MurphyA/hacker-news huggingface dataset:
by FrustratedMonky | 2026-02-24 14:18:50+00:00
People need to eat.

That's the main flaw in open source. Yes, its a great idea, but why am I working a real job to eat, and spending nights and weekends on a project just as a hobby.

Science doesn't progress very fast using the 'hobby' model of funding. Unless you are rich, and it is a hobby, much like Wolfram Alpha was. He wanted to play with math/physics stuff and was rich enough to self fund.
by jatari | 2026-02-24 14:19:21+00:00
Real answer, none of us can do anything more than what you are given by your parents. You get the brain you get and that's it. You can either work hard and improve and become a genius or you become a drug addict and die in a gutter. Determinism and the laws of physics rules us all.

We might as well chose to praise those of us who were gifted with abilities that we aspire to.
by hypeatei | 2026-02-24 14:19:27+00:00
> Can we not just have something that works without spying, without engagement-driven shit switched on all the fucking time?

Absolutely not! Making someone opt-in (the horror!) would result in too much confusion and support tickets! We can't ignore those tickets and tell people to figure it out, we have to cave and turn all the bullshit on by default.

I think a lot of our problems can be explained by: corporations lacking a spine and people unwilling to learn about the computer they use everyday. It's basically unacceptable to not know how to change a tire if you own a car but clicking through some browser settings is too hard, I guess.
Show HN: Clash – Detect Git worktree conflicts before parallel agent edits
by matk9 | 2026-02-24 14:19:32+00:00
Claude Code recently added native worktree support (--worktree), which helps a lot with parallel agent isolation.

What's still unsolved is conflicts across active worktrees, which often surfaces late.

I built Clash (OSS, Rust) to detect potential conflicts earlier using read-only merge simulation across worktrees during edits.

- clash check <file> for pre-edit checks
- clash status for a cross-worktree conflict matrix
- clash watch for live monitoring
- Claude plugin hook support for Write|Edit|MultiEdit

Quick setup (CLI + Claude plugin):

curl -fsSL https://clash.sh/install.sh | sh && \
(claude plugin marketplace add clash-sh/clash || true) && \
(claude plugin install clash@clash-sh || claude plugin update clash@clash-sh)

Would love feedback or your thoughts on this.
by wat10000 | 2026-02-24 14:19:42+00:00
So what does peace look like? You say he should sue for peace. Does that mean proposing that Russia retreat to pre-2014 borders? Pre-2022 borders? Borders at the current front lines? Something in between? What do you think would work?

The fact that you can’t describe what Zelenskyy should do to stop the bleeding beyond a uselessly vague “sue for peace” tells me that your objection isn’t really Zelenskyy’s handling of the war, your objection is to the fact that he exists as the leader of a place that Russia wants.
by maxglute | 2026-02-24 14:21:07+00:00
> A) The "IP" they're concerned about isn't the same IP you speak of. It's the investment in RL training / GPU hours that it takes to go from a base model to a usable frontier model.

Investment/gpu hours is locked behind export controls, which Anthropic supports since it keeps GPU prices low(er) sans PRC demand. Given that why would PRC labs care about US IP laws, the high level story is pretty clean, there's no healthy competition when US policy (supported by US labs) has been stacked to keep PRC behind, and it's entirely reasonable within PRC purview to circumvent.
by nyarlathotep_ | 2026-02-24 14:21:11+00:00
(Un?)ironically enough, Mr Kling was one of the people that (indirectly) first got my attention wrt LLM coding.

I watched some of his streams on the development of the JIT compiler (what this change set seems to replace) on one of his streams, and was blown away by the quality of Copilot generated suggestions/completions on an (under-represented) domain (x86 opcodes, etc). This was before Claude Code et al, and pretty early-on for LLM tooling.
by abahgat | 2026-02-24 14:21:37+00:00
Hi HN,
I wrote this post after an experiment over the holidays. I had Claude write a cross-stack feature touching our database, cloud infra, mobile app, and the embedded application running on our hardware devices at work. What would usually take me a week took an afternoon to generate.

But it still took weeks to test and merge.

The takeaway for me was that for teams operating with legacy debt, or teams where verification requires physical interaction (you can't throw prompt engineering at a hardware test bench), AI doesn't solve the bottleneck; it just shifts it. We are making code generation incredibly cheap, but the cost of verification and code review isn't shrinking, and the burden is falling on our most senior engineers.

I’d be curious to hear how others managing complex or non-standard codebases are adapting their CI/CD and review processes to keep up with the volume of AI-generated code.
Show HN: Axon – A Kubernetes-native framework for AI coding agents
by gjkim042 | 2026-02-24 14:21:39+00:00
Hi HN,
I originally started this project simply to safely run autonomous coding agents (like Claude in auto-mode) in isolated environments. But as I built it, I realized the potential was much bigger than just sandboxing: it's about making a coding agent callable like a standard API, and ultimately, defining your entire development workflow as infrastructure.

Axon is a Kubernetes-native framework that abstracts the coding agent itself. By standardizing the container interface, you can seamlessly plug in Claude, Codex, Gemini, OpenCode, or your own custom images without changing your orchestration.

How it works under the hood:

The architecture relies on standard K8s CRDs (Tasks, Workspaces, TaskSpawners, and AgentConfigs).

A Task is the fundamental unit of work for a coding agent. When a Task is created, Axon spins up an ephemeral Pod with a freshly cloned git workspace to execute it.

You use an AgentConfig to declaratively define the specific rules, custom skills, and MCP (Model Context Protocol) servers the agent is allowed to access during that Task.

A TaskSpawner reacts to GitHub events (like a new issue or PR) and automatically generates these Tasks on the fly.

Deterministic outputs (branch names, PR URLs, token usage) are captured directly back into the K8s resource status.

To test this, I built a fully autonomous self-development pipeline. It actively triages issues, suggests new features, finds bugs, and writes the code to fix them. It uses standard GitHub issues and PR comments as the feedback loop to guide the agents. You can see how that is wired together here: https://github.com/axon-core/axon/tree/main/self-development

The main repo is here (with demo video): https://github.com/axon-core/axon

I’d love to get your real-world feedback—especially on the CRD design, the container abstraction model, and what new features you would need to actually integrate this into your workflows.
Show HN: Pythia– Moody's-style AAA–C rating for any site (perf and other vitals)
by conorfarrington | 2026-02-24 14:22:30+00:00
Hey HN,

A few years ago the worst boss I ever had told me “I don’t encourage side projects.”

So obviously I spent a few evenings recently to build Pythia (live beta at https://pythia-rating.com).

It’s a single letter grade (AAA down to C) that combines five indices into one executive-friendly score:
•Performance (40 %) – real CrUX field data + Lighthouse lab
•Security (20 %) – modern HTTP security headers
•Privacy & Tracking (20 %) – cookies, trackers, 3rd-party domains, consent signals
•Sustainability (15 %) – page weight, green hosting, CO₂ estimates, image bloat
•Infrastructure (5 %) – CDN usage + aggressive caching headers

Plus a fun “Amazon lost revenue” calculator (100 ms delay ≈ 1 % revenue impact, adjustable by your ARR and e-comm %).

Some illustrative point-in-time scans (as of ~13:00 GMT today, public data only, indicative):

AI companies
•OpenAI: CCC
•xAI: B
•Anthropic: CCC
•Google DeepMind: BB

(Keeping Elon happy.)

Universities
• MIT: CCC
• Harvard: CCC
• Oxford: BBB
• Cambridge: BBB
(Oxbridge quietly winning on digital health.)

Everything runs on public sources (CrUX, Lighthouse, custom resilient HTTP agent for headers/cookies). No logins, no tracking on the scanner itself. Built purely as a side project because I was tired of 47-metric dashboards that no CEO ever reads. Wanted one number + dollar impact + actual fix suggestions.

Would love your brutal feedback on:
•Scoring weights (do they feel right?)
•Missing metrics you’d want to see
•Edge cases it gets wrong
•Who else this could actually be useful for (agencies doing client audits? PE doing diligence? in-house teams benchmarking competitors?)

Happy to answer questions or add anything people ask for. Thanks for looking!
by Aachen | 2026-02-24 14:22:46+00:00
So you can still inject <h1> or <br><br><br>...
etc into your username, in the given example

Preventing one bug class (script execution) is good, but this still allows arbitrary markup to the page (even <style> CSS rules) if I'm reading the docs correctly. You could give Paypal a fresh look for anyone who opens your profile page, if they use this. Who would ever want this?
Show HN: Train a 230KB text classifier from 50 examples – no API keys, no GPU
by veniyer | 2026-02-24 14:22:53+00:00
I kept running into the same pattern: calling an LLM API thousands of times with the same prompt template, just swapping in different text. Classify this contract clause. Route this support ticket. Categorize this log line.
For teams handling contracts, patient records, or internal logs, sending that data to a third-party API isn't always an option. And at scale, you're paying per-token for what's essentially pattern matching.
So I built a CLI that trains a small local classifier from labeled examples. Give it 50 input/output pairs, it trains a ~230KB model on your machine, and you run inference locally. No network calls. Everything runs on Node.js - no Python, no GPU, no Docker.
Under the hood it uses all-MiniLM-L6-v2 for sentence embeddings (runs locally, downloads once at ~80MB) and trains a small neural network on top of your labels.
For topic/domain classification - where categories are about different things - I'm seeing 80-95% accuracy with 50 examples. It struggles with sentiment and tone (44-50%), because "amazing camera" and "terrible camera" produce nearly identical embedding vectors. I documented this openly in the benchmarks.
The benchmarks use real text from AG News (127K articles) and 20 Newsgroups (18K posts), with only 50 training samples drawn from each. The test harness and all fixture data are in the repo - clone it and run npx tsx tests/harness/run.ts to reproduce.
This isn't trying to replace LLMs. It's specifically for the repetitive classification tasks where the same prompt structure processes different data every time.
Open source, Apache 2.0. Still early. Curious whether anyone has tried similar embedding+classifier approaches for their own workflows, or if there's demand for multi-label classification.
by dtj1123 | 2026-02-24 14:23:16+00:00
Last I checked, yes I am indeed human. Are you implying I'm a language model because you think my maths is wrong?

Ok let's see, 20 Watts is 20 joules per second. Einstein was alive for about 75 years, so that's 75x365x24x60x60 seconds by 20 Joules per second which is 47,304,000,000 Joules.

So you are correct, I dropped an order of magnitude.

Based on the numbers here: https://www.businessenergyuk.com/knowledge-hub/chatgpt-energ...

ChatGPT gets through 39.98 million kWh per day, or 1.4 x 10e14 Joules per day, about 1.6 x 10e9 Joules per second.

47,304,000,000 / 1,665,000,000 is about 28.4 seconds.

So you're right on two counts, I'm off by an order of magnitude and an erroneous milli prefix. Napkin maths huh.

I think the original point I was trying to make stands though.
by ctmnt | 2026-02-24 14:23:17+00:00
Really depends on your threat model and use case. The problems with .env files: plain text on disk, no access control, no rotation mechanism, no audit trail, trivial to leak accidentally, secrets go into env variables (which are exposed and often leak). Which of those do you care about? What are you trying to prevent?

At the simplest level, keeping .env-ish files, use sops + age [1] or dotenvx [2] (or similar) to encrypt just the values. You keep the .env file approach, the actual secrets are encrypted, and now you can check the file in and track changes without leaking your secrets. You still have the env variable problems.

There are some options that'll use virtual files to get your secrets from a vault to your process's env variables, or you can read the secrets from a secret manager yourself into env variables, but that feels like more complexity without a lot more gain to me. YMMV.

You could use a regular password manager (your OS's keychain, 1Password and its ilk, etc) if you're just working on your own. Also in the more complexity without much gain category for me.

If you want to use a local file on disk, you could use a config file with locked down permissions, so at least it's not readable by anything that comes along. ssh style.

Better is to have your code (because we're talking about your code, I assume) read from secret managers itself. Whether that's Bitwarden, AWS / GCP / Azure (well, maybe not Azure), Hashicorp, or one of the many other enterprisey options. That way you get an audit trail and easy rotation, plus no env variables and no plain text at rest. You can still leak them, but you have fewer ways to do so.

Speaking of leaking accidentally, the two most common paths: Logging output and Docker files. The first is self explanatory, though don't forget about logging HTTP requests with auth headers that you don't want exposed. The second is missed by a lot of people. If you inject secrets into your Dockerfile via `ARG` or `ENV` that gets baked into the image and is easy to get back out. Use `--mount-type=secret` etc. (Never use the old Docker base64 stored secrets in config. That's just silly.)

There are other permutations and in-between steps, these are just the big ones. Like all security stuff, the details really depend on your specific needs. It is easy to say, though, that plain text .env files injected into env variables are at the bad end of the spectrum. Passing the secrets in as plain text args on the command line is worse, so at least you're not doing that!

1: https://github.com/getsops/sops / https://github.com/FiloSottile/age

2: https://dotenvx.com
by ComCat | 2026-02-24 14:23:25+00:00
that framing is too broad for what npm supply chain attacks actually look like.

Antivirus deals with arbitrary binaries on a general purpose OS. npm attacks are much more constrained. The code has to run during install or import, steal credentials, send them over the network, and hide inside a package that claims to do something ordinary. That narrows the space.

I am not solving “is this code malicious?” in the abstract. I am checking concrete violations of behavioral invariants. A CSS library importing child_process. A utility suddenly adding obfuscated network calls in a patch release. A package reading .ssh keys during postinstall. Those patterns are not theoretical edge cases. They are how real attacks work.

No, you cannot catch everything. But every major npm supply chain incident in 2025 used the same playbook: install script abuse, credential theft, network exfiltration. That is highly detectable. The goal is not perfection. It is raising the cost of attack in a space where most attackers are currently not even trying to evade detection.
by metalman | 2026-02-24 14:23:46+00:00
it's not on purpose,I run a browser with no java scriot, cookies, or dom, and it loads perfectly, but encounter many sites that will doom loop if they encounter partial permissions, for which I have another browser version, and if that does not work, I teather my phone to a computer and use a browser there.
I can state that there are many sites that just load for me, and for which I am making no active attempt to bypass any "paywall", which I only become aware of through comments such as yours, though I will add that the way some sites render under the settings I have, makes me strongly suspect that some clever person is having fun at my expense.
by jonasn | 2026-02-24 14:23:55+00:00
Hi HN, I'm the author of this post and a JVM engineer working on OpenJDK.

I've spent the last few years researching GC for my PhD and realized that the ecosystem lacked standard tools to quantify GC CPU overhead—especially with modern concurrent collectors where pause times don't tell the whole story.

To fix this blind spot, I built a new telemetry framework into OpenJDK 26. This post walks through the CPU-memory trade-off and shows how to use the new API to measure exactly what your GC is costing you.

I'll be around and am happy to answer any questions about the post or the implementation!
Show HN: Rebuilt My Social Network with Codex in One Day
by subdomain | 2026-02-24 14:23:56+00:00
Hi HN,
I'm Micah Blachman, the creator of Crosspassion. After posting about my previous version a few days ago, I rebuilt the entire app from the ground using Codex.

Crosspassion aims to be Reddit, but for finding where your interests overlap. If I was interested in, say, mechanical keyboards and type design, I could check the mechanical keyboard/type design community, and look at the latest discoveries of projects that combine both interests. Plus, you get to connect with people who share your exact crosspassion, or interest combination.

I'm not a developer, so I used Codex for the code. I'm the first to say AI-generated websites and web apps are not a match for the quality of human-created projects, but Crosspassion is still very early-stage.

I'd love feedback on how to improve Crosspassion even further, and if you're a developer and you have any ideas about how to take the project to the next level, feel free to reach out!

I wrote about the idea behind Crosspassion on my newsletter: https://micahblachman.beehiiv.com/p/crosspassion/, and you can contact me at micah.blachman@gmail.com.

-Micah
by chris_money202 | 2026-02-24 14:24:18+00:00
Feel like this could be the solution to “LLMs will write in binary” Elon was talking about. The problem with it is, assembly is tightly coupled to the hardware, so LLMs might have an easier time generating/understanding context of a “typed” assembly language but now need to understand the hardware and its constraints as part of the context or have it in its training data. I personally just think having that knowledge codified deterministically in the compiler is simpler, but I guess time will tell.
by ltbarcly3 | 2026-02-24 14:24:21+00:00
You are begging the question. If age verification is required, it's not 'perfectly legal' to access weird porn without going through age verification.

There is no right, or even a debate about whether there should be a right, to consume digital streams of other people engaging in sexual acts in total anonymity without proving age. In fact being able to do this at all is something that didn't exist until about 25 years ago, before that you had to drive down to a video store and rent a DVD or tape. At that video store you would have to show an ID to get an account, and there would be a permanent record at the store of what you have rented.

I get that people want to watch people engage in acts that they themselves find embarrassing and shameful. I don't agree that this is healthy, but if it's legal then I have no standing to complain much. However, it's not legal to provide videos of hardcore sex to children, which you are insisting is necessary to allow adults to consume videos of hardcore sex acts in perfect anonymity, which wasn't even a thing that was possible until very recently. Your argument is just stupid and absurd on its face.
by maxdo | 2026-02-24 14:25:02+00:00
Being politically active is normal and legitimate.

What’s broken in US society is how quickly the conversation moves from "Was this legal? Was the process competitive?" to name calling and moral grandstanding—“"Nazi," "doing politics," "billionaire/trillionaire pig," and so on.

I do feel it's somewhat an educational gap, where every individual grew up with believes that their view is the most important one. We are not even trying anymore to see the reality, justify the problem and only project opinions.
by albertzeyer | 2026-02-24 14:25:07+00:00
I wonder a bit about that. What activities or possibilities are you exposed at during that age.

I know many computer science colleagues who were not exposed to programming during that age and only later came to it.

I feel kind of lucky that somewhat randomly I stumbled into computer programming (because XtreeGold could show the content of files, and I was learning to understand BAT-files by looking into them) during that age, and that's what I do now.

There are probably a lot of things you were not exposed during that age, that could have been the perfect match.

There are also lots of kids who just play games, or video games, do sports, watch films or so during that age, without really being exposed to any "potential useful" activities. Some parents would maybe even say that this is how it should be.

As a parent, I guess a good advice would be to try to expose your child to as much things as possible, without forcing it to do anything of course.
by andai | 2026-02-24 14:25:22+00:00
Your concerns are not entirely unfounded.

https://www.reddit.com/r/ClaudeAI/comments/1r186gl/my_agent_...

I have noticed similar behavior from the latest codex as well. "The security policy forbid me from doing x, so I will achieve it with a creative work around instead..."

The "best" part of the thread is that Claude comes back in the comments and insults OP a second time!
by ch4s3 | 2026-02-24 14:25:31+00:00
Think about it for a minute, the harm from gambling is intrinsic because you are statistically likely to lose money. It's not so different from a behavioral addiction like gaming, but you can lose your house.

Chemical dependency just makes addictive behavior that much worse. Moreover there is literally no evidence that social media is harder to quit than cigarettes.

I think you're engaging in moral panic.
by joe_mamba | 2026-02-24 14:25:52+00:00
>but stuff like that has actually happened

Yes, if you live and organize your life around things that are unlikely to happen to you, but only because they've happened ONCE to someone else, typically a high value target by state actors, that's called paranoia.

Most people are not gonna be targeted via BIOS hacks. From state actors to online scammers they all have easier ways to getting your data remotely.
by embedding-shape | 2026-02-24 14:26:10+00:00
> So you can still inject <h1> or <br><br><br>... etc into your username, in the given example

How exactly, given that setHTML sanitizes the input? If you don't want to have any HTML tags allowed, seems you can configure that already? https://wicg.github.io/sanitizer-api/#built-in-safe-default-...