MurphyA/hacker-news huggingface dataset:
Show HN: Self-Protecting Files for the Agentic Era
by cl0r0x70 | 2026-03-03 13:25:53+00:00
We've been building Honeycake, a file-native security platform that embeds encryption, access policies, and audit trails directly into files.

The thesis: AI Agents are moving data at machine speed across workflows, platforms, and organizations, often without explicit human approval. Conventional security protects locations (firewalls, IAM, DLP), but once an Agent copies a file somewhere new, those controls don't follow. The file is unprotected.

Our approach is a new file primitive called .cake. Every .cake file carries quantum-resistant encryption, section-level access controls (down to individual paragraphs within a document), and tamper-evident audit logging as intrinsic properties. All encryption/decryption happens locally. We never see your files.

The key architectural decisions:

Zero-exposure: keys and encrypted files never coexist in the same place. Even we can't access your content.
Section-level granularity: an Agent can be authorized to see one part of a document and redacted from another, within the same file.
Every file open is a logged event, so unusual access patterns (an Agent opening hundreds of files in seconds) are caught in real time.
We wrote up the full thinking in a whitepaper: https://honeycakefiles.com/whitepaper.html

The desktop app, CLI, and API are live. Happy to answer questions about the architecture or the threat model.
by itsmemattchung | 2026-03-03 13:26:06+00:00
Really interesting format (and appreciate him / Guido being explicit about preferring written prose over [audio] podcasts).

> I remember my niece had a problem with it because her son wanted to drop out of school and pointed to me as, look, I don’t meet school, look at Thomas. And I had to go, no, no, no. I was in a unique situation where the industry was open to anyone who could do the work and I could do the work. That’s not the case anymore. So you have to finish school.
by devilbunny | 2026-03-03 13:26:13+00:00
... that's the tension, right? The US, for good or ill, does not "do" pre-approval for speech.

It's also nigh-impossible for a libel suit to succeed. And the government can't stop the New York Times from publishing the Pentagon Papers.

You can make strong arguments either way, but at the very least you have to acknowledge that it's not all downsides.
by stopbulying | 2026-03-03 13:26:16+00:00
Royal intermarriage >
Inbreeding: https://en.wikipedia.org/wiki/Royal_intermarriage#Inbreeding

"What if they're cousins instead"

Why hasn't God controls for ignorance of blood relation and conception?

In its first chapter, the Christian Bible suggests that we are all incestuous descendents of Adam and Eve and their children.

"You are all inferior"

Is God benevolent if there is accidental conception by incest, and it genetically damns the sinless child and multiple generations of their progeny by design?

Anything closer than first cousins risks the health of the child.
by njwi332 | 2026-03-03 13:26:34+00:00
Upway | Software Engineers (All levels), Senior Product Designer, Senior Product Managers | Full-time | Paris (ONSITE)

We’re building the biggest bike shop in the world.

Upway is the leading marketplace for refurbished e-bikes across Europe and the United States.

In 3 years, we grew from 0 to $200M GMV. The tech team grew from a small senior core to ~12 engineers in 2025, and we plan to grow to ~30 engineers in 2026.

We also raised a $60M Series C at the end of last year to support the next phase of the company.

This is not a SaaS. We operate warehouses, handle real inventory, and build software that connects logistics, product, and marketplace dynamics at scale.

We work with a Shape Up–inspired methodology that gives teams real ownership: shaping problems, building solutions, shipping, and learning from real-world impact.

Stack: TypeScript | NestJS | React | Shopify | PostgreSQL | GCP

Learn more:

- Tech & Product subjects we’re working on: https://like-piper-15f.notion.site/tech

- Open roles: https://careers.upway.shop/

- Contact our tech recruiter: https://www.linkedin.com/in/maeg-horeau-28445b72/
by DaedalusII | 2026-03-03 13:27:00+00:00
this is one of the most popular themes in pornography for whatever reason. incest titles increase click through rates to any porn video, even if they contain no incest content or even reference to incest

why this is so huge is fascinating. i suspect it is not really about the age gap, but rather the emotional trauma and sexual confusion so many people experience living in the same house hold as non biological "family members". the tension between "it is taboo to be attracted to my family" and "I am sexually attracted to a physically attractive person of no biological relation who lives in my house"

a male and female 19 year old of no biological relation, who only met each other 4 years earlier when their parents started dating, would very naturally feel sexual attraction to each other. indeed, they would share many of the social and biological traits of their parents. yet, this would be a massive taboo. consider the huge trauma of the mother being betrayed by her daughter sleeping with her step-sibling, or even her step-parent, fear of this, jealousy, fantasy.

of course the combination of taboo with sexual attraction will result in an entire genre of erotic fantasy much like adultery, cheating, professor-college student, or any other relationship of power and betrayal

the real question is, at what point does expressing the human condition become illegal? especially when as others have noted, it is legal to do the thing in real life but apparently not photograph it

and if this content is harmful to the consumer, why is other pornography apparently not? Should we ban also onlyfans?
by tkjef | 2026-03-03 13:27:04+00:00
Creator here, happy to answer questions.
A quick demo of the auto-snap workflow: you type 'claude' or 'codex' in any pane, Yaw detects it, and splits — agent on the left, shell in the same directory on the right. When the agent exits, the split closes automatically. It sounds trivial but it removed a surprising amount of friction for me.

Love to hear others pain points around terminals!
by Someone1234 | 2026-03-03 13:27:14+00:00
It is worth noting that both products have had "student" tiers or similar, that had fixed credit limits with a cliff.

Therefore, they've implemented hard-limits. So not offering hard-limits is a business decision, NOT a technical one. They're essentially hiding functionality they have.

Make of that as you will. Anyone justifying it, should be me with skepticism.
by seancolsen | 2026-03-03 13:27:14+00:00
Location: Boston, MA, USA

Remote: Yes (or on-site in greater Boston)

Willing to relocate: No

Technologies: TypeScript, Svelte, React, Vue, Rust, Python, Django, PostgreSQL, PL/pgSQL

Résumé/CV: https://github.com/seancolsen

Email: colsen.sean@gmail.com

I'm a software engineer with 15+ years experience working across the web stack, mostly on front end. I thrive in fast-pace startup environments where I can take the lead on big projects.
by muragekibicho | 2026-03-03 13:27:38+00:00
It's super nit-picky of me to point out: the double and add visualization is a meme among professional elliptic curve guys.

You are in fact drawing a hyperbola between points on an (almost) circular plane. However, you won't find this published anywhere idk why.
It's just one of those things you get from spending 3 years in office hours with the 73 year old math professor who's worked on elliptic curves since they became mainstream in the 1980's.
by Nursie | 2026-03-03 13:27:41+00:00
Clearcast is a private body owned by the broadcasters. The BCAP code is issued by the Advertising Standards Authority which, despite the name, is an industry self-regulation body.

It appears to be established in law that Clearcast is an assistance service, and approval doesn't seem to be sufficient or necessary by law to ensure advertising is legal. It establishes risk, rather than making a legal finding.

If Mullvad's ad was 'banned' by Clearcast, what happened is that their ad didn't meet the standards that the industry has set for itself and the broadcasters didn't want to touch it.

(edit - does this make it 'better'? I don't know. It seems to me a bit like the situation in the US with HOAs, which heavily restrict what you can and can't do with your property, but aren't exactly government either. But I favour accuracy over emotion when talking about this stuff, which is why I wanted to point out the actual structure of the system here.)
by dangus | 2026-03-03 13:28:10+00:00
Of course this pitch is more like “white people might something resembling the kind of experience that natively born non-white people have in America.”

Is a black person whose parents grew up in segregation, redlining, etc, really getting a worse experience in China?

I know fully English speaking born in USA Asian people who avoid certain parts of the country over the racism they get from Americans.

This “lack of racism in the USA” only exists if you’re white.

Don’t forget that ICE is currently arbitrarily detaining people for looking/sounding foreign, and that actual US citizens and people with permanent residency status have been caught up in it.

At least in China they have their fucking paperwork in order.
by whywhywhywhy | 2026-03-03 13:28:31+00:00
It was Clearcast that rejected it you can see the reasoning here [0], seems to be mostly that it implies VPNs facilitate criminal activity and "irrelevant to the average consumer’s experience with a VPN". Either way they gave a real gift to the marketing team in rejecting it. Every person in advertising dreams of having to write the phrase "our banned ad" even more perfect when the ad was about tracking/censorship.

[0]: https://cybernews.com/news/and-then-mullvads-anti-surveillan...
by matthewdgreen | 2026-03-03 13:28:36+00:00
Getting rid of the filibuster is a good thing in general. The GOP-led states have already moved into mid-cycle gerrymanders and routine gerrymandering of the state legislatures to eliminate fair elections there: I'm sure eventually someone will have the idea of adding new GOP states. Adding two actual territories/districts that are full of actual unrepresented Americans happens to be a good idea on the merits, since those people are being screwed by the Federal government.
by pixelesque | 2026-03-03 13:28:40+00:00
Yeah...

I can't use Mullvad for several banks in the UK with IPv4 - if I switch to IPv6 in the app settings I sometimes can, but often I have to just disable it completely...

I can't use Youtube anonymously (i.e. without logging in) within the last month or so either, as Youtube very often won't play content due to my IP as well...
by dhab | 2026-03-03 13:28:58+00:00
Conditioning the crowd gradually towards being monetised in some of the most egregious ways - first pay for the glasses, then pay with revelations of private life sold to government (ICE?), business (private insurance) and so on. Super evil.

And despite this, there is no strong will to detach from what they produce - in the beginning or later when it is considered like cultural fabric. That’s how good their tactics is.

And for the pay one gets working for them - screw the world! I won’t use it anywhere near my loved ones - but will build it
by gorgoiler | 2026-03-03 13:29:12+00:00
Hah, yes I switched over as soon as they started showing the scenes behind the scenes behind the scenes.

I worked on the set of an electric shaver commercial once. I’m wouldn’t say out loud that the production team were up themselves, but in addition to the regular crew there was a second director on set making a “making of” documentary about the production process. For a shaver commercial.
by Jessyabc | 2026-03-03 13:29:56+00:00
Founder here. A few things I couldn’t fit in the post:
Here’s what the app looks like: https://imgur.com/a/1Z6sjVP

Honest state of the product: the core loop is built and working — blueprints, spaced rep, practice hub with AI tutor and vision-based canvas feedback. Shipped the practice hub this week. Rough in places, I’m one person.

Why $15/month: I wanted to price it as a serious tool. If it doesn’t save you more than $15 in tutoring or wasted study time it’s not doing its job.

Happy to go deep on any technical decisions or the product philosophy in the thread.
by DaedalusII | 2026-03-03 13:30:14+00:00
you are both correct, but what if there is no trauma?

two teenagers move into the same house because their parents started a relationship. they see each other little because both step-parents have shared custody arrangements. they have no biological connections whatsoever. four years later they are both 19, alone together a lot, et cetera. but simultaneously, this is a huge taboo, a betrayal of the parents, a great psychodrama

i knew one guy in college whose girlfriend cheated on him, with his biological father. a great betrayal, a great freudian cuckolding. what kind of strange fantasy will this man have now?
by chille87 | 2026-03-03 13:30:35+00:00
Hey HN,

After years of building websites, I got hit with an accessibility complaint.
I spent months learning WCAG, scanning my sites with every tool out there, and hating every one of them. They all generated massive PDF reports that sat in a shared drive collecting dust. So I built my own.

AccessGuard scans your site for WCAG 2.2 issues and generates production-ready code fixes for every one of them - not documentation links, not vague recommendations, actual code you can copy-paste and deploy.

What makes it different:

- AI-generated code fixes for every issue
- Scans JavaScript-rendered pages via headless Chrome, so React/Vue/Angular
SPAs work out of the box
- Prioritizes issues by lawsuit risk, not just WCAG severity
- Smart grouping - no 500-issue reports, just the issues that matter
- AltWizard: drag-and-drop AI alt text generator for images

The regulatory urgency is real - the EU Accessibility Act took effect June 2025
and ADA digital lawsuits hit 5,100+ in 2025 alone.

Tech stack for the curious: Rails 8, Ruby 3.4, PostgreSQL, Hotwire (no JS framework), Vanilla CSS (no Tailwind), Ferrum for headless Chrome scanning,
Solid Queue/Cache/Cable (everything on Postgres, no Redis), Kamal for deployment, ImportMap (no Node build step).

Free tier: 3 scans, no credit card required.

https://getaccessguard.com

Happy to answer questions about the scanner architecture, the checker methodology, or the AI fix generation.
by oyaa52 | 2026-03-03 13:31:10+00:00
Hey guys,

I'm an indie hacker and digital nomad.
I could see so many people go to this country and in a month go to other country like me.
And I was thinking "If there is a website that I can see which city indie hackers are now, I could check people I can get along for next destination and so on." so I made this website.

And my bf is owning launch platform so I was thinking it's cool to show people are launching by shipping a rocket.

If you are planning to launch like ProductHunt or TinyLaunch, you can add the launch post url so people can visit and vote for you.

Feel free to visit and mark your location!
by bloak | 2026-03-03 13:31:10+00:00
These discussions are always very annoying. People tend to state their preferences without mentioning their latitude, their longitude, or their current time zone.

Anyway, here are my preferences: GB should switch to UTC+0 all year. UTC+1 all year was tried (1968-1971) and was very unpopular in Scotland. School hours are roughly 09:00 till 15:00 and they only get about 6 hours of sunlight in winter up north so local noon has to be at around 12:00. Also, for political reasons relating to Northern Ireland, it is very helpful for GB and Ireland to have the same time. So UTC+0 it is.

Seasonal changes in school hours is a theoretical possibility, but parents of schoolchildren have a hard enough time as it is and lots of other things are linked to school hours. It would be much easier for everyone else to make seasonal changes to their timetables, like just get up an hour earlier if you want to. Nobody's stopping you.
by jcgrillo | 2026-03-03 13:31:12+00:00
The problem is that reviewing code for correctness is harder than writing correct code. So these things will always slip through review. I'm a little bit divided here whether we can (or should) blame a reviewer too harshly for letting broken code through review whether it's LLM or human generated.

I've worked on teams with a rubber stamp review culture where you're seen as a problem if you "slow things down" too much with thorough review. I've also worked on teams that see value in correctness and rigor. I've never worked on a team where a reviewer is putting their job on the line every time they click "Approve". And culturally, I'm not sure I'd want to.

That said I think it's pretty clear we need mechanisms that better hold engineers to account for signing off on things they shouldn't have. In some engineering domains you can lose your license for this kind of thing, and I feel like we need some analogous structure for the profession of software engineering.
Show HN: Open-sourced AI Agent runtime (YAML-first)
by nsokra02 | 2026-03-03 13:31:20+00:00
Been running AI agents in production for a while and kept running into the same issues:

controlling what they can do
tracking costs
debugging failures
making it safe for real workloads

So we built AgentRuntime, the infrastructure layer we wished we had.
Not an agent framework, but the platform around agents:

policies
memory
workflows
observability
cost tracking
RAG
governance

Agents and policies are defined in YAML, so it's infrastructure-as-code rather than a chatbot builder.
Example – agents and policies in YAML
agent.yaml – declarative agent config
name: support_agent

model:
provider: anthropic
name: claude-3-5-sonnet

context_assembly:
enabled: true

embeddings:
provider: openai
model: text-embedding-3-small

providers:
- type: knowledge
config:
sources: ["./docs"]
top_k: 3

policies/safety.yaml – governance as code
name: security-policy

rules:
- id: block-file-deletion
condition: tool.name == "file_delete"
action: deny

CLI – run and inspect
Create and run an agent
agentctl agent create researcher --goal "Research AI safety" --llm gpt-4
agentctl agent run researcher
agentctl runs watch <run-id>

Manage policies
agentctl policy list
agentctl policy activate security-policy 1.0.0

RAG – ingest docs and ground responses in your knowledge base
agentctl context ingest ./docs
agentctl run --agent agent.yaml --goal "How do I deploy?"

Agent-level debugging
agentctl debug -c agent.yaml -g "Analyze this dataset."

Cost tracking is exposed via the API (per agent/tenant), and the Web UI shows analytics.
The workflow debugger (breakpoints, step-through) lives in the pkg layer; the CLI debug is for agent execution.
What’s in there
Governance

Policy engine (CEL)
Risk scoring
Encrypted audit logs
RBAC
Multi-tenancy
Fully YAML-configurable

Orchestration

Visual workflow designer (React Flow)
DAG workflows
Multi-agent coordination
Conditional logic
Plugin hot-reload
Workflow marketplace

Memory & Context

Working memory
Persistent memory
Semantic memory
Event log

Context assembly combines:

policies
workflow state
memory
tool outputs
knowledge

RAG features:

embeddings (OpenAI or local)
SQLite for development
Postgres + vector stores in production

Observability

Cost attribution via API
SLA monitoring
Distributed tracing (OpenTelemetry)
Prometheus metrics
Deterministic replay (5 modes)

Production

Kubernetes operator (Agent, Workflow, Policy CRDs)
Helm charts
Istio config
Auto-scaling
Backup / restore
GraphQL + REST API

Implementation

~50k LOC of Go
Hundreds of tests
Built for production (in mind)

Runs on:
Local

SQLite
In-memory runtime

Production

Postgres
Redis
Qdrant / Weaviate

Happy to answer questions or help people get started
by lambda | 2026-03-03 13:31:39+00:00
Yeah. I've been finding a scary number of people saying that they never write code by hand any more, and I'm having a hard time seeing how they can keep in practice enough to properly supervise. Sure, for a few weeks it will be OK, but skills can atrophy quickly, and I've found it's really easy to get into an addictive loop where you just vibe code without checking anything, and then you have way too much to review so you don't bother or don't do a very good job of it.
by lazide | 2026-03-03 13:31:42+00:00
Even ‘true general intelligence’ (if we count humans as that) screws up frequently, sometimes (often?) intentionally for it’s own benefit - which is why accountability is such a necessary element.

If someone won’t be held liable for the end result at some point, then there is no reason to ensure an even somewhat reasonable end result. It’s fundamental.

Which is also why I suspect so many companies are pushing ‘AI’ so hard - to be able to do unreasonable things while having a smokescreen to avoid being penalized for the consequences.
by christalingx | 2026-03-03 13:31:52+00:00
How it works under the hood (since HN will ask):
No LLM call, no summarization — purely deterministic.

Strips filler words ("basically", "essentially"), collapses verbose constructions ("in order to" → "to"), removes redundant connectors. Output is always a strict subset of the original — no words added, none moved.

On privacy, since it always comes up: your OpenAI/Claude keys never leave your app. You send us text → we return compressed text → you call your LLM yourself. We don't know which model you use or what you're building.

Real numbers across 2.4M+ calls: 42% average reduction. One beta user at 50k prompts/day saves $2,100/month.

For existing codebases, one line:
from agentready import patch_openai
Every OpenAI call gets compressed automatically. Zero other changes.

Free during beta, no card: https://agentready.cloud/hn

AMA on how the rule engine works, the edge cases are more interesting than you'd expect.
by edgyquant | 2026-03-03 13:32:18+00:00
This is not a genuine question and the answer is very obvious to anyone who isn’t porn brained (and even then, they’re just lying.)

Tom and Jerry is not equivalent to videos of intercourse and you should rethink your life and how depraved your view of sex is if you are trying to make the case they are in defense of children consuming pornography.
by bschwindHN | 2026-03-03 13:32:36+00:00
Thanks, I eventually discovered it after a ton of trial and error. It's a shame though because the whole point of a touchpad is multitouch gestures which actually make navigating CAD applications pretty nice. I'll use a touchpad or a combination of touchpad and mouse in other apps like KiCad and it works quite well. Seems to me like all these open source programs should be stealing/sharing the best implementations of some of these basic things like 2D/3D input controls with each other.
by ben_w | 2026-03-03 13:32:45+00:00
Much as I like them, I do frequently remind myself of two things:

1) https://en.wikipedia.org/wiki/Clever_Hans

2) https://archive.org/details/nextgen-issue-26 as an example of how in the 90s we has rapid cycles of a new tech (3d graphics) astounding us with how realistic each new generation was compared to the previous one, and forgetting with each new (game engine) how we'd said the same and felt the same about (graphics) we now regarded as pathetic.

So yes, they do sound "authoritative and confident text it just overrides any skepticism subconsciously", but you shouldn't be amazed, we've always been like this.
by horsawlarway | 2026-03-03 13:32:47+00:00
There is not any practical way to do this effectively.

There are several, rather tedious and incomplete, hacks that you can apply to attempt to prevent billable actions after limits are hit.

But to be frank - they're cop-outs for a real spending cap.

You'd hope these companies would address this themselves - but it's not profitable for them to resolve (it's somewhat involved and requires them to allow people to pay them less)... So my strong vote is to make the contracts that allow this sort of "un-cappable" spending for automated actions void in court.