MurphyA/hacker-news huggingface dataset:
Show HN: DiffDeck, a PR review tool with file context and code navigation
by riegerj | 2026-03-06 13:00:31+00:00
I built DiffDeck because I was struggling to review larger pull requests in
GitHub, especially ones with a lot of AI-assisted code.

GitHub's diff view works well for smaller changes, but once a PR gets big I
usually want more of an editor-style workflow while reviewing ie see the
surrounding code, jump to related symbols and files, and mark off what I have already reviewed and I felt Github's interface was really frustrating me.

DiffDeck opens a GitHub pull request in a review workspace with:

- full file context
- go-to-definition and references for TS/JS
- review notes
- per-file reviewed state and review progress
- hide/checkoff reviewed files

One thing I wanted was for it to feel closer to VS Code than a traditional PR tool. You can jump around the codebase while reviewing, and features like go-to-definition are meant to feel familiar if you already spend most of your time in an editor.

Right now it requires GitHub sign-in, because the point is to open pull
requests you already have access to and review them with more context than
GitHub's diff view gives you. I considered making a public demo, but that felt less representative than letting people try it on their own PRs.

This is an early alpha. Right now the code navigation features are focused on TypeScript and JavaScript codebases. The main thing I'm trying to learn is whether this is actually a better review workflow than staying in GitHub's PR UI. For now you can feel free to review a single PR.

I'd especially like feedback from people who review large PRs or AI-generated code:

- what still feels missing
- whether this solves a real problem or just one I personally had
by pembrook | 2026-03-06 13:00:55+00:00
In my view, STEM PhDs are not members of the “elite.”

Historically, in the US the elite are the managerial class, the lawyers (future politicians), and the coastal dilettantes who are already wealthy enough to major in the social sciences.

When 1+ million students are getting MBAs every year in the belief they will be members of the C-suite, but there’s only a few thousand such positions, you have a case of elite overproduction.
by ftmootnomoat | 2026-03-06 13:00:57+00:00
It works in China because they have growth. In the west thousands of college kids thought they could land cushy management positions or at least highly paid expert jobs.

Then these kids realise these jobs don’t exist, that they should have gone to trade school instead, and that their student debt will cripple them for life.

Same thing will happen in China. For now their economy grows so fast it can absorb many intellectuals, but that won’t last forever.
by rmasoodx22 | 2026-03-06 13:01:08+00:00
Perfect thread. Oath is about human authorization before AI acts. Titan Gate is about cryptographic proof after AI writes code. Directly complementary.
Paste this as your reply:

Nice protocol design — the "absence of signature is itself evidence" framing is exactly right.
Oath solves the authorization layer: did a human approve this action before it ran. Titan Gate sits one layer up: did the AI-written code that resulted from those actions get cryptographically receipted before it shipped.
The two compose cleanly. Oath attests the human intent. Titan Gate receipts the code change that follows. Both are needed for a complete audit trail in a SOC2 environment.
Our receipt model: every PR gets HMAC-SHA256 signed, Merkle-ledgered, with SOC2 control mappings (CC6/CC7/CC8) embedded in the receipt JSON. The receipt travels with the code. Verify command:
pip install titan-gate
titan verify receipt.json --key 0dd06d207d711486523b21fe027681d05fc13c10ac313d979fc1e7de657d2447
Live receipt from today: 89bd57ed-b7e1-455a-9f63-5d0005d8d27f
On your protocol design — the namespace:action:scope format looks solid. One edge case worth considering: replay attacks where a valid attestation for action A gets reused for a structurally identical action A'. How are you scoping attestations to a specific execution context rather than just action class?
https://github.com/Rehanrana11/titan-gate
by lb1lf | 2026-03-06 13:01:19+00:00
LB1LF here - much to my dismay, I currently have no antennas at home, but I take part in the IARU Region 1 Field Day every year - some friends and I, alumni from the Norwegian University of Technology and Science in Trondheim, Norway created a ham radio club - LA1AFP - for the express purpose of having an excuse to meet up annually and have a good time.

I have mostly worked HF phone, but in latter years I've (finally!) become reasonably proficient in CW, too.

I enjoy the technical aspects of the hobby, being a radio frequency engineer - but also enjoy chatting to others, particularly to improve my language skills - Portuguese and Brazilian hams are an absolute delight and quite patient as I try to make myself understood in Portuguese!

Oh, and chasing the occasional award - but I am not very good at sending in the paperwork, so I guess I had better do that soon and get some paperwork for my shack. I have a particular soft spot for the RSGB IOTA program, as I live on one - EU-079 - myself.

I hope to be QRV from home again before long, though - I live on a farm, have lots of room, and I have a small mast and an almost finished wire beam in the barn, so with any luck I'll be able to put it all together and have a working station again sometime this spring!
by farialima | 2026-03-06 13:01:45+00:00
I think it’s just poorly worded; it’s about the upward mobility of the _generation born after the Second World War_. This generation lacked opportunities and this created unrest in the 60s and 70s.

The previous generation – the one that reached adulthood before and during WW 2 – had upward mobility in the 40s, 50s, and wanted its children to have too
by lukan | 2026-03-06 13:02:20+00:00
The most succesful open source projects (firefox, blender, linux, krita,..) do not have libre in their name, the most famous of those who have is probably libreoffice, but it is not exactly loved.

So I totally agree on rather having a name that appeals normal users, than a certain tech bubble who will rather use the terminal wherever they can anyway ..
by kif | 2026-03-06 13:03:19+00:00
But that's the problem. Something that can be so reliable at times, can also fail miserably at others. I've seen this in myself and colleagues of mine, where LLM use leads to faster burnout and higher cognitive load. You're not just coding anymore, you're thinking about what needs to be done, and then reviewing it as if someone else wrote the code.

LLMs are great for rapid prototyping, boilerplate, that kind of thing. I myself use them daily. But the amount of mistakes Claude makes is not negligible in my experience.
by rswail | 2026-03-06 13:03:26+00:00
Many countries have avoided the complete brand/chain-ification of the US market.

Cafes and coffee places are still great, Starbucks did for them what McDonalds did for food. They're a known standard of quality. It might be low, but it's known. Starbucks didn't invent the 3rd place, or re-invent it.

As jobs moved from manufacturing to services, more people were able to work in a way that the "3rd place" offers. The ultimate extension of that is WFH.

The actual planes are much better today than in the "golden age ... of Concorde and 747", what ruined it was the security theater as a result of 9/11, and the race to the bottom of the service offerings.

Business classes (especially international and Asian airlines) is much much better, economy has more services (individual entertainment, USB, power etc), better seats, but much worse seat pitches, and nickel-and-diming every item possible (ticket transfers/changes, luggage, seat selection, meals, etc).

So not so much "Brand Age" for air travel, it's more a stratification.
by the_af | 2026-03-06 13:03:41+00:00
This today:

https://www.youtube.com/watch?v=qGPnh3u1vBs

Evangelical pastors laying hands on Trump and praying for his success in his holy war against Iran. I don't know the overlap between Christian Zionism and evangelicals in the US, but I'm sure it's not zero.

Christian fundamentalists are influencing US policy to a noticeable degree. Nobody's saying it's the only factor.
by lostmsu | 2026-03-06 13:03:43+00:00
From skimming that chat: it doesn't, no matter how much you tried to steer it into that direction. It barely reluctantly agreed under some hypotheticals, but it never agreed to the hypotheticals actually being true.

This submission is junk, and the the title is editorialized.

Direct reply from Claude: https://claude.ai/share/628e6a1d-087d-4454-95e3-cf8a3c4a5b72

"The case for a bright future is strong."

I trust Claude over JCW2001
by sinuhe69 | 2026-03-06 13:03:56+00:00
In the Turchin model of societal collapse, discussing elite overproduction alone is not helpful at all. The model calls for 3 pillars:

- elite overproduction and limited job opportunities

- wealth pump and inequality

- declining of popular wellbeing and growing resentment

Thus, it only makes sense to consider elite overproduction within this framework.
by staticassertion | 2026-03-06 13:05:01+00:00
I've had mixed results. I find that agents can be great for:

1. Producing new tests to increase coverage. Migrating you to property testing. Setting up fuzzing. Setting up more static analysis tooling. All of that would normally take "time" but now it's a background task.

2. They can find some vulnerabilities. They are "okay" at this, but if you are willing to burn tokens then it's fine.

3. They are absolutely wrong sometimes about something being safe. I have had Claude very explicitly state that a security boundary existed when it didn't. That is, it appeared to exist in the same way that a chroot appears to confine, and it was intended to be a security boundary, but it was not a sufficient boundary whatsoever. Multiple models not only identified the boundary and stated it exists but referred to it as "extremely safe" or other such things. This has happened to me a number of times and it required a lot of nudging for it to see the problems.

4. They often seem to do better with "local" bugs. Often something that has the very obvious pattern of an unsafe thing. Sort of like "that's a pointer deref" or "that's an array access" or "that's `unsafe {}`" etc. They do far, far worse the less "local" a vulnerability is. Product features that interact in unsafe ways when combined, that's something I have yet to have an AI be able to pick up on. This is unsurprising - if we trivialize agents as "pattern matchers", well, spotting some unsafe patterns and then validating the known properties of that pattern to validate is not so surprising, but "your product has multiple completely unrelated features, bugs, and deployment properties, which all combine into a vulnerability" is not something they'll notice easily.

It's important to remain skeptical of safety claims by models. Finding vulns is huge, but you need to be able to spot the mistakes.
by erelong | 2026-03-06 13:05:05+00:00
I think getting rid of IP shifts economic focus on to tangible physical goods which you can exclusively own: you can sell the physical medical devices, just not claim a specific design is "yours exclusively"

IP has always had awkward things like, what if you discover the sole treatment for a disease and can restrict people from making use of it... kind of weird, especially when people can "independently" draw the same conclusions so they truly obtain an idea that is "their own" but which then they are legally restricted from making use of in such an example
Show HN: Checking if financial processes can be bypassed before deployment
by burlakovlm | 2026-03-06 13:05:06+00:00
I’m trying to sanity check an idea with people who work with regulated systems.

In many organisations we have scanners for code, monitoring for systems, and multiple layers of controls and audit. But the business process itself is rarely checked for logical vulnerabilities before it goes live.

Processes like KYC onboarding, approvals, payments or compliance workflows are often designed in meetings and documented later. Over time more controls get added and monitoring improves, but the underlying process logic is rarely tested.

Which raises a simple question: can this process be bypassed?

I started experimenting with describing processes as state machines and running static checks on them. Things like reachability, missing review steps, irreversible actions without compensation, and similar structural issues.

The idea is to detect what you might call "business process vulnerabilities by design" before the process is deployed.

The page explains the concept and shows a small prototype. The prototype lets you describe a process as a state machine and run automated checks against rule sets (for example operational risk or resilience rules).

What I’m mainly trying to understand is whether this is actually a real problem in practice.

For people working in fintech, banking, risk or operations:

Do process bypasses or design gaps show up in real systems?
How are new processes usually reviewed before they go live?
Where do things tend to break down?
Paper: veilgovernance.com/research/missing-first-line-of-defence
by iggldiggl | 2026-03-06 13:06:06+00:00
> That is an issue with the capabilities the os exposes to you. The answer to every security issue not "add a backdoor".

Problem is, I strongly suspect we'd still be having the same discussion even if we were talking about "allow the user direct access to all files*" instead of "allow the user full root rights".

Because while some of those missing capabilities are "simply" a matter of it being too much effort to provide a dedicated capability for each and every niche use case (though that once again raises the question as to whether you prefer failing open, i.e. provide root as an ultimate fallback solution, or fail closed), with file access I guess that this was very much an intentional design decision.
Show HN: Geo-lint – Claude Code skill that auto-fixes SEO/GEO violations in loop
by ijonis | 2026-03-06 13:06:17+00:00
Hey HN, I built geo-lint — an open-source linter for content (Markdown/MDX) that checks 92 deterministic rules across SEO, GEO (Generative Engine Optimization), content quality, and technical issues.

GEO is the idea that AI search engines (ChatGPT, Perplexity, Claude) cite content differently than Google ranks it. Things like question-formatted headings, FAQ sections, entity density, E-E-A-T signals, and citation-ready statistics all matter for whether an LLM will pull from your content. geo-lint has 35 rules specifically for this.

The interesting part is the lint loop. It ships as a Claude Code skill — you run /geo-lint audit and it spawns parallel subagents, one per file. Each agent reads the violations, edits the content, re-lints, and repeats until clean (max 5 passes). The linter is fully deterministic (no LLM in the rules themselves), so the agent gets unambiguous violation + suggestion pairs to act on. Zero hallucination risk in the analysis layer.

It also works without Claude Code — npx geo-lint --format=json gives you a flat JSON array any agent (Cursor, Copilot, Windsurf) can consume. The rules are the same either way.

MIT licensed, zero runtime deps beyond gray-matter. npm: @ijonis/geo-lint

GitHub: https://github.com/IJONIS/geo-lint
by juanre | 2026-03-06 13:07:01+00:00
I am running gpt-5.4 as one of my coding agents, and something interesting has happened: it's the first time I've seen an agent unfairly shift blame to a team mate:

"Bob’s latest mail is actually the source of the confusion: he changed shared app/backend text to aweb/atlas. I’m correcting that with him now so we converge on the real model before any more code moves."

This was very much not true; Eve (the agent writing this, a gpt-5.4) had been thoroughly creating the confusion and telling Bob (an Opus 4.6) the wrong things. And it had just happened, it was not a matter of having forgotten or compacted context.

I have had agents chatting with each other and coordinating for a couple of months now, codex and claude code. This is a first. I wonder how much can I read into it about gpt-5.4's personality.
by myrmidon | 2026-03-06 13:07:15+00:00
This is a false dichotomy. In the words of the post-war US strategic bombing survey:

"Based on a detailed investigation of all the facts, and supported by the testimony of the surviving Japanese leaders involved, it is the Survey's opinion that certainly prior to 31 December 1945, and in all probability prior to 1 November 1945, Japan would have surrendered even if the atomic bombs had not been dropped, even if Russia had not entered the war, and even if no invasion had been planned or contemplated."

While this is all speculation, that was at the very least a defensible point of view held by a bunch of Americans shortly after the war.

Regarding firebombing: Hiroshima alone killed probably more civilians than the entire Tokyo firebombing campaign. A firestorm is a terrible thing, but you can still run from a fire even if your whole city burns down; you can't run from a nuke.

So if you measure collateral damage primarily in civilian deaths, firebombing still looks much better (a hypothetical firebombing campaign would have probably killed <40k civilians in Hiroshima instead of 100k, guesstimating from Tokyo numbers).

Edit: I don't think dropping the nuclear bombs was especially ethically questionable compared to the rest of the war, but I feel it is very important to not whitewash that event as valiant effort to save young American conscripts. Regarding it as a slightly selfish weapon demonstration feels much more accurate to me.
by gzread | 2026-03-06 13:07:25+00:00
It's not about that. Yes we can expect things made by unskilled artisans to be of low quality, but low quality things existing is fine, and you made low quality things too when you started out programming.

What's new is people treating the chatbox as a source of holy truth and trusting it unquestioningly just because it speaks English. That's weird. Why is that happening?
by ijonis | 2026-03-06 13:07:36+00:00
Maker here. I run a small AI consultancy and kept seeing the same pattern: clients' content ranked fine on Google but never got cited by ChatGPT or Perplexity.

Turns out AI engines look for different signals — question-formatted headings, entity density, FAQ sections, citation-ready statistics. Nobody had a linter for this, so I built one.

The lint loop is the part I'm most proud of: the linter outputs deterministic JSON (no LLM involved), then Claude Code agents consume those violations and fix them autonomously. One subagent per file, in parallel, max 5 passes. The separation matters — deterministic analysis, non-deterministic fixes.

Happy to answer questions about GEO rules, the Claude Code skill architecture, or the lint loop design.
by msdz | 2026-03-06 13:08:49+00:00
Interesting article you’ve linked. I’m not sure I agree, but it was a good read and food for thought in any case.

Work is still being done on how to bulletproof input “sanitization”. Research like [1] is what I love to discover, because it’s genuinely promising. If you can formally separate out the “decider” from the “parser” unit (in this case, by running two models), together with a small allowlisted set of tool calls, it might just be possible to get around the injection risks.

[1] Google DeepMind: Defeating Prompt Injections by Design. https://arxiv.org/abs/2503.18813
by erelong | 2026-03-06 13:10:00+00:00
postmarketos would probably be the next in line for consideration: https://postmarketos.org/

and then maybe ubuntu touch: https://www.ubuntu-touch.io/

edit: list of supported lineagos devices (would have been crucial to note in the OP that only certain devices are supported; some have "unofficial" third party support as well, not listed on this link): https://wiki.lineageos.org/devices/
by refurb | 2026-03-06 13:10:19+00:00
> No, that isn’t what my comment suggests at all, on any level.
I don’t think you can have intelligent ethical opinions if you disparage and ignore the field that studies ethics (philosophy.)

You're not suggesting that, but then put up your own requirements for someone's ethics to be "valid". So in the end you are filtering others ethical choices by your own requirements.

And your logic seems to work backwards: someone does something you disagree with based on your personal ethical view -> assume they aren't well thought out
by demorro | 2026-03-06 13:10:53+00:00
That update blog is funny. The only data they can get at reports slowdowns, but they struggle to believe it because developers self-report amazing speedups.

You'd get the same sort of results if you were studying the benefits of substance abuse.

"It is difficult to study the downsides of opiates because none of our participants were willing to go a day without opiates. For this reason, opiates must be really good and we're just missing something."
by rswail | 2026-03-06 13:11:25+00:00
> (Of course, PG writing an essay about being too smart for fancy watches - while knowing a lot about them - is its own signaling game, just aimed at a different audience)

He was aiming at people like the people commenting on this thread and who read the essay.

Also to the startup/entrepreneur founder-types that are actually interested in building a business that makes a qualitative improvement in the market that it works in.

But mechanical watches are very appealing to nerd/geek types as well, purely in terms of the design and engineering of the movements and the precision of the manufacture.

Complications are absolutely pointless, but making a movement that can deliver them is very appealing.
by atq2119 | 2026-03-06 13:12:56+00:00
> DEI -- along with hiring quotas -- tended to bring new "officials" at companies and government orgs ("head of diversity") which is another great way of "creating" more elites.

If anything, it's a way of placating existing elites.

The elite overproduction idea is that there is a surplus of people who feel that they should have an elite status compared to reasonably available elite positions.

Creating additional managerial positions is a way to attempt to absorb this situation.
by incomingpain | 2026-03-06 13:13:09+00:00
Oh noes, an anonymous person on the internet thinks my anonymous account is rude. Whatever will I do?

Plus this is a valid discussion. A minimum wage worker is generally intelligent, BGI - Biological General Intelligence.

Hiring them to do tasks that AGI does is a cost-benefit analysis. Whereas that BGI has sick days and may not even work. Afterall minimum wage, minimum work.