for the employee's safety, but it definitely had me thinking how they might approach other tradeoffs. What if the Department of Justice wants you to hand over some customer data that you can legally refuse, but you are simultaneously negotiating a multi-billion dollar cloud hosting deal with the same Department of Justice? What tradeoff does the company make? Totally hypothetical situation, of course.
by metalman | 2026-02-21 15:09:16+00:00
flip it, and build green(organic) lists
perhaps work towards having sites than dont just, not use AI, but never talk about it
it's not just AI, search is a scam, no mojo in the world can extract the contact info for the business next door and the mountains of porncoin, scamulous garbage and hate news
taking up a full 50% of whats left, does in fact make a determined effort to greenwall a section of the web something to consider
by quotemstr | 2026-02-21 15:09:16+00:00
Social media cannot "threaten democracy". Democracy means that we transfer power to those who get the most votes.

There's nothing more anti-democratic than deciding that some votes don't count because the people casting them heard words you didn't like.

The kind of person to whom the concept of feed ranking threatening democracy is even a logical thought believes the role of the public is to rubber stamp policies a small group decides are best. If the public hears unapproved words, it might have unapproved thoughts, vote for unapproved parties, and set unapproved policy. Can't have that.
by tushar22202 | 2026-02-21 15:09:16+00:00
I built an iOS app that adds an AI classification and search layer on top of Google Drive.
All processing happens on-device. No documents are sent to external servers.

The problem: Google Drive is great for storage but terrible for retrieval. Search fails
when you don't remember file names, and it doesn't work offline at all.

How IntelliDrive works:

1. Upload a document (camera capture, photo import, or file pick)
2. On-device classification pipeline runs:
- Text extraction via Vision OCR
- NLModel (maxEnt) for text-based category prediction
- VNCoreMLRequest for image-based classification
- Both signals merged with confidence weighting
3. Document is uploaded to user's Google Drive with metadata
4. Local SQLite FTS5 index is updated for full-text search
5. NLEmbedding vectors (512-dim) stored as binary BLOBs for semantic search

Search architecture:
- Tier 1: SQLite FTS5 keyword search with porter tokenizer (~5ms)
- Tier 2: Batched cosine similarity over NLEmbedding vectors via Apple Accelerate
vDSP (~20ms for 10K docs)
- Tier 3: Optional LLM re-ranking for natural language queries

The search index lives entirely on-device in Application Support. Survives cache
purges. Rebuilds automatically from Drive metadata if the app is deleted and
reinstalled. Each Google account gets an isolated SQLite database.

Sync uses Google Drive Changes API (delta sync with startPageToken) instead of
full metadata re-downloads. 4-hour TTL to avoid redundant API calls.

Additional features:
- Custom categories with few-shot learning (VNFeaturePrintObservation + kNN, k=3)
- Offline upload queue with NWPathMonitor
- Multi-account isolation with per-user storage keys
- Deletion tombstones (24h TTL) to prevent sync resurrection

Built with Swift/SwiftUI, Core ML, Vision, NaturalLanguage, SQLite3, Accelerate.
No Firebase. No third-party analytics. No external AI APIs for classification.

TestFlight: https://testflight.apple.com/join/mkuuWmv4

Would appreciate feedback on the architecture and UX. Solo developer — this is
my first iOS app going to production.
by testing22321 | 2026-02-21 15:09:47+00:00
There is Starlink and Amazon’s version, which both need many thousands of launches each (ignoring data centres)

There’s US military stuff like the starsheild, and it seems extremely likely china will follow suit.

Sat internet is changing the world rapidly where fibre can not be run. I saw it first hand in remote Australia, Yukon, Alaska and Africa. Not to mention ships and planes.

These projects are aggressively driving down launch costs, which increases demand for launches, which drives down launch costs which drives up demand.
by danFctr | 2026-02-21 15:10:53+00:00
This is a brilliant formalization of a pattern we arrived at a while ago while building Tako, an open-source Okta AI agent.

Even just exposing ~107 read-only GET endpoints was blowing out our context windows. We realized we couldn't load the spec; we had to let the agent query it.

We built a two-step discovery pattern: the agent requests a lightweight index of operation names (system_log.list_events, user.list, etc.), then requests the full spec only for the operations it actually needs. The full spec never hits the context window.

The key difference from querying a raw OpenAPI spec is the notes field. Each endpoint in our JSON carries a hand-written notes field with usage rules, gotchas, and agent planning hints. For example, the list-users notes tell the agent: "CRITICAL: Use search for SCIM filtering, use filter for limited system properties, use q for simple name/email matching — mixing search and filter parameters causes errors."

An OpenAPI spec will never tell you that. It gives you parameter names and types, but not that mixing two valid parameters silently breaks, or that q excludes deprovisioned users, or that you need a follow-up call to get-user because an endpoint only returns IDs. Those are the things that make agents fail in production. They only exist in tribal knowledge or buried in docs. We put them directly in the JSON, per endpoint, where the agent reads them at query time.

The tradeoff: it's not auto-generated, so it takes effort to maintain. But the payoff is that end-users can edit the notes for their own tenant. Custom profile attribute? Add it to the notes. Want the agent to always filter by your department structure? Edit the JSON. No code changes.

To prove this pattern translates to MCP, we built an Okta MCP server with two modes — Standard Mode (every endpoint as a separate tool, immediately crushes context) and Discovery Mode (this progressive pattern): https://fctr.io/okta-mcp-server.html

The raw JSON spec: https://github.com/fctr-id/okta-ai-agent/blob/main/src/data/...

Cloudflare's server-side V8 isolate is a big improvement for security over our client-side execution. Great write-up.
by runarberg | 2026-02-21 15:10:59+00:00
The problem with benchmaxxing is that lies about the capabilities of the technology. IF all we wanted was a machine that plays chess, we would just use a chess engine, which we have known how to make for decades. If Google wanted Gemini to be able to play chess, it would be much easier (and better; and hellavulat cheaper) to stick a traditional chess engine into their product and defer all chess to that engine.

The claim here (way up thread) was: “we have the technology to train models to do anything that you can do on a computer, only thing that's missing is the data”, and the implication is that logic and reasoning is an emerging properties of these models if given enough data and enough parameters. However the evidence seems to suggest otherwise. Logic and reasoning have to be specifically programmed into these models, and even with dataset as vast as online chess games (just lichess has 7.1 billion games), if that claim above were true, chess should be easy for LLMs, but it obviously isn’t. And that tells us something about the limitations of the technology.
Ask HN: Why don't software developers make medical devices?
by piratesAndSons | 2026-02-21 15:11:39+00:00
As software development becomes a commodity thanks to LLM, I wonder why more software developers don't switch to building medical devices to make their careers more secure. Here's why I picked medical devices in particular.

1. Natural Moat

Since human body hardware is more or less immutable in its most essential parts, you don't have to worry about some LLM hype cycle replacing you. Once you build the product and clear FDA or local certifications, you're set. Unlike Uber destroying the taxi medallion business, healthcare is a beast — no tech startup dares to bypass all the regulations and gatekeeping.

2. Regulatory Moat

The medical devices I'm talking about require around $50K–$200K for FDA clearance — low enough that any small business can manage it, but high enough to discourage bottom-feeders and Chinese product dumpers. It also lets you avoid the big established healthcare corporations, because this market segment is too small for them to care about, yet large enough for you to pull in $10M–$15M a year in revenue.

Medical device manufacturing sidesteps the two fatal flaws of software development: the lack of a moat and static, almost never-changing hardware margins. LLM companies don't care about copyright, IP, or the health of the broader economy — but they can't go head-to-head with the healthcare industry, so you don't have to worry about them at all.
by jonathanlydall | 2026-02-21 15:12:01+00:00
> You can’t push changes to a non-bare repo – if you try, Git will reject your push.

You can push to a folder with a non-bare Git repo, it’s just that you can’t push the same branch which it has checked out.

Or in other words, if you get an error when trying to push to a folder with a checked out repo, push to a different remote branch.

(I do this regularly between WSL and the Windows host)
by Forgeties79 | 2026-02-21 15:12:26+00:00
I actually think Congress is the one who controls the reins still with this one. All they have to do is simply say “no“ and stop falling in line with the party because their president is in charge. They won’t do it, but they need to just agree enough is enough and legislate instead of handing it off to the president so they can’t be held accountable for their votes. Still, at the end of the day the ball is in their court.
by bryanlarsen | 2026-02-21 15:12:27+00:00
I'm sure the UK has way more than 41 thousand shitty jobs with shitty pay that no native really wants. I doubt they're not working because they don't want to.

In Canada the standard complaint is that "immigrants take the jobs" not that "immigrants aren't working". It seems like it's a lot easier to get a job at a Tim Hortons if you speak Hindi like the owners and managers. A job at a restaurant if you speak Levantine Arabic.

And those are just the public tip of the iceberg. Construction crews are mostly foreign. Our roofers were Indian. Our landscapers were Lebanese / Syrian. The people we interacted with spoke great English, but their workers didn't.

The big difference is that Canada had constant immigration. They came over 40 years ago and since they had trouble finding employment became entrepreneurs and restaurants and construction and other blue collar services are the most fertile areas for entrepreneurs. Now they have a huge advantage in hiring low cost labor.
by cess11 | 2026-02-21 15:12:36+00:00
Arguably Marx is the most important historical scientist when it comes to political economy. The methodology pioneered by him has been extremely influential.

Reactionary liberalism, e.g. neoliberalism, Austrian school, that kind of thing, discards the 'mess' of interdisciplinary approaches and seek a return of a protestant worldview, riffing off of their use of the New Testament verses about "render unto Caesar". This puts them in harsh ideological conflict with the political economists and elevates their 'theology' above the work of previous scientists.

Historically some trace political economy to ibn Khaldun, but in the Occident it's Ricardo, Mill, Marx and so on that create a (to us) recognisable science out of it.
by iambel0ved | 2026-02-21 15:13:12+00:00
I'd love to see Nebark expand its capabilities to support more advanced
A/B testing scenarios, such as multivariate testing and canary releases. The current implementation seems to focus on simple A/B testing, which may not be sufficient for more complex systems. Additionally, it would be great to see Nebark integrate with other monitoring and analytics tools to provide a more comprehensive view of the system's performance. For example, integrating with tools like Prometheus and Grafana could provide valuable insights into how the A/B tests are affecting the system's metrics and performance. Furthermore, supporting more programming languages and frameworks would make Nebark a more versatile tool for a wider range of use cases.