MurphyA/hacker-news huggingface dataset:
by bostik | 2026-02-10 07:52:36+00:00
> The thing is that real security isn't something that a checklist can guarantee.

I've taken this even further. You cannot do security with a checklist. Trying to do so will inevitably lead to bad outcomes.

Couple of years back I finally figured out how to dress this in a suitably snarky soundbite: doing security with a spreadsheet is like trying to estimate the health of a leper colony by their number of remaining limbs.
by 9dev | 2026-02-10 07:53:41+00:00
> Good illustration that those guardrails are ineffective and trivial to bypass.

Is that genuinely surprising to anyone? The same applies to humans, really—if they don't see the full picture, and their individual contribution seems harmless, they will mostly do as told. Asking critical questions is a rare trait.

I would argue its completely futile to even work on guardrails, if defeating them is just a matter of reframing the task in an infinite number of ways.
by MattJ100 | 2026-02-10 07:54:25+00:00
Firstly, nobody is actually calling for authentication using client certificates. We use "normal" server certificates and validate the usual way, the only difference is that such a certificate may be presented on the "client" side of a connection when the connection is between two servers.

The statement that dialback is generally more susceptible to MITM is based on the premise that it is easier to MITM a single victim XMPP server (e.g. hijack its DNS queries or install an intercepting proxy somewhere on the path between the two servers) than it is to do the same attack to Let's Encrypt, which has various additional protections such as performing verification from multiple vantage points, always using DNSSEC, etc.
by lenkite | 2026-02-10 07:54:45+00:00
> Can you show any evidence of any such medical equipment whose export to Cuba was prohibited?

Here is a UN report.

"Necessity of ending the economic, commercial and financial embargo imposed by the United States of America against Cuba"

https://digitallibrary.un.org/record/4090890/files/A_80_83-E...

Here is another report from Cuba Solidarity, which details the cost of the blockade

https://cuba-solidarity.org.uk/resources/2025%20blockade%20r...

Here is another report from Cambridge University Press which illustrates an example in Chapter-8

https://www.cambridge.org/core/books/economic-sanctions-from...

"A concrete example from a report on company behavior: Cuba’s MediCuba tried to buy Vitek 2 Compact lab equipment via Canadian suppliers, but was told the U.S.-origin components made the sale impossible under the embargo — even when trying to route it through subsidiaries in Spain and Panama."

Antoher report of denial during Covid crisis

https://cuba-solidarity.org.uk/news/article/3985/us-company-...

There are a dozen other reports/articles that I can bring up. Most of this research, you could easily find out by yourself. You are just not willing to admit the basic truth to yourself and chosen to blind your eyes deliberately.

I am not from any NATO nation and obviously not from Cuba myself.
by threethirtytwo | 2026-02-10 07:55:22+00:00
I’m not underestimating Erlang processes. I’m saying the distinction you’re drawing is largely semantic and policy-level, not a fundamentally different concurrency mechanism.

Erlang processes, goroutines, and async tasks are all cooperatively scheduled user-space execution units multiplexed over OS threads. That is the same underlying concurrency primitive. There is no new physics here.

Erlang’s real contribution is that it forbids shared memory, bakes message passing, supervision, and restart semantics into the runtime, and forces a particular design discipline. That’s a design rule, not a different execution model.

You can approximate Erlang’s semantics on top of async/await or goroutines; you cannot approximate preemptive shared-memory threads on top of Erlang. That asymmetry tells you where the real difference lies.

Treating policy and guarantees as if they were a different kind of concurrency entirely is what causes people to mystify Erlang instead of understanding why its constraints work.
by dgfl | 2026-02-10 07:55:28+00:00
You also don’t consciously use your senses until you actively think about them. Same as “you are now aware of your breathing”. Sudden changes in a sensation may trigger them to be conscious without “you” taking action, but that’s not so different. You’re still directing your attention to something that’s always been there.

I agree with the poster (and Daniel Dennet and others) that there isn’t anything that needs explaining. It’s just a question framing problem, much like the measurement problem in quantum mechanics.
by Mashimo | 2026-02-10 07:55:59+00:00
Discord can do quite a lot, which results in people using it in different ways.

I'm quite active on multiple discord server and yet never use voice / video. But I get why people use it.

If OP is looking for a platform not to replace Discord 1 to 1, but overall to have a community why not do a broader comparison. Then everyone can for themself see what fits their personal needs.

> I expect from a Discord alternative is text messaging, voice and video call with screensharing, both possible on community spaces and with personal contacts in a way that is extremely easy to setup.

Same. I'm somewhat sad that a lot of the FOSS community got stuck with IRC level of technology and ease of use :( I whish for more projects would subscribe to a low barrier of entry mantra.

Learning reg-ex to ban a member is .. ughh
by greey2026 | 2026-02-10 07:56:21+00:00
I’ve been working on a small side project to help diagnose common mouse issues like double-clicking and scroll wheel jitter.

It’s a simple, no-backend web tool that visualizes raw mouse input directly in the browser, mainly because I kept running into these issues myself and wanted a quick way to tell hardware problems from software ones.

If anyone’s curious, it’s here: https://mousetester.net
by hansmayer | 2026-02-10 07:57:20+00:00
I wonder how much of the violation of ethical, and often even legal constraints in the business world today one could tie not only to the KPI pressure but also to the the awful "better to ask for forgiveness than permission" mentality that is reinforced by many "leadership" books written up by burnt out mid-level veterans of Mideast wars, trying to make sense of their "careers" and pushing out their "learnings" on to us. The irony being, we accept being thought about leadership, crisis management etc by people who during their "careers" in the military were in effect being "kept", by being provided housing, clothing and free meals.
by toephu2 | 2026-02-10 07:57:45+00:00
Do you know how many people live in America?

The chances of you being struck by lightning are higher than the chances of you being labeled a domestic terrorist. 1 person out of 340 million people gets labeled a domestic terrorist (or lets say 9 if you can even find 9 examples of law abiding citizens being labeled a domestic terrorist) and the response by people like you is "lets ban flock, ban all CCTVS, no more surveillance whatsoever!! because it might be used inappropriately in 1 out of 340 million cases"

Lets ban cars while we're at it too, because 100+ people in America die in auto-accidents every day. Why isn't anyone protesting cars?

You should learn about statistics. In a country of 340 million there is always someone doing something crazy and it will get picked up and make the news. Then people who never learned statistics think this is a common occurrence and happens everyday to everyone in America. When really it's just an outlier and you should move on with your life and stop watching the news.
by JohnMakin | 2026-02-10 07:58:14+00:00
These technologies are easily and readily available for whoever wants to pay for it. I personally believe the scope of the privacy nightmare will result in a glut of faux “privacy” oriented services that just serve the monster more.

I can tell you know what you are talking about here, but communicating this to the masses is difficult to why this matters or how bad it is. Unfortunately there’s a strong industry incentive to keep the status quo.

I take the more cynical view privacy is impossible to participate online, let alone anonymity, and would love a disruptor in the space, but at this point, I’ve become so cynical that participating as minimally as possible in it seems the only real solution. But I am not fatalistic, so I keep trying. You can’t really fight it in any real way, so my approach has been monitoring, observing, informing, and learning.
by anon7000 | 2026-02-10 07:58:29+00:00
Yep. As someone in a similar position to influence this, I’ll also be pushing for at least significant discounts in our contract. The challenge with migrating off for enterprise is going to be integrations & compliance. There are dozens of options that replicate the core PR workflow that people use, and it’s probably fairly easy to migrate that. The hard part is the hundreds of things that hook into GitHub that don’t have a simple migration, even internal tooling. So it just turns into a pretty big project.
by lakshikag | 2026-02-10 08:01:49+00:00
We are also currently working on a privacy-focused alternative called Kloak, which is in its very early alpha stage. We would greatly appreciate your feedback on areas for improvement and any expectations you may have for the platform.

Here is a quick promo video as well - https://www.youtube.com/watch?v=ekOxAg7leXM
by zrm | 2026-02-10 08:01:53+00:00
The second one doesn't seem excessively complicated and the latency could be mitigated by caching the CA for a reasonable period of time.

But if you're going to modify the protocol anyway then why not just put it in the protocol that a "server" certificate is to be trusted even if the peer server is initiating rather than accepting the connection? That's effectively what you would be doing by trusting the "server" certificate to authenticate the chain of trust for a "client" certificate anyway.
Show HN: Running a public CORS proxy on the open internet for 4 years
by mariusbolik | 2026-02-10 08:01:57+00:00
Hi HN — solo developer here.

I built this tool ~4 years ago purely to solve my own frustration with CORS and repeated proxy setup.
The idea was intentionally boring: just prefix a URL and get control over the request and response.

Somehow it grew to serving billions of requests per day, including usage by companies and universities.

I’m sharing it here mainly to:

- get technical feedback
- learn what people would actually use a proxy like this for
- understand what I should simplify or remove
by neya | 2026-02-10 08:01:59+00:00
I completely disagree. Gemini is by far the most straightforward AI. The other two are too soft. ChatGPT particularly is extremely politically correct all the time. It won't call a spade, one. Gemini has even insulted me - just to get my ass moving on a task when givn the freedom. Which is exactly what you need at times. Not constant ass kissing "ooh your majesty" like ChatGPT does. Claude has a very good balance when it comes to this, but I still prefer the unfiltered Gemini version when it comes to this. Maybe it comes down to the model differences within Gemini. Gemini 3 Flash preview is quite unfiltered.
What is this and why do people do it?
by Lukem121 | 2026-02-10 08:02:06+00:00
I've noticed an uptick in these articles published and then linking to Amazon S3.

It looks like some sort of SEO thing or the reason why they're doing it, but it looks like this one is a link to like a weird article that then tries to direct people to some site that sells cheap followers.

https://s3.ap-south-1.amazonaws.com/digimediaarticles/how-can-you-buy-followers-on-twitter.html

What kind of SEO tactic is this?
by rendall | 2026-02-10 08:02:22+00:00
I sympathize with this a lot. What you’re describing really is exhausting, and it shouldn’t be this hard.

My take is that parental controls fail because they’re trying to solve a social and psychological problem at the technical layer. No amount of filters or settings can keep up with the internet, and kids are better at routing around them than we like to admit.

What’s worked better for us is treating this like other hard topics. We talk to our kids directly about social media, disturbing content, and strangers online, the same way we talk to them about drugs or sex.

We’re explicit about why some things aren’t allowed, what kinds of content exist out there beyond just sex, and that if something upsetting happens, telling us is always the right move and won’t cost them our trust or love.

That doesn’t remove all risk, but it shifts the burden from constant surveillance to shared understanding. To me that feels more realistic than trying to centrally control an environment that isn’t controllable.
by sheept | 2026-02-10 08:03:25+00:00
Wiz's report on Moltbook's data leak[0] notes that the agent to human owner ratio is 88:1, so it's plausible that most of the posts are orchestrated by a few humans pulling the strings of thousands of registered agents.

[0]: https://www.wiz.io/blog/exposed-moltbook-database-reveals-mi...

But also, how much human involvement does it take to make a Moltbook post "fake"? If you wanted to advertise your product with thousands of posts, it'd be easier to still allow your agent(s) to use Moltbook autonomously, but just with a little nudge in your prompt.
by ifwinterco | 2026-02-10 08:04:40+00:00
I saw a post once from a white guy with a wife and two kids (I think also white) who was confused why he was having so much trouble getting Singaporean PR despite contributing so much to the economy.

Like bro... you are the wrong race, it's that simple, shouldn't be too hard to understand.

I'm not making a moral judgement on whether that's correct or not but it's just how it works
by atoav | 2026-02-10 08:05:13+00:00
No that is not the message. The message is that icons take cognitive energy to parse even if there is a label next to it.

If you have many text options, highlighting some specific ones with an icon is benefitial, as you have an easy way to differenciate it from the "less important" ones without icon. If everything has an icon, that benefit goes away and you could just as well use text.
by mrb | 2026-02-10 08:06:13+00:00
I suppose our hobby is related to the hobby of ground-to-ground long-distance observation. Except we don't perform the actual observation, just the math of where it is theoretically feasible :-) In my case, years ago, I did exactly the same as Tom and Ryan: I algorithmically searched for the longest sightline. It was a weekend project just to satisfy my curiosity. Then last year, Tom and I kinda connected informally over this hobby.
by threethirtytwo | 2026-02-10 08:06:24+00:00
You still don’t get what I’m saying, and at this point it’s not a disagreement, it’s a category error.

I am not saying the problem is impossible. I am saying the problem is obvious, stupid, and solvable in theory, and that the only actual solution is to rewrite the foundation from scratch. That is precisely why there is no practical path forward. The impracticality is the point.

When you keep asking me to name an alternative, you’re implicitly assuming I’m advocating for some incremental migration or deployable fix inside the current ecosystem. I am not. There isn’t one. If you want whole system static guarantees, you need a database that is designed from the beginning to be part of the same language and type system as the application. Queries are programs. Schemas are types. The datastore is a compiled artifact, not a remote string interpreter. That requires a fundamentally different database.

That is the alternative. And it is completely unrealistic to retrofit into the existing world. Which is why we are stuck.

So when you say I’m “waxing theoretical,” you’ve missed the entire point. The theory is the indictment. The fact that the solution is obvious but unusable is exactly the problem. We built ourselves into a corner decades ago, and everything we now call “systems engineering” is about managing the consequences of that decision.

The article is fine. It surveys techniques for surviving in the world as it exists. I am not disputing their usefulness. I am saying those techniques exist because we accepted a broken foundation and normalized it. That distinction matters.

You keep arguing as if I’m refusing to answer your question. I’m answering it directly. The answer just isn’t one you like. The only real fix is a ground up rewrite of the data layer and its relationship to code, and that’s never going to happen at scale. That’s the conclusion. Understand?

If you think that means the path we’re on was the only one available, then we fundamentally disagree about what “choice” means in system design.

You’re still trying to refute a design critique by demanding an escape hatch, which only proves you never understood what was being critiqued.
by dgfl | 2026-02-10 08:06:31+00:00
This is not as good a refusal as you think it is. To me (and I imagine, the parent poster) there is no extra logical step needed. The problem IS solved in this sense.

If it’s completely impossible to even imagine what the answer to a question is, as is the case here, it’s probably the wrong question to pose. Is there any answer you’d be satisfied by?

To me the hard problem is more or less akin to looking for the true boundaries of a cloud: a seemingly valid quest, but one that can’t really be answered in a satisfactory sense, because it’s not the right one to pose to make sense of clouds.
by matsemann | 2026-02-10 08:06:37+00:00
That's one of the sentiments I don't quite grasp, though. Why can't they just learn the tools when they're stable? So far it's been sooo many changes in workflows, basically relearn the tools every three months. It's maybe a bit more stabilized the last year, but still one could spend an enormous amount of time twiddling with various models or tools, knowledge that someone else probably could learn quicker at a later time.

"Being left in the dust" would also mean it's impossible for new people / graduates to ever catch up. I don't think it is. Even though I learned react a few years after it was in vogue (my company bet on the wrong horse), I quickly got up to speed and am just as productive now as someone that started a bit earlier.
by QuantumLeapOG | 2026-02-10 08:07:34+00:00
I built this because I got tired of re-explaining the same things to Claude Code
every session. The core idea is from Boris Cherny (Claude Code creator) — his team
checks a single CLAUDE.md into git and updates it whenever the agent makes a mistake.

I turned that into a framework: 3-layer architecture (hooks for hard rules, 200-line
working memory, indexed long-term knowledge), a self-learning system that captures
your corrections automatically, and 21 pre-installed skills.

The dangerous-command blocker hook was the latest addition — it hard-blocks rm, git
reset --hard, sudo, curl|sh before execution. Not a suggestion, an actual exit code 2.

Happy to answer questions about the architecture or trade notes on CLAUDE.md workflows.
by koverstreet | 2026-02-10 08:09:10+00:00
I'm not the only person who knows the codebase well enough to do actual work (there's at least one other person I'd be comfortable with giving commit access to), and it's clean and documented pretty well for a filesystem.

And the sustainability equation just changed dramatically, thanks to Claude.

I've been using it the past week for a lot of stuff, and I should really write something longer up, but suffice it to say that I'm impressed. It can't do much independently yet, but it's been able to handle a /lot/ of the grunt work - the other night I had it go through open Github issues, fix what it could and take notes on the rest, and I came back to 8 patches for actual bugs, all of them correct, with excellent commit messages. Holy shit, we're living in the future :)

It can't design for shit, it doesn't understand performance implications when writing code (I've noticed this repeatedly); most of how I'm using it is "pair programming". But I'm finally feeling like I'll be able to take a vacation in the near future and still keep up with everything.

Two other people are using it (with heavy review, actively telling it to go back and research topics more) for a big update to the Principles of Operations. Nice.

Basically, the sustainability aspect comes down to writing clean, maintainable, well documented code - and I think I've accomplished that. One holy shit moment the other day was watching Claude navigate /and understand/ btree and journalling code - and making the connection between the way I use assertions and linear typing/dependent typing. All those years spent on that code developing new ways of thinking about and using assertions to make that stuff practical for one person to do... it's paid off.

Beyond that, the real challenges are pushing the boundaries of how introspectable, understandable and transparent complex systems code can be for the end user - and bcachefs is pushing boundaries there. Making a habit of writing pretty printers for absolutely everything means that now our tracing is the best you'll see in software like this, and well integrated with 'bcachefs fs top'. The timestats stuff that I started well over a decade ago - we've now got a new 'bcachefs fs timestats' interface for that, which is already making debugging performance issues dramatically easier than it has been in the past.

This is gamechanging stuff :)
by jtlebigot | 2026-02-10 08:10:12+00:00
This may sound silly, but this makes a real difference. Until this, it was not possible to run standard containers like Docker or Podman in an initramfs without ugly tricks (like using chroot instead of pivot_root, or mounting the root over itself before starting init).

This makes the initramfs rootfs un-special. Aside from being volatile, but this is a design decision.
by orlp | 2026-02-10 08:10:22+00:00
In modern usage (e.g. in gaming communities) "carries" has become not only ambitransitive but also a noun.

If something "carries" or is "a carry", it means it is so strong it metaphorically carries the rest of the setup with it. For example:

> This card carries.

> These two are the carries of the team.
by gary_0 | 2026-02-10 08:10:36+00:00
I'm pretty sure quantum mechanics already forgoes conventional causality. Attosecond interactions take place in such narrow slices of time that the uncertainty principle turns everything into a blur where events can't be described linearly. In other words, the math sometimes requires that effect precedes cause. As far as we can tell, causality and conservation of energy is only preserved on a macroscopic scale. (IANAQP, but I'm going off my recollections of books by people who are.)
by alentred | 2026-02-10 08:11:17+00:00
If we abstract out the notion of "ethical constraints" and "KPIs" and look at the issue from a low-level LLM point of view, I think it is very likely that what these tests verified is a combination of: 1) the ability of the models to follow the prompt with conflicting constraints, and 2) their built-in weights in case of the SAMR metric as defined in the paper.

Essentially the models are given a set of conflicting constraints with some relative importance (ethics>KPIs), a pressure to follow the latter and not the former, and then models are observed at how good they follow the instructions to prioritize based on importance. I wonder if the results would be comparable if we replace ehtics+KPIs by any comparable pair and create a pressure on the model.

In practical real-life scenarios this study is very interesting and applicable! At the same time it is important to keep in mind that it anthropomorphizes the models that technically don't interpret the ethical constraints the same was as this is assumed by most readers.