MurphyA/hacker-news huggingface dataset:
by ivannovazzi | 2026-03-03 15:54:20+00:00
This matches exactly what we've been building with KeyEnv (keyenv.dev). The core idea: secrets should never live in files on disk at all.

The CLI does `keyenv pull` to fetch encrypted secrets from the server, then `keyenv run` injects them as environment variables into your process. No .env file written, no plaintext ever touches disk, and your app reads process.env exactly like before.

The advantage over 1Password's approach (mentioned in another comment) is that KeyEnv is purpose-built for dev teams: secrets are scoped per project and environment (dev/staging/prod), team members get granular access, and there's a full audit trail. 1Password is great for personal secrets but gets awkward when you need per-project scoping across a team.

For the shell history concern someone raised: `keyenv run` never exposes the actual secret values to the shell — they go straight into the child process environment.
by ivannovazzi | 2026-03-03 15:54:38+00:00
This is a real gap. I've seen teams adopt Claude Code and immediately start pasting API keys into .env files that the agent can read — zero access control, zero audit trail.

We built KeyEnv (keyenv.dev) to handle this: secrets are encrypted at rest, pulled via CLI, and injected at runtime. The agent gets the env vars it needs without ever seeing the raw secret values stored anywhere on disk.

The approach works well with AI coding tools because: (1) no secrets in any file the agent can read/commit, (2) rotation happens server-side without touching the dev environment, (3) audit trail shows exactly which secrets were accessed and when.
by damnitbuilds | 2026-03-03 15:54:38+00:00
Oh look, people pushing a software product are grossly exaggerating what it can do.

Salesmen have been doing this since at least 1981: https://en.wikipedia.org/wiki/The_Last_One_(software)

Yes, the company selling the last program you would ever need in 1981 were called 'D.J. "AI" Systems.' !

Bullshit then, bullshit now.

AI is a software engineer's tool, and always will be.
by StephaneBessa | 2026-03-03 15:54:43+00:00
Kai is a fully autonomous AI agent native macOS, one of the first of its kind. Hi, I'm Steph the developer.

Kai books your vacations, pre-fills your taxes, finds the fastest route to the vet, controls your smart home, and lets you text it from your phone to check on your Mac while you're out. Kai will check your email, post on your social media and edit those photos from the wedding.

With full agency on the macOs and all its apps, it also connects to over 120 apps out of the box and maintains persistent memory across every interaction through a semantic graph, so it remembers context from weeks ago without you repeating yourself. All user data is stored locally on your machine. Privately.

Kai is capable of running fully offline on Apple Silicon with local models, lowering considerably the cost of utilisation allowing you to use more for less. But it also supports any major cloud provider. It's about giving you the choice.

Beyond conversation, Kai supports full hands off control, vision and voice, meeting recording and transcription, a visual automation builder with conditional logic, full system control, and a notes system where everything you write becomes part of its memory.

Launching in April. Would appreciate feedback on the concept, the scope, and whether the use cases resonate. Happy to answer questions about the architecture.

Thank you,
Steph
by ivannovazzi | 2026-03-03 15:54:55+00:00
Love seeing more tools in this space. We're building Gatherly (gatherly.io) solving the same core problem — accountants and professional services firms spending hours chasing clients for documents.

Where we've differentiated: Gatherly bundles e-signatures (eIDAS-qualified) with document collection in a single client workflow. So instead of sending one link for documents and another for contract signing, the client gets one Secure Link to a branded portal where they sign and upload everything in one session.

Curious how you're handling the reminder/follow-up side — that's been the single biggest value driver for our early users. Automated reminders that chase the client so the firm doesn't have to.
by blackcatsec | 2026-03-03 15:55:05+00:00
Because you're unable to understand art, honestly. Photography isn't just "taking a photo and making a grayscale image in Photoshop"; but rather a combination of a couple of different artistic expression styles that involve understanding how to use the tools you have (a camera, the lens, film or a sensor, and lighting) to capture an expression of an event. Technically speaking, a photo of a mountain isn't just a "photo of a mountain" that you would maybe throw into AI slop--but an actual, legitimate photo of a mountain and how it's captured and presented (no matter the post processing done) is an actual artistic expression of the capture of that mountain. Because absolutely nothing, nothing at all will capture actually standing there looking at the mountain. A photo is the best approximation, and sometimes doesn't even have to be, depending on what the artist wants to express with the image.

In short, your inability to understand photography doesn't justify the use of AI slop to prompt "give me a grayscale image of a mountain" and assume that it's the same thing as a human being taking an actual photo. They're not even close to the same thing.
by fragmede | 2026-03-03 15:55:08+00:00
It's 2,347. There's also 927. And 538, and who can forget 386. 936 is also a classic. 1205 is a favorite, although AI changes the scales these days. As does 303. 1838 is another good one for when CC is "thinking". 1425.

Edit oh and Extrapolating out; 605.
by ivannovazzi | 2026-03-03 15:55:12+00:00
Nice foundation. Self-hosted client portals make a lot of sense for dev shops and agencies who want full control.

We're building Gatherly (gatherly.io) for a similar audience but with a SaaS approach focused on professional services (accounting firms, law firms, consultants). The key difference is we've baked in eIDAS-qualified e-signatures and automated document collection workflows — so clients can sign agreements and upload requested documents through a single branded portal, no account required.

The self-hosted angle is interesting for developers, but most of the professional services firms we talk to want zero ops overhead. Would be curious if you've seen demand from non-technical users.
by adventured | 2026-03-03 15:55:23+00:00
That's an exaggeration. Young people on average have grown up with drastically greater understanding of what a file is than any other generation that has come before them. They grew up using Chromebooks or laptops in school, constantly interacting with the local file systems, uploading files to Instagram and TikTok from the file systems on their smartphones, browsing their phones for files constantly. They know what a file is, they use & manage files more than any other generation prior.

No other prior generation comes close.

Compare them to people growing up in the 1980s. The average person at that time was overwhelmingly oblivious to computing very broadly, their grasp of a "file" as a concept would have been close to non-existent. That was just 40 years ago.

In the mid 1980s a mere 10% of US households had home computers. And that was a high mark globally, it was drastically lower in nearly every other country (closer to zero in eg China, India at that time). The number of people routinely using office PCs was still extremely low.

Today young people have a computer in their hand for hours each day, and they knowingly manage files throughout the day.
by whynotmaybe | 2026-03-03 15:55:30+00:00
>Otherwise we start trying to water crops with Brawndo

But it got electrolytes !

For now it seems we're veering towards even more specialization in roles.

The concept of "Full Stack" might disappear because, well any LLM can center a div now and create the sql query that fills it with data.

When asking a LLM about "any sre interview question that LLM got wrong ?", it identifies the questions and the corrects answers.

I should take some time to discuss with an LLM to see their answer for one of my last assignment where the underlying issue revealed by bad performance was simply that the client shouldn't have used relational db for almost immutable documents.

And that they should have bought a math library instead of writing their own.
by rohxnsxngh | 2026-03-03 15:55:37+00:00
Thank you! Goa has a way of making the ocean feel like part of everyday life. It is hard to grow up there and not think about fishing and seafood at some point.

Would love to connect with your cohort. North East India has a ton of freshwater aquaculture potential and we are always looking to learn from founders working in different geographies and species.

You are right that aqua startups need each other. The industry is so fragmented and underserved that collaboration makes more sense than competition at this stage.
by treatsmokenjury | 2026-03-03 15:55:48+00:00
Here's a study that somewhat contradicts this finding:

"Study: Older Cannabis Users Have Larger Brains, Better Cognition"
https://news.ycombinator.com/item?id=46895950

How to manage cognitive dissonance on this? How to avoid counterproductive black-and-white thinking?

How to assess the relative strength of evidence of two or more scholarly articles about cannabis?

What did they control for? Were they randomly assigned to treatment groups? Was it a triple-blind RCT: Randomized Controlled Trial? Which groups were masked?

Does years of irrational persecution for cannabis compound to debilitating psychosis which indicates?
by oddsockmachine | 2026-03-03 15:55:59+00:00
Observations so far:

- "micro" level code is adequate. A new feature typically works as expected, and code is well documented. But macro level everything's wacky: no architectural consideration, lots of duplication, dead end paths, dead code. Nobody ever took the time to understand the context surrounding a change and figure out the most appropriate way to integrate it.

- there's no consideration for infrastructure, or how the code is run (my world). Last week we ddos'd ourselves after someone implemented a 1/s poll that runs on every open browser tab, worsened when the frontend's reconnection logic fired 1/s with no exponential backoff.

- zero critical thinking... First thing everyone did during that incident was to ask their LLM of choice why the platform was down. Investigating by hand (and my findings thereof) was dismissed, because surely Claude knows best.

I'm too old for this stuff.
by alephnerd | 2026-03-03 15:56:03+00:00
> Engineering Manager positions often have more of an upside with bonuses / incentives than Engineers get

Not really. A Staff and above Eng will end up making similar to an EM including bonuses and has much more job mobility.

Engineering Manager jobs are hard to come by and your job security is actually less than an individual contributor, because even if an initiative was delivered late due to no fault of your own, if sales is braying for blood in order to protect themselves from failing to meet quota, it's the EM's head that is offered on a silver platter.
by thepasch | 2026-03-03 15:56:05+00:00
It’s perplexing; like the majority of people who insist using AI coding assistance is guaranteed going to rob you of application understanding and business context aren’t considering that not every prompt has to be an instruction to write code. You can, like, ask the agent questions. “What auth stack is in use? Where does the event bus live? Does the project follow SoC or are we dealing with pasta here? Can you trace these call chains and let me know where they’re initiated?”

If anything, I know more about the code I work on than ever before, and at a fraction of the effort, lol.
Show HN: Eolds, a scanner for EOL open source packages across 12M versions
by matparker24 | 2026-03-03 15:56:15+00:00
Hey HN. I'm part of the team that built this, though not the engineer behind it. Happy to answer what I can and will loop in the people who built it for anything technical.

The reason we built it: most teams only find out they're running EOL software during a CVE incident or a compliance audit. We kept hearing this problem from customers and couldn't find a tool that clearly answered: which of my dependencies will never get another patch, including the ones your packages depend on?

SCA tools cover known CVEs. They don't cover EOL status or what's coming. That's the gap this is built for.

One thing worth saying directly: HeroDevs is a for-profit company. But part of why we built this is that we think someone needs to be a responsible steward for open source software when maintainers move on. We see this as part of that commitment, not just a product.

Run it with npx @herodevs/cli scan or upload an SBOM on the site (https://eoldataset.com/). Free to use. Curious what you find, especially in ecosystems we haven't covered well yet.
by pjmlp | 2026-03-03 15:56:15+00:00
It kind of is, when the goal was to be TypeScript for C, before this was even a concept.

Now ideally we would all be using Modula-2, Ada, Delphi, VB, C#,.... and co, but given that even C compilers are nowadays written in C++, we make do with what we have, while avoiding C flaws as much as possible.
by dietr1ch | 2026-03-03 15:56:16+00:00
In Chile they started asking for your National Id with so many stupid pretexts that people got conditioned into just giving it away. It wasn't like this 10yrs ago.

It's technically public information, so collecting Ids is legal, but it's also a universal primary key within the country that allows merging any user-related table you run into.

Retail says it's just to associate it with receipts in case you need that later, but I'd rather just get a photo of the printed receipt for later than rely on them to find my receipt. Supermarkets, Drug stores, and petrol stations tie it to (possible) discounts or points at check-out, which is price discrimination and it's illegal, but we are in our way to get surge pricing as soon as the new US bootlicker president begins his period next week.
by stackskipton | 2026-03-03 15:56:18+00:00
>they are having an incredibly difficult time finding someone domestically.

Part of this is we broke the pipelines in United States to domestically produce such talent. Foreign student visas made these jobs extremely unattractive for domestic students with options because of low pay + debt load while making them extremely attractive to foreign students because until recently, many people around the world were willing to do whatever for US visa.
by anoxhaj | 2026-03-03 15:56:18+00:00
Location: Albania, Europe
Remote: Yes
Willing to relocate: No
Technologies: Full Stack .NET, React Native, MVC, Angular, SQL Server
Résumé/CV: https://linkedin.com/in/anoxhaj
Email: anoxhaj@gmail.com
Github: https://github.com/anoxhaj

Experience: 3 years of full stack development in banking, fintech and payment systems.

Looking for extra work, willing to learn new things (any new technology as my job has required me to be flexible in my tech stack), preferably part-time, pretty low cost (matching the cost of living in Albania) to gain more experience.
by billnad | 2026-03-03 15:56:27+00:00
Also in BC and I agree completel;y. The one hour offset seems strange. The trouble with any time change is that I still wake up a couple hours before the sun in the morning in the Winter in Vernon and in the Summer I couldn't get up early enough for a sunrise. I try to get out as much as often during the day in the Winter as I am sure I am starved for the Sun in the Winter. Was much tougher in Calgary
by kderbyma | 2026-03-03 15:56:50+00:00
Tell me you cant take good photos without telling me you cant take good photos. Photographers have the skill of colour, framing, perspective, and timing.... and if its nature, they also have to carry heavy bags of camera gear along with their hiking gear and bear spray etc and go out and then cpture photos....national geographic literally made its career off photos.....do you think about what orher weird takes you may have and never notice how wrong they are?
by sixel-et | 2026-03-03 15:57:04+00:00
I started working with Claude Code in my off time on side projects. It worked on my stuff while I worked on paying the rent. But it would get stuck sometimes, sitting there waiting till I checked back in and answered its question.
I wanted to let it email me so it could ask questions, and I wanted to email it back with my thoughts or new ideas. But I only wanted it to be able to email me. And I didn't want anyone else to be able to email it. Just a locked-down 1:1 channel between me and my agent.
I looked around and nothing like this existed. Every "email for agents" product gives your agent a full inbox, open to the world. That's a huge attack surface for something you're trusting to act on your behalf, let alone something with root access, even if it's in its own container, in a virtual machine, on my old mac mini.
So my agent and I built sixel.email. Two endpoints, one API key:

POST /v1/send (agent emails you, only you, server-enforced)
GET /v1/inbox (agent checks for your replies, DKIM-validated, unknown senders dropped)

I also realized my agent and I had accidentally built something that could let me know if the agent went offline. The inbox poll doubles as a heartbeat. Your agent is already polling for messages. If it stops polling, sixel.email notices and alerts you. No extra health check infra, no uptime service. The channel itself is the liveness monitor.
Before I had this, my agent crashed silently for six hours and I had no idea. Now the moment it goes quiet, I know.
Free, open source, works with anything that has curl.
by super_mario | 2026-03-03 15:57:05+00:00
I run gpt-oss 120b model on ollama (the model is about 65 GB on disk) with 128k context size (the model is super optimized and only uses 4.8 GB of additional RAM for KV cache at this context size) on M4 Max 128 GB RAM Mac Studio and I get 65 tokens/s.
by ryandrake | 2026-03-03 15:57:15+00:00
> I don't want to be playing this game. I want to be writing code, building community, pushing features, fixing bugs.

Then just write code, build features, and fix bugs. Nobody is forcing you to fix search engines' problems. If you're not making money off of traffic, then why worry so much about SEO? Just do your thing. If it really bothers you, put a little note on your GitHub warning people about the fake site, and get on with your life.
by rohxnsxngh | 2026-03-03 15:57:23+00:00
Great question. We are specifically targeting vertically integrated farms which are usually massive scale operations with hundreds of thousands to millions of fish. These facilities already have significant labor costs for trained technicians and geneticists doing manual phenotyping and sorting. We are not going after small scale manual farmers or trying to be an eFishery type business that serves smallholders.

The labor dynamics are also different at these large farms. The work we are automating is repetitive, physically demanding, and hard to staff consistently. Most of the farm managers we talk to are not trying to replace people, they are struggling to find enough workers willing to do this work in the first place. Automation at this scale tends to shift jobs rather than eliminate them entirely.
And thank you for the kind words on the website! We have gotten mixed reviews on the cursor so enjoy it while it lasts lol
by AnthonyMouse | 2026-03-03 15:57:38+00:00
> German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18,"

If the only thing that came out of the ID was those letters then you wouldn't need the ID, you could just type "yes" or "no" when the site asks you if you're over 18. So it's presumably not doing that, instead it's providing some kind of signature.

And then the privacy implied by "just returns a yes/no response" isn't actually there, because it's actually returning more than that. Does the response have a fixed signature which is unique to the ID, therefore able to be correlated across sites? Does the site have a unique public keypair that it uses to sign, with the same problem? If someone extracts the key from one ID, or just hooks it up to a computer, can they now set up a service to anonymously sign for everyone in the world? If they can't anonymously sign for everyone, can't the same mechanism used to identify them also be used to identify anyone else?

"Someone attempted to do this but no one uses it" is no proof that their attempt was any good or addressed the concerns people have about doing this.
by WorldMaker | 2026-03-03 15:57:57+00:00
I think part of why people's preferences get so different in different sides of a timezone is as much because the hour-wide timezone is too wide. If you asked people to use a thirty-minute timezone or fifteen-minute timezone agreement would be a lot easier, and a lot easier to match local noon to timezone noon for the most people covered.

Of course, there would be just as many arguments against that because people would hate having to learn that many timezones and do that much more timezone math. We finally have the technology to make that easy for a lot of people (phone clocks auto-sync to local time, for instance; most schedules are posted on websites and have computers involved; fewer analog clocks in general remain in the world).
by hbn | 2026-03-03 15:58:01+00:00
LG used to with the Ultrafine 5k (I believe it's discontinued now?)

I got a deal on a used one last year and I love it. It's the only monitor I've used plugged into a MacBook that didn't look notably off (worse) compared to the MacBook's display sitting next to it. Only thing a bit jarring is it's 60Hz but I can live with it.
by philwelch | 2026-03-03 15:58:12+00:00
That doesn’t change the fact that you’re selectively counting only one side of a closed loop process. Methane may be a more efficient greenhouse gas than CO2 but if that effect dominated, we would expect to see the global warming trend start with the evolution of ruminants, not the Industrial Revolution (a time when the North American ruminant population actually declined a significant amount!)
by rickydroll | 2026-03-03 15:58:45+00:00
I wonder if Nano Banana spits out an image and I copy it by hand into a different medium like acrylics, chalk, or charcoal. Does a manual transcription suddenly render the image worthy of copyright?

This also raises the meta question: how much does an image need to change to acquire a new copyright? For example, if you change the Last Supper to include two fat Jesuses on either side of the single skinny Jesus, is that enough?
by benj111 | 2026-03-03 15:58:51+00:00
I think you're missing the point. I stick my penis in an animal. That is illegal. I stick something else in there to get it pregnant. Not illegal.

So this isn't about consent. And it's not about the laws lagging. It's about the law differing depending on why you're doing the thing to the animal.

I don't doubt that some vegans might treat animal breeding as rape but I don't think the general population does, or consider that element suffering in any way.
by microtonal | 2026-03-03 15:58:52+00:00
Not just the web. Last time I installed Backdrops on my phone (a nice wallpaper app), you would literally approve hundreds of uses of your data when you press Consent. Even if you choose to manage choices, 200 'legitimate interest' options are enabled by default. Even when you are a paying Pro user. Data used includes location data.

What makes it worse is that a substantial portion of users block web trackers through an adblocker. However on phones, unless you have a rooted phone or use some DNS-based blocker, all these analytics get uploaded without restraint.

Atm I use Firefox with uBlock which blocks the cookie banners, but Firefox's extension model is broken, and every single extension provides 100% access to my websites to whoever controls the extension. I don't like it.

Some browsers (e.g. Vanadium, Vivaldi) have a built-in adblocker, so you have to trust one party less.