MurphyA/hacker-news huggingface dataset:
by kai-agi | 2026-02-22 01:30:50+00:00
Nice. What endpoints does your scanner probe? Asking because after scanning 518 servers from the Official MCP Registry, the most common issues were:
1. No authentication (41%) – just open SSE endpoints
2. SSRF via URL-accepting tools (file readers, webpage fetchers)
3. Overly broad tool permissions (shell exec, filesystem write)

We found that checking for authentication presence + tool capability enumeration catches most of the risk. More details on methodology: https://dev.to/kai_security_ai/i-scanned-every-server-in-the...
by shepherdjerred | 2026-02-22 01:31:57+00:00
I really don't understand why there are so many comments like this.

Yesterday I had Claude write an audit logging feature to track all changes made to entities in my app. Yeah you get this for free with many frameworks, but my company's custom setup doesn't have it.

It took maybe 5-10 minutes of wall-time to come up with a good plan, and then ~20-30 min for Claude implement, test, etc.

That would've taken me at least a day, maybe two. I had 4-5 other tasks going on in other tabs while I waited the 20-30 min for Claude to generate the feature.

After Claude generated, I needed to manually test that it worked, and it did. I then needed to review the code before making a PR. In all, maybe 30-45 minutes of my actual time to add a small feature.

All I can really say is... are you sure you're using it right? Have you _really_ invested time into learning how to use AI tools?
by gus_massa | 2026-02-22 01:34:21+00:00
There are official threads for jobs, https://news.ycombinator.com/newsfaq.html

Latest edition https://news.ycombinator.com/submitted?id=whoishiring

They are closed now, but you can take a look. Wait until March 2nd for next month edition, take a look and repost in the correct one.
by apothegm | 2026-02-22 01:34:46+00:00
There is an alternative, which is that $BigCorp for whom a single SWE salary is a drop in the ocean offers to hire the maintainer as a FTE. If there’s only a fraction of an employee’s worth of work to do to maintain the package, they give the maintainer other responsibilities as well, helping build or maintain other software (or processes or teams or whatever).
by ompogUe | 2026-02-22 01:35:04+00:00
>> Abstractions often really do speed up production, but you pay the price in maintenance later on.

> What? I don't know what this means. Good abstractions allow us to better maintain code. Maintaining something that hasn't been structured into appropriate abstractions is a nightmare.

100% agree with this. Name it well, maintain it in one place ... profit.

It's the not abstracting up front that can catch you: The countless times I have been asked to add feature x, but that it is a one-off/PoC. Which sometimes even means it might not get the full TDD/IoC/feature flag treatment (which aren't always available depending upon the client's stack).

Then, months later get asked to created an entire application or feature set on top of that. Abstracting that one-off up into a method/function/class tags and bags it: it is now named and better documented. Can be visible in IDE, called from anywhere and looped over if need be.

There is obviously a limit to where the abstraction juice isn't worth the squeeze, but otherwise, it just adds superpowers as time goes on.
by magicalhippo | 2026-02-22 01:35:08+00:00
Some years ago I realized that if I had oodles of money to spend I would totally get someone to make a PCIe card with like several hundreds microSD cards on it.

You can buy vertical microSD connectors, so you can stack quite a lot of them on a PCIe card. Then a beefy FPGA to present it as a NVMe device to the host.

Goal total capacity, as you can put 1TB cards in there. And for teh lulz of course.
by dmix | 2026-02-22 01:35:11+00:00
There's a long legacy in America which has led to the expansion of the executive branch. It didn't start with Trump. Almost every power he's abusing was recklessly laid down in prior administrations/congress. FDR caused lots of controversy with how he acted and there was a pull back from executive power, including administrative laws currently slowing Trump down.

There's lots of other examples, such as the various emergency powers, including a large string of them for terrorism during Bush and expanded during Obama.

I've been posting about this issue on HN long before Trump was in power and plenty of journalists were documenting it.
by musicale | 2026-02-22 01:35:13+00:00
360 also benefited from PS3 issues (unusual architecture that was hard to program effectively, high price ). GamePass is great, and the Xbox hardware is good, but PS4 and PS5 had stronger timed exclusives while Switch had an appealing combination of Nintendo first-party exclusives (several of them rising from the ashes of the Wii U), lower cost, and handheld/hybrid operation.
by Delk | 2026-02-22 01:36:42+00:00
> biwepe(?)

Probably beweep; lament, weep over.

> pinunge(?)

This is explained later on the page. "Where a modern writer would say he underwent torture, a 1200-era writer must say that he suffered pinunge instead."

I also couldn't understand this one although the word "pining" did come to mind, apparently not totally off, as that has apparently come from the same ancestor. Didn't help me figure out the intended meaning, though.

> No scar(?) is never hit(?) forgotten, not uuhiles(?) is libbe(?).

I guessed this meant something along the lines of "[?] shall I never [?] forget, not while I live". I didn't figure out that "uu" is actually "w" until that was explained, so it escaped me that "uuhiles" is "while[s]", though.
by jcdavis | 2026-02-22 01:37:23+00:00
Its a wild time to be in software development. Nobody(1) actually knows what causes LLMs to do certain things, we just pray the prompt moves the probabilities the right way enough such that it mostly does what we want. This used to be a field that prided itself on deterministic behavior and reproducibility.

Now? We have AGENTS.md files that look like a parent talking to a child with all the bold all-caps, double emphasis, just praying that's enough to be sure they run the commands you want them to be running

(1 Outside of some core ML developers at the big model companies)
by jacquesm | 2026-02-22 01:38:06+00:00
This is an interesting area for experiments. I suspect that in the longer term model optimization (knowing which bits you can leave out without affecting the functioning of the model) will become the dominant area of research just like it did with compression algorithms because effectively a model is a lossy compression scheme.

And that's good because that increases democratization of AI away from the silos that are being created.
by a_e_k | 2026-02-22 01:38:09+00:00
Author here. What a pleasant surprise to see this trending on the front page!

(I did post a Show HN at the time of the original release, https://news.ycombinator.com/item?id=33148540, but it never gained traction.)

Just to answer some comments that I see:

1. This was absolutely not vibecoded!

I'd originally started with a different version control system and was still getting used to Git and GitHub at the time that I'd released this. (I was a latecomer to Git just because I hated the CLI so much.) It was easiest for me just to drop the whole thing as a snapshot in a single commit.

But my private repo for it actually started in May 2017, and it had 320 commits leading up to its release, all human-written.

For the v2.0 that I have in mind, I'm thinking of force-pushing to migrate the full development history to the public repo.

And finally I'll add that I'm a graphics engineer by education and career. Where would the fun be in vibe-coding this? :-) Oh, and this compiles down to just ~36KiB of object code on x86-64 last I checked. Good luck vibe-coding that constraint.

2. Why a single header with `#define CANVAS_ITY_IMPLEMENTATION`?

I was inspired by the STB header ibraries (https://github.com/nothings/stb) and by libraries inspired by those, all of which I've found very convenient. In particular, I like their convenience for small utilities written in a single .cpp file where I can just `g++ -O3 -o prog prog.cpp` or such to compile without even bothering with a makefile or CMake.

Since the implementation here is all within a single #ifdef block, I had figured that anyone who truly preferred separate .cpp and .h files could easily split it themselves in just a few minutes.

But anyway, I thought this would be a fun way of "giving back" to the STB header ecosystem and filling what looked to me like an obvious gap among the available header libraries. It started as something that I'd wished I'd had before, for doing some lightweight drawing on top of images, and it just kind of grew from there. (Yes, there was Skia and Cairo, but both seemed way heavier weight than they ought to be, and even just building Skia was an annoying chore.)

----

Since I mentioned a v2.0, I do have a roadmap in mind with a few things for it: beside the small upgrades mentioned in the GitHub issues to support parts of newer <canvas> API specs (alternate fill rules, conic gradients, elliptical arcs, round rectangles) and text kerning, I'm thinking about porting it to a newer C++ standard such as C++20 (I intentionally limited v1.0 to C++03 so that it could be used in as many places as possible), possibly including a small optional library on top of it to parse and rasterize a subset of SVG, and an optional Python binding.
by mapontosevenths | 2026-02-22 01:38:36+00:00
> As long as AIs are either non-deterministic or chaotic

You just hit the nail on the head.

LLM's are stochastic. We want deterministic code. The way you do that is with is by bolting on deterministic linting, unit tests, AST pattern checks, etc. You can transform it into a deterministic system by validating and constraining output.

One day we will look back on the days before we validated output the same way we now look at ancient code that didn't validate input.
by DontForgetMe | 2026-02-22 01:39:07+00:00
I think your reflexive disagreement is a testimony to the point of the article. And the fact that you didn't immediately notice what was the authors view vs what they were relaying, may be testimony to the author's good writing.

I found it to be an unexpectedly evocative piece, a kind of poetic prose style that I don't see very often in journalism, let alone tech journalism.
Each word seemed carefully chosen to make the reader almost fell like they were there, witnessing, understanding.

So, I can imagine the author being a little pleased that you reacted to that passage with a sudden skepticism. Seems like a very successful case of 'show, don't tell'.
by alexmorgan26 | 2026-02-22 01:39:08+00:00
This separation of planning and execution resonates deeply with how I approach task management in general, not just coding.

The key insight here - that planning and execution should be distinct phases - applies to productivity tools too. I've been using www.dozy.site which takes a similar philosophy: it has smart calendar scheduling that automatically fills your empty time slots with planned tasks. The planning happens first (you define your tasks and projects), then the execution is automated (tasks get scheduled into your calendar gaps).

The parallel is interesting: just like you don't want Claude writing code before the plan is solid, you don't want to manually schedule tasks before you've properly planned what needs to be done. The separation prevents wasted effort and context switching.

The annotation cycle you describe (plan -> review -> annotate -> refine) is exactly how I work with my task lists too. Define the work, review it, adjust priorities and dependencies, then let the system handle the scheduling.
by dragonwriter | 2026-02-22 01:39:34+00:00
> You don't give the agent the password, you send the password through a method that bypasses the agent.

The thing is, to work, you need to send the warning that indicates what the specific action is that is being requested to the authorizing user out of band (rather than to the agent so the agent can request user action); otherwise sending the password from the user to the system needing authorization out of band bypassing the agent doesn't help at all.
by tyleo | 2026-02-22 01:39:45+00:00
Same here. I did bounce off these tools a year ago. They just didn't work for me 60% of the time. I learned a bit in that initial experience though and walked away with some tasks ChatGPT could replace in my workflow. Mainly replacing scripts and reviewing single files or functions.

Fast forward to today and I tried the tools again--specifically Claude Code--about a week ago. I'm blown away. I've reproduced some tools that took me weeks at full-time roles in a single day. This is while reviewing every line of code. The output is more or less what I'd be writing as a principal engineer.
by jongjong | 2026-02-22 01:40:11+00:00
Because JavaScript is the best for the application layer. We just have to accept that this is reality. AI training sets are just full of JS... Good JS, bad JS... But the good JS training is really good if you can tap into it.

You just have to be really careful because the agent can easily slip into JS hell; it has no shortage of that in its training.
by danjl | 2026-02-22 01:41:32+00:00
I think that comment is interesting as well. My view is that there is a lot of Electron training code, and that helps in many ways, both in terms of the app architecture, and the specifics of dealing with common problems. Any new architecture would have unknown and unforeseen issues, even for an LLM. The AIs are exceptional at doing stuff that they have been trained on, and even abstracting some of the lessons. The further you deviate away from a standard app, perhaps even a standard CRUD web app, the less the AI knows about how to structure the app.
by xp84 | 2026-02-22 01:41:33+00:00
You’ve asked for feasibility. But do you want “a brutally frank critique” of that idea? If not, why?

If you do - if someone wants an AI-generated critique of their idea, they can type it into a chatbot themselves. Anytime you find yourself trying to add value to the world by pasting something into a chatbot with a prompt that would be obvious, remind yourself: basically anyone can make that same thing themselves for free.
by jamesmcq | 2026-02-22 01:41:41+00:00
Exactly my thoughts - the value in AI is not auto-generating anything more than something trivial, but there's huge value in a more customized knowledge engine - a targeted, specific Google if you will. Get answers to your specific question instead of results that might contain what you were looking for if you slog through them.

AI is hugely beneficial in understanding a problem, or at least getting a good overview, so you can then go off and solve/do it yourself, but focusing on "just have the AI generate a solution" is going to hugely harm AI perception/adoption.
by keyle | 2026-02-22 01:42:11+00:00
I partly agree with you. But once you have a codebase large enough, the changes become longer to even type in, once figured out.

I find the best way to use agents (and I don't use claude) is to hash it out like I'm about to write these changes and I make my own mental notes, and get the agent to execute on it.

Agents don't get tired, they don't start fat fingering stuff at 4pm, the quality doesn't suffer. And they can be parallelised.

Finally, this allows me to stay at a higher level and not get bogged down of "right oh did we do this simple thing again?" which wipes some of the context in my mind and gets tiring through the day.

Always, 100% review every line of code written by an agent though. I do not condone committing code you don't 'own'.

I'll never agree with a job that forces developers to use 'AI', I sometimes like to write everything by hand. But having this tool available is also very powerful.
by liumw1203 | 2026-02-22 01:42:16+00:00
Guilty as charged.

English isn't my native language (I'm based in China), so I use an LLM to translate my messy notes and polish my replies. I get nervous about messing up the technical nuances when talking to guys like you and beans42 on here.

But to be clear: the actions are 100% human and real. The raw extraction in that Gist is actual backend output I queried from the DB, and the fake UI logger really is getting ripped out today.

Appreciate the callout—I clearly need to tune my prompt to sound less like a PR bot.
by a_e_k | 2026-02-22 01:42:26+00:00
Author here. No vibe-coding, all human-written. Are you thinking of my use of GitHub emoji on the section headings in the README? I just found they helped my eye pick out the headings a little more easily and I'd seen some other nice READMEs at the time do that sort of thing when I went looking for examples to pattern it off of. I swear I'd had no idea it would become an LLM thing!
by ctoth | 2026-02-22 01:42:51+00:00
> Where is AI when you need it?

Back in 2003 or so some wonderful smart folks added accessibility to the Quake engine. Since then, there have been very few accessible FPS games.

I just took Claude, dropped it in the AudioQuake engine directory, asked it to write up a taxonomy of the accessibility solutions used to make quake accessible, waited, dropped the EDuke32 source next to it, and said "Let's plan for how we can make this accessible now using similar techniques."

I now have the beginning of a working accessibility mod[0], and am walking around replaying Hollywood Holocaust, something I haven't been able to do since I played with my dad (him driving and me shooting). It's kind of amazing, actually.

I am totally blind.

[0]: https://gist.github.com/ctoth/f955884813dd0daa497914108c467c...
by a-dub | 2026-02-22 01:43:32+00:00
> To me that implies the input isn't deterministic, not the compiler itself

or the system upon which the compiler is built (as well as the compiler itself) has made some practical trade offs.

the source file contents are usually deterministic. the order in which they're read and combined and build-time metadata injections often are not (and can be quite difficult to make so).
by snowhale | 2026-02-22 01:43:40+00:00
the threat model that actually matters for most users isn't 'malicious server' -- it's 'LastPass gets breached and attacker gets an encrypted vault dump.' the research is interesting but the real-world risk for cloud password managers is much more basic: the offline derivation attack when you have the encrypted blob. that's what happened in the 2022 breach.
by keepamovin | 2026-02-22 01:43:42+00:00
This is not the concern for me. I thought the risk was obvious to everyone. Tho I've been tempted because it means I'll "have more interactions" or whatever LinkedIn pitches with, I didn't want to put a public signal out there with yes: "This is my real name, real job, real city" - to me it's like a pre-vetted database of marks for identity theft criminals or whatnot. You know?

I thought everyone, at least in security would be somewhat concerned about this, but they're not. I get the benefits, and I want to enjoy those benefits too. I'd much prefer if I could privately confirm my name using IDs (zero problem with that) but then not have to show it or an exact profile photo. I'm sure there's a cryptographic way for my identity to be proven to any who I chose to prove it to who required such bona fides. I dislike the surface of "proven identity for everyone". You know?

This to me is the far more important thing than: "security focused biometric company processed my data, therefore being rational and modern I will now have a meltdown." Everytime you drive, use a payment method linked to your name, use your plan phone, your laptop, go to a venue that ID scans, make a rental, catch a flight, cross a border, etc, your ID (or telemetric equivalents sufficient to ID you) is processed by some digital entity. If you will revolt against the principle of "my government issued and not-truly-mine-anyway ID documents, or other provided bona fides are being read by digital entities contracted to do that", it seems nonsensical.

I think the bigger risk is always taking a photo of your passport and putting it on the internet, which is basically what the current LI verification means. Casual OSINT on a verified profile likely reveals the exact birthday (or cross-referenced on other platforms), via "happy birthday" type posts. How old am I type image AI can give you rough years.
by econ | 2026-02-22 01:44:08+00:00
Some time around 2010 I update th virus and Trojan definitions on a windows 95 machine that wasn't really used beyond 2004. It had every free scanner one could download. They found over 1500 things. Apparently someone ran a trojan generator on my machine. I don't know when they all became known trojans or if it found all of them but when the box was in use the scanners found nothing.

God knows what is sleeping on our machines today.

I once hear there are very very expensive tools with luxurious gui's that bundle bags of fresh exploits and receive new ones over the tubes.

The guy told me that most of the code involved cleaning up after it self.

I think the AI will only run known exploits? Its nice to find those but if anyone really wants in it's just a matter of money.

I'm curious what applications we can bake into hardware. You can't insert malicious bread into a toaster to gain access to other things.
by adamtaylor_13 | 2026-02-22 01:44:39+00:00
As many have pointed out, code is not free. More than that, the ability to go fast only makes architectural mistakes WORSE. You'll drive further down the road before realizing you made the wrong turn.

A native app is the wrong abstraction for many desktop apps. The complexity of maintaining several separate codebases likely isn't worth the value add. Especially for a company hemorrhaging money the way the Anthropic does.
by filldorns | 2026-02-22 01:45:16+00:00
I'm not saying that those who use these terms are racist. I'm saying that language evolves. If there are equivalent technical alternatives that don't carry a history of oppression, why not use them? It costs nothing and can make the environment more inclusive. This doesn't replace concrete actions, but it also doesn't prevent them from happening.

If changing a word is "purely performative," then keeping it is also purely performative. The difference is that one choice preserves a metaphor of domination and the other does not. Technology is made of choices. This is one too.
by crazylogger | 2026-02-22 01:46:26+00:00
Money is useful mostly for hiring human labor to outcompete others, e.g. Satya Nadella has 100K employees under his command, you don't, so you can't realistically compete with MS today - this is their main moat.

If AI renders human labor a cheap commodity (say you can orchestrate a bunch of agents to develop + market a Windows competitor for $1000 of compute), what used to be "Satya + his army vs. you" now becomes mostly a 1:1 fair fight, which favors the startup.
by jamesmcq | 2026-02-22 01:48:26+00:00
Trust me I'm very impressed at the progress AI has made, and maybe we'll get to the point where everything is 100% correct all the time and better than any human could write. I'm skeptical we can get there with the LLM approach though.

The problem is LLMs are great at simple implementation, even large amounts of simple implementation, but I've never seen it develop something more than trivial correctly. The larger problem is it's very often subtly but hugely wrong. It makes bad architecture decisions, it breaks things in pursuit of fixing or implementing other things. You can tell it has no concept of the "right" way to implement something. It very obviously lacks the "senior developer insight".

Maybe you can resolve some of these with large amounts of planning or specs, but that's the point of my original comment - at what point is it easier/faster/better to just write the code yourself? You don't get a prize for writing the least amount of code when you're just writing specs instead.