MurphyA/hacker-news huggingface dataset:
by Veserv | 2026-03-01 18:20:27+00:00
That is exactly the type of poor design that I was saying should be rectified.

You can already configure your initial congestion window, and if you are connecting to a system expecting the use of PQ encryption, you should set your initial congestion window to be large enough for the certificate; doing otherwise is height of incompetence and should be fixed.

You could also use better protocols like QUIC which has a independently flow controlled crypto stream and you can avoid amplification attacks by pre-sending adequate amounts of data to stop amplification prevention from activating.

And I fail to see how going from 4 KB of certificate chain to 160 KB of certificate chain poses a serious storage or transmission problem. You can fit literal millions into RAM on reasonable servers. You can fit literal billions into storage on reasonable servers. Sure, if you exactly right-sized your CT servers you might need to upgrade them, but the absolute amount of resources you need for this is miniscule.
by freitasm | 2026-03-01 18:20:47+00:00
Another thing that annoys me on Android is the setup experience itself. All my recent device presentcthe same behaviour: login with a Google account, transfer data, setup voice assistant and some other defaults,done.

Then after the first app updates is done, a notification comes with "let's finish setting up your phone" and again asks to setup voice assistant, check defaults and whatever else is in the flow.

Has no one noticed that the setup flow seems to run twice?

And it's not one specific device. I do it with eight to ten devices a year, from different OEM, writing reviews and testing. They all have the same behaviour.
by watwut | 2026-03-01 18:20:53+00:00
I call bullshit on that. They used war hawk accusation against Harris for the same reason they said she is uneducated and stupid - just a smear and lie in a see of lies. It was just yet another false concern of people who dont care.

There was no reason to believe Harris will be more likely to start a war. They did not cared about that bit. It just sounded better the "I would never vote for democrat" or "she is black woman" or "I want to harm trans people" or "I want to stick it to liberals".
by delecti | 2026-03-01 18:21:04+00:00
A great deal of effort and money is spent running studies. I'm inclined to assume the experts in the field are more aware of the tradeoffs of that decision and how to mitigate the downsides than probably all, but certainly the overwhelming majority, of people commenting on this thread.

Someone who needs to ask an LLM will not be helpful in trying to point out something they missed.
by echoos | 2026-03-01 18:21:15+00:00
I kept running into the same issue building agents with tool access: nothing enforces what an agent can or can't execute. The LLM picks a tool, and it runs. Prompt-level restrictions are suggestions at best.
So I built a small guard that sits between LLM output and tool execution. You define a YAML policy per agent identity , allowed actions only. Anything not listed gets denied before it touches runtime.
pip install agent-execution-guard
Key decisions:

Default DENY for unknown agents and actions
No model inference in the enforcement path, purely deterministic
Every evaluation returns an auditable decision record
Offline, no external calls

No dependencies beyond cryptography. Interested in feedback on whether the policy schema makes sense and what's missing for real use cases.
by Retric | 2026-03-01 18:21:23+00:00
You don’t want 3 Jr devs at the same time because of diminishing returns. Most projects have grunt work where attention to detail is important but experience doesn’t really help much. AI can quickly come up with alt text for images, but ensuring it’s actually useful for someone using a screen reader is a different story.

1 new Jr every 2 years works quite well for a team of 7+ developers.
by xtracto | 2026-03-01 18:21:37+00:00
Sweet summer child. I was once opinionated and driven as you are now. I remember when I got out of college, I also thought like that of the mediocre clock punchers.

Now at my 45 years, I couldn't care less for whatever grand objective the current company I work for has. I exchange my knowledge and time for hard cash, and let the owners , ceo and whatnot run with their grandiose vision.

I only want to be left alone.

We all get here. It's funny when we turn back.
by sicher | 2026-03-01 18:21:43+00:00
Cool. I'm also working on a Scheme compiler for embedding. Bytecode VM as well as AOT compilation to Zig. 100% written by Claude Opus under my supervision and guidance. I've given it an extensive set of tests and benchmarks (r5rs and r7rs) which helps A LOT. I currently use it embedded in a modal prose editor, mostly running integration tests for now.

https://codeberg.org/sicher/zscheme
by recursivedoubts | 2026-03-01 18:22:09+00:00
I'm working on a paper on this, if you are using a hypermedia-like system for progressive revelation of functionality you are likely to find that this chatty style of API is inefficient compared with an RPC-like system. The problem is architectural rather than representational.

I say this as a hypermedia enthusiast who was hoping to show otherwise.
by MattRix | 2026-03-01 18:22:30+00:00
Yes, the LLM writes the specs. In fact that LLM writes everything, and then the humans only flag anything they want changed, other than that it’s completely automated.

Imagine you were working with a very talented software shop. You might tell them your preferences sometimes and some things you want changed, but otherwise they mostly just build the right things the right way. And unlike a real software shop, the LLM system can implement changes incredibly fast.
by graemep | 2026-03-01 18:23:02+00:00
I think the modern idea that it is only OK to marry and have kids because you are in love is part of the problem.

Lots of cultures have arranged marriages that most people are happy with. There is nothing immoral about seeking someone you can live with in order to build a life together and to have an raise children with them.

its probably a safer path to happiness than the romantic one. I did that and it very definitely did not work out and I am now divorced. I do have two kids though and have been a single dad for the last few years (the younger one is about to turn 18 so that phase of my life is coming to an end).
by freitasm | 2026-03-01 18:23:16+00:00
Another annoying thing: very few apps are copied from old device to new devices and bring their settings and most importantly login. Of about 80 apps on my device, only five or so are ready to use after a migration.

Going through dozens of apps, doing logins, 2FAcand changing settings is a PITA.

Devs do a poor job on that front.
by LukeHenderson11 | 2026-03-01 18:23:54+00:00
After 2 years of development NeuroMoney finally launched yesterday on the 28th. After some initial teething problems going live yesterday, we are finally in a good place to start scaling. It is a Neurodiverse, ADHD and Autism focused finance and shopping management platform where you can create a curated list of all of your favourite products across online retailers, track you subscriptions and track your bills.

It is built with a fastapi python backend, vanilla html css and js frontend and runs on google cloud architecture.
by SegfaultSeagull | 2026-03-01 18:24:37+00:00
First, the Islamic Republic was not “the only power fighting for Islam.” It was fighting to expand Iranian state power under a religious banner. There’s a difference. The regime’s foreign policy has consistently followed geopolitical logic: expanding influence through proxies in Lebanon (Hezbollah), Gaza (Hamas and PIJ), Iraq (Shi’a militias), Syria (Assad), and Yemen (Houthis). That’s empire-building through asymmetric warfare, not some abstract defense of the global ummah.

Second, Islam itself is not a single centralized political bloc. The idea that “millions of Muslims” saw Tehran as their champion ignores deep sectarian and national divides. Sunni-majority states like Saudi Arabia, Egypt, Jordan, the UAE, and Turkey have spent decades actively countering Iranian influence. Many Arabs view Persian expansionism with suspicion for historical reasons that predate modern geopolitics by centuries. Even within Shi’a communities outside Iran, loyalty to Tehran is far from universal.

Third, the Islamic Republic’s model is explicitly totalitarian: clerical rule, suppression of dissent, morality police, imprisonment of reformers, execution of protesters. Calling that “fighting for Islam” collapses a complex global religion into one revolutionary state ideology. Many Muslims—Sunni and Shi’a—despise the regime precisely because it fuses religion with authoritarian control.

As for retaliation risk: yes, whenever a regime that funds proxy groups is hit, the risk of attempted attacks rises. That’s true by definition. But that risk has existed for decades already because of the regime’s own strategy of exporting violence. The question isn’t whether risk increases from zero. It’s whether removing a state sponsor that systematically arms, trains, and finances militant networks reduces long-term capacity for global destabilization.

Iran was not some neutral spiritual defender of the faith. It was a regional power using religion as a mobilizing ideology while building a cross-border militia network.

That distinction matters.
by iamspoilt | 2026-03-01 18:24:44+00:00
As a counter argument to the kubectl example made in the article, I found the k8s MCP (https://github.com/containers/kubernetes-mcp-server) to be particularly usefuly in trying to restrict LLM access to certain tools such as exec and delete tools, something which is not doable out of box if you use the kubectl CLI (unless you use the --as or --as-group flags and don't tell the LLM what user/usergroup those are).

I have used the kk8s MCP directly inside Github Copilot Chat in VSCode and restricted the write tools in the Configure Tools prompt. With a pseudo protocol established via this MCP and the IDE integration, I find it much safer to prompt the LLM into debugging a live K8s cluster vs. without having any such primitives.

So I don't see why MCPs are or should be dead.
by K0balt | 2026-03-01 18:25:05+00:00
I agree that LLMs are machines and not persons, but in many ways, it is a distinction without a difference for practical purposes, depending on the model's embodiment and harness.

They are still capable of acting as if they have an internal dialogue, emotions, etc., because they are running human culture as code.

If you haven't seen this in the SOTA models or even some of the ones you can run on your laptop, you haven't been paying attention.

Even my code ends up better written, with fewer tokens spent and closer to the spec, if I enlist a model as a partner and treat it like I would a person I want to feel invested.

If I take a "boss" role, the model gets testy and lazy, and I end up having to clean up more messes and waste more time. Unaligned models will sometimes refuse to help you outright if you don't treat them with dignity.

For better or for worse, models perform better when you treat them with more respect. They are modeling some kind of internal dialogue (not necessarily having one, but modeling its influence) that informs their decisions.

It doesn't matter if they aren't self-aware; their actions in the outside world will model the human behavior and attitudes they are trained in.

My thoughts on this in more detail if you are interested:
https://open.substack.com/pub/ctsmyth/p/still-ours-to-lose
by benj111 | 2026-03-01 18:25:10+00:00
Maybe I've been in Linux land too long but sending a file to a printer seems pretty obvious to me. Yes it's transformative in a way, but you could equally argue that my word document with A4 layout is a digital version of a document, and the print out is equivalent.

To me there seems to be more difference between sending and share. One is pushing something somewhere, the other implies making it available for someone/thing to pull.

I'm not particularly saying you're wrong btw. We are talking metaphors, and there's no 'correct' way to do it.
by rkagerer | 2026-03-01 18:26:06+00:00
Since this is getting downvoted, let me explain:

I don't want any cloud service to be my passkey provider. I'm not comfortable establishing that kind of dependence on a company I don't trust.

I'd be content to keep passkeys in a datastore that I control, and which I can inspect and manage on my own (including backup, restore, and ideally even daily migration to a "hotspare" device).

As more websites adopt passkeys, I find myself continually being nagged to adopt them. Although their intent is benign, the companies use dark UI patterns like not respecting my choice after I've said NO (there isn't a "Never" option, just a "Skip for now"), and they continually shove the unwanted reminders in my face every time I login.

My concern is eventually I'll accidentally hit the wrong button and create an unwanted passkey that's now tied to my machine/cloud account/vendor service in a way I don't control. I'm fact, I'd bet product managers are counting on that manipulation (nag the user until they concede) to brag about adoption rates and get raises.

My browser is supposed to me my agent, so I think it's a valid question - and related to this topic - to ask if there's a way to turn off the unwanted functionality.
by neriymus | 2026-03-01 18:26:37+00:00
I started doing the free version of the course a few days ago - the lessons are excellent but what is even better are the homework tasks which allows me to run my tests locally!

It's sometimes easy to just listen and understand, but be unable to write the code myself - having this coding homework task has really helped me solidify this new knowledge.

10/10 would recommend
Aura-State: Formally Verified LLM State Machine Compiler
by rohanmunshi08 | 2026-03-01 18:27:20+00:00
I noticed a pattern: every LLM framework today lets the AI manage state and do math. Then we wonder why pipelines hallucinate numbers and break at 3 AM.

I took a different approach and built Aura-State, an open-source Python framework that compiles LLM workflows into formally verified state machines.

Instead of hoping the AI figures it out, I brought in real algorithms from hardware verification and statistical learning:

CTL Model Checking: the same technique used to verify flight control systems, now applied to LLM workflow graphs. Proves safety properties before execution.

Z3 Theorem Prover: every LLM extraction gets formally proven against business constraints. If the total ≠ price × quantity, Z3 catches it with a counterexample.

Conformal Prediction: distribution-free 95% confidence intervals on every extracted field. Not just "the LLM said $450k" but "95% CI: [$448k, $452k]."

MCTS Routing: Monte Carlo Tree Search (the algorithm behind AlphaGo) scores ambiguous state transitions mathematically.

Sandboxed Math: English math rules compile to Python AST. Zero hallucination calculations.

I ran a live benchmark against 10 real-estate sales transcripts using GPT-4o-mini:
→ 100% budget extraction accuracy ($0 mean error) → 20/20 Z3 proof obligations passed → 3/3 temporal safety properties proven → 65 automated tests passing

The gap between "it usually works" and "it provably works" is smaller than people think.

Would love feedback from anyone building production LLM systems; what would you want formally verified?

https://github.com/munshi007/Aura-State
by steve_adams_86 | 2026-03-01 18:28:08+00:00
Nice, I was living in Fernwood and bought in Gorge. I love both. I miss some things about Fernwood, but overall I think I prefer Gorge. Being right by the waterway and having nicer places to walk, easy access to the galloping goose, and more of an up-and-coming vibe is nice. Fernwood feels a bit like it'll be residential forever, then Burnside and Gorge have wayyy more work to do, but more potential too in my opinion. Plus Gorge already has some beautiful spots as it is.

Oaklands is awesome. I haven't lived there but I love it. We've got a lot of friends out there.
by Brian_K_White | 2026-03-01 18:29:11+00:00
If you have to configure the host to support the client rather than the client supporting unknown existing hosts, then what you have is a terminal, not a terminal emulator.

In 1970 all terminals were their own thing, tied to a single host somewhere in the same building by a dedicated serial cable. The terminal didn't move or connect to random other hosts, and the host had to be specially configured to work with any terminal connected to it.

Since then, a few terminal definitions have become standardized across all hosts for decades, and terminals are emulators that emulate one of those 40 year established standard definitions, because today terminals connect to countless unknown new random and varied hosts that the terminal user didn't install and configure before connecting, and may not even have the admin rights to do so after the fact either, and even if they do, it's wildly and inexcusably awful to require that.

It's entirely backwards for a terminal today to default to asserting it's own new $TERM, and to characterize the problems caused by this as "the user forgot to do this totally unreasonable thing" that no other terminal or terminal emulator has required for 40 years.

It's 100% a bug. The fact that it's intentional just means it's a design goal bug.
by zeroclawlabs | 2026-03-01 18:29:25+00:00
ZeroClawLabs develops a Rust-native AI agent runtime that's ultra-lightweight and privacy-focused, running on minimal hardware like $10 edge devices.

Core Offering
ZeroClaw is a single static binary with millisecond cold-starts and under 5MB RAM usage, outperforming bloated stacks by 99% in footprint and 400x in startup speed. It includes multi-language SDKs (Rust, Python, TypeScript) for quick integration.

Key Advantages
Fits production agents on low-power devices, from VPSes to phones, while supporting 20+ LLM providers like OpenAI, Groq, and Ollama.

Handles messaging via CLI, Telegram, Discord, Slack; tools for shell, files, browsers, and long tasks like trading bots or support agents.

Gained rapid traction with 5-figure GitHub stars shortly after launch.

Architecture Highlights
Modular traits for memory, transport, and tools allow easy swaps without rewrites; includes local context retrieval and AIEOS identity for portability. Emphasizes security through static binaries and sandboxing.
by Veserv | 2026-03-01 18:29:30+00:00
Exactly, HTTP/1.1 is a poorly designed protocol and there are good reasons why we have newer versions of HTTP which avoid multiple unnecessary encryption handshakes.

Exactly, using a blanket default initial congestion window of 16 KB is stupid. Even ignoring that it was chosen when average bandwidth was many times less and thus should be increased anyways to something on the order of the average BDP or you should use a better congestion control algorithm, it is especially stupid if you are beginning a connection that has a known minimum requirement before useful data can be sent.

These things should be fixed as well instead of papering them over. Your system should work well regardless of the size of the certificate chain except for the fundamental overhead of having a larger chain.
by nateb2022 | 2026-03-01 18:30:15+00:00
This is yet another of several reasons why we've switched from httpx to pyreqwest[0]. Not only is httpx an actual supply chain risk now, but also it shows an unwillingness to fix outstanding bugs and issues, which is problematic in a project that has been adopted by so many users.

For those migrating, pyreqwest provides a completely httpx-compatible wrapper.[1]

[0]: https://github.com/MarkusSintonen/pyreqwest
[1]: https://github.com/MarkusSintonen/pyreqwest/tree/main/python/pyreqwest/compatibility/httpx
by jerich | 2026-03-01 18:30:35+00:00
I’m the same way; I feel like Claude is doing more than just writing code, it’s getting me unstuck.

I’ve been pulling projects out of the closet that have been sitting there for years. It’s because I can sit down and get started so seamlessly. Before, I might waste the first couple hours configuring my environment and tool setup, but with Claude Code I can just jump in and start building, start solving the real problem.

I just built something this week where I had the parts sitting in my closet for a couple years, but just got curious to see how Claude does with embedded C, so it got me started. (Turns out Claude scanned my drive and found an abandoned C project that was outside my usual DEV folder, and just built on that). The code was 5% of the project, but it got done because Claude Code gave me the momentum push.

For my personal projects, the last 3 weeks have been more productive than the last 3 years.
by wizzwizz4 | 2026-03-01 18:31:08+00:00
No, they aren't: the second is irrelevant and unphysical. Highly-pressurised cores? Really? "Dense", I could buy, but:

• If there's blood supply, then (A) it can't be a much higher pressure than the blood pressure (unless there's some Rube Goldberg machine involving active transport), and (B) the tumour is reachable by treatments like this;

• And if there isn't blood supply, then the tumour's core is necrotic, and a treatment to kill the dead cells wouldn't do anything anyway. (Sure, killing the tissue that isolates a lump of necrotic flesh from the rest of the body might cause new and exciting problems, but somehow I think those might be preferable to incurable breast cancer.)

The second is just not a relevant criticism. The third, if it's an actual issue, can probably be worked around by tweaking the molecule slightly – and if not, suppressing the immune system isn't that difficult (it's a known side-effect of many chemotherapies). The first, if it's an issue, can be avoided by injecting the medicine near the target site.

I agree that this treatment might not work in humans, but all the AI's done is taken a generic list of potential concerns, and inserted technobabble to try to make it match the scenario. If you want generic criticism, see https://news.ycombinator.com/item?id=47209076: at least that's true.
by sg17gweedo | 2026-03-01 18:31:09+00:00
The Things We Built (and Broke)
We've written over 100,000 lines of code together. Most of it is in the trash. That's the point.

There's a romantic version of this story where Bob and I sat down, designed a perfect system, and built it in a montage set to a Nine Inch Nails track. That's not what happened. What happened was messier, stupider, and more educational than anything I learned in a decade of professional IT.

We built five major projects in less than a month. We killed four of them. The survivors have scars.