MurphyA/hacker-news huggingface dataset:
Part 1 the Persistent Vault Issue: Your Encryption Strategy Has a Shelf Life
by PhantomKey | 2026-02-08 05:02:41+00:00
Every enterprise identity platform—from Okta and Azure AD to self-hosted password managers and privileged access management systems—shares a common architectural assumption: credentials are encrypted at rest in persistent storage. AES-256, PBKDF2 stretching, HSM key management—these are table stakes. But they're also irrelevant the moment an attacker exfiltrates your encrypted database.

The 2022 LastPass breach exposed the fundamental flaw. Attackers didn't need to defeat encryption in real-time. They copied encrypted vault data and moved it to their own infrastructure. At that point, security degraded to a single variable: how long until users' master passwords fell to offline brute-force attacks. For accounts created before 2018 with lower iteration counts, the answer was "not long enough."

The enterprise cost:
-$53M+ in regulatory fines and breach remediation
-Permanent loss of customer trust
-Ongoing credential rotation mandates for affected organizations
-Cyber insurance rate increases industry-wide

The industry response has been predictable: increase PBKDF2 iterations, mandate longer passphrases, add MFA. These are defense-in-depth measures that slow attackers down. But in an environment where attackers have unlimited time and computational resources—including emerging AI-assisted cracking and future quantum threats—slowing down offline attacks is a losing strategy.

The architectural question your board should be asking:
If encrypted data exists at rest, what's your organization's exposure window before that encryption becomes obsolete?

The answer requires a paradigm shift from storage-based security to execution-based security. In a zero-persistence architecture, decryption keys are never written to disk, never cached in memory pools, never persisted in cloud buckets. They're derived ephemerally from user passphrases—manifested only for the microseconds needed to decrypt specific credentials, then immediately purged from RAM.

An attacker who compromises your infrastructure finds encrypted data with no persistent keys to target. The methodology that generates keys is decoupled from the data itself. You've eliminated the exfiltration-to-offline-cracking pipeline entirely.
This isn't incremental improvement. It's rethinking what "breach" means when there's nothing persistent to steal.

Next: How blockchain verification models eliminate the vault entirely, and why your current SSO architecture can't get there from here.
by cortesoft | 2026-02-08 05:03:02+00:00
> PureScript is a programming language. English is not.

Why can’t English be a programming language? You would absolutely be able to describe a program in English well enough that it would unambiguously be able to instruct a person on the exact program to write. If it can do that, why couldn’t it be used to tell a computer exactly what program to write?
by halfcat | 2026-02-08 05:04:49+00:00
> Can you provide examples in the wild of LLMs creating bad descriptions of code? Has it ever happened to you?

Yes. Docs it produces are generally very generic, like it could be the docs for anything, with project-specifics sprinkled in, and pieces that are definitely incorrect about how the code works.

> for some stuff we have to trust LLMs to be correct 99% of the time

No. We don’t.
by agentultra | 2026-02-08 05:05:04+00:00
C++ nudges you to think in terms of single elements. Operator overloading, ctors/dtors, references, etc. you pay that cost all over the place.

C programs tend to nudge you into thinking in terms of arrays of data.

For game development you generally want to think this way. The cost of vtables and all the cache misses doesn’t have to be paid. A game has to stream bytes. Many things at once. Rarely single elements at a time.
by csmantle | 2026-02-08 05:06:06+00:00
If you are referring to timestamps, buildids, comptime environments, hardwired heuristics for optimization, or even bugs in compilers -- those are not the same kind of non-determinism as in LLMs. The former ones can be mitigated by long-standing practices of reproducible builds, while the latter is intrinsic to LLMs if they are meant to be more useful than a voice recorder.
by vanderZwan | 2026-02-08 05:06:10+00:00
I don't really follow Racket, but I recall that few years ago one apparently fairly significant contributor within their community wrote a blog post about Racket having a Missing Stair problem involving another even more significant (possibly foundational) contributor.

I'm a complete outsider, cannot find that blog post any more, and also just not invested in the language at all, so I'm hesitant draw conclusions about the validity of any of the accusations that were thrown back and forth at the time, but it seems pretty obvious to me that it's inevitable that the community will end up being split after an event like that.

https://en.wikipedia.org/wiki/Missing_stair
Show HN: StyloShare – privacy-first anonymous file sharing with zero sign-up
by stylofront | 2026-02-08 05:06:35+00:00
Hi HN,

I built StyloShare, a small web app for anonymous, one-off file sharing.

The idea was to remove everything that usually gets in the way

Key points:

Anonymous by default

Files auto-expire

Simple UX, works on low-end devices

Built with a focus on performance and minimal client overhead

Happy to answer technical or architectural questions.

Thanks!
by nemothekid | 2026-02-08 05:06:37+00:00
My motivation for learning how to use agents has nothing to do with my ability. In fact I didn't think LLMs provided value for a very long time - the work I do tends to be embedded in nature ad LLMs were really bad at generating useful code.

Opus 4.5 changed that and like every programming tool I've used in the past, I decided to sit seriously with it and try and learn how to use it. If coding agents turn out to be a bust, then oh well, it goes into the graveyard of shit I've learned that has gone nowhere (Angular, Coffeescript, various NoSQL databases, various "big data" frameworks). Even now one of my favorite languages is Rust, but I really took the plunge into the language before async/await and people also called it overhyped.

If coding agents are real, I don't want to be struggling to learn how to use them while everyone else is being 10x more productive. There's no downside to learning how to use them for me. I've invested my time in many hyped software frameworks, some good and some bad.
by shrubby | 2026-02-08 05:07:50+00:00
This scary, yet almost nothing on the news.

We're living in a fake world and pretending everything is fine.

Adam Curtis made a movie HyperNormalisation and we're living it also today.

Adam Curtis:

“HyperNormalisation” is a word that was coined by a brilliant Russian historian who was writing about what it was like to live in the last years of the Soviet Union. What he said, which I thought was absolutely fascinating, was that in the 80s everyone from the top to the bottom of Soviet society knew that it wasn’t working, knew that it was corrupt, knew that the bosses were looting the system, know that the politicians had no alternative vision. And they knew that the bosses knew that they knew that. Everyone knew it was fake, but because no one had any alternative vision for a different kind of society, they just accepted this sense of total fakeness as normal. And this historian, Alexei Yurchak, coined the phrase “HyperNormalisation” to describe that feeling.
by pwg | 2026-02-08 05:07:51+00:00
Appending is much better than prefixing, but having "." in the path, anywhere, can still open you up to running mistyped commands (arguably a much less common possibility, but still a possibility).

I.e., you have "." as the very last item in your path. You are in /tmp/ (so a directory other uses can write files to). You mean to type "ls -l something" to look for "something" files. But instead, you just miss the space, and type "ls-l something*", and some other nefarious user has left a /tmp/ls-l binary behind just waiting to be run. It could package up your ~/.ssh folder and ship it off to "nefarious" user, and then do a proper "ls -l" so that you may not even notice the typo.

And, if you happen to be root when you are in /tmp and mistype ls-l, and if the ls-l binary checks to see if it is being run as root, it could then do even worse. For example, it could leave behind an suid to root bash or sh executable in 'nefarious user's' home dir, so that 'nefarious' can now become root at some point later and proceed to actually 'own' the system.
by mindslight | 2026-02-08 05:08:57+00:00
One of the fundamental mistaken beliefs of contemporary neofascists is that Pournelle's Iron Law only applies to bureaucracies. It would be much much less work for ICE to stop executing American citizens, stop abducting citizens and lawful immigrants, and stop keeping deportees in overcrowded and opaque concentration camps, and repair their own reputation by generally operating within the law like good faith public servants. But obviously that would not meet the needs of the expanding autocracy.
by nemothekid | 2026-02-08 05:13:09+00:00
>Perhaps the frontier models of 2026H2 may be good enough to start compacting and cleaning up entire codebases

I don't think this will happen - or rather I don't think you can ask someone, human or machine, to come in and "compact and clean" your codebase. What is "clean" code depends on your assumptions, constraints, and a guess about what the future will require.

Modularity where none is required becomes boilerplate. Over-rigidity becomes spaghetti codes and "hacks". Deciding what should be modular and what should be constant requires some imagination about what the future might bring and that requires planning.
by kjs3 | 2026-02-08 05:13:51+00:00
The teaching language for my undergrad OS course (late 80s) was Modula-2. We had no experience with it prior to the class (but had experience with Pascal and several other languages by this point) and the whole of intro was "get Kim King's Modula-2 book". Everyone seemed to pick up the language just fine. Unfortunate it never much took off.
by yoyohello13 | 2026-02-08 05:14:14+00:00
We’re already there. Seeing OpenClaw and the new thing LocalGPT on the front page. It’s clear these projects are pretty heavily vibe coded and I have no trust that they are tested, secure or even work as advertised. It’s going to suck when all projects become that. When you can’t trust that a library works as advertised.
by deathanatos | 2026-02-08 05:14:42+00:00
… all this hype, and just … where are the macro level results? GitHub is seemingly having more outages than ever before, and MS is pretty directly involved in the AI hype; should they be a beacon of how great AI's output is? Yet obvious bugs that have persisted for years still languish. My day job is more and more feeling like I'm fighting just to get tooling or services to do the most basic things they were allegedly designed to do.

On the other hand, you have AI companies claiming "we built a browser from scratch" — and then having that claim utterly eviscerated. I cannot fathom going to my boss and requesting "$1,000/day per engineer" for AI — that's an absurd amount of money.

And yet, whenever I actually do try to get AI to meet the road … it is just query and query after clarifying query that humans would not and do not need. E.g., trying to ask clarifying questions about tsc, and TS, and … just wrong answer after wrong answer, or even just misunderstanding the question entirely. Trying to file a support ticket in big clouds now requires wading through AI slop that doesn't solve anything, just to get to a human whose writing feels suspiciously like you've been shoveled a second dose of slop. Like I just finished a quarter long ticket with GCP on "IAM is not functioning to spec, and we can clearly and concisely prove it" to get back a very long form "we don't care".
by rekabis | 2026-02-08 05:15:10+00:00
99% of my collection is in hardcover format, which has decently large type that is easy on my eyes, a comfortable heft in my hands as I sit in my curved-back wingback, and unless damaged, has great shelf stability (the ability to sit well on a shelf without physical warping causing it to slide out all over the place).

If I want portability, I have my rooted Kindle. That can fit 10,000 books into my satchel with very little complaint.
by Ygg2 | 2026-02-08 05:15:54+00:00
AMOC makes Europe hotter than expected, and US east coast colder.

Europe is already hotter than expected.

AMOC collapse in a heating world wouldn't mean much. It seems to me that whatever cooling from it will be offset by global warming.

AMOC could be a generally bad thing for biodiversity or crops, but it's not going to stop global warming.
by saidinesh5 | 2026-02-08 05:15:56+00:00
It depends on what you're building with the language too.

For eg.
In very embedded contexts where we were not using any big data structures like struct of strings, not doing any memory allocations etc... C might be easier to reason about than C++. (No hidden code paths). Just allocate something on the stack, pass the pointer to a function to do the computation, done.

In any desktop apis (gui, web servers etc..), where you deal with collections of objects, need to spin up thread pools and rely on results from the future etc... The standard library data structures (vectors, maps etc...) alone makes C++ code a lot more easy to read and review than C. When raw pointers are forbidden, Ownership of memory becomes very clear. Granted my opinion of desktop development comes mostly from very few libraries (Qt vs. Gtk, gstreamer's C API vs. C++ wrapper, http libraries etc...), but there are some problem domains for which C is just insufficient.
by zamalek | 2026-02-08 05:15:58+00:00
This is OSINT (open-source intelligence) and isn't spying by any technical standard because it's speech in a public venue, there isn't a way to raise hell like with e.g. Snowden. Spying would be going into their DMs without a warrant (which is probably happening).

> Reddit post about “spreading awareness” as though it were the secret messages of al Qaeda

Extreme waste of tax dollars, though. I guess this is an important lesson in Big Brother and "having nothing to hide." They will put something worth hiding in your hands and swiftly arrest you.
by layman51 | 2026-02-08 05:16:03+00:00
But doesn’t that article say that it hasn’t weakened from “between 1963 and 2017” with the important caveat being that after 2017, maybe there’s been more acceleration? Some other commenter on this thread also posted a similar statement about how its collapse is unlikely before 2100, but that’s not very far away which should be very concerning.
by coldtea | 2026-02-08 05:17:31+00:00
>because in all of this change we can’t be bothered to imagine a world where people have money without jobs?

We can imagine it all we want, and a free pony too. What we'll get is most of humanity not needed, and living in the edges of society, plus some 10-20 percent still "useful".

>The best bull case for us reaching luxury gay space communism is that people not working and having near infinite capital to buy whatever they want to enjoy is the only way the billionaires get to see their pot growing forever.

Billionaires are about power. The money was just a means for that, if they can get it in another way, they will use that. People "not working and having near infinite capital to buy whatever they want to enjoy" is the last thing they'll want.
by nozzlegear | 2026-02-08 05:17:48+00:00
> But here's Pfizer CEO: "When [we] do the math, shall we reduce the US price to France’s level or stop supplying France? We [will] stop supplying France. So they will stay without new medicines. The system will force us not to be able to accept the lower prices.”

This person is a less than neutral source in an industry that's already infamous for lying through its teeth to grind out every red cent from its customers. I would lend precisely zero credence to what he says when he's trying to justify why his poor billion dollar company wouldn't be able to lighten up on its wholesale fleecing of American customers.
by Zakodiac | 2026-02-08 05:18:05+00:00
The framing of "code's audience is shifting from humans to agents" feels premature. AI agents often don't have the full context needed to make good architectural decisions - they don't understand the client's constraints, the timeline, the maintenance burden, or the tradeoffs that led to a particular design. A human still needs to be the architect, and that means humans still need to be able to read and understand the code.

The real risk isn't that agents can't read messy code - it's that without humans deeply understanding the codebase, you lose the ability to catch when an agent has missed edge cases, taken a shortcut, or produced something that technically passes but doesn't actually solve the right problem. We've all seen agents "cheat" their way through tasks in ways that look correct on the surface.

So the question isn't whether good code matters less now - it arguably matters more. Clean architecture, clear documentation, and well-understood code are what let you verify that an agent did the right thing. And testing remains as useful as it's always been, not because the agent needs it, but because humans need proof that the system actually works. Tests are a spec, a review mechanism, and a safety net all in one.

We're a long way from truly hands-off AI development. Until then, writing good code is how you stay in control.
by languid-photic | 2026-02-08 05:19:15+00:00
Yes, understandable.

The question is which multi-agent architecture, hierarchical or competitive, yields the best results under some task/time/cost constraints.

In general, our sense is that competitive is better when you want breadth and uncorrelated solutions. Or when the failure modes across agents are unknown (which is always, right now, but may not be true forever).
by toss1 | 2026-02-08 05:20:04+00:00
Yup, sounds about right. Same issue with I tried Fusion a few years back...

I use RhinoCAD / MadCAM, and it is really the only thing keeping me on Windows. I've heard it works on some emulators like WINE, but haven't yet made the effort to test it, and can't really afford to have any latent issues pop up at random times after initial testing seems to work, so still enduring the Microslop insanity... ugh
by nunez | 2026-02-08 05:20:19+00:00
My pleasure!

I forgot one more thing. Your technical aptitude carries less weight as an SE. Getting the technical win at a customer is what you're evaluated on.

Since you're almost always working with engineers and technical stakeholders at the customers you're selling to, you need to be able to talk the talk to fit in, gain their trust and help them see the value of what you're selling.

But those skillets alone won't get the technical win. This is where the sales part of sales engineering matters, and it matters a lot.

A quick example: a common mistake many new SEs coming from consulting make while giving demos is showing customers everything about a product step-by-step instead of showing them only what the customer said they care about (which you, hopefully, learned in the initial discovery call) and/or what they need to see (because other similar customers usually care about those things).

The former comes very naturally to consultants, as that's a big part of the job, but giving demos this way makes it much easier to NOT show what the customer needs to see AND increases the likelihood of you showing a deficiency in the product that can reduce interest or, if it's bad enough, kill the deal.

You won't come across those kind of skills unless you (a) founded a company and try hard to build business or (b) work in sales. But these skills make or break SEs.
by f_allwein | 2026-02-08 05:24:04+00:00
Here’s the science: https://www.pik-potsdam.de/en/news/latest-news/possible-nort...

„Under high-emission scenarios, the Atlantic Meridional Overturning Circulation (AMOC), a key system of ocean currents that also includes the Gulf Stream, could shut down after the year 2100.“
by languid-photic | 2026-02-08 05:24:08+00:00
https://github.com/voratiq/voratiq

For comparison, there's a `review` command that launches a sandboxed agent to review a given run and rank the various implementations. We usually run 1–3 review agents, pull the top 3 diffs, and do manual review from there.

We're working on better automation for this step right now.
by simoncion | 2026-02-08 05:25:08+00:00
It seems like every quarter or two, I hear a story just like yours (including the <<Wow! We've quietly passed an inflection point!>> part).

What does that tell me?

It tells me that I shouldn't waste my time with a tool that's going to fundamentally change in three to six months; that I should wait until I stop hearing stories like this for a good, long while. "But you're going to be left behind!", yeah, maybe. But. I've been primarily a maintenance programmer for a very long time. The "bleeding edge" is where I am very, very rarely... and it seems to work out fine.

New tools that are useful are nice. Switching to a radically different tool every quarter or two? Not nice. I've got shit to do.
by Shadow_Death | 2026-02-08 05:25:46+00:00
LOL Nobody should be shocked. I forgot who said it but someone said something to the tune of they don't need to wire tap because people openly post all over social media for everyone to see.

People see it as a way to share information with friends and family, meanwhile governments use it as a survaylance tool, always have been.

Tin foil hat time: DARPA wanted to create LifeLog to track everything about you. Now you post everything they wanted to know about you on Facebook.

/Rant
by chasd00 | 2026-02-08 05:27:22+00:00
I think about those conversations a lot. I’m in the high power rocketry hobby and wrote my own flight controller using micropython and parts from Adafruit. Worked just fine and did everything I wanted it to do yet the others in the hobby just couldn’t stand that it wasn’t in C. They were genuinely impressed then I said micropython and all of a sudden it was trash. People just have these weird obsessions that blind them to anything different.
by flaminHotSpeedo | 2026-02-08 05:27:27+00:00
You might want to review the commenting guidelines, notably the first few.

Like you mention, big tech gravitates to a handful of tech hubs across the US, which drives up salaries for every company in the area. Which is more data suggesting something is wrong with BLS' numbers.

My expectation (based on anecdotal/personal data - if you have better data I'd love to see it) is that the median developer in a tech hub makes more than an entry level big tech kid. So unless there's either an error, omission, or unexpected inclusion in the BLS data, the data implies that nearly all of big tech, plus ~50% of developers in tech hubs, accounts for about 10% of the workforce.

That doesn't make sense. What does seem plausible is that this data doesn't account for bonuses, options, RSUs, and the like, which would put big tech entry level jobs right around the median for developers. I'm not certain if that's the case, but it at least passes the sniff test.
by parable | 2026-02-08 05:27:45+00:00
This is what I've been saying for years. I really could care less if my passwords were leaked. My phone number, on the other hand, is near-impossible to change. The fact that VoIP/virtual numbers are blacklisted from use almost everywhere doesn't help anything, because otherwise I would just use a ton of cheap rented numbers.

The same goes for full names on file, physical addresses, and other hard-to-change information. Passwords have been the least of my concerns since password managers were invented.

You could, in theory, use a custom domain or email aliasing service like SimpleLogin or Addy to combat the email address issue, though websites like GitHub have been known to block emails created with an aliasing service. I could go on about why that move does next to nothing to combat actual abuse; any spammer worth their salt can just buy a bunch of Gmail accounts or Outlook accounts instead.