MurphyA/hacker-news huggingface dataset:
by danielvaughn | 2026-02-19 15:02:05+00:00
Agree that it's not the best for UI stuff. The best solution I've found is to add skills that define the look and feel I want (basically a design system in markdown format). Once the codebase has been established with enough examples of components, I tend to remove the skill as it becomes unnecessary context. So I think of the design skills as a kind of training wheel for the project.

Not to promote my own work, but I am working on what I think is the right solution to this problem. I'm creating an AI-native browser for designers: https://matry.design

I have lots of ideas for features, but the core idea is that you expose the browser to Claude Code, OpenCode, or any other coding agent you prefer. By integrating them into a browser, you have lots of seamless UX possibilities via CDP as well as local filesystem access.
by jamiemallers | 2026-02-19 15:03:00+00:00
This follows a pattern I have seen play out in infrastructure tooling for years. Company builds great product, offers generous terms to capture market share, then gradually restricts access once they have lock-in.

The interesting thing is how this differs from traditional infrastructure vendor lock-in. With Datadog or PagerDuty, the lock-in is mostly data gravity and workflow integration. With AI coding tools, the lock-in is muscle memory and workflow habits. The switching cost is not migrating data -- it is retraining your fingers.

But the moat is thinner than they think. Models are converging in capability faster than anyone predicted. The real value in these tools is not the model, it is the harness: context management, tool integration, session continuity. And that is the part that is easiest to replicate.

The companies that will win long-term are the ones building open protocols and letting users bring their own model. Same lesson the monitoring industry learned the hard way -- proprietary agents and custom query languages felt like defensible moats until OpenTelemetry showed up and made the collection layer interchangeable.
by torginus | 2026-02-19 15:03:26+00:00
I think these pictures are a perfect and accessible metaphor for the problems of vibecoding slop and asking an actual engineer to fix it.

The end results evokes a sense of unease even in laymen, and the more you know about the subject matter, the more wrong it looks..

And 'fixing' it essentially requires as much if not more effort as writing it from scratch.
by Ajedi32 | 2026-02-19 15:03:28+00:00
DNS has always been a single-point-of-failure for TLS cert issuance. The threat is real, but not at all unique to this validation method.

(For example, an attacker with control of DNS could switch the A record to their server and use that to pass HTTP-01 or TLS-ALPN-01 validation, or update the _acme-challenge TXT record and use that to pass DNS-01.)
by jamiemallers | 2026-02-19 15:03:31+00:00
Really interesting approach. The gap between "package installed" and "static analysis runs" is genuinely one of the most undermonitored windows in CI pipelines.

Curious about a few things:

1. How does this handle legitimate post-install network calls? Some packages do license checks or fetch pre-built binaries (e.g. node-gyp downloading prebuilds, or packages that pull ONNX models). A strict PyPI-only whitelist would break those. Do you have a mechanism for user-defined allowlists per package?

2. Have you looked at the performance overhead of the BPF LSM hooks on large dependency trees? Something like a fresh pip install of a data science stack (numpy, pandas, scipy, etc.) can spawn hundreds of subprocesses. Would be interesting to see benchmarks.

3. The kernel 5.8+ BTF requirement is going to be the main adoption barrier. Most CI runners (GitHub Actions, GitLab CI) run on relatively recent kernels, but corporate Jenkins boxes are often pinned to ancient RHEL kernels. Have you considered a fallback mode using seccomp-bpf for older kernels, even if less granular?

The connect() syscall whitelist is elegant because it catches the exfiltration without needing to understand the malware payload. You are basically saying "I do not care what the code does, I care what it talks to." That is the right abstraction for this problem.
by xingped | 2026-02-19 15:03:43+00:00
Do the speeds of a PCIe 5.0 (or now 6.0) meaningfully affect anything for your average consumer? Would games load faster or files transfer faster? Or is this just at super high-end applications and hardware that you'd actually see a difference? I don't know if there's some other part of the hardware that would limit actual gains seen by the 5.0 and 6.0 specs.
by jamiemallers | 2026-02-19 15:03:52+00:00
Peer relays solve a real pain point for self-hosted infrastructure. The number of times I have seen teams build elaborate DERP relay chains or maintain dedicated VPN gateways just to get two nodes talking through corporate NATs is absurd.

What is interesting about this from an operations perspective is the observability challenge it creates. When traffic routes through a relay, your network monitoring tools see the relay as the destination, not the actual peer. Suddenly your flow logs, latency metrics, and connection traces all point to an intermediary instead of the real endpoint.

Teams running self-hosted monitoring stacks (Prometheus, Grafana, etc.) behind Tailscale need to instrument at the Tailscale layer, not the network layer, to get accurate topology maps. Otherwise you end up with dashboards that show everything connecting to a single relay node and wonder why your "distributed" system looks like a star topology.

The peer relay GA is great for availability, but I would love to see Tailscale expose relay usage metrics -- how often peers fall back to relays, relay latency overhead vs direct, bandwidth through relays. That data is gold for capacity planning in self-hosted setups.
by capitainenemo | 2026-02-19 15:04:23+00:00
If you're talking about url/search bar at the bottom on mobile, that's customisable - actually they ask you which you prefer when you install it, but you can change it at any time in settings.
(personally I prefer all that stuff at the bottom since it's more conveniently where all my other phone nav is, and visibility fits in well with how I scroll)
by nozzlegear | 2026-02-19 15:04:26+00:00
> I've been wondering if it is even possible for a publicly-traded company to deliver a voice assistant product without these incentives involved. I have to imagine the UX of these devices would be much different if they were built by a private company without the same market pressures.

Apple's HomePods have never had ads and don't require a subscription/data collection to control home devices.
by squeefers | 2026-02-19 15:04:32+00:00
i mean, it kind of is. do they similarly blame chrome for showing suicide content in her auto-complete? this would have never happened if the girl hadnt searched for it herself. and if this suicide content is so powerful, how come everyone who reads it isnt killing themselves? i suspect to search for suicide content, she may well have been suicidal. a bold accusation, i know
by PopAlongKid | 2026-02-19 15:05:38+00:00
>Fifty repetitions usually gets you there.

I think that's on the low side. My signature got locked in during my early twenties, when I worked at a commercial AM/FM radio station. I had to sign various transmitter logs (FCC requirement), about six times every three hours as I recall, and I worked six days a week, so a lot of signatures. It still took a while before I could sign consistently without thinking about it (muscle memory).

>One last thing: consider where you'll use it. Legal documents and contracts need a signature that's at least partially legible — someone should be able to connect it to your printed name.

I don't think this is true, although you may need witnesses to your legal signature if the best you can do is sign with an "X". After all, there are people without hands, blind, or other disabilities that might prevent a "normal" signature.

And these days, with paper checks becoming uncommon and credit card payments skipping the paper receipt to sign, how often do people get the chance to sign anything on paper?

>But for everyday use, emails, creative work? It can be as abstract as you like.

I don't think trying to maintain two different signatures makes a lot of sense, but if you are pasting an image (e.g. emails), I suppose it's not that much trouble.
by rayiner | 2026-02-19 15:06:24+00:00
A confounding factor here is that savings behavior is cultural rooted: https://pmc.ncbi.nlm.nih.gov/articles/PMC6135367/. Studies show that people within a country can have substantially different savings behaviors, robustly correlated with their origin countries, even among people who are third generation immigrants. It’s a mistake to treat either the U.S. or Singapore as homogenous populations for purposes of this analysis.
by squeefers | 2026-02-19 15:06:26+00:00
> Applies equaly to land mines and crack cocaine

but no parent lets their kid play with either land mines or crack cocaine do they? cos the dangers are real. if the dangers were real, YOU wouldnt be on it would you?

Just like porn, its so dangerous kids just CANNOT be shown it, yet fine for adults obviously. that is not the same for crack cocaine and land mines (ie real dangers)
by elliotbnvl | 2026-02-19 15:06:31+00:00
This was surprisingly tricky, but fixed! The issue was that short tap strokes were being fed through the stroke-rendering library (perfect-freehand), which applies start/end taper over a configurable length. When the total stroke distance is shorter than the combined taper length, the stroke tapers to nothing — so dots just disappeared. The fix detects tap-like strokes and renders them directly as small ellipses, bypassing the stroke pipeline.
by saidinesh5 | 2026-02-19 15:06:56+00:00
> Also, don’t expose it to hot water (this could weaken the waterproof seals), or high pressure water. It’s not invincible.

Aahhh. Finally the mystery of how my old pebble died is solved. Hopefully . One fine morning, the display came off. It was supposed to be waterproof and there was no puffed up battery either.
by mothballed | 2026-02-19 15:06:58+00:00
If you want to go down the bad faith rabbit hole I can play that fuck fuck game with you, then yes Midway USA will literally sell a gun to basically any child in the country in the country in two boxes, the first as a black powder revolver and the second as a cartridge replacement cylinder. Once both boxes are in proximity it legally becomes constructive possession of a firearm.

Of course in some states (I think North Dakota is one) there is no restriction on transferring a gun privately to a minor. So yeah in North Dakota you can straight up sell a gun to a kid.

But what I was referring to was that adults don't have to be carded or have age verification in AZ to privately buy a gun, not that it is legal to sell a gun to a child.
Tell HN: A production-ready "Hello World" is now ~600 files
by thesssaism | 2026-02-19 15:07:03+00:00
I recently ran an audit on our latest full-stack repo to figure out why "spinning up a new project" felt like such a heavy lift. I counted every file required just to reach a "production-ready" baseline—before writing a single line of unique feature code.

The count was roughly 600 files.

To be clear, I'm not talking about a `create-react-app` sandbox. I mean a compliant, scalable SaaS foundation: Next.js frontend, Node.js/NestJS backend, mobile wrapper, CI/CD pipelines, and enough security config to pass a SOC2 audit.

It sounds ridiculous (and honestly, it feels ridiculous), but when I broke it down, I couldn't find many files I was willing to delete.

Here is where the bloat comes from:

First, the "Configuration Hell" accounts for about 40-50 files alone. We aren't just dealing with `package.json` anymore. It's `tsconfig.json` (base), `tsconfig.build.json`, `tsconfig.spec.json`... multiplied across frontend, backend, and shared libraries. Then add `.eslintrc.js`, `.prettierrc`, `jest.config.js`, `vitest.config.ts`, `nodemon.json`, and the Docker-compose variants for dev, test, and prod.

Then there’s the DevOps and Quality layer. We have roughly 20-30 files for GitHub Actions workflows (lint, test, build, deploy, semantic release), Husky hooks (pre-commit, commit-msg), and pull request templates.

But the real multiplier is the separation of concerns. In a modern monorepo, a "Hello World" isn't just `console.log`. It’s:
- A NestJS module (Controller, Service, Module, DTO, Entity, Unit Test, E2E Test).
- A Next.js slice (Page, Component, Type definition, API client wrapper).
- A shared library entry.

We found that adding a single "minimal" API endpoint usually touches 5-7 files just to maintain architectural standards.

The trade-off is painful. On one hand, this setup handles the things we used to forget: security headers, proper logging, consistent error handling, and type safety across boundaries. It prevents the "spaghetti code" distinct to startups that scale too fast.

On the other hand, the cognitive load of managing a 600-file "empty" project is massive. Updating dependencies becomes a chore because a major version bump in one tool (like ESLint) cascades through forty config files.

I’m curious how others are handling this "starting line" complexity.

Are you accepting the boilerplate as the cost of doing business? Or have you found a way to strip this down without sacrificing the compliance/safety guardrails that enterprise clients demand?

It feels like we've over-engineered the entry point of software development, but I’m not sure what the alternative is for a serious project. We tried going "lean" initially, but spent weeks retrofitting auth and testing harnesses later—which was worse.

Is there a middle ground I'm missing, or is ~600 files just the new normal?
by bluGill | 2026-02-19 15:07:15+00:00
English is not really a phonic language. The is some, but the rules are not clear - why is phone not fone? Many letters can have more than one sound, and it is arbitrary which is chosen. Different English speakers even have different sounds / ways to pronounce a word.

Not that phonics is useless, but it isn't as helpful as it should be. We need spelling reform first - which probably needs to start with a more general spoken language reform, and that doesn't seem like it will get anywhere for political reasons.
by tialaramex | 2026-02-19 15:07:16+00:00
Well, here's Barry's actual proposal paper: https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/p26...

The language is the problem, and WG21 hates fixing the language. The really bone headed stuff like "UB? in my Lexer?" got through as a language change and Barry has also had some success with "just fix it" language changes, that's what happened so that C++ can attempt what Rust's MaybeUninit<T> does, but mostly WG21 will take weird new intrinsics in the standard library, as here, over just fixing the programming language.
by WarmWash | 2026-02-19 15:07:24+00:00
My favorite conspiracy explanation:

Claude has gotten a lot of popular media attention in the last few weeks, and the influx of users is constraining compute/memory on an already compute heavy model.
So you get all the suspected "tricks" like quantization, shorter thinking, KV cache optimizations.

It feels like the same thing that happened to Gemini 3, and what you can even feel throughout the day (the models seem smartest at 12am).

Dario in his interview with dwarkesh last week also lamented the same refrain that other lab leaders have: compute is constrained and there are big tradeoffs in how you allocate it. It feels safe to reason then that they will use any trick they can to free up compute.
by cestith | 2026-02-19 15:07:51+00:00
I buy a lot of books for an individual. I have a dedicated library room in my home, and that’s not the only place there are bookcases.

I shop by ISBN often because I want specifically a particular edition in a particular cover. So it’s not just title and author. It’s not even title, author, publisher, edition, and cover honestly. Sometimes there’s an Indian subcontinent English printing of a book that’s laid out differently and on different paper from the US/Canada market version.

One small drawback is sometimes I’ll order a book by ISBN, and the bookseller will locate it by ISBN, and it will be a completely different item on a different topic by a different author. Sometimes if a book is a small printing or is a very old title the publisher will recycle the ISBN.
by juffasdfwa | 2026-02-19 15:08:01+00:00
I too really want algebraic effects but the majority are panicans and exceptionauts. PL's will always cater to majority. We still don't have proper tail calls because the luddites want stack metaphors. Javanese & Gophers can't conceive of a world of pattern matching, sum types, and null/nil-safe code. Now we have machines writing code for us. It's over.
Ochat – reproducible, diffable LLM workflows in a single Markdown file
by dakotamurphyucf | 2026-02-19 15:08:07+00:00
I built Ochat, a toolkit for building AI agent workflows out of a small set of primitives.

The core primitive is ChatMarkdown (ChatMD): a single .md file is both:

the prompt/program (model config, tool allowlist, instructions, context), and
the auditable transcript (assistant replies + tool calls + tool outputs)
The part that feels most powerful in practice is that this simple building block scales: with good prompting + a curated tool set you can build lots of workflows, and then package them as prompt packs by mounting other prompts as tools (“agent-as-tool”). That lets you assemble Claude Code/Codex-style “agent apps” as just a folder of .md files.

High-leverage built-ins (especially for coding workflows):

apply_patch (repo-safe atomic edits)
read_file / read_dir (safe grounding in local files)
webpage_to_markdown (web ingestion + GitHub blob fast-path)
local retrieval: index_markdown_docs + markdown_search
code retrieval: index_ocaml_code + query_vector_db
import_image (vision inputs)
Extensibility: beyond built-ins, you can add narrowly-scoped shell wrappers, and (optionally) import external tools via MCP. MCP isn’t the point of the project, but it’s useful when you want to reuse existing tool servers.

You can run the same prompt file via:

chat_tui (interactive terminal UI; persistent sessions; branching/export; manual context compaction)
ochat chat-completion (scripts/CI)
mcp_server (expose prompts as MCP tools)
Caveats: provider support today is OpenAI-only; project is research-grade and evolving quickly.

Repo
<https://github.com/dakotamurphyucf/ochat>

Demo
<https://youtu.be/eGgmUdZfnxM>

If this resonates: stars help a lot, and I’d love early adopters + contributors (prompt packs, examples, docs, tool integrations).

Minimal snippet (prompt pack orchestrator + optional MCP tool):

<config model="gpt-5.2" reasoning_effort="medium" temperature="0"/>

<!-- core built-ins -->
<tool name="read_dir"/>
<tool name="read_file"/>
<tool name="apply_patch"/>
<tool name="webpage_to_markdown"/>

<!-- optional: import an external tool via MCP -->
<tool mcp_server="stdio:npx -y brave-search-mcp" name="brave_web_search" />

<!-- prompt-pack tools (agents as tools) -->
<tool name="plan" agent="prompts/pack/plan.md" local/>
<tool name="code" agent="prompts/pack/code.md" local/>
<tool name="review" agent="prompts/pack/review.md" local/>

<developer>
You are the orchestrator. Call plan first.
Keep edits small. Before apply_patch: explain the diff and wait for confirmation.
</developer>

<user>
Add a Quickstart section to README.md.
</user>
by andai | 2026-02-19 15:08:16+00:00
When I had a Mac I used an encrypted volume in Dropbox. (Not sure if that's a good idea, but I didn't have any issues.)

I used Notational Velocity in those days :) A rare gem of ergonomics.

Later I did the same thing with a VeraCrypt volume.

Now I'm in Obsidian, which has its own encryption (if you trust 'em!), but never quite got the frictionless feeling of NV back.
by lou1306 | 2026-02-19 15:08:23+00:00
They believe so because we have spent decades using the term AI for another category of symbolic methods (search-based chess engines, theorem provers, planners). In the areas where they were successful, these methods _were_ infallible (of course, compared to humans and modulo programming bugs).

Meanwhile, neural techniques have flown under the public consciousness radar until relatively recent times, when they had a huge explosion in popularity. But the term "AI" had retained that old aura of superhuman precision and correctness.
by elliotbnvl | 2026-02-19 15:08:52+00:00
Ok, got Cranach's in (plus some more "famous" signatures, about 10 more). Cranach's might be my personal favorite signature of the lot. Dragon imagery, minimalism, cool backstory.

There were no SVGs of it available online so I had to trace a PNG but Claude handled that like a champ with a combination of imagemagick and potrace:

magick cranach-autograph.png -colorspace Gray -threshold 70% cranach.pbm
potrace cranach.pbm -s -o cranach.svg --tight --alphamax 1.0 --opttolerance 0.5
by wasmainiac | 2026-02-19 15:09:11+00:00
That’s fine, static objects can be integrated in to sequences if each unit has enough positional accuracy.

My point is that if you interrupt the sequence by pushing it over or standing in front of it, the unit will not be able to recover or mitigate the issue. I’m not sure about the models in the video but they should enter a safe state, hopefully gracefully.
by dahart | 2026-02-19 15:09:29+00:00
Oh yes I forgot to mention it, you’re absolutely right, Thall’s method for df64 and qf128 gives you double/quad precision mantissa with single-precision exponent ranges, and the paper is clear about that.

FWIW, my own example (emulating doubles/quads with ints) gives the full exponent range with no wasted bits since I’m just emulating IEEE format directly.

Of course there are also bignum libraries that can do arbitrary precision. I guess one of the things I meant to convey but didn’t say directly is that using double precision isn’t export controlled, as one might interpret the top of thi thread, but a certain level of fp64 performance might be.
by pjmlp | 2026-02-19 15:09:32+00:00
Only if not able to do import std, or pre-compiled headers, and not using modern IDEs with "just my code" filters.

As someone that enjoys C++ since 1993, alongside other ecosystems, many pain points on using C++ complaints are self inflicted, by avoiding using modern tools.

Heck, C++ had nice .NET and Java alike frameworks, with bounds checking even, before those two systems came to exist, and nowadays all those frameworks are mostly gone with exception of Qt and C++ Builder ones, due to bias.
by HorizonXP | 2026-02-19 15:09:39+00:00
So I know these are just benchmarks, but apparently Elixir is one of the best languages to use with AI, despite having a smaller training dataset: https://www.youtube.com/watch?v=iV1EcfZSdCM and https://github.com/Tencent-Hunyuan/AutoCodeBenchmark/tree/ma...

Furthermore, it's actually kind of annoying that the LLMs are not better than us, and still benefit from having code properly typed, well-architected, and split into modules/files. I was lamenting this fact the other day; the only reason we moved away from Assembly and BASIC, using GOTOs in a single huge file was because us humans needed the organization to help us maintain context. Turns out, because of how they're trained, so do the LLMs.

So TypeScript types and tests actually do help a lot, simply because they're deterministic guardrails that the LLM can use to check its work and be steered to producing code that actually works.