MurphyA/hacker-news huggingface dataset:
Show HN: Nebark – Simple A/B Testing for system prompts using steganography
by nicolasmery | 2026-02-21 12:10:37+00:00
New project!

I just built the first version of Nebark, an A/B testing platform for LLM system prompts. It aims to solve a very specific pain point: tracking prompt performance without forcing developers to wire trace IDs all the way through their backend to their frontend.

The Problem
If you want to know which system prompt variant generates better user feedback (upvotes, downvotes, or copy-to-clipboard events), the standard approach is intrusive. You have to generate a trace ID in your backend, pass it down to your client, attach it to your UI components, and send it back to your analytics DB. It creates friction and litters your API responses with telemetry metadata.

The Solution: Context Hashing
We decoupled the telemetry entirely using what we call "Context Hashing" to bridge the backend and frontend asynchronously.

Here is how the architecture works:

The Proxy (Backend): You point your OpenAI baseURL to our gateway. We intercept the request, inject Variant A or B of your system prompt, and stream the response back. Once the stream closes, our proxy calculates a unique cryptographic hash based on the interaction's content and stores it as a blind trace.

The SDK (Frontend): A lightweight vanilla JS script watches the DOM. It smartly waits for the AI's response to finish streaming and rendering on the screen. It then extracts the visible text and calculates the exact same unique hash locally, without intercepting any network traffic.

The Match: The SDK injects the feedback UI (/). When a user clicks, the frontend sends this calculated Hash and a local Session ID to our DB. We match this Hash against the Proxy's traces to attribute the vote to the correct prompt variant.

Why it’s interesting

Zero Backend Config: You only change the base URL. The backend remains completely unaware of the A/B test or the telemetry.

Semantic Caching Immunity: If your backend uses Redis to serve a cached response and skips our Proxy, the frontend will generate a Hash that doesn't exist in our DB. It naturally prevents skewed A/B data from cached hits.

The Edge Cases (Where I need your feedback)
The biggest risk with DOM hashing is hydration/rendering discrepancies. If a client's frontend uses an aggressive Markdown parser that strips out specific characters before rendering the text, the frontend hash won't match the proxy hash. We built a strict internal normalization engine on both ends to mitigate this, but it is an ongoing challenge.

I’d love to hear your thoughts on this architecture. Is there a glaring edge case with DOM extraction or SSE proxying that I’m missing? Its free for now. Tear it apart.
by scotty79 | 2026-02-21 12:10:56+00:00
HN model works, people do downvote for you, if you are just like everybody else here. You indicate that by visiting HN.

In more universal platform such as Facebook you need to indicate who you are by subscribing to specific groups or downvoting some of the content yourself. Just visiting. Facebook is not enoug. Once you signal who you are you also benefit from other people just like you downvoting content you wouldn't like, for you.
by Guestmodinfo | 2026-02-21 12:10:58+00:00
Please include the setting called: "The buffaloes on the loose ate your entire sugarcane crop in the night. Yes Yes you made proper fences. But they are powerful and ruthless beasts. They tore through the wire fences and made one pole loose and the entire hoarde entered your field and ate your crop of 1.5 years. Now you have nothing."
If I get a rupee for how many times it happens with sugarcane farmers in some parts of India
by forinti | 2026-02-21 12:11:16+00:00
Many moons ago I bought a TP-Link Neffos precisely because you could swap out the battery. The problem is that TP-Link never sold replacement batteries in my country. When I tried buying a couple from China, I got used ones that barely lasted a few months.

If producers aren't forced to sell batteries then we should at least mandate standard sizes that could be made by third parties.
by carlosjobim | 2026-02-21 12:11:24+00:00
Famously tariffs on steel. The European Union was originally created as a tariffs union, and the official name was "European Coal and Steel Community", which then slowly grew into the EU we have now.

Steel tariffs are still a core part of the EU, and are aggressively used today.

The European Commission has all the information on tariffs you might be interested in at this page:

https://taxation-customs.ec.europa.eu/customs/customs-tariff...

The European Council has a more general information page:

https://www.consilium.europa.eu/en/policies/eu-tariffs-expla...
by crispyambulance | 2026-02-21 12:11:37+00:00
They almost certainly did not. They likely just hired a cheap contractor to get their service up, and went with it when "it worked".

The contractor (who was certainly incompetent) probably looked at a bunch of nightmarishly complex identity API's and said "F** it!", combine that with being grossly underpaid and you get stuff like this.

It's a bad situation, of course, and involving threatening lawyers makes it even more ugly. But I can understand how a very small business (knowing nothing about IT other that what their incompetent contractor told them) might get really offended and scared shitless by some rando giving them a 30-day deadline, reporting them to authorities, and demanding that they contact all affected customers.
by alexpotato | 2026-02-21 12:12:13+00:00
Reminds me of the story about Aeroflot (Soviet National airline) and hijackings

- Aeroflot flights get hijacked and flown to West Berlin

- Soviets decided to put Spetsnaz (Soviet special forces) on the planes much like we have Air Marshals today

- Spetsnaz figures "we have guns and are on the plane already" so they start hijacking flights

- So Soviets put TWO Spetsnaz teams on the flight

- Team 1 decides to hijack flight, realize there is a Team 2 who ALSO agrees to hijack the flight
by SkiFire13 | 2026-02-21 12:12:40+00:00
I'm not sure what that has to do with the article, but anyway: https://www.cs.utexas.edu/~EWD/transcriptions/EWD08xx/EWD831...

That said, I'm not sure how 1-based indexing will solve off-by-1 errors. They naturally come from the fencepost problem, i.e. the fact that sometimes we use indexes to indicate elements and sometimes to indicate boundaries between them. Mixing between them in our reasoning ultimately results in off-by-1 issues.
by blindxfish | 2026-02-21 12:12:48+00:00
So, I really liked devrant and it was quiet a hit when it died, I am not fan of the large social platforms as they tend to censor, cancel, too many people I don't know, and I prefer smaller platforms where after some time users know each other.
So with this aim I made devplace.net and currently with 2-3 other survivors of sinking of devrant we are there, experimenting with the site, trying out features, testing AI integrations, automated news, diferent stuff, the idea is to close the place to invite only to keep it small and friendly after reaching the amount of people that feels manageable for someone to interact with.

I would really appreciate any input or ideas to make it a fun and usefull place for interaction while keeping it a small community.

Cheers, and thanks for the read. :)
by Reason077 | 2026-02-21 12:13:01+00:00
Removable batteries were standard in the early days of mobile phones (and laptops) out of necessity: batteries in those days just weren’t very good. They didn’t last long, took hours to charge, and wore out relatively quickly. You’d carry a spare battery around and swap over when your first one ran out.

Now days, there is much less need for that because a charge lasts much longer, and if you do run low you can fast change in 30 minutes or so. Not buying extra spare batteries for every device means less e-waste, not more!
by rdtsc | 2026-02-21 12:13:13+00:00
> Without a deadline of some form, when do you escalate to public knowledge so customers can know they might get defrauded in some capacity?

You set a deadline after an initial conversation and urging them to fix it, if they don’t respond. I think the idea would be to escalate slowly. Like the original poster said large tech companies like know how to do this and streamlined the process. But, to someone not familiar with the process it looks like threats and deadlines imposed by a random person.

I am not defending the company just presenting their possible point of view. It’s worth seeing things with their eyes so to speak to try to understand their motivations.
by i_am_a_peasant | 2026-02-21 12:13:18+00:00
You know it often is the case that APIs like this both in C++ and Rust don't offer you enough knobs when your usecase deviates from being trivial.

It happens with locking APIs, it happens with socket APIs, anything platform dependent.

Does the C++ standard give you an idiomatic way to set PTHREAD_RWLOCK_PREFER_READER_NP or PTHREAD_RWLOCK_PREFER_WRITER_NP explicitly when initializing a rwlock? Nope. Then you either roll your own or in Rust you reach for a crate where someone did the work of making a smarter primitive for you.
by jfengel | 2026-02-21 12:13:35+00:00
Impeached, possibly. Conviction is effectively impossible.

That illustrates the structural problem. Congress was designed to have a high bar for action. But the bar is so high that it can't balance the other branches.

I'd argue that no system will work when so many voters are willing to overlook obvious crimes in order to remain in power. But even in less pathological circumstances, the legislative branch had too many internal checks to also participate in external ones.
by jjkaczor | 2026-02-21 12:13:36+00:00
Exactly this - I had a role in a multinational, US-founded company, however - I was based in Canada - our title had the name "engineer" contained within it. We were NOT by any means certified professional engineers according to any regulatory body - we were great at our jobs, but that was the reality.

We were NOT allowed to refer to our job title when deployed to the province of Quebec, which has strong regulations around the use of the term "engineer". It was fine - we still went, did our jobs, satisfied our customers and fixed their issues.
by madarcho | 2026-02-21 12:14:33+00:00
CodeQL was a good help on some projects, but more recently, our team has been increasingly frustrated by the thing to the point of turning it off.

The latest drop in the bucket was a comment adding a useless intermediate variable, with the justification being “if you do this, you’ll avoid CodeQL flagging you for the problem”.

Sounds like slight overfitting to the data!
by toofy | 2026-02-21 12:15:09+00:00
it’s only a matter of time. we have all seen first hand how … wrong … these companies behave, almost on a regular basis.

there’s a small tinfoil hat part of me that suspects part of their obscene investments and cornering the hardware market is driven by an conscious attempt to stop open source local from taking off. they want it all, the money, the control, and to be the only source of information to us.
by llm_nerd | 2026-02-21 12:15:33+00:00
Their use of LinkedIn is for local and semi-local professional networks. It's like if you use Nextdoor for your street.

And of course those Europeans use LinkedIn for the network effect (even though LinkedIn is just a pathetic sad dead mall now, so most are doing so for an illusion), because other prior waves of Europeans also used LinkedIn, and so on. Domestic or regional alternatives falter because everyone demands they be on the "one" site.

The centralization of tech, largely to the US for a variety of reasons, has been an enormous, colossal mistake.

It's at this point I have to laud what China did. They simply banned foreign options in many spaces and healthy domestic options sprouted up overnight. Many countries need to start doing this, especially given that US tech is effectively an arm of a very hostile government that is waging intense diplomatic and trade warfare worldwide, especially against allies.
by TZubiri | 2026-02-21 12:15:50+00:00
A has an account at B, A has another account at C, A wants to allow C to access data at B (or to send data to B on A's behalf).

How can B be sure that C is acting on A's behalf? Can A only allow C to access certain data (or send only certain data) in order to reduce risk?

A protocol that allows for that three way negotiation is OAuth.

Like with most specs, a lot of the complexity is added in the later years, by companies that have thousands of users and complex edge cases and necessities, and they are the ones dominating the council, and their needs are the ones that push forward newer versions.

So with most specs, the best way to start learning it is by learning from the oldest specs to the newest ones, so if you start by reading or using OAuth2, you will be bombarded with a lot of extra complexities, not even the current experts started like that.

If you need to catch up, always start with the oldest specs/versions.
by luxpir | 2026-02-21 12:16:21+00:00
I really appreciate this write-up.

Was forced to verify to get access to a new account. Like, an interstitial page that forced verification before even basic access.

Brief context for that: was being granted a salesnav licence, but to my work address with no account attached to it. Plus I had an existing salesnav trial underway on main account and didn't want to give access to that work.

So I reluctantly verified with my passport (!) and got access. Then looked at all the privacy settings to try to access what I'd given, but the full export was only sign up date and one other row in a csv. I switched off all the dark pattern ad settings that were default on, then tried to recall the name of the company. Lack of time meant I haven't been able to follow up. I was deeply uncomfortable with the whole process.

So now I've requested my info and deletion via the details in the post, from the work address.

One other concern is if my verified is ever forced to be my main, I'll be screwed for contacts and years of connections. So I'll try to shut it down soon when I'm sure we're done at work. But tbh I don't think the issues will end there either.

Why do these services have to suck so much. Why does money confer such power instead of goodwill, integrity and trust/trustless systems. Things have to change. Or, just stay off the grid. But that shouldn't have to be the choice. Where are the decentralised services. I'm increasingly serious about this.
by franze | 2026-02-21 12:16:34+00:00
my time at a money startup (debit cards) i pushed to legal and security people to change their behaviour from "how can we prevent this" to "how can we enable this - while still staying with the legal and security framework" worked good after months of hard work and day long meetings.

then the heads changed and we were back to square one.

but for a moment it was glorious of what was possible.
by Fraterkes | 2026-02-21 12:16:43+00:00
No indexing system is perfect, but one can be better than another. Being able to do array[array.length()] to get the last item is more concise and less error prone than having to add -1 every time.

Programming languages are filled with tiny design choices that don’t completely prevent mistakes (that would be impossible) but do make them less likely.
by ms_sv | 2026-02-21 12:17:09+00:00
Thank you for the feedback, I appriciate it. The idea is to avoid the corruption and bias by hand picking a starter deck of super trusted few professionals who would be able to verify others.

For example to prove someone is an senior engineer from google I can ask for a pay slip and references and yes certifications, so we would become that rusted partner. Still working on the proposal and iterations, I wanna talk to much engineers, hiring manages as possible since this is going to be for everyone, to navigate this wild job market.

We definitely need better tools, at the moment it is wild that it takes 1000 of applications to just get an answer from any company, this not right at all
by trilogic | 2026-02-21 12:18:40+00:00
Great article, thank you.

Hiding all this very important info (which literally affects the users life) behind an insignificant boring click!
Even the most paranoid user will give up in certain use cases, (like with covid 19 which even though didn´t agree, you needed to travel, work making it compulsory).
Every company that uses deciving techniques like this should be banned in Europe.
by enraged_camel | 2026-02-21 12:18:45+00:00
The "feels like" metric is more closely tied to human stress and safety than raw temperature.

In cold weather (wind chill), wind strips away the thin warm layer of air next to your skin, so you lose heat faster. Hence, "feels colder".

In hot weather (heat index), humidity slows sweat evaporation, so your body can't cool itself as effectively. Hence, "feels hotter".

So it's a lot more useful for decision-making (like what to wear, weather it is safe to run/hike, how much water you need, etc.) than the plain temperature.
by imiric | 2026-02-21 12:18:54+00:00
> I work at a FAANG and every time you try something innovative the "policy people" will climb out of their holes and put random roadblocks in your way

What a surprise that someone working in Big Tech would find "pesky" policies to get in their way. These companies have obviously done so much good for the world; imagine what they could do without any guardrails!
by TZubiri | 2026-02-21 12:18:55+00:00
I think the reason a lot of people struggle is because they start with OAuth from a consumer perspective, that is, they are the third party requesting data, and their OAuth implementation is imposed by the resource holder, so they have to jump through a lot of hoops that don't have a clear reason for being.

If you start with OAuth from the perspective of a Service Provider/resource holder, it will all come clear.

Web security is often like that as well, most people facing stuff like CORS or HTTPS, is usually not because they are trying to solve a security issue, but it's because an upstream provider is forcing them to increase their security standards in order to be trusted with their user's data.
by cb321 | 2026-02-21 12:19:44+00:00
As @SkiFire correctly observes[^1], off-by-1 problems are more fundamental than 0-based or 1-based indices, but the latter still vary enough that some kind of discrimination is needed.

For many years (decades?) now, I've been using "index" for 0-based and "number" for 1-based as in "column index" for a C/Python style [ix] vs. "column number" for a shell/awk/etc. style $1 $2. Not sure this is the best terminology, but it is nice to have something consistent. E.g., "offset" for 0-based indices means "off" and even the letter "o" in some case becomes "the zero of some range". So, "offset" might be better than "index" for 0-based.

[^1]: https://news.ycombinator.com/item?id=47100056
by Embedl-Wilhelm | 2026-02-21 12:20:21+00:00
Quickstart (vLLM Jetson container):

-gpu-memory-utilization and --max-num-seqs should be adapted to system specifications (i.e., available RAM).

docker run --rm -it \
--network host \
--shm-size=8g \
--ulimit memlock=-1 \
--ulimit stack=67108864 \
--runtime=nvidia \
--name=vllm-serve \
ghcr.io/nvidia-ai-iot/vllm:latest-jetson-orin \
vllm serve "embedl/Cosmos-Reason2-2B-W4A16" \
--max-model-len 8192 \
--gpu-memory-utilization 0.75 \
--max-num-seqs 2
by SomeUserName432 | 2026-02-21 12:21:10+00:00
> Was forced to verify to get access to a new account. Like, an interstitial page that forced verification before even basic access.

I'm forced to verify to access my existing account.

I cannot delete it, nor opt out of 'being used for AI content' without first handing them over even more information I'm sure will be used for completely benign purposes.
by embedding-shape | 2026-02-21 12:21:23+00:00
So why are these people not involved from the first place? Seems like a huge management/executive failure that the right people who needs to check off the design weren't involved until after developers implemented the feature.

You seem to blame the person who is trying to save the company from security issues, rather than placing the blame on your boss that made you do work that would never gotten approved in the first place if they just checked with the right person first?
by shablulman | 2026-02-21 12:21:44+00:00
This demographic shift feels less like a temporary swing in sentiment and more like a fundamental realignment of how younger generations view their professional and personal horizons. For those who grew up in a digitally and culturally borderless environment, the friction introduced by Brexit—from the loss of Erasmus+ to complex work visas—is often viewed not through a partisan lens, but as a tangible constraint on their mobility and agency.

It suggests that for this cohort, the value of the EU isn't just political; it’s about a baseline level of access to collaborative research, labor markets, and shared infrastructure that they consider essential for the modern world.
Show HN: Tired of BIG JavaScript frameworks? try this
by aggroot | 2026-02-21 12:21:56+00:00
I wrote a tiny 5kb library with a new concept for client-side interactivity: reactive hypermedia contexts embedded in HTML.

It looks like this:

<div hctx="counter">
<span hc-effect="render on hc:statechanged">0</span>
<button hc-action="increment on click">+1</button>
</div>

It comes with reactive state, stores, and allows you to build your own DSL in HTML.

One feature that stands out is the ability to spread a single context scope across different DOM locations:

<!-- Header -->
<nav>
<div hctx="cart">
<span hc-effect="renderCount on hc:statechanged">0 items</span>
</div>
</nav>

<!-- Product listing -->
<div hctx="cart">
<button hc-action="addItem on click">Add to Cart</button>
</div>

<!-- Sidebar -->
<div hctx="cart">
<ul hc-effect="listItems on hc:statechanged"></ul>
</div>

Contexts are implemented via a minimal API, and TypeScript is fully supported.

Curious what you think, feedback is welcomed.
by tmtvl | 2026-02-21 12:23:28+00:00
Yep. I tried paying with my card on Steam and it showed me a QR code and I was like 'what do you want me to do, hold my card up against the screen so it somehow magically makes the transfer happen?'. There simply isn't an alternative to PP in many cases. It sucks, but that's the state of online payments today. Crypto would be an alternative if it were the least bit stable. Wero seems promising but at the moment it doesn't work.
by Sharlin | 2026-02-21 12:23:35+00:00
I wonder if the politics issue is just much worse in certain parts of the world. Nobody bothers to spend money trying to influence the population of a small Nordic country.

As an experiment, I disabled Ghostery and uBlock, and the feed became about 33% ads, which is rather annoying, but the ads were mostly fine. There was one obvious AI slop image advertising a dating site, and one cryptobro ad, but otherwise they were fairly reasonable, relatively speaking.
by rationalist | 2026-02-21 12:23:38+00:00
If anyone from Shop.app is here, your unsubscribe does not work either (maybe due to VPN usage).

But that's okay, Fastmail now automatically routes it to the spam folder where it belongs.

additionally:

Interesting, I set my email as a backup authentication for a luddite friend's Comcast email account, and I just discovered spam from Xfinity in my spam folder. Shame on you Xfinity Comcast.

The problem:

My understanding is the CAN-SPAM Act violations can only be prosecuted by states Attorney Generals, there is no civil action available.