MurphyA/hacker-news huggingface dataset:
by tialaramex | 2026-03-04 17:22:51+00:00
> I’m curious how well this will actually work in practice

You're experiencing it working in practice. RFC9849 is a published document, the end of a very long process in which the people who make this "actually work in practice" decided how to do this years ago and have deployed it.

This isn't like treaty negotiation where the formal document often creates a new reality, the RFC publication is more like the way the typical modern marriage ceremony is just formalising an existing reality. Like yeah, yesterday Bill and Sarah were legally not married, and today Bill and Sarah are married, but "Bill and Sarah" were a thing five Christmases ago, one of the bridesmaids is their daughter, we're just doing some paperwork and having a party.
by therealpygon | 2026-03-04 17:22:55+00:00
There are limits to what crime can be shown “on TV” (broadcast), yes? There is also a pretty big difference between a public “on TV” broadcast, and a private interaction in your own home with a privately owned website depicting things that others may disagree with.

I think it’s unhealthy, I think it influences young minds in adverse ways, and I think the parents should be responsible for allowing that to happen. But hey, I don’t really have a dog in this fight either way.
by CamperBob2 | 2026-03-04 17:23:35+00:00
I’m doing nothing of the sort. I’m carrying water for the evidence.

Unfortunately I don't feel that I have access to the "evidence" you're referring to.

Everything I know about the attacks on Iran, I learned from people who lie a lot. That's pretty much all they do. They begin lying shortly after they wake up in the morning but before they get out of bed, and then they don't stop lying until they enter the alpha state that night. After that they probably lie in their dreams, but to be fair I guess I don't have evidence of that either.

Facts aren’t partisan.

Are your non-partisan facts more like Kellyanne Conway's "alternative facts," or the kind that are actually true?
by sega_sai | 2026-03-04 17:23:50+00:00
In astrophysics we now have Open Journal of Astrophysics that is basically an overlay on top of arxiv. https://astro.theoj.org/ It is now catching on with ~ 200 papers published last year, after some of the astro journals started to charge the Golden Open Access publishing fees. I think now people realize how crazy it is to pay for hosting a PDF and for sending your draft to a few referees without paying anything for their work.
by ultropolis | 2026-03-04 17:24:23+00:00
Hip kids were doing bad type since Photoshop 3/illustrator* gave them the ability to do so. Apple boldly ignored their fanbase and did type right.

I don't want kids who think [incompetent] typography is hip designing my laptop, even if they use said laptop. Good type on Apple marketing says "don't worry, we hire boring people to do make your computer work". This looks like incompetence on the part of some designer IMO.

Also: if Apple wants the hip kids to know they are being marketed to, they just show a picture of a hip kid using their computer to do trashy type.

* I didn't mention any page layout programs on purpose.
by dkatsura | 2026-03-04 17:24:37+00:00
As promised, here’s a minimal sketch.

*Capsule format (high-level)*

* magic + version
* crypto suite id (AEAD)
* KDF id + parameters (for password path)
* salt / nonces
* policy section (time/geo/password/visual, AND/OR AST)
* ciphertext (payload blob)
* auth tag / integrity

*Threat model (compact)*
Protects against:

* someone who only gets the `.cfcaps` file (without required secrets/rules)
* accidental/premature access during sharing (time/place/team constraints)

Does not protect against:

* fully compromised endpoint/runtime (bypass checks / exfiltrate plaintext after legitimate open)
* malicious recipient taking photos/screenshots once content is opened

If people want, I can write a 1-page spec from this (policy AST fields + encoding).
by bumby | 2026-03-04 17:24:47+00:00
This is bordering on a non-productive discussion but:

Yes, revenue provides cash flow, not profit. And costs provide the other part, as was already mentioned. But if it increases cash flow without increasing relative costs, it increases profit. Do you think banks would charge fees if they could make more money by removing them? Again, the banks are largely in control of these costs, like the amount of cash back they provide. For example, the federal reports that bank fees account for 1.82% of purchase volume, while cash back programs account for 1.57% of purchase volume. In other words, they make a profit on balance.

You can read the financial statements to get more information. That's where the above numbers came from. They don't generally say "Fees contribute to X% of profits" but they do indicate they are relatively large parts of revenue. For example, JPMorgan lists $5.97B in fee revenue and rewards cost $4.28B, with the difference being profit. So where are the extra costs you are implying coming from that make fees a net cost?
by riddlemethat | 2026-03-04 17:25:34+00:00
This is FUD. The US has dumped truckloads of cash to make it likely that masked men with no cameras and little training will parade around abducting anyone they even suspect of being an illegal immigrant, after even Yale admitted it's likely that more than 22M+ people came here illegally. https://insights.som.yale.edu/insights/yale-study-finds-twic...

It'd be good if Congress could do something to remove the masks, put cameras on these agents, and for the local governments to stop fighting removal of all people who are here illegally so we can pretend we have borders again.
by D-Machine | 2026-03-04 17:25:36+00:00
> A peer reviewer reads a paper and make comments on it. That's it! They don't check primary data, they don't investigate methods, they don't interrogate scientists, they don't re-run experiments just to double check. They assist a journal's editors in editing--that's it.

Um, what? I have done all these things in reviews, and know other academics that have done these things as well. More confusingly though, if you are saying most reviewers don't do these things (which I agree with), this would only strengthen my point?

I'll let readers decide if it is my comments that exacerbate the problem, or if, perhaps, it is apologism for journalistic peer review that might be causing bigger issues in the present day.
by martinald | 2026-03-04 17:26:11+00:00
Yeah, the other problem is I've really struggled to have postgres use multiple threads/cores on one query. Often maxes out one CPU thread while dozens go unused. I constantly have to fight loads of defaults to get this to change and even then I never feel like I can get it working quite right (probably operator error to some extent).

This compares to clickhouse where it constantly uses the whole hardware. Obviously it's easier to do that on a columnar database but it seems that postgres is actively designed to _not_ saturate multiple cores, which may be a good assumption in the past but definitely isn't a good one now IMO.
by just6979 | 2026-03-04 17:26:38+00:00
Because programmers made the LLMs, and they first applied it to the problems they know, so the examples of "replacing a programmer" are abundant. Then the hype train rolled in and now it's suddenly going to replace everything, just that software engineering is the low-hanging fruit since they already have "proof" that it works in that domain.

Hint: it actually doesn't work at real depth, and why not is fairly well explained in TFA: they hype always overestimates the depth of the field. So these advances do help to make easy thing easy (in the case of LLMs because they have been trained on a billion examples of the easy stuff), but don't really end up helping with the hard things (because they really only make new things that weren't encompassed in their training by getting lucky, and because tedious things are different than hard things).
by dragonwriter | 2026-03-04 17:26:41+00:00
> If you just copyright it normally with yourself as the author, seems like it would be fine to copyright whatever bs you want?

That's not really clear; the Copyright Office has guidance on copyright with AI used as a tool (which both complicated and lacks clear, objective standards), but its not at all clear how the courts would view it (I think there have been some trial court cases over it already, but I am not aware of any appellate law).

What is clear is that this case doesn't address that issue at all.
by observationist | 2026-03-04 17:26:56+00:00
LLMs are intelligent. Marketing them as such is an accurate descriptor of what they are.

If people are confusing the word intelligence for things like maturity or wisdom, that's not a marketing problem, that's an education and culture problem, and we should be getting people to learn more about what the tools are and how they work. The platforms themselves frequently disclaim reliance on their tools - seek professional guidance, experts, doctors, lawyers, etc. They're not being marketed as substitutes for expert human judgment. In fact, all the AI companies are marketing their platforms as augmentations for humans - insisting you need a human in the loop, to be careful about hallucinations, and so forth.

The implication is that there's some liability for misunderstandings or improper use due to these tools being marketed as intelligent; I'm not sure I see how that could be?
by iberator | 2026-03-04 17:27:03+00:00
Imagine if monkeys could communicate using crystals.
That would be interesting - human - animal language!

Research could lead into shit like cows TELLING us when feeling sick or know something etc. Food production, pets, police animals - a lot of potential uses.

The same as literally chemistry and rocks gave us transistors.

Almost no study is crazy.

Playing with glass gave us telescopes and microscopes.
by 0xbadcafebee | 2026-03-04 17:27:03+00:00
This post misunderstands why the journal system exists, and why they work this way. It is not because there is an evil corporation controlling everyone else.

Universities do the research. They voluntarily choose to pay for and publish in journals. They could just decide not to do this. Literally, just don't publish in a journal, anymore, ever. Upload your study paper to a Dell Inspiron sitting in a closet in the university faculty lounge, connect it to the internet. Done. Why don't they do this?

#1. No guarantee anyone will look at it. You just spent years of time and money to come up with a research conclusion. Will anyone read it? Comment on it? Learn from it? Is it any good? Will anyone review it? It's after all just a paper sitting on a server. Without some kind of process to vet it independently, and publish it in a place where people can find the latest vetted papers, it's too much hassle for most people to ever find, much less trust.

#2. The reputation feedback loop. Universities give research grants to "well respected" researchers. You become a "well respected" researcher by having academic achievements. You get academic achievements by... doing research that gets published in a journal. Universities depend entirely on the prestige of the researcher and journal to decide who gets a grant. Because...

#3. Money is hard to get. In order to convince someone (government, private donor) to give your university money, you have to show them it's worth it. And the way they show that is.... the prestige of the researcher, being published in the prestigious journal. Look, we have cool peeps, publishing in cool journals! Give us more money!!

Therefore, the reason journals still exist, is Universities desperately need them. They don't want to pay an insane amount of money to a journal. But they don't really have a choice.

Could Universities replace journals with something else? Well, they could work hard to replace the "prestige machine" with other processes (which must enable them to get money, by showing their researchers are good, with vetted papers, published somewhere people will see them). They could replace the journal system with their own intra-university system. But it turns out, that costs a considerable amount of money, time, and resources... which is entirely what the "evil journal publishers" do. Universities would have to spin out their own entire corporation to do all that work, which would be a journal publisher. They know this is expensive, difficult, time-consuming, and they also know the existing system benefits them.

"Let's just throw papers on arXiv" does nothing to solve the money and prestige problem. So the world continues to turn as it has.
by delichon | 2026-03-04 17:27:29+00:00
I have had conversations where the bot started with a firm opinion but reversed in a prompt or two, always toward my point of view.

So I asked it if the sycophancy is inherent in the design, or if it just comes from the RLHF. It claimed that it's all about the RLHF, and that the sycophancy is a business decision that is a compromise of a variety of forces.

Is that right? It would at least mean that this is a solvable problem.
by pvaldes | 2026-03-04 17:27:34+00:00
> The species matters a lot. Tilapia, catfish, and carps use very little wild fish in their feed

The big problem with herbivores is that nobody really likes their muddy taste. This market only works if you can raise this fishes for free with organic discards. Sea Aquaculture is a totally different planet.

I'm aware of the inclusion of vegetable proteins on the diet since decades, but is a tricky issue. Too much of them and the fishes don't grow well, and too low and the costs of feeding your fishes raise over the value of your fishes in the market. And you still need to import your food. This is a big point. Unexpected 10% more of tariffs just because the president farted that night, means the death of your company.
by ycombinator_acc | 2026-03-04 17:27:58+00:00
iPhone SoCs are very powerful. MacBook SoCs are built on them.

Memory is the bottleneck with all Apple products. I have zero issues in terms of compute with the iPhone 12 Mini and could use it for years to come if the SoC were the bottleneck, but it can't even hold two apps in memory.

This would be a very competent computer if it came with 16 GB.
by strix_varius | 2026-03-04 17:27:58+00:00
To add to this, sometimes leadership will assume (or even imply) that there's some laziness involved in not wanting to jump immediately on-board with the complex proposal.

I often end up saying, "I can build this, and I will build this if product insists on it, but first let me suggest an alternative ordering of deliverables that starts with a simple implementation and moves towards this one." In almost every case, that simple implementation is still what's in production years later.
by john01dav | 2026-03-04 17:28:43+00:00
What, exactly, is sandboxed Google play prevented from accessing? Can I feed it a fake location or disable location access? Is it prevented from running in the background 24/7? Can I force it and just it through a VPN? Or is it just blocked from accessing apps and files that aren't in the sandbox? There are many such questions and all could be considered "sandbox".
Show HN: CodexBar for Android – Monitor Claude/Codex quotas on your phone
by hyunnnchoi | 2026-03-04 17:29:00+00:00
I ported CodexBar (a macOS menu bar app by @steipete) to Android after getting
tired of opening three browser tabs to check whether I'd burned through my quotas.

It monitors Claude, Codex (ChatGPT), and Gemini usage in one place — persistent
notification, Quick Settings tile, background refresh, and push alerts on reset.

A few notes:
- Uses the same OAuth endpoints the CLI tools rely on, so you extract tokens from
your local CLI config (no separate login flow)
- No backend server. All tokens stay on-device in EncryptedSharedPreferences
- Gemini needs 4 values because Google OAuth requires client ID/secret for refresh

Pre-built APK on the Releases page if you want to try it without building.

Happy to answer questions about the token extraction or the Android architecture.

First time posting a Show HN — feedback welcome.
by theChaparral | 2026-03-04 17:29:13+00:00
Adding amdgpu.gttsize=126976 and ttm.pages_limit=32505856 to the kernel parameters, while setting the VRAM in the BIOS to the minimum value, enables unified memory to work as expected on AMD Strix Halo running Linux.

The https://strixhalo.wiki has most of the info you need to get LLMs running on these machines.
by hightrix | 2026-03-04 17:29:22+00:00
It really isn’t. The track pad on surface is terrible compared to Mac. The surface has some weird edges and other spots to get caught on. I’ve seen a few with serious damage from typical daily use. The surface I have is barely hanging together, the charger is extremely finicky and will stop charging randomly. It takes effort to get the charger to “sit” in the slot and make contact.

That said, my surface is pretty old so maybe some of these design flaws have been fixed.

But from my experience, the build quality of the MacBook is in a different league than the surface.
Stockpile witholding funds, support is non-existent
by kaishiro | 2026-03-04 17:29:28+00:00
Years ago, I used Stockpile (stockpile.com) to invest a small amount of money. Recently, I’ve been consolidating my accounts and sold my positions, but I’ve hit a systemic wall - the linked bank account on file is old/invalid, and the platform provides no way to modify or remove it.

I have attempted to reach out via support@stockpile.com and their in-app chat, but have received no response for several days. It appears to be a total operational breakdown - the UI requires a linked bank for withdrawals, but the UI for editing that bank account is non-existent.

I have filed complaints with FINRA and the SEC (CRD# 156170), but I'm obviously not holding my breath for any real recourse. I just wanted to warn the community that if you have funds here, you might find yourself in a similar technical hostage situation with zero human support to override it.
by gaoshan | 2026-03-04 17:29:38+00:00
ICE has been detaining Chinese people in my area (and going door to door in at least one neighborhood where a lot of Chinese and Indians live). I was hearing about this just last week as word spread amongst the Chinese community here (Ohio) to make sure you have some legal documentation beyond just your driver's license on you at all times for protection. People will hear about this through the grapevine and it has a massive (and rightly so) chilling effect. US labs can try but with US government behaving like it is I don't think they will have much luck.
by solarkraft | 2026-03-04 17:29:52+00:00
> The damn thing _talks_. You can just _speak_ to it. You can just ask it to do what you want

I mean - yeah. So do humans. But it turns out that that a lot of humans require considerable process to productively organize too. A pet thesis of mine is that we are just (re-) discovering the usefulness of process and protocol.
by TazeTSchnitzel | 2026-03-04 17:29:53+00:00
I guess some folks at KTH have been looking at this topic for a while now, there was a story about it on SVT (Swedish equivalent of the BBC) two years back: https://www.svt.se/nyheter/inrikes/sa-latt-hackas-ditt-barns...

Same professor, Pontus Johnson, is mentioned that story.
by roman_klis | 2026-03-04 17:30:07+00:00
We just shipped gVisor sandboxing for TaskForge AI agents. Here's why.
When an AI agent writes and runs its own code, you're one container escape from a compromised host. Standard Docker won't save you — --privileged is a skeleton key.

In the latest TaskForge update, every AI agent now runs inside gVisor — Google's user-space kernel that intercepts every syscall before it touches your host. VM-level isolation. Container speed. Zero privileged mode.

What changed:
Custom DinD image with runsc baked in — zero host setup
Bridge network isolation with NAT — no more network_mode=host
Service discovery via pre-resolved IPs — no DNS inside the sandbox
Network watchdog guarding interface addresses against Docker flushes
Multi-layer warnings if you run without it (CLI, logs, UI banner)

Why it matters:
Capability gating stops agents from installing unauthorized packages. gVisor stops everything else — even if the agent's code is actively malicious, it's talking to a fake kernel, not yours.

No privileged containers. No hypervisor overhead. No excuses.
AI agents will run untrusted code. The only question is what's between that code and your infrastructure.

AGENT_SANDBOX_MODE=gvisor — one env var, done.
by dragonwriter | 2026-03-04 17:30:12+00:00
> Why is "AI-generated code" not also "AI art"?

It is, and if you did what the actor in this case did with code (tried to register a copyright on a piece of code disclaiming any human authorship and claiming an AI tool as the sole author) it would also not be copyrightable.

This case does not actually address what people are actually mostly interested in with copyrightability of works made by humans with the assistance of AI tools, where the human running the tool is claiming authorship, because that was not what happened that was being fought over here.
by zackmorris | 2026-03-04 17:30:23+00:00
Just about every project I've ever worked on eventually needed everything.

So the way we write software piecemeal today is fundamentally broken. Rather than starting with frameworks and adding individual packages, we should be starting with everything and let the compiler do tree shaking/dead code elimination.

Of course nobody does it that way, so we don't know what we're missing out on. But I can tell you that early in my programming journey, I started with stuff like HyperCard that gave you everything, and I was never more productive than that down the road. Also early C/C++ projects in the 80s and 90s often used a globals.h header that gave you everything so you rarely had to write glue code. Contrast that with today, where nearly everything is just glue code (a REST API is basically a collection of headers).

A good middle ground is to write all necessary scaffolding up front, waterfall style, which is just exactly what the article argues against doing. Because it's 10 times harder to add it to an existing codebase. And 100 times harder to add it once customers start asking for use cases that should have been found during discovery and planning. This is the 1-10-100 rule of the cost of bugs, applied to conceptual flaws in a program's design.

I do miss seeing articles with clarity like this on HN though, even if I slightly disagree with this one's conclusions after working in the field for quite some time.
by gondo | 2026-03-04 17:30:48+00:00
People on call will use AI as well. As long as the first AI left enough documentation and implemented traceability, the diagnosing AI should have an easier time proposing a fix. Ideally, AI would prepare the PR or rollback plan. In a utopia, AI would execute it and recover the system until a human wakes up.

Or at least there is something to chat with about the issue at 3am.
by bluemario | 2026-03-04 17:30:50+00:00
The structural problem is that simplicity accrues value slowly and diffusely, while complexity delivers visible credit immediately to whoever built it. The person who adds the abstraction layer gets the PR merged and the ticket closed. The person who deletes it six months later gets... a smaller diff and a shrug.

I've noticed the incentive breaks down even further when you consider that simplicity often means saying no upfront, which requires correctly predicting future maintenance costs that nobody has experienced yet. Complexity requires no such foresight. You just build the thing someone asked for.

The orgs where I've seen this actually work had explicit "deleted lines" culture, where removing code was celebrated as loudly as shipping features. Not many places do that. Most treat a 2000-line deletion PR with the same energy as taking out the trash.