MurphyA/hacker-news huggingface dataset:
by ivanr | 2026-03-04 12:16:15+00:00
Yes, there is! After I left SSL Labs, I built Hardenize, which was an attempt to go wider and handle more of network configuration, not just TLS and PKI. It covers a range of standards, from DNS, over email, TLS and PKI, and application security.

Although Hardenize was a commercial product (it was acquired in 2022 by another company, Red Sift), it has a public report that's always been free. For example:

https://www.hardenize.com/report/feistyduck.com

The CSP inspection in Hardenize could use a refresh, but the TLS and PKI aspects are well maintained [at the time of writing].
by Asm2D | 2026-03-04 12:16:19+00:00
Many SQL engines have JIT compilers.

The problems related to PostgreSQL are pretty much all described here. It's very difficult to do low-latency queries if you cannot cache the compiled code and do it over and over again. And once your JIT is slow you need a logic to decide whether to interpret or compile.

I think it would be the best to start interpreting the query and start compilation in another thread, and once the compilation is finished and interpreter still running, stop the interpreter and run the JIT compiled code. This would give you the best latency, because there would be no waiting for JIT compiler.
by galdauts | 2026-03-04 12:16:25+00:00
The source code is available here: https://gitup.uni-potsdam.de/bsvs/public/hpc-benchmark-game

As far as I know the code was ported to use @floops, with minor optimisations in addition to that.

I think it's quite possible that it's an allocation issue, that's something we're looking into, although I don't have any specific results for Julia yet.
Show HN: sombra – Your personal deep analysis system for understanding power
by hashino | 2026-03-04 12:16:35+00:00
Hi HN,

I've built sombra: an AI system for analyzing situations and understanding the flow of power.

You give it a situation and it gives you: the real agents at play; their interests; and what they'll probably do to achieve said interests. You can then chat with it about its analysis.

I built it with consultants and managers in mind. People who make tough decisions and need to understand complex situations to do so. It isn't meant to replace an experienced consultant but to save their time.

It's a multi agent system capable of tool calling (searching) with a RAG knowledge base. It works in a loop of creating analyses, searching, adversarially challenging the analysis, making another and so on.

What I recommend is giving it a news article about your field and after the analysis asking it how you can benefit from the situation. In my experiments it gave very good recommendations and analysis.

Any feedback is highly appreciated.
by qsera | 2026-03-04 12:18:28+00:00
I didn't mean it is a one to one mapping from tokens. But instead it might be mapping a corpus of input text to some points in some multi dimensional space, (just like the input data a linear regression), then then it just extends the line further across that space to get the output.

>How is transfer learning possible when non-textual training data enhances performance on textual tasks?

If non-textual training data can be mapped to the same multi-dimensional space ( by using them alongside textual data during training or something like that), then shouldn't it be possible to do what you describe?
by tw-20260303-001 | 2026-03-04 12:18:31+00:00
This article doesn't answer why is it a good practice.

> You need to prime it with some kind of personality (ideally that of a useful, friendly assistant) so it can pull from the helpful parts of its training data instead of the horrible parts.

No, you have to give it enough context so that it can start finding an answer but it certainly doesn't need a personality. Try it yourself, instead of telling it "you are", tell it "your task is". No personality, simply expectations.
by gus_massa | 2026-03-04 12:19:06+00:00
[I was going to write an explanation, but these sentences of Wikipedia article ar better.] From https://en.wikipedia.org/wiki/Super-Kamiokande

> A neutrino interaction with the electrons or nuclei of water can produce a charged particle that moves faster than the speed of light in water, which is slower than the speed of light in vacuum. This creates a cone of light known as Cherenkov radiation, which is the optical equivalent to a sonic boom. The Cherenkov light is projected as a ring on the wall of the detector and recorded by the PMTs.
by skapadia | 2026-03-04 12:19:22+00:00
"Test harness is everything, if you don't have a way of validating the work, the loop will go stray"

This is the most important piece to using AI coding agents. They are truly magical machines that can make easy work of a large number of development, general purpose computing, and data collection tasks, but without deterministic and executable checks and tests, you can't guarantee anything from one iteration of the loop to the next.
by szszrk | 2026-03-04 12:19:47+00:00
Could be related.

It was likely their management doing random shit to fix it. Instead of fixing real problem, which was bogus campaign rules. Reddit was full of people abusing their app discounts and ordering insane amount of food for free. It was well described.

None of that was due to app security holes. It was an issue in their promotional campaign. It was still working after those "secure" app limitations appeared.
by jaen | 2026-03-04 12:19:56+00:00
The problem was mostly Java, not the idea.

Java enforced a rigid (static) disjoint exception hierarchy (necessitating the boilerplate wrapping), no error inference, inability to parametrize over thrown exceptions etc. etc. Basically fired all the language design footguns due to lack of experience and foresight (understandable at that point in history).

I'm sure this can be done with an actually decent design, and Rust developers do seem to be innovating in this space with the various error handling crates.
by adolfont | 2026-03-04 12:20:14+00:00
Well, for starters, I think it's wrong to criticise LLMs with ‘it can't do that’ (from what I understood from the first paragraph, this was Donald's criticism).

If it can, does it make a difference in relation to all the other problematic aspects of LLMs? Not for me.

Two links that might enlighten Donald:

- Against the Uncritical Adoption of 'AI' Technologies in Academia https://zenodo.org/records/17065099
- The AI Con https://thecon.ai
by palata | 2026-03-04 12:20:22+00:00
> I would certainly be using GrapheneOS if only I could get one to run on something else than a Pixel.

But the whole idea of GrapheneOS is the reason why it (currently) only runs on Pixels. On other phones you can run anything based on LineageOS...

I don't want GrapheneOS to compromise on that: if I didn't care about it, I would use any other alternative. To me it's a bit like saying "I would be using Linux if it was a lot more like Windows" (that's something I often understand when Windows users explain what it would take for them to use Linux). But I, as a Linux user, really don't want Linux to look a lot more like Windows.
by tim333 | 2026-03-04 12:20:35+00:00
Life doesn't have an obvious purpose so people tend to pick up on what others around them are into, so may be into social justice, or greed is good, or islam or christianity or whatever.

Then they tend to clash, fight and blame the other group for their problems.

Kids don't really do it but it's why dad has to go bomb the islamists or jihad the infidels or similar.
by mariushh | 2026-03-04 12:20:39+00:00
Hi HN.

I spent some time thinking through what "building software" actually means in the age of AI, what's genuinely changing, what isn't, and why the discourse keeps getting stuck on the wrong question. The article summarizes my thoughts.

AI making programming accessible to more people is a genuine good. The apps are real, they run, and the excitement is deserved. But everyone is asking "will AI replace software engineers?" when the more interesting question is hiding in plain sight: what happens when there is more software than people who know how to operationalize it?

I tried to think this through honestly rather than just react to the hype. Curious what people here think.
by Traubenfuchs | 2026-03-04 12:20:47+00:00
Oh I am sure with the right prompts and the right chunking and subagents this is already possible today. But converting the old cobol mess to java code that is "most likely doing the same things" is just a fraction of the work.

You need to run those systems in parallel, integrate them in each other or have an abstraction/two-rails layer in front of them, test, test, test and test again, all of which takes months, while new features now need to be added to both systems, whether by AI or some average developer schmuck!

Do you have any idea how much any of this costs? Mind boggling amounts of money. Infrastructure costs will at least DOUBLE for several MONTHS. Meanwhile you will need extra manpower and AI credits for MONTHS on top of your increased existing costs for maintenance and new features.

Welcome to a new hell! LLM can't solve this!
by Aachen | 2026-03-04 12:21:15+00:00
Just get a SIM from another country and use roam like at home. I can use any network here as though it's my home network.

The provider isn't required to support this (they can give me 2 weeks' notice any time) but I use very little of my subscription (the smallest one they have) so I assume they're happy with the deal and don't have to pay the roaming carriers much
by nickk81 | 2026-03-04 12:21:16+00:00
I built a chat interface that extracts context (locations, budgets, goals, preferences) from natural conversation and visualizes it in a live side panel.

The idea: most AI chat is a flat wall of text. But when you're planning a trip or scoping a project, the structured information matters more than the prose. So instead of burying it in paragraphs, the UI pulls it out and displays it — maps for locations, cards for budgets and preferences.

I recently had another submission here on HN: https://news.ycombinator.com/item?id=47205890

Limits:

- Only supports a pre-defined user profile

- Note that the underlying AI model is simple, to keep costs down, this is about the concept of Visual Contextual Chat.
Show HN: See the blast radius of every code change in VS Code
by lnguyen11288 | 2026-03-04 12:21:18+00:00
I kept pushing changes and finding out 20 minutes later in CI that I broke a bunch of stuff downstream. Last week I added one field to a shared struct and it turned out 417 files depended on it.

I wanted to see that before pushing, so I built this. It's a VS Code extension (works in Cursor too) that shows you which files are affected every time you save. The sidebar fills up with a tree of everything downstream, and the files get color coded by how far away they are from your change.

The part I actually use the most is the CodeLens — it shows caller counts above functions. If something shows zero callers, you know you can change it without worrying. Saves me from grep -r.

It's a Rust CLI underneath that uses tree-sitter to parse your code and build a dependency graph. Supports Rust, TypeScript, Python, Go, Java, and a few others (10 languages total). The CLI watches your repo and streams updates to the extension, usually under a second.

There's also a GitHub Action if you want blast radius comments on PRs automatically: https://github.com/codelayers-ai/codelayers-action

And you can try it without installing anything — paste a public GitHub URL here and it'll build a 3D dependency graph in the browser: https://codelayers.ai/explore
by gzread | 2026-03-04 12:21:23+00:00
We are technologists here. There is no technology that can determine if somebody is a pedophile. We can't make a system that exposes the data of pedophiles but is secure for everyone else. We think it has to be all or nothing.

But other people are not technologists. Lawyers think the law is robust enough to determine if someone is a pedophile and only issue warrants for pedophile's data and simultaneously punish anyone who leaks the data of non-pedophiles. Most of the public also believe the police and the law can do that.

When the law is set up to do that, always gets abused eventually, after a time of not getting abused. The public gets outraged and the responsible person gets a slap on the wrist, and the abuse is normalized. In other words, lawyers are wrong and it doesn't work - by our standards. That doesn't stop them thinking it does. Our definition of "you can't do that" is "it's impossible to do that." Their definition of "you can't do that" is "you can do that, but if the police find out, you will go to jail."
by bakugo | 2026-03-04 12:22:05+00:00
You can explain away any obvious astroturfing campaign with "wow, so many people love this product and feel the need to bring it up all the time in unrelated contexts!" if you want to.

If you think two people making the exact same comment about "Claude Max" (not even just Claude, specifically bringing up the $200 subscription) on an unrelated post is organic, I don't know what to tell you.
by boondongle | 2026-03-04 12:22:25+00:00
The tension is that Security and Dev parts of the stack remove the actual troubleshooting capabilities of the Network layer without opening up the tools that are supposed to replace them.

It's not a problem if Network can still do their job. It's a whole other matter to expect Network to do their job through another layer. You end up with organizations that can't maintain their applications and expect magic fixes.

Orgs that are cooperative probably don't have this issue but there are definitely parts of some organizations that when one part takes capability from another they don't give it back in some sort of weird headcount game despite not really wanting to understand Network to a Network level.
by CloakHQ | 2026-03-04 12:23:01+00:00
the naive bot point is true but the threat model that actually matters is the other end - the sophisticated bots that already do implement TLS spoofing. those are the ones using got-scraping, curl-impersonate, or custom TLS stacks specifically to pass JA3/JA4 checks. they're already past the "can't be bothered" threshold.

for that tier, ECH flips the dynamic a bit. right now detection can use JA3/JA4 as a positive signal - "this fingerprint matches Chrome 120, looks clean". with ECH, if the bot is running behind a CDN that terminates ECH (like Cloudflare), the server sees a decrypted ClientHello that looks like... a real Chrome on Cloudflare's infrastructure. the fingerprint is clean by construction.

so paradoxically ECH might make things harder for the sophisticated bot detection case while doing nothing about the naive case, which is sort of backwards from what you'd expect.
by trigvi | 2026-03-04 12:23:16+00:00
Every single thing one does in life is a gamble that carries a probability of success.

Getting a degree. Investing in a business. Investing in a relationship. Having kids. Smoking. Booking a flight cheaper but with no possibility of cancellation. Moving town. Not moving town.

I could go on forever.

Everything is a gamble. Some forms of gambling are more socially acceptable than others.

The difference, in everyhthing, is emotional control and knowing how much you stand to lose if it goes wrong.
by leokennis | 2026-03-04 12:23:20+00:00
At least in the ChatGPT app, you can set some "personality" traits. Like the style (more or les warm or enthusiastic, use more or less lists and emojis) and the tone.

I have mine set to efficient, using less warmth, less enthusiasm, less headers and lists and less emoji's. Combined with sensible personal instructions (don't placate me, don't flatter me, be professional, tell me if I'm wrong, tell me if you don't know etc.), I see none of the "that's not crazy, that's commitment!" or "here is the no-frills rundown" BS.
by foster-hangdaan | 2026-03-04 12:24:22+00:00
Location: Ontario, Canada

Remote: Yes

Willing to relocate: No

Technologies: TypeScript, Deno, Node, BASH, Guile, Preact, React, Vue, GraphQL, Docker, Flatpak, Tailwind, CSS, HTML, Git, Amazon Web Services, Linux, Guix

Résumé/CV: https://cloud.hangdaan.com/public.php/dav/files/s2Tg2zNoz3EF...

Email: foster@hangdaan.email
by josephg | 2026-03-04 12:24:38+00:00
Yep this. I migrated from Gmail to my own domain years ago. It was painful. Weirdly enough, I think the longest holdouts were my parents, who were still sending email to my Gmail account a decade after I stopped using the address.

I moved my email to Fastmail, and I’ve been very happy ever since. But now that I own the domain, moving to a different provider - if I ever need to - would be trivial.
by palata | 2026-03-04 12:25:52+00:00
> [I want root,] The fact that I own my device is non-negotiable.

I read that a lot, and I agree that I want to own my device. But that does not mean that I should have root access on the OS I choose to install on it.

Owning my device means that I should be able to install whatever OS I want. It does not mean at all that OS developers must do whatever I tell you to do.
by adrian_b | 2026-03-04 12:26:01+00:00
Nobody knows for sure.

The uncertainties about the masses of the various kinds of neutrinos are very high.

Also their abundance in the Universe is much less accurately known than for electrons and nucleons, because many processes generate neutrinos or antineutrinos and only few of those are absorbed in later collisions, so the total amount of neutrinos and antineutrinos is increasing continuously, even if the difference between the number of neutrinos and antineutrinos varies only little.

For the mass of nucleons and electrons one can make reasonable estimates, even if the uncertainties about the densities of interstellar and intergalactic matter are also very high. On the other hand, for the mass of neutrinos + antineutrinos the uncertainties encompass many orders of magnitude.

The detectors of neutrinos can detect only high-energy neutrinos. There may be much more undetectable low-energy neutrinos.
by fnordian_slip | 2026-03-04 12:26:21+00:00
It's incredible that about 80% of people in this thread seem to be commenting without having looked at the website.

In defense of Deutsche Bahn, countries with comparable infrastructure but more reliable transport have put in about twice as much money per capita for the last 30 years at least.

Also, it went through a pseudo-privatisation back then, which hasn't helped (just private enough to focus on quarterly profits by letting bridges decay so that they have to be rebuilt or repaired in a few years, just public enough that they have to serve a lot of non-lucrative areas by law).

I have to admit I'm rather biased as I work there, but I would say most employees do the best they can with the hand they're dealt. It's just that politicians dealt them a really bad hand. And if Germany were to properly invest in infrastructure from now on, there's so much stuff that has to be repaired that reliability would go down even more in the next decade or so (seriously, this is not something you could fix in a year or two, even with hundreds of billions).
by FrankWilhoit | 2026-03-04 12:26:51+00:00
Microsoft always float trial balloons like this in advance of product releases. They envision maximal hardware and/or licencing requirements. Then they are quietly dropped or scaled back. But Windows is a mass-market, consumer-grade product and they are not going to sell hundreds of millions of copies off the back of a forced hardware upgrade, this year of all years. The supply chain isn't even going to be there.
by yoghurt114 | 2026-03-04 12:26:51+00:00
I built mdenc because I wanted to keep internal team docs in a public git repo without them being in plaintext, but GPG-encrypting whole files makes every commit a full-file diff.

mdenc encrypts at paragraph granularity with XChaCha20-Poly1305. Unchanged paragraphs produce identical ciphertext, so git only tracks what you actually edited. One paragraph changed = one line in the diff.

The tradeoff: it's deterministic encryption (same plaintext + same key = same ciphertext), which leaks some metadata (paragraph count, sizes, edit patterns). This is intentional -- it's what makes diffs work.

It uses git's native smudge/clean filter, so after setup you just `git add` and `git checkout` normally. Plaintext in your working directory, ciphertext in the repo.

Important caveats I want to be upfront about:

- *Not audited.* The crypto primitives are from audited libraries (@noble/ciphers, @noble/hashes), but the protocol itself has not been independently reviewed.

- *Not for real secrets.* The password is shared with everyone who needs access. A widely-shared password is a single point of failure. This is for internal docs that shouldn't be in plaintext on the internet, not for credentials or PII.

- *No forward secrecy.* Password + git history = full decrypt of all historical versions.

Spec: https://github.com/yogh-io/mdenc/blob/main/SPECIFICATION.md

Security model: https://github.com/yogh-io/mdenc/blob/main/SECURITY.md

Live demo: https://yogh-io.github.io/mdenc/

npm: https://www.npmjs.com/package/mdenc

Would love feedback on the construction.
by 6510 | 2026-03-04 12:26:59+00:00
My theory is that you can replace everyone with AI as long as the result (for each) is obviously better. To replace management the main edge seems to be that AI can read everything and talk to everyone all of the time. You don't need meetings if it remembers everything everyone said and is available for debate until the deadline. If someone feels the need to go all out bike-shed they can do it on their own. A different edge the AI has is that it can write everything into policy. Saves a lot of tokens.
by andriamanitra | 2026-03-04 12:27:09+00:00
This is very interesting. I'm a bit skeptical about the benchmarks / performance claims because they seem almost too good to be true but even just the extended operators alone are a nice improvement over existing regex engines.

The post mentions they also have a native library implemented in Rust without dependencies but I couldn't find a link to it. Is that available somewhere? I would love to try it out in some of my projects but I don't use .NET so the NuGET package is of no use to me.
by simonw | 2026-03-04 12:27:19+00:00
I wonder how many accounts on other services were then hijacked using "forgot my password" attacks.

UPDATE: After a bit of digging it looks like they started the username recycling policy in 2013, may have quietly stopped doing that in 2018 but formalized no longer doing that in 2021: https://web.archive.org/web/20230627104616/https://www.micro...

"Summary of changes to the Microsoft Services Agreement – June 15, 2021 [...] In the Outlook and Office Services sections, we’ve removed the Outlook.com section to clarify that an email address or username is not recycled into our system or assigned to another user."
by palata | 2026-03-04 12:28:15+00:00
> the concept that you shouldn't own your device for safety is so fucked.

That's not it. The concept is "if you choose to install this particular OS on the device you own, then it comes with this particular security model". That's totally fine. If you own your device, you can run Linux on it and you'll have root access.

"Not owning your device" means "not being able to install the OS you want on it". I want to own my device, obviously. But it does not mean that I own the developers of every OS in the world and that they should do whatever I tell them to do, for free.