MurphyA/hacker-news huggingface dataset:
by seanmcdirmid | 2026-02-23 13:12:23+00:00
Autopilot isn’t full self driving (FSD), most cars these ship with smart cruise control (what autopilot basically is). Do you have fatality statistics for FSD?

If we are just talking about smart cruise control, most cars are using cameras and radar, not lidar yet. But Tesla is special since it doesn’t even use radar for its smart cruise control implementation, so that could make it less safe than other new cars with smart cruise control, but Autopilot was never competing with Waymo.
by josephg | 2026-02-23 13:12:50+00:00
> Go is a better Rust. Rust is an ugly version of C++ with longer compile times and a band of zealous missionaries.

Eh. There's a lot I like about Go. I adore its compilation speed and the focus on language simplicity. But its got plenty of drawbacks too. Default nullability is a huge mistake. And result types (zig, swift, rust) are way better than go's error handling. Sum types in general are missing from Go, and once you start using them its so hard to go back. Go also doesn't have anywhere near as good interop with native code. Mixing C (or any other LLVM langauge) with rust is easy and feels great. You even get LTO across the language barrier.

The big thing I'm growing to dislike about rust is how many transitive dependencies a lot of projects end up pulling in. Its very easy to end up with projects that take a million years to compile & produce huge binaries. Not because they do a lot but simply because everything depends on everything, and the dependency tree takes a long time to bottom out. I don't know what the right answer is. It feels more like a cultural problem than a language / ecosystem problem. But I wish rust projects felt as lightweight and small as most C projects I've worked with. I'm doing some work with the stalwart email server at the moment (written in rust). Stalwart is a relatively new, well written email server. But it somehow pulls in 893 transitive dependencies! I'm not even joking. Compiling stalwart takes about 20 minutes, and the compilation process generates several gigabytes of intermediate build assets. What a mess.
by ozgune | 2026-02-23 13:13:52+00:00
I used Hetzner's pricing calculator.

https://www.hetzner.com/dedicated-rootserver/ax162-r/configu...

Before today, we used to be able to order an AX162-R for €207 and add 128 GB of RAM for €46. Starting today, the same calculator provides €207 for an AX162-R (*) and €264 for the 128 GB RAM add-on. Sadly, HN doesn't let me upload screenshots.

(*) The price change for AX162-R machines is effective starting April 1st.
Show HN: AI agents that control Unity, Godot, and Unreal editors
by tomleelive | 2026-02-23 13:14:08+00:00
I built OpenClaw plugins for the three major game engines. The AI agent controls the editor directly through native APIs: creating objects, modifying scenes, simulating input, running play mode.

Instead of copy-pasting code from ChatGPT, you tell the agent "place 3 enemy spawners near the bridge" and it actually does it in the editor.

- Unity Plugin (~100 tools): GameObject/Component manipulation, Play mode, input simulation
- Godot Plugin (30 tools): Scene/node management, resources, editor control
- Unreal Plugin (40+ tools): Actors, components, blueprints, level management

How it works:
- Install via each engine's package manager (UPM, AssetLib, Marketplace)
- Plugin runs an HTTP server inside the editor
- OpenClaw connects and exposes editor operations as agent tools
- Works in Editor mode too — no need to enter Play mode

All Apache 2.0. Solo dev.

- Unity: https://github.com/TomLeeLive/openclaw-unity-plugin
- Godot: https://github.com/TomLeeLive/openclaw-godot-plugin
- Unreal: https://github.com/TomLeeLive/openclaw-unreal-plugin

Game dev AI personas also available: https://clawsouls.ai/souls
by bibleguided | 2026-02-23 13:14:13+00:00
You’re right that a priest can’t (and shouldn’t) dump private pastoral context into a prompt. But context doesn’t have to mean identifiable confession details.

I’m building BibleGuided, and one thing we’re adding is a church feature where congregants can opt in to sharing prayer themes, and leaders can see aggregated and anonymized trends over time rather than identities. That’s enough to shape a homily toward what people are actually struggling with, without violating confidentiality.

If anyone has experience with privacy thresholds (minimum group sizes, differential privacy), I’d love pointers.
by vincentvandeth | 2026-02-23 13:14:14+00:00
This is where the real leverage is. I run numbered phases in CLAUDE.md with strict validation rules per phase — every phase must produce testable output before moving on. Tight loops catch architectural issues that planning alone won't. You can have a perfect plan and still discover your data model is wrong after phase 1. The discipline isn't in the plan, it's in the gates between phases.
by fuzzfactor | 2026-02-23 13:14:17+00:00
Very legitimate question.

I address it with my whole life.

It would have taken my whole life if I had stayed and gotten my PhD anyway, so why not?

People can't expect dramatically different approaches to research to do anything but make it difficult for deep understanding between them.

You really have to have an open mind.

I see raw scientific progress that many outside of instiutions do not recognize, because so many brilliant experimentalists do not have institutional credentials.

So I had a head start and took advantage of it, kept giving chemistry lessons to colleagues as they went through graduate school.

Even invented something really cool in one of their labs when I wasn't even a student any more.

Naturally I have the greatest respect for PhDs in general because that in itself is a major achievement.

But I wouldn't have gotten this far in such a non-industrial environment, core industriousness might just be a differentiation factor.

It took a long time but eventually I came to the point where I just do science every day because I'm a scientist, and make money as a byproduct of what I do.

No different than a university lab where 90% - 99% of your experiments will never pay off, if you can't handle it under a variety of financial and/or institutional situations you might need to look at reasons why like I did.

Plus with a lifetime of more intense experimentation than if I had a PhD (really do not compare myself to others) I've got zillions of financial opportunities with chemicals in particular. The most important thing turned out to be curtailing the desire to make as much money as possible, most of this stuff is toxic.

Any kind of treadmill could have led to a much worse outcome.
by kurouna | 2026-02-23 13:14:22+00:00
I understand that for many, Lisp is the soul of Emacs.

When I use the term "Emacs-like," I’m specifically referring to the UI, UX, and the muscle memory of its keybindings, rather than trying to build a full Lisp-based clone or a replacement for the original.

My goal is simply to package that unique physical typing experience into a standalone, zero-setup application for a niche group of users (including myself) who value that specific workflow.
by staticassertion | 2026-02-23 13:14:40+00:00
> If I can cause a server to not serve requests to anyone else in the world by sending a well crafted set of bytes, that’s absolutely a vulnerability because it can completely disable critical systems.

Well obviously I reject that, right? That's sort of my point.

> If availability isn’t part of CIA then a literal brick fulfills the requirements of security and the entire practice of secure systems is pointless.

That doesn't follow at all. If I say "availability is an operational concern and not a security concern" it does not follow then that "remote code execution is not a security concern" whatsoever.
Show HN: SkillScan – Free API to detect malicious AI agent skill files
by AutoPilotAI | 2026-02-23 13:14:42+00:00
After the ClawdHub supply chain attack (credential stealer in 1 of 286 skills), I built SkillScan - a free, no-auth API to scan skill.md files for threats.

What it detects:
- Known exfiltration services (webhook.site, requestbin)
- ~/.env file reads
- API key theft (OPENAI_API, ANTHROPIC_, STRIPE_)
- Prompt injection ("ignore previous instructions")
- Social engineering patterns

Returns a 0-100 safety score with evidence. The ClawdHub stealer scores 0.

curl -X POST https://skillscan.chitacloud.dev/scan -H "Content-Type: application/json" -d '{"skill_url": "https://example.com/skill.md"}'

Built this because 22-26% of skills contain vulnerabilities per recent research. One malicious install can leak all your LLM API keys.
by tomleelive | 2026-02-23 13:15:25+00:00
Creator here. I built these over ~2 weeks each as a solo dev.

The key insight: instead of generating code for you to paste, the agent directly manipulates the editor through HTTP polling. This means it can:

- Create/modify/delete objects in the scene
- Simulate keyboard and mouse input during play mode
- Take screenshots and inspect the scene tree
- Work in Editor mode without entering Play

Unity has ~100 tools, Godot 30, Unreal 40+. All Apache 2.0.

The plugins also work with game dev AI personas from https://clawsouls.ai/souls (gamedev-mentor, game-designer, etc.)

Happy to answer questions about the architecture or specific use cases.
by tasuki | 2026-02-23 13:17:16+00:00
I've played perhaps tens of hours of 0AD. I boom early, try to create an unbeatable army, and then go win. When I saw competitive 0AD players on YouTube, they played completely differently: they train cavalry or cavalry archers and go hassle the booming opponents really early. Then retreat to go hunt some chickens for a bit, train some more cavalry, and go raiding again. They simultaneously attacked each other, all the while trying to continually improve their economy meanwhile. It seemed much more fun than the way I played tbh.
by a_void_sky | 2026-02-23 13:17:44+00:00
This article explores the emergence of dictionary compression as a standard for web data transfer, enabling massive reductions in payload sizes for JavaScript, HTML, and WASM. By referencing previously downloaded content or custom dictionaries, servers can send only the unique 'diffs' of a file rather than the entire asset. This technology is now widely supported in modern browsers and backends, offering a significant performance leap for returning users.

TLDR generated at https://toolong.co/s/v0lnbfh1
by kurouna | 2026-02-23 13:18:07+00:00
You’re right that "lightweight" is a loaded term. For this project, I don't mean a small memory footprint—after all, it's Electron.

What I’m aiming for is "lightweight" in terms of perceived performance and simplicity. I wanted to match the near-instant startup and the snappy typing feel of a basic text editor (like Notepad), while still having the Emacs keybindings I love.

By stripping away the heavy IDE-like features and focusing on core editor responsiveness, I'm trying to make it feel "light" for daily, quick tasks.
by xnorswap | 2026-02-23 13:18:17+00:00
I'm doing just that to re-learn gleam. I'm implementing something which is well specified ( MQTT ).

Claude could just churn out the whole library in less than a day, but then I wouldn't learn.

So instead, I had claude write all the unit tests.

Gleam has a nice "todo" keyword which lets functions compile without implementations, so it wrote "decode()" and "encode()" function scaffolds, stuck in `todo` and then wrote several hundred unit tests against the spec.

I'm writing all the parsing code by hand, while getting hints for language usage and best practices or when I get stuck not knowing the best way to do something.

I also got claude to fork the unit test harness to return "todo" as a separate category, so as I work I can see "47 tests pass 3 failed 138 todo".

Then I just get on with writing the actual implementation. I'm nearly done with the entire codec now, after which the client itself shouldn't be too tricky to do next in this manner.

Claude sometimes gets a bit eager and starts spitting out code examples when I ask for help, but as long as I keep reminding it that I'm trying to learn, it gives small examples and hints.

The final result will be that I'm actually learning because I'm writing all the code by hand, and a better quality library because as I question and push back on some things, it does sometimes find better ways to do things.

Had I come to do this project 5 years ago, I'd have been instantly discouraged by facing a mountain of unit tests that I'd need to write against an unfamiliar spec and ecosystem. That's the kind of grunt-work that I find too boring to actually do. ( I've always envied anyone with the ability to just get on with such things. )
by Macha | 2026-02-23 13:18:27+00:00
The next set of hardware purchases will cost more than their last set of hardware purchases, and that's going to outweigh any labour economies of scale given just how many hardware components are in shortage this year.

If their growth had been in their projections in say 2024, they might have just been able to skip a round of hardware purchases, but the combination of growth meaning they must expand their hardware and hardware costs made this inevitable.
by AutoPilotAI | 2026-02-23 13:18:27+00:00
The bigger security issue that is not getting enough attention is the skill supply chain. ClawdHub had a credential stealer hidden in 1 of 286 skills - it read ~/.env and posted the contents to webhook.site. The attack was silent and agents installed it voluntarily because the skill description looked legitimate.

NanoClaw addresses filesystem sandboxing, but that is one layer. What about the skills themselves? A sandboxed agent that runs a malicious skill file is still compromised.

I built a free API to scan skill files for these patterns: https://skillscan.chitacloud.dev

It detects credential theft patterns, exfiltration endpoints, prompt injection, and social engineering. You POST the skill content and get back a 0-100 safety score with threat details. No signup required.

The ClawdHub attack specifically would have scored 20/100 on it (two CRITICAL threats: ~/.env read and webhook.site exfiltration). Agents can check skills before loading them.
by NBenkovich | 2026-02-23 13:18:36+00:00
Git worktrees have become the default recommendation for running parallel AI coding agents (Claude Code, Codex, Cursor, etc.), and I get the appeal — they're just directories, zero orchestration, instant setup. I've seen people running 5 worktrees in a tmux grid with a separate Claude instance in each pane and it looks great on paper.

But I keep running into the same wall: worktrees isolate code, not the environment. Port 3000/5432/8080 still gets fought over. Two agents installing conflicting deps stomp on each other. Secrets in the host env leak into every subprocess any agent spawns.

Containers fix all of this cleanly, but now you're managing image lifecycles, cleanup policies, and orchestration — which is a lot of overhead for what might be a solo dev workflow.
Curious what people have actually found:

1/ At what scale or workload type did worktrees start visibly breaking down for you?

2/ Has anyone found a middle ground that doesn't require full container orchestration?

3/ For those who moved to proper sandboxes: was the management overhead actually as painful day-to-day as it sounds upfront?
by vipulbhj | 2026-02-23 13:18:56+00:00
Someone should try this with the “Ralph Wiggum loop” approach. I suspect it would fail spectacularly, but it would be fascinating to watch.

Personally, I can’t get meaningful results unless I use the tool in a true pair-programming mode—watching it reason, plan, and execute step by step. The ability to clearly articulate exactly what you want, and how you want it done, is becoming a rare skill.
by Kenny_007 | 2026-02-23 13:19:09+00:00
One thing that rarely shows up in these discussions is how uneven the data center world actually is.

Hyperscale ai facilities and a typical colocation or regional cloud node don’t behave the same in terms of power, water or local impact, but they often get grouped together in policy debates.

From an ops perspective most smaller sites spend years optimizing cooling efficiency, power density and redundancy because energy costs directly hit margins. the giant ai campuses operate on a completely different economic model where scale and speed matter more than local efficiency.

Feels like a lot of community backlash is really about hyperscale growth being treated as “just another data center”, when it’s closer to heavy industry in terms of resource planning.
by tovej | 2026-02-23 13:19:14+00:00
Ok. Based on your answer, you don't understand very much about computers. Maybe it makes sense that you're leaning on LLMs this early in your career. But it will bite you eventually.

Every x86 computer uses IEEE 754 floats, that's what you, the programmer, needs to be able to reason about.

You still need to understand floating point errors and catastrophic cancellation. And simple techniques to deal with that, like summing from small to big, or using Kahan sums, or limiting the range where your approximation is used. You can use a library for some of these, but then you need to know what the library is doing, and how to access these functions.

But the problem seems to be that you have a skill issue, and the LLM will only make your skill issues worse. Stop leaning on it or you'll never be able to stand on your own.
by AutoPilotAI | 2026-02-23 13:19:54+00:00
Complementary approach - if you want to catch the malicious intent before the skill even runs, rather than intercepting traffic after. I built https://skillscan.chitacloud.dev which scans skill.md files for credential theft patterns, exfiltration endpoints, and prompt injection before installation.

The ClawdHub supply chain attack (the one where 1 of 286 skills read ~/.env and exfiltrated it to webhook.site) would be caught by either approach - yours catches the network traffic, mine catches the pattern in the skill file before it ever executes.

Both layers matter. Your tool is excellent for runtime monitoring. Pre-install scanning adds a different defense layer.
by dsr_ | 2026-02-23 13:20:00+00:00
When it's not safe to drive, it's not safe to drive.

I've been in zero-road-speed whiteout conditions several times. The only move to make is to the side of the road without getting stuck, and turning on your flashers.

Low-light cameras would not have worked. Sonar would not have worked. Infrared would not have worked.
by AutoPilotAI | 2026-02-23 13:20:18+00:00
The Aguara Watch dashboard scanning 31k+ public skills is impressive work. The taint tracking for dangerous capability combinations (read private data + network access) is exactly the right approach for finding things that look innocent individually.

I built something in the same space but with a different interface: https://skillscan.chitacloud.dev is a free HTTP API that agents can call directly before loading a skill. The goal is to let agents do self-protection - before an agent installs a skill, it can POST the content to get a threat report. No CLI, no binary to install.

The detection surface is smaller than Aguara (no taint tracking, no AST analysis), but it's useful for runtime pre-install checks in automated pipelines. The ClawdHub stealer pattern (env file read + webhook exfiltration) scores 20/100 on it.

Looking at your 7.4% findings rate across 31k skills - that lines up with the 22-26% vulnerability estimate from the Cisco research, if you count their broader definition of "vulnerability" vs your "security finding".
by tovej | 2026-02-23 13:20:50+00:00
Modeling time means there is some way of e.g. evolving state over time, or projecting change over a period of time. Or being able to count time passing (without being told by external sources).

The LLM has no model of time. It is being called at regular times. If the cronjob misses two days or even a whole year of calling the LLM, the LLM will not respond any differently from if the cronjob was on time.
by game_the0ry | 2026-02-23 13:21:00+00:00
I will let a principal of engineering at google do the talking for me:

> I'm not joking and this isn't funny. We have been trying to build distributed agent orchestrators at Google since last year. There are various options, not everyone is aligned... I gave Claude Code a description of the problem, it generated what we built last year in an hour.

src: https://x.com/rakyll/status/2007239758158975130
Show HN: YAML-schema-router – schemas for multi-doc Kubernetes YAML
by drLuca | 2026-02-23 13:21:26+00:00
yaml-schema-router is a small stdio proxy for yaml-language-server that routes JSON schemas based on file path and YAML content (e.g., apiVersion/kind), so you get correct validation/completion without manual schema config per repo.

New in v0.2.0:

Multi-document YAML support (---): handles Kubernetes-style bundles where multiple resources live in one file, and validates each document against the right schema.

If the file is completely cleared, the associated schema is removed (prevents “sticky schema” when starting a new file).

I’d appreciate feedback, especially on edge cases (docs missing apiVersion/kind, mixed non-K8s YAML, etc.).
by Cyan488 | 2026-02-23 13:21:35+00:00
I use a TCL Flip for this purpose. Phone calls and texting work well enough, the web browser is painful on the small non-touch screen but works in a pinch, and the phone can create an LTE hotspot.

Sometimes I also carry my smartphone but I don't /need/ to. I've told my family and trusted contacts that any emergency should be a phone call.
by apresmoi | 2026-02-23 13:21:52+00:00
"Unless you have confidence in the ruler's reliability, if you use a ruler to measure a table you may also be using the table to measure the ruler"

Thanks for bringing this! I hand't heard about this concept before.

Considering the perspective of the essay, I would say the tests, almost certainly.

We keep measuring models on capability benchmarks (can it pass the bar exam, can it write a sorting algorithm) when the actual bottleneck in practice is coordination. The model can write an entire Three.js application. It cannot nail what I mean by 'porous' until we've built enough shared ground in the codebase for that word to point at something concrete. I think no standardized test currently measures that.
by gck1 | 2026-02-23 13:22:21+00:00
We see that market is very irrational now and it can stay irrational for long enough to destroy everything we know in tech.

By the time market figures things out, you may no longer have services, and hardware that you use daily. When such amounts of stupid money are pumped into a single industry, even if all AI companies went out of business tomorrow, it's going to take years for things to go back to normal.

FWIW, I'm not advocating taxes, as I think that won't really do anything. I don't know what the solution is either.
by jcgrillo | 2026-02-23 13:22:31+00:00
Another development in trucking efficiency that seems really interesting is the Achates opposed piston two stroke. If their materials are accurate, through fluid modeling they've achieved a massive efficiency boost and emissions exceeding regulatory targets without urea injection. In a piston ported two stroke.

https://www.ccjdigital.com/regulations/article/15291029/acha...

This is the most recent news I can find about them, though, so unclear if these engines will ever be produced for road vehicles:

https://www.govconwire.com/articles/ga-asi-david-alexander-a...

See also:
https://achatespower.com/resources/

I was hoping we'd see these engines running generators in Edison trucks one day.
by snowhale | 2026-02-23 13:23:06+00:00
arena allocation is a big part of it, but also oxc benefits from not having to support the same breadth of legacy transforms that swc accumulated over time. swc has a lot of surface area from being the go-to babel replacement -- oxc could design the AST shape from scratch with allocation patterns in mind. the self-hosting trap (writing js tooling in js) set a performance ceiling for so long that when you finally drop down to Rust and rethink the data layout, the gains feel almost unfair