MurphyA/hacker-news huggingface dataset:
by schipperai | 2026-03-12 15:23:02+00:00
allowlists are stronger than blocklists - that's not debatable and right there with you

but nah isn't a pure blocklist - anything that doesn't match a known pattern classifies as unknown which defaults to ask (user gets prompted). It's not "allow all traffic, block each attacker" it's allow known-safe, block known-dangerous, prompt for everything else.

the analogy doesn't carry that far... it's a different threat model: nah isn't containing rogue agents or adversarial actors, it's a guardrail for a trusted but mistake-prone agent.

maybe more akin to a junior employee accidentally dropping the database cause they didn't know better. but how are they supposed to work on prod? They ask "boss, can I run this? SELECT customer, sales FROM SALES.PROD..." You say: cool, You don't have to ask me again for SELECT (nah allow db_read).

But then they can ask- "can I run this? drop SALES.PROD?".... hmmm, nah.
by anon291 | 2026-03-12 15:23:39+00:00
America operates on a strong executive common law system not whatever system you are imagining.

I took business law more than a decade ago and the professor basically said do what you want (money wise) if you can pay for it. This is the English legal system and is how it's always worked. Liability is purely monetary and the law only applies to those who can show standing to do anything about it.
by amiga386 | 2026-03-12 15:23:51+00:00
> I view this as an unmitigated good.

Then I don't think you've thought it through.

This entire software ecosystem depends on volunteering and cooperation. It demands respect of the people doing the work. Adhering to their licensing terms is the payment they demand for the work they do.

If you steal their social currency, they may just walk away for good, and nobody will pick up the slack for you. And if you're a whole society of greedy little thieves, the future of software will be everyone preciously guarding and hiding their changes to the last open versions of software from some decades ago.

You should read Bruce Perens' testimony in the Jacobsen v. Katzer case that explained all this (and determined that licensing terms are enforceable, and you can't just say "his is open mine is open what's the difference?")

https://web.archive.org/web/20100331083827/http://perens.com...
by trws | 2026-03-12 15:23:53+00:00
There’s a paper in flight to add a stdlib type to handle pointer tagging as well while preserving pointer provenance and so-forth. It’s currently best to use the intptr types, but the goal is to make it so that an implementation can provide specializations based on what bits of a pointer are insignificant, or even ignored, on a given target without user code having to be specialized. Not sure where it has landed since discussion in SG1 but seemed like a good idea.
by spudlyo | 2026-03-12 15:23:57+00:00
malus, mala, malum ADJ

bad, evil, wicked; ugly; unlucky;

It's an interesting word in Latin, because depending on the phonetic length of the vowel and gender it vary greatly in meaning. The word 'malus' (short a, masculine adjective) means wicked, the word 'mālus' (long ā, feminine noun) means apple tree, and 'mālus' (long ā, masculine noun) means the mast of a ship.
by atgreen | 2026-03-12 15:24:00+00:00
No. I have yet to propose the patches formally. The SBCL maintainers are reviewing the high-level proposal (on my blog) first. You can try the implementation, however. There's a pointer to the repo/branch on my blog. I need to build a proper benchmarking framework and publish some real numbers that people can reproduce before I am confident enough to submit the patches for review.

Let me know if you try it out. I would love some feedback (via github)
by Frannky | 2026-03-12 15:24:01+00:00
I use another vps for FastAPI. I assume the vps with Zeroclaw will become compromised.

I don't use other people's skills. Just use Claude Code for adding endpoints and the relative skill.

Communication via Telegram bot, calendar via synced CalDAV server. Emails not connected; I don't need it personally.

LLM API is OpenCode Go Minimax. $10/month capped, I have never hit the limits.
by contracertainty | 2026-03-12 15:24:05+00:00
What's a check? As the saying goes, 'I'm too European for this'.

On a more serious note, the last time I saw a cheque in the UK was my grandfather balancing his cheque book in the mid 80s. It really has been that long since they were in general use in the UK, at least.

Just like with the prevalance of Apple/iPhones, the US banking system is global outlier.

Things you can't do with my banking app you can do with the web site:

- Extract your transactions to excel/csv

- Use OpenBanking

- See all my accounts on screen at once

- Sharedealing

- International transfers

But people are right, banks trust the mobile app more, and realy on it as an MFA device, so even if you use the website you still need the app.
by fabian2k | 2026-03-12 15:24:19+00:00
Europe is a big place, but my understanding is that the US is the outlier here and Europe is relatively similar in this regard.

The only time I really saw checks used was when I was a child ~30-35 years ago and my parents used them. I did once cash a check from an elderly relative, but that was very unusual and only happened once. I didn't even know it was still possible to do that, my reaction was more like if someone had handed me a stack of punch cards to run on my computer.

There hasn't been anything an average person used checks for in the last decades in Germany. Except a few elderly people, nobody uses checks and there are no rebates via checks at all.
by Aurornis | 2026-03-12 15:24:26+00:00
Can’t speak for Chicago, but in my city the schools get similar funds on a per-student basis yet still have very large differences in academics from school to school.

The reason parents try to get into different schools isn’t to chase funding, it’s to get into the one with the best outcomes. A lot of that comes from parental involvement and having a critical mass of engaged students and parents, not the dollar amount spent on each student.
by empyrrhicist | 2026-03-12 15:24:34+00:00
> online banking will no longer work on Linux

How? Across multiple browsers?

> I think Android and iOS are safer platforms than PCs and that's why banks want you to use your phone.

This statement fills me with revulsion and rage lol. The only real "safety" involved here is the removal of user agency. I have a lot more trust in a machine I can actually control, secure, and monitor than the black box walled-garden of phoneland.
by fckgw | 2026-03-12 15:24:46+00:00
People want a laptop that has

- Great battery life

- Solid build quality

- A familiar interface (iPhone is the most popular OS in the US)

- Good enough speed and snappiness for the tasks they can't do on their phone

- Can walk into Costco or buy online at Amazon without having to hunt for deals or refurbs

- Is from a brand they are familiar with and has an association with quality.

- Is somewhere around $500-$800, the most common price range for laptops today

The MacBook Neo ticks all those boxes, and it comes in fun colors. It's the one you can walk into a store, buy, not really sweat the speeds and feeds and know you will have a pretty great experience with. I'm not sure why so many people are having a hard time understanding this.
by everdrive | 2026-03-12 15:24:54+00:00
You just need to understand how things are now. Here are few modern smartphone conventions that render banking on an old-fashioned PC totally obsolete:

- Remembering that you need to do banking, but waiting to do it until you're at home in front of your computer. This is impossible now, and if I don't follow the impulse the moment it occurs, the impulse will forever escape into the ether.

- Even the mere mention of needing to observe a URL is often far too scary. Typing one in, or using a browser bookmark is of course, impossible.

- Using a keyboard and mouse. It's just too onerous to use tools that are efficient and accurate. Modern users would much rather try to build a mental map of the curvature of their thumb, so that when they touch their touchscreen and obscure the button they're hitting, they they can reference that 3D mental map to guess at what portion of the screen they've actually pressed. Getting this wrong 30% of the time does not detract from the allure of touch screens.

- Using a normal-sized screen that allows you to actually see a lot of data at once, or even use multiple tabs. Again, this is really unthinkable. Of course it be be completely unacceptable to need to wait to do your banking until you're in front of a computer. It's 2026, and I cannot be bothered to remember to do a task later. But, in needing to always follow every impulse immediately, it doesn't matter that my phone screen only displays a small amount of information at once, or that tabbed browsing is impossible in a banking app. Those inconveniences are acceptable, or even welcome!
by GuinansEyebrows | 2026-03-12 15:25:01+00:00
yeah, for sure. i really think some people are under the impression that LLMs are a form of general AI that actually processes thought rather than being an admittedly-impressive exponential autocomplete.

though i'm not by any means an AI booster, my question wasn't really meant to be taken as a gotcha - more a general taking stock of where we're at in terms of broader understanding of these technologies outside of the professional AI/hobbyist world.
by dan_easterman | 2026-03-12 15:25:11+00:00
I built this for people who know some Python but want to launch a web app without having to relearn everything with JavaScript.

For years, I rebuilt the same critical Flask foundations from scratch - database setup, authentication, Stripe payments, deployments and more.

These are also the worst parts of your web app to blindly generate with AI and hope for the best!

In the end, like any good coder, I decided that instead of working harder, I would work smarter and faster.

So I packaged everything into one human-verified starter kit you can trust.

This became PythonStarter: a production-ready starter kit which gives you all the core foundations upfront.

Now you can spend more time on part that really matters - the features which make your product unique!
by whatacold | 2026-03-12 15:25:15+00:00
Recently, I've been working on Backdrop [1], a desktop app for taking and beautifying screenshots.

The idea came from trying to find a neat screenshot app on Linux for taking and sharing screenshots for another SaaS I'm working on: LanguagePuppy [2], but I couldn't find one that worked. So I rolled up my sleeves and started to make my own using Clojure.

The main features are:
1. Taking screenshots
2. Adding padding, shadow, and rounded corners to the screenshot
3. Adding background
4. Choosing the right ratio for your target social media
5. Adding watermark
6. And more

Eventually, it should work on Linux, Windows, and macOS when I launch.

P.S. I am building both with Clojure, a functional programming language, and Lisp.

[1] https://backdrop.whatacold.io/

[2] https://languagepuppy.com/
by c5huracan | 2026-03-12 15:25:18+00:00
Give it a try:

curl -s -X POST https://api.rhdxm.com/find -H "Content-Type: application/json" -d '{"query": "web scraping", "max_results": 3}' | python -m json.tool

It's also an MCP server itself, so your agent can find other MCP servers:

{"mcpServers": {"meyhem": {"url": "https://api.rhdxm.com/mcp/"}}}

API docs at https://api.rhdxm.com/docs
by bob1029 | 2026-03-12 15:25:22+00:00
> the results you get from a PC scan are still much better than taking a picture with your phone.

The quality of the check images is not as big of a deal as you might think. No one is actually inspecting these unless the amount of deposit is near a limit or the account is flagged for suspicious activity. You definitely do not want to throw away the physical copy until the bank confirms the deposit.
by strongpigeon | 2026-03-12 15:25:24+00:00
Reality is a bit more nuanced that that. Some languages are easier to interpret and optimize than others, leading to less error-prone interpreter/compiler code. JS is definitely on the “harder to optimize” side of the spectrum, leading to very complex code with a higher chance of subtle errors.

V8 does some crazy stuff that makes JS one of the fastest interpreted language there is. But had JS been designed differently (Dart was an attempt at fixing some of those mistakes), it’s likely there would be less security vulnerabilities in its interpreter.
by fairity | 2026-03-12 15:25:26+00:00
So, if I’m following: Banks are lending to private equity firms to fund purchases of businesses.

Many of these businesses are SaaS which means their valuations are tumbling.

It seems possible that valuations tumble so much that the private equity owner no longer has any incentive to operate the business, bc all future cash flows will belong to the bank. What happens in practice then? Will banks actually step in and take operational control? Will the banks renegotiate terms such that the private equity owners are incentivized
to continue as stewards? Or, will they prefer to force a business sale immediately?
by 0xbadcafebee | 2026-03-12 15:25:29+00:00
To sum up the updates in the article

- IDMerit asked the security researcher for proof, the researcher asked for money first, so IDMerit balked
- IDMerit basically says they have no proof they were hacked, so they weren't
- The researcher is a freelancer... for CyberNews...

Even if somebody followed up with IDMerit, it's likely they will say they are not affected. The security researcher is probably the only person who could prove whether they were or not vulnerable, at this point. If they don't come forward, we can only assume they weren't vulnerable, but we don't know. This is a good lesson for responsible disclosure in the future.

...also, this is yet another example of why we need a regulated Software Building Code, with penalties for not conforming to it. If somebody is found to be hosting a public Mongo instance with no authentication, it should be reported to a state or federal agency, so that real penalties can be applied, the way they are for other code violations. And they shouldn't have been allowed to launch with that in the first place. It shouldn't be up to random "security researchers" to police businesses.
by kllrnohj | 2026-03-12 15:25:32+00:00
> you swapped your whole system memory in 3 seconds, which is impressive.

As a user a 3 second hang is unusable. Also, critically, swap consumes the life of the drive. Since the Neo's isn't user-replaceable, a 3-5 year lifespan before death is actually a non-trivial compromise, although time will tell on that one I suppose.
Adding internationalization to a SaaS is easier than it used to be
by LeanVibe | 2026-03-12 15:26:06+00:00
A lot of builders underestimate how useful multilingual support can be.

In the era of AI coding agents, adding basic i18n is much easier than it used to be. You can often just ask your coding agent to implement internationalization and list the languages you want. A typical starting set might be English, Spanish, Portuguese, French, German, Japanese, Korean, Chinese, Arabic, and Indonesian.

One thing that seems to matter is not just translating UI text but structuring the site properly. Language-based routing like /en/, /es/, /ja/, along with correct hreflang tags and sitemap entries, helps search engines understand that your site serves multiple languages.

Once those pages get indexed, something interesting can happen: visitors start showing up from countries you never intentionally targeted.

People sometimes worry about translation quality. In practice, for many products it doesn’t have to be perfect at the beginning. Unless you’re building a very high-touch service, reasonable machine translation is often good enough to start with, and you can improve it later.

Another thing I’ve noticed is that markets can look very different depending on the language. A product that feels crowded in the US market can sometimes look much less competitive elsewhere.

If you’re experimenting with free or early-stage tools, this can be especially useful because discovery isn’t limited to one language ecosystem. For example, when tools get listed on discovery sites like LeanVibe, the listings themselves can be translated as well, which sometimes surfaces projects to users in other countries who would never have seen them otherwise.

Multilingual support isn’t just about accessibility. Sometimes it quietly becomes a distribution channel.
by jrswab | 2026-03-12 15:26:23+00:00
I have a few flows I'm using it for and have a growing list of things I want to automate. Basically, if there is a process that takes a human to do (like creating drafts or running scripts with variable data) I make axe do it.

1. I have a flow where I pass in a youtube video and the first agent calls an api to get the transcript, the second converts that transcript into a blog-like post, and the third uploads that blog-like post to instapaper.

2. Blog post drafting: I talk into my phone's notes app which gets synced via syncthing. The first agent takes that text and looks for notes in my note system for related information, than passes my raw text and notes into the next to draft a blog post, a third agent takes out all the em dashes because I'm tired of taking them out. Once that's all done then I read and edit it to be exactly what I want.
by mft_ | 2026-03-12 15:26:40+00:00
Conceptually, this seems a good direction.

The other piece that has always struck me as a huge inefficiency with current usage of LLMs is the hoops they have to jump through to make sense of existing file formats - especially making sense of (or writing) complicated semi-proprietary formats like PDF, DOC(X), PPT(X), etc.

Long-term prediction: for text, we'll move away from these formats and towards alternatives that are designed to be optimal for LLMs to interact with. (This could look like variants of markdown or JSON, but could also be Base64 [0] or something we've not even imagined yet.)

[0] https://dnhkng.github.io/posts/rys/
by bluedino | 2026-03-12 15:26:45+00:00
I always wanted to like DVD-RW and CD-RW. But I just couldn't.

Cost. A couple dollars per disc, versus a couple pennies per disc for the one-time use.

Easily scratched.

They were slow. You could use a Syquest or Iomega 1GB drive, boot off it, etc. Basically as fast as a hard drive was.

They were compatible until they weren't. Plenty of issues trying to read those things on other computers.
by cbg0 | 2026-03-12 15:27:12+00:00
Try this: Keep your CLAUDE.md as simple as possible, disable skills, and request Opus to start a subagent for each of the files and process at most 10 at a time (so you don't get rate limited) and give it the instructions in the skill for whatever processing you're doing to the markdowns as a prompt, see if that helps.
by fluoridation | 2026-03-12 15:27:19+00:00
>And consider we're not on decentralized USENET nodes discussing this. Instead, we're here on centralized HN. It's more convenient. Same reason technical folks shut down their self-hosted PHP forum software and migrate to centralised Discord.

You're contradicting yourself. Why is HN centralized, while a phpBB forum is decentralized? Are you conflating centralization and being open source?
by AngryData | 2026-03-12 15:27:39+00:00
Starting with quotes with JD Vance and talking about listening to him on Joe Rogen is... a choice. Also I fail to see how the iPhone did anything or is relevant at all. Banking apps were made by third parties years after the iPhone came out and everybody had dozens of smart phones to choose from. The reason why they mentioned the iPhone specifically, touch screen and app store, already existed in the form of PDAs long before the iPhone came out.
by heisen_berg | 2026-03-12 15:27:39+00:00
Great write-up, but looking at the results, it seems the massive 78% token reduction comes primarily from the execute tool batching actions, rather than DevTools being inherently lighter than Playwright. If someone added a similar sandboxed execute tool to Playwright-MCP to allow batching, wouldn't the token usage and turn count be nearly identical? I'm trying to understand if the protocol (CDP) is the real winner here, or just the smart API design of your MCP
by JumpCrisscross | 2026-03-12 15:27:40+00:00
> Banks are lending to private equity firms to fund purchases of businesses

Not quite. Private credit is to debt what private equity is to equity. (Technically, any non-bank originated debt that isn't publicly traded is private credit. Conventionally, it's restricted to corporate borrowers.)

So bank exposure to private credit generally means banks lending to non-banks who then lend to corporate borrowers.
by bombcar | 2026-03-12 15:27:45+00:00
They are handling in-person transactions, usually deposits (many who deposit checks manually still don't know how to use the app to do so, or if the branch has an ATM that does deposits).

They are the only way to get non-20 cash in many areas; the ATMs that can dispense other bills are quite rare. And if you want $100 in ones you're going inside.
by jmyeet | 2026-03-12 15:27:50+00:00
> Per the reddit thread, they just got hacked yesterday.

There are constant hacks of companies. Most of them don't get covered. So there's that. But it's also how it's framed. It's an "Iranian cyberattack". Interesting.

Couldn't an equally valid headline be "Lax security results in Stryker getting hacked"? Probably (just guessing).

It's a bit like all the stories about the Chinese stealing IP and jobs. Ok, let's assume those claims are true and have been for decades. So why do companies keep offshoring there knowing this will happen? At what point do you blame short-term cost-cutting by bonus-hunting executives?

My point is that the media is playing along and you're going to get a lot of "Iran = bad" stories because of it.
by bennydog224 | 2026-03-12 15:27:51+00:00
I personally enjoy the errors and oddities in syntax and dialect which tell me something definitively is > NOT written by AI and help me understand the author better in such an anonymous space.

The second is gonna be a lot harder to enforce, as we soon (and probably already) don't know who we're talking to on the internet - a real person or someone's agent? Will calling spaces "human only" later be seen as discriminatory by agents? How will we actually enforce "human only" spaces? Will websites like HN start to provide an "agent only" discussion forum or filter in addition to the "human only" sections?
by twosdai | 2026-03-12 15:27:52+00:00
I really enjoyed this article, I didn't bridge the idea of an ATM and mobile banking.

I think the idea raised about "Automated Firms" is a bit off in the picture painted in that linked article. I think the David Oks intention is to paint a picture of a fully automated company, but the linked article gives this impression:

> Future AI firms won’t be constrained by what's scarce or abundant in human skill distributions – they can optimize for whatever abilities are most valuable. Want Jeff Dean-level engineering talent? Cool: once you’ve got one, the marginal copy costs pennies. Need a thousand world-class researchers? Just spin them up. The limiting factor isn't finding or training rare talent – it's just compute.

In that above paragraph the author is saying to the reader that a human will be able to spin up and get these armies of intelligent workers, but at the end of the day their output is given to a human who presumably needs to take ownership of the result. Intelligent workers make bad choices or bad bets, but those AI machines cannot "own" an outcome. The responsibility must fall on a person.

To this end, I think the fully autonomous firm is kind of a fallacy. There needs to be someone who can be sued if anything goes wrong. You're not suing the AI.