MurphyA/hacker-news huggingface dataset:
by IronsideXXVI | 2026-02-21 00:04:57+00:00
You just need an Apple Developer account ($99/year), which you likely already have if you're distributing apps. Notarization itself has no per-build cost — you can notarize as many builds as you want. The process is essentially: codesign your app, zip it up, submit it to Apple's notary service via xcrun notarytool, and staple the ticket. It can be automated in CI too — this project uses a GitHub Actions workflow for it. The $99/year is really the only cost, and that's for the developer account itself, not notarization specifically.
by tombert | 2026-02-21 00:05:11+00:00
I have thought about this a lot, and I have no idea. I work for an "AI-first" company, and we're kind of required to use AI stuff as often as we can, so I make very liberal use of Codex, but I've been shielded from the interview process thus far.

I think I would still kind of ask the same questions, though maybe a bit more conceptual. Like, for example, I might see if I could get someone to explain how to build something, and then ask them about data structures that might be useful (e.g. removing a lock by making an append-only structure). I find that Codex will generally generate something that "works" but without an understanding data structures and algorithms, its implementation will still be somewhat sub-optimal, meaning that understanding the fundamentals has value, at least for now.
by peterjliu | 2026-02-21 00:05:26+00:00
Post author here: To clarify, this is not a post from Polymarket.

This is talking about using Compound AI (product I'm working on) to query Polymarket data, including finding insiders, just as a fun example analysis you could do.

Often you need a well-calibrated probability of a future event to feed into some other analysis, and Polymarket is pretty great for that. An example is how much insurance (hedge) to buy for some disastrous event.
by coppsilgold | 2026-02-21 00:05:41+00:00
You don't even need active measures. If a publisher is serious about tracing traitors there are algorithms for that (which are used by streamers to trace pirates). It's called "Traitor Tracing" in the literature. The idea is to embed watermarks following a specific pattern that would point to a traitor or even a coalition of traitors acting in concert.

It would be challenging to do with text, but is certainly doable with images - and articles contain those.
by runako | 2026-02-21 00:06:40+00:00
When reading any essay about the perils & merits of Bluesky's architecture, save yourself some time by searching for "Blacksky" in the post. If they don't address Blacksky, more than likely the author's understanding of the space has major gaps.

(Blacksky is the/one of the furthest along in building competing versions of each part of the AT proto stack.)
by kube-system | 2026-02-21 00:06:52+00:00
I suspect that the direction of these situations often depends on how your initial email is routed internally in these organizations. If they go to a lawyer first, you will get someone who tries to fix things with the application of the law. If it goes to an engineer first, you will get someone who tries to fix it with an application of engineering. If it were me, I would have avoided involving third party regulators in the initial contact at least.
by javascriptfan69 | 2026-02-21 00:07:41+00:00
I genuinely think we will look back at the algorithmic content feed as being on par with leaded gasoline or cigarettes in terms of societal harm.

Maybe worse since it is engineered to be as addictive as possible down to an individual level.

Then again maybe I'm being too optimistic that it will be fixed before it destroys us.
by dekhn | 2026-02-21 00:07:58+00:00
It would take a bit of time to re-read the entire chain and come up with highly specific ways. The way I read the exchange, the lawyer basically wants the programmer to shut up and not disclose the vulnerability, and is using threatening legal language. While the programmer sees themself as a responsible person doing the company a favor in a principled way.

Some things I can see. I think the way the programmer worded this sounds adversarial; I wouldn't have written it that way, but ultimately, there is nothing wrong with it:
"I am offering a window of 30 days from today the 28th of April 2025 for [the organization] to mitigate or resolve the vulnerability before I consider any public disclosure."

When the lawyer sent the NDA with extra steps: the programmer could have chosen to hire a lawyer at this point to get advice. Or they could ignore this entirely (with the risk that the lawyer may sue him?), or proceed to negotiate terms, which the programmer did (offering a different document to sign).

IIUC, at that point, the lawyer went away and it's likely they will never contact this guy again, unless he discloses their name publicly and trashes their security, at which point the lawyer might sue for defamation, etc.

Anyway, my take is that as soon as the programmer got a lawyer email reply (instead of the "CTO thanking him for responsible disclosure"), he should have talked to his own lawyer for advice. When I have situations similar to this, I use the lawyer as a sounding board. i ask questions like "What is the lawyer trying to get me to do here?" and "Why are they threatening me instead of thanking me", and "What would happen if I respond in this way".

Depending on what I learned from my lawyer I can take a number actions. For example, completely ignoring the company lawyer might be a good course of action. The company doesn't want to bring somebody to court then have everybody read in a newspaper that the company had shitty security. Or writing a carefully written threatening letter- "if you sue me, I'll countersue, and in discovery, you will look bad and lose". Or- and this is one of my favorite tricks, rewriting the document to what I wanted, signing that, sending it back to them. Again, for all of those, I'd talk to a lawyer and listen to their perspective carefully.
by ajuhasz | 2026-02-21 00:08:11+00:00
Yes! We see a lot of the same things that really should have been solved by the first wave of assistants. Your _Around The House_ reads similar to a lot of our goals though we would love the system to be much more pro-active than current assistants.

Feel free to reach out. Would love to swap notes and send you a prototype.

> I hope the memory crisis isn't hurting you too badly.

Oh man, we've had to really track our bill of materials (BOM) and average selling price (ASP) estimates to make sure everything stays feasible. Thankfully these models quantize well and the size-to-intelligence frontier is moving out all the time.
by cardanome | 2026-02-21 00:08:44+00:00
The character is completely irrelevant to whether they are a victim of doxxing.

They might be the worst person ever but that doesn't matter. People can be good and bad, sometimes the victim sometimes the perpetrator.

Is it morally wrong to doxx someone and cause them to go to jail because they are running an archive website? Yes. It is. It doesn't matter who the person is. It does not matter what their motivations are.
by mcint | 2026-02-21 00:08:48+00:00
It's good FUD. You re-iterate their talking points. (Also, no CTA, no takeaway, just "worry!")

As others have said, the data has to be publishable to be useful. We do have data export laws. The format is known to be ready to use interoperably, not some private schema--atop the PBC commitment, which will at least have moderate legal costs if not a guarantee. It has unequivocally set a new high bar.

They seem pretty locked in to doing what they committed to. The day may come when they turn. It may come first by friction, but the turn has to be pretty complete, because the data is pretty open. What's needed to view it, use it at all, is pretty close to what's needed to host it.

"The site whose value prop is sharing your posts and data with other apps may stop sharing your posts and data with other apps." Yeah, it's possible. It's also possible they just close.
by ImJamal | 2026-02-21 00:08:59+00:00
First, let me start off saying I don't like Elon and think he is a terrible person.

Next, my issue is primarily on your issue with hateful speech, I should have been more clear. I wrote it on my phone and didn't feel like expanding upon what I was trying to say. I should have conveyed my thoughts better.

I will explain my position more clearly.

I think pushing what you are when it comes to hateful speech is dangerous. Using your own logic the comment I am replying to could be illegal. You said "hateful speech must be curtailed". What you said about Elon is clearly derogatory and could easily be considered hateful. If the laws were in place, I think with how petty Elon is, he would go after people who are critical of him like yourself.

Having emotional harm is not really something that can be determined which is the primary harm that hate speech causes. Every person is different so you wouldn't have a way to know what you could say. The only way to know if something is hateful is to ask the person if they were intending it to be hateful or if the recipient found it hateful.

When you have vague terms that could be determined by emotion rather than an objective measure you are going to run into issues. Obviously sometimes there will be subjective measures, but we need to minimize them whenever possible.

If somebody is directing somebody to kill somebody that is causing physical harm towards an individual and should be illegal.

Going back to the world war examples. Hitler would be guilty of directing people to cause physical harm.

If Hitler said to kill somebody I don't consider that to be different than if Hitler just pointed and somebody and then turned his finger into a gun. The issue wasn't what he said or didn't say, it was what he was directing somebody to do.

If Hitler said something like we have economic issues and Jews run the banks, that would probably be considered hateful by many people. I don't think it should be illegal. If Hitler added let's kill the Jews, that would be directing people to commit violence and would not be legal.

Hitler hating the Jews in the first statement doesn't mean he should go to jail. It didn't cause a normal person to go out and commit the Holocaust.
by regularfry | 2026-02-21 00:09:03+00:00
Aaaaah! No! You're doing it too! I am not talking about copying how xyz cad built their UI. I am not talking about consciously implementing concepts from other software. I'm talking about this crazy tendency to assume that the reason someone wants UI feature X is because xyz cad does it, not because it's a natural, intuitive thing to want to do. Natural, intuitive things tend to get independently invented; more than once I've made a suggestion and had "this isn't Fusion 360, you know" thrown back at me, despite the fact I've never used F360 to know what comparison they're making.
by MBCook | 2026-02-21 00:09:12+00:00
Is the author arguing anything about eye strain? The word “strain“ doesn’t even appear on the page.

I think they’re purely talking about the idea that cutting back on blue light will help you sleep better. Nothing else.

Why would the author care? Honestly it does seem like one of those junk science things that popped up a couple years ago that all of a sudden was everywhere. I literally remember comments here on hacker news from people saying Apple was killing people because they were blocking F.lux and didn’t have night shift yet. Yes they were the most hyperbolic, but they were there.

I kind of like Night Shift too, for similar reasons. But I don’t think it ever did anything for my sleep. Nor did I ever expect it to.
by AgentME | 2026-02-21 00:09:14+00:00
Bluesky is architected so you can export your data and follows and followers to your own or someone else's infrastructure at any time. There are some groups that have taken that offer and moved off of Bluesky's infrastructure (see Blacksky). The fact that most people aren't doing that is a sign that people are happy with how Bluesky-the-company is running things. What's the issue?
by dekhn | 2026-02-21 00:09:18+00:00
I'm talking about any situation where a principled person who is technically correct gets a threatening letter from a lawyer instead of a thank you.

If you read enough lawyer messages (they show up on HN all the time) you will see they follow a pattern of looking tough, and increasingly threatening posture. But often, the laws they cite aren't applicable, and wouldn't hold up in court or public opinion.
by shawneechase | 2026-02-21 00:09:50+00:00
This has been the most interesting design problem we've tackled in a while, so wanted to share.

The problem: when you deploy an agent to multiple users, every user gets the same tools with the same permissions. There's no layer between "the agent can see this tool" and "the agent can execute this tool with any parameters and the user sees the full response." For a single-user demo that's fine. For 200 users across five teams hitting SAP, Snowflake, and internal APIs, it's a non-starter.

We added three webhook-based hooks to the tool execution pipeline. What made it interesting:

The Access hook runs before the LLM even receives the tool list. If a user can't access a tool, the model never knows it exists. We added batch support here so a single webhook call evaluates the entire catalog (no N+1 when you have hundreds of tools), with TTL-based caching so you're not adding latency on every chat turn.

The Pre-Execution hook is where it gets fun. It's not just allow/deny. Your webhook can modify the inputs before the tool fires. We're using this to inject per-user compliance parameters into Snowflake queries, map human-readable IDs to internal UUIDs, and route requests to region-specific backends. The agent doesn't need to know about any of that.

The Post-Execution hook was originally just for PII redaction, but the more interesting use case turned out to be prompt injection defense. A scraping tool returns content with embedded hijack instructions? The payload gets stripped before the LLM ever sees it. This protects in both directions: the tools from the agent, and the agent from the tools.

The design decision we debated the most: hooks execute as a pipeline. Multiple hooks on the same hook point chain together, each seeing the accumulated output of the previous one. Org-level hooks run first (company-wide compliance), then project-level hooks (team-specific rules), then org-level hooks again (final PII sweep, audit logging). If any hook in the chain denies, execution stops immediately.

Each hook has its own failure mode: fail_closed or fail_open. A PII scanner going down shouldn't have the same blast radius as a telemetry collector.

There's also a dry-run mode that lets you test new hooks against live production traffic without enforcing anything. You see exactly what would have been blocked, modified, or flagged before you flip it on.

Everything's via webhooks, so you implement your logic in whatever language, on your infrastructure.

Happy to answer questions about the architecture.
Docs: https://docs.arcade.dev/guides/contextual-access
by dragonwriter | 2026-02-21 00:09:57+00:00
> Yes but in practice they delegate this power to the executive.

No, they do not delegate the power to lay (set) taxes to the executive, they do assign the executive the function of collecting the taxes laid by Congress.

> Congress doesn’t run the IRS themselves after all

The IRS doesn't freely set taxes, it collects the taxes set by Congress.
by the_hoffa | 2026-02-21 00:10:06+00:00
You'd be surprised how many SE's would love for this to happen. The biggest reason, as you said, being able to push back.

Having worked in low-level embedded systems that could be considered "system critical", it's a horrible feeling knowing what's in that code and having no actual recourse other than quitting (which I have done on few occasions because I did not want to be tied to that disaster waiting to happen).

I actually started a legal framework and got some basic bills together (mostly wording) and presented this to many of my colleagues, all agreed it was needed and loved it, and a few lawyers said the bill/framework was sound .. even had some carve-outs for "mom-n-pops" and some other "obvious" things (like allowing for a transition into it).

Why didn't I push it through? 2 reasons:

1.) I'd likely be blackballed (if not outright killed) because "the powers that be" (e.g. large corp's in software) would absolutely -hate- this ... having actual accountability AND having to pay higher wages.

2.) Doing what I wanted would require federal intervention, and the climate has not been ripe for new regulations, let alone governing bodies, in well over a decade.

Hell, I even tried to get my PE in Software, but right as I was going to start the process, the PE for Software was removed from my state (and isn't likely to ever come back).

I 100% agree we should have even a PE for Software, but it's not likely to happen any time soon because Software without accountability and regulation makes WAY too much money ... :(
by arjie | 2026-02-21 00:10:39+00:00
I will not claim to be an expert historian but one general belief I have is that nomenclature undergoes semantic migration over a century. So for the sake of conciseness I will quote the first demand of each portion of the Fascist Manifesto. This isn't to obscure, because it is in Wikipedia[0] and translated in English on EN Wikipedia[1], but so I can share a sample of whether this is something we can relate to our present day political orientation. Hopefully it will inform what you believe "author of the Fascist Manifesto" to imply:

> ...

> For this WE WANT:

> On the political problem:

> Universal suffrage by regional list voting, with proportional representation, voting and eligibility for women.

> ...

> On the social problem:

> WE WANT:

> The prompt enactment of a state law enshrining the legal eight-hour workday for all jobs.

> ...

> On the military issue:

> WE WANT:

> The establishment of a national militia with brief educational services and exclusively defensive duty.

> ...

> On the financial problem:

> WE WANT:

> A strong extraordinary tax on capital of a progressive nature, having the form of true PARTIAL EXPROPRIATION of all wealth.

> ...

0: https://it.wikipedia.org/wiki/Programma_di_San_Sepolcro#Test...

1: https://en.wikipedia.org/wiki/Fascist_Manifesto#Text
by 1vuio0pswjnm7 | 2026-02-21 00:11:24+00:00
https://web.archive.org/web/20260220191245if_/https://arstec...

archive.today is very popular on HN; the opaque, shortened URLs are promoted on HN every day

I can't use archive.today. I tried but gave up. Too many hassles. I might be in the minority but I know I'm not the only one. As it happens. I have not found any site that I cannot access without it

The most important issue with archive.today though is the person running it, their past and present behaviour. It speaks for itself

Whomever it is, they have lot of info about HN users' reading habits given that archive.today URLs are so heavily promoted by HN submitters, commenters and moderators
by ripped_britches | 2026-02-21 00:11:30+00:00
I think local inference is great for many things - but this stance seems to conflate that you can’t have privacy with server side inference, and you can’t have nefariousness with client side inference. A device that does 100% client side inference can still phone home unless it’s disconnected from internet. Most people will want internet-connected agents right? And server side inference can be private if engineered correctly (strong zero retention guarantees, maybe even homomorphic encryption)
Show HN: AI Council – multi-model deliberation that runs in the browser
by prijak | 2026-02-21 00:11:34+00:00
There's LLM Council and similar tools, but they use predefined model
lineups. This one is different in a few ways that mattered to me:

*Bring your own models.* Mix Ollama (local), OpenAI, Anthropic, Groq,
Google — or any OpenAI-compatible endpoint — in whatever combination you
want. A council of DeepSeek-R1 + llama2-uncensored + mistral-nemo is a
very different deliberation than GPT-4o + Claude + Gemini.

*Zero server, zero account, zero storage.* The app is purely static.
API calls go directly from your browser to providers. Nothing touches a
backend. No tokens, no sessions, no analytics. Your API keys never leave
your machine.

*Runs on your own hardware.* If you have Ollama, you can run an entire
council locally for free. I use a 5-member all-Ollama setup on an RTX 2070
(8GB VRAM) — sequential requests, slow, but completely private.

The deliberation process is 3 stages:
1. All members answer independently
2. Each member critiques anonymized responses from the others
3. A designated Chairman synthesizes a final verdict

A few things I found genuinely interesting:
- Reasoning models (DeepSeek-R1, QwQ) emit <think> blocks mid-stream.
Stripping these while showing a " Thinking…" indicator keeps the UX
clean without losing answer quality.
- The Contrarian persona on an uncensored model produces meaningfully
different critiques than a safety-tuned model playing the same role.
- Peer review across models catches blind spots that a single model
arguing with itself won't surface.

GitHub: https://github.com/prijak/Ai-council.git
by alright2565 | 2026-02-21 00:11:51+00:00
If you are needing to version your password hashes, then you are likely doing them incorrectly and not using a proper computationally-hard hashing algorithm.

For example, with unsuitable algorithms like sha256, you get this, which doesn't have a version field:

import hashlib; print(f"MD5: {hashlib.md5(b'password').hexdigest()}")
print(f"SHA-256: {hashlib.sha256(b'password').hexdigest()}")

MD5: 5f4dcc3b5aa765d61d8327deb882cf99
SHA-256: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

But if you use a proper password hash, then your hashing library will automatically take care of versioning your hash, and you can just treat it as an opaque blob:

import argon2; print(f"Argon2: {argon2.PasswordHasher().hash('password')}")
import bcrypt; print(f"bcrypt: {bcrypt.hashpw(b'password', bcrypt.gensalt()).decode()}")
from passlib.hash import scrypt; print(f"scrypt: {scrypt.hash('password')}")

Argon2: $argon2id$v=19$m=65536,t=3,p=4$LZ/H9PWV2UV3YTgF3Ixrig$aXEtfkmdCMXX46a0ZiE0XjKABfJSgCHA4HmtlJzautU
bcrypt: $2b$12$xqsibRw1wikgk9qhce0CGO9G7k7j2nfpxCmmasmUoGX4Rt0B5umuG
scrypt: $scrypt$ln=16,r=8,p=1$/V8rpRTCmDOGcA5hjPFeCw$6N1e9QmxuwqbPJb4NjpGib5FxxILGoXmUX90lCXKXD4

This isn't a new thing, and as far as I'm aware, it's derived from the old apache htpasswd format (although no one else uses the leading colon)

$ htpasswd -bnBC 10 "" password
:$2y$10$Bh67PQAd4rqAkbFraTKZ/egfHdN392tyQ3I1U6VnjZhLoQLD3YzRe
by MBCook | 2026-02-21 00:12:21+00:00
The author showed that Apple‘s implementation only cuts two colors by roughly 50%. And given we perceived light non-linearly aren’t they right that that really doesn’t make much of a difference?

If someone put up an article saying “Turning down your headphones 1% will help stop hearing loss!“ most people are going to ignore it. OK yeah technically it will, but not to any meaningful amount.