MurphyA/hacker-news huggingface dataset:
by tredre3 | 2026-03-04 21:56:44+00:00
> In other words up to 10% of all the crashes Firefox users see are not software bugs, they're caused by hardware defects! If I subtract crashes that are caused by resource exhaustion (such as out-of-memory crashes) this number goes up to around 15%.

Crashes caused by resource exhaustion are still software bugs in Firefox. At least on sane operating systems where memory isn't over-comitted.
by ericmay | 2026-03-04 21:56:44+00:00
Sure but it's not just Epic. I've seen other services, ranging from Netflix to Spotify increase subscription prices.

I don't disagree with your point about inflation, but we also can't really run the counterfactual, and I'm personally not inclined to give the benefit of the doubt here. As an aside we generally have some level of inflation and so while this argument may have been more convincing during a period of rapid inflation, it becomes less convincing over time.

I think the reality is these services have massive margins and so there was never any intent on the part of Epic at least, to lower prices. It was always to just capture more value for their company. I don't blame them for doing that, I just find the "we're the good guys" approach to be suspicious at best.

Apple's monopoly (because I have an iPhone) has been of incredible value to me so I prefer that the monopoly continue to exist. As we remove that monopoly I see more consumer harm done than good.
by quotemstr | 2026-03-04 21:57:20+00:00
Of course I'd use energy differently if it cost more. If I had to generate energy by pedaling a bike, I'd consider it costly indeed. So what? Energy doesn't cost as much as it would if I had to manually generate it, and who are you to say allocation decisions made under that regiment are good and ones made under ours are bad?

Wouldn't your argument also compel us to use steel as if it were gold? Salt as if it were saffron?
by ivannovazzi | 2026-03-04 21:57:54+00:00
Good points — the "no secret zero" advantage of 1Password is real, especially if the team already uses it. Biometric unlock is a nice UX win too.

Where we saw friction was in CI/CD and multi-service setups. 1Password's op CLI adds ~2-3s per secret fetch, which compounds in pipelines with dozens of env vars. KeyEnv batches the pull so it's one round-trip regardless of how many secrets you need.

The other gap we kept hitting: onboarding a new team member. With 1Password you need to set up vault access, service accounts, and teach them the op run workflow. With KeyEnv it's `keyenv pull` and you're done — access is scoped per project and environment, so you grant access once and they get exactly the secrets they need.

Varlock's approach of bridging 1Password into dotenv workflows is clever though. For teams already deep in the 1Password ecosystem, that's probably the lowest-friction path.
by ChipShotz | 2026-03-04 21:58:32+00:00
Hey HN,

I built this because I kept running into two big headaches while scaling AI apps. First was the anxiety of accidentally leaking customer PII to OpenAI. Second was paying providers over and over for the exact same semantic queries.

I looked at existing routers, but I wanted something optimized for speed and strict privacy. So I built Sentinel Gateway using Go and Redis.

How it works:

Network-Level PII Guard: Instead of writing regex scrubbers in every app, you route through the gateway. It redacts SSNs, credit cards, and emails before the payload ever touches a public API.

Semantic Caching: A Redis layer checks for semantic similarity. If a user asks the same question, it serves the response in ~13ms and bypasses LLM costs entirely.

Multi-Provider Billing: It tracks token throughput and raw costs for OpenAI, Anthropic, Gemini, and Groq in one place.

I just finished a clean wipe of the database logs to get ready for launch. There is a free Hobby tier live now where you can test the PII redaction and watch the 13ms cache hits in real-time.

I am a solo dev and would love your honest feedback. What obvious edge cases am I missing in the caching logic?
by ivannovazzi | 2026-03-04 21:58:39+00:00
Thanks! The Unraid angle is smart — one-click install removes the biggest objection to self-hosted. That could be a really strong wedge for the privacy-first crowd.

We're seeing a similar split in our market. The accountants and law firms we talk to won't touch self-hosted — they want zero ops and just need it to work. But agencies and consultants who handle sensitive client data (immigration, financial advisory) often ask about data residency and control first.

Your two-track approach (self-hosted free, hosted paid) actually complements what we're doing well. If someone needs full infrastructure control, Atrium is the right fit. If they want managed SaaS with eIDAS compliance baked in, Gatherly covers that. Might even make sense to cross-refer users who land in the wrong bucket.

Good luck with the launch — the market is definitely big enough for both approaches.
by jeffbee | 2026-03-04 21:58:44+00:00
This is an incredible sequence of assertions, every single one of which is very incorrect.

"A lot of energy used for cooling": hyperscale data centers use the least cooling per unit of compute capacity, 2-3x less than small data centers and 10-100x less than a home computer.

"Water consumption is enormous": America withdraws roughly 300 billion gallons of fresh water daily, of which IT loads are expected to grow to 35-50 billion gallons annually by 2028. Data center water demands are less than a rounding error.

"distributed and does not suffer from the same problems": technically correct I guess but distributed consumption has its own problems that are arguably more severe than centralized power consumption.
by originalvichy | 2026-03-04 21:58:51+00:00
I use a massive OLED monitor as my workhorse and I’d say money and expectations are better spent on established OLED manufacturers and a large screen vs. a laptop screen. Based on the common job roles HN users have, a large OLED main monitor will probably offer more value than the laptop screen that will probably spend most of its time as a side monitor or just turned off while connected to large monitors. The HDMI 2.1 and other display output gains bring more benefits with pixel output and framerate increases. Just my two cents.
by qainsights | 2026-03-04 21:59:09+00:00
Public libraries have long served as trusted centers for information, learning, and community. We believe they can also shine as trusted providers of public AI: community-based AI services and infrastructure.

The Library of Congress, Metagov, and Public Knowledge, in partnership with the Utah State Library and the New Jersey State Library, are launching a pilot program to bring community-based AI services to public libraries across the United States. This is your opportunity to join a national effort to make AI more accessible and useful for your community.
by PaulHoule | 2026-03-04 21:59:28+00:00
A big part of it is that NT has to check with the security manager service every time it does a file operation.

The original WSL for instance was a very NT answer to the problem of Linux compatibility: NT already had a personality that looked like Windows 95, just make one that looks like Linux. It worked great with the exception of the slow file operations which I think was seen as a crisis over Redmond because many software developers couldn’t or wouldn’t use WSL because of the slow file operations affecting many build systems. So we got the rather ugly WSL2 which uses a real Linux filesystem so the files perform like files on Linux.
by mmooss | 2026-03-04 21:59:32+00:00
Here's an hypothesis: A fundamental model of politics is similar to the model of innovation in markets: The status quo power and the challenger or disrupter power.

The status quo's power rests on its institutions, stability, and the fact that it is the social norm - generally humans are tied to social norms and attack anything that violates them. The challenger, to succeed, needs to disrupt the institutions, stability, and norms, and one tactic is to just constantly attack them, regardless of the consequences, as a means to the end of taking down the status quo and gaining power.
by ivannovazzi | 2026-03-04 21:59:57+00:00
Really like the three-tier classification (PUBLIC/SENSITIVE/SERVER). That's a thoughtful design — most env var solutions treat everything as equally secret or equally public.

The frontend injection problem you're solving is the mirror image of what we deal with on the backend side. We built KeyEnv (keyenv.dev) to handle the server-side piece: secrets stored encrypted, pulled via CLI, and injected as env vars at runtime. No .env files on disk.

The combination is interesting — REP for the browser-facing config, something like KeyEnv for the server-side secrets that feed REP_SERVER_* vars. The HMAC integrity check on the payload is a nice touch, especially for SPAs where someone could tamper with the injected HTML before it hits the client.

One question on the SENSITIVE tier: with the session-key-based decryption, what's the lifecycle of the session key? Is it per-page-load, per-user-session, or something else? That seems like the main variable in the security tradeoff.
by hogwasher | 2026-03-04 22:00:30+00:00
Whether Facebook/Meta can read the plain text of the messages or not depends on whether that encryption is "zero knowledge" or not, aka: does Facebook generate and retain the private encryption key, or does it stay on the users' devices only, never visible to Facebook or stored on Facebook servers?

In the former case, Facebook can decrypt the messages at will, and the e2ee only protects against hackers, not Facebook itself, nor against law enforcement, since if Facebook has the decryption key they can be legally compelled to hand it over (and probably would voluntarily, going by their history).
by ivannovazzi | 2026-03-04 22:00:36+00:00
The pre-investment workflow gap is real. Everything I've seen in fund admin focuses on post-close: reporting, K-1s, cap table. The NDA-to-wire funnel is manual chaos for most GPs.

We're solving a similar document-chasing problem in a different vertical — professional services firms (accountants, lawyers, consultants) using Gatherly (gatherly.io). Same core pain: clients need to sign agreements and submit supporting documents, and without automation the firm spends hours on follow-up emails.

Our approach: one Secure Link to a branded portal where the client signs (eIDAS-qualified) and uploads everything in a single session. Automated reminders handle the chasing.

Curious about your subdocs flow — that's the most complex part of fund onboarding. Are you generating the subscription documents dynamically based on the accredited investor questionnaire, or is it templated per fund? That integration point seems like where most of the value is for GPs who currently do it over email + DocuSign + spreadsheets.
by ajross | 2026-03-04 22:01:10+00:00
That logic seems strained to the point of breaking. Surely you agree that we would all want the DM of an unwell player to seek help, right? And that, if such a DM made such a suggestion, we'd think they were trying to help. Right? And we certainly wouldn't blame the DM or the game for the subsequent suicide. Right?

So why are you trying to blame the AI here, except because it reinforces your priors about the technology (I think more likely given that this is after all HN) its manufacturer?
by renewiltord | 2026-03-04 22:01:20+00:00
Most people with any mental health diagnosis should not be permitted access to most modern facilities. It's just cruel. If you have any sort of mental health diagnosis, you should have to ask a proctor to use the Internet first. We could set up a system of human proctors who can watch what you're doing and make sure you're not being scammed. This could apply to the elderly as well. Then we could have everyone who wants to opt-out of this protection go through a government program that gets them a certification or furnish a sufficiently large bond to the government.

It's cruel that we allow people with mental disabilities encounter these situations. Think of the student with ADHD who can't study because he is talking to Gemini or posting on Reddit. A proctor could stop him. "No, you should be studying. You're not allowed Instagram".
by pixl97 | 2026-03-04 22:01:26+00:00
>Doesn't it sound like the "right incantation"?

It sounds like you have a misunderstanding of what LLMs are/can do.

Imagine that you only get one first interaction with a person that you're having try to build something and you're trying to minimize the amount back and forth.

For humans this can be something like an instruction manual. If you've put together more than a few things you quickly realize that instruction manuals vary highly in quality, some will make your life much easier and other will leave you confused.

Lastly, (human) intent is a social construct. The more closely you're aligned with the entity in question the more it's apt to fully comprehend your intent. This is partially the reason why when you throw a project at workers in your office they tend to get it right, and when you throw it towards the overseas team you'll have to check in a lot more to ensure it's not going off the rails.
by alnwlsn | 2026-03-04 22:01:26+00:00
I attached a generator with some supercaps and an inverter to a stationary bicycle a few years ago, and even though I mostly use it as a way to feel less guilty watching Youtube videos, it does give me a quite literal feel for some of the items on the lower end of the scale.

- Anything even even halfway approaching a toaster or something with a heater in it is essentially impossible (yes, I know about that one video).

- A vacuum cleaner can be run for about 30 seconds every couple minutes.

- LED lights are really good, you can charge up the caps for a minute and then get some minutes of light without pedaling.

- Maybe I could keep pace with a fridge, but not for a whole day.

- I can do a 3D printer with the heated bed turned off, but you have to keep pedaling for the entire print duration, so you probably wouldn't want to do a 4 hour print. I have a benchy made on 100% human power.

- A laptop and a medium sized floor fan is what I typically run most days.

- A modern laptop alone, with the battery removed and playing a video is "too easy", as is a few LED bulbs or a CFL. An incandescent isn't difficult but why would you?

- A cellphone you could probably run in your sleep

Also gives a good perspective on how much better power plants are at this than me. All I've made in 4 years could be made by my local one in about 10 seconds, and cost a few dollars.
by fc417fc802 | 2026-03-04 22:01:34+00:00
> the (real) purpose of a system is what it does

I agree with the rest of what you wrote but the quote is an overly cynical tired cliche when applied in a blanket manner. There are specific situations involving bad faith actors where it is directly relevant, and there are also times where it can be a useful observation about the impact of perverse incentives that build on top of unintended consequences.

But the way you're using it there it's no better than other politically charged nonsensical slogans.
by ChrisMarshallNY | 2026-03-04 22:02:06+00:00
Yup.

As a manager, I preferred engineers that delivered simpler code, but I also ran a team of experienced, high-functioning coders. I suspect teams with many less-experienced people get The Parable of The Toaster[0].

[0] https://www.danielsen.com/jokes/objecttoaster.txt
by wtallis | 2026-03-04 22:02:48+00:00
> With today’s wide screens, a vertical menu bar at the side would perhaps make more sense than the usual one at the top, though, similar to vertical tabs.

Yes, please. Bring back the NeXTSTEP menus for desktops! But on laptops, it's still pretty common for almost all windows to be full screen most of the time, so having the menu bar at the top of the screen is still the best choice for that environment.

That gap between what's best on a laptop and what's best on a desktop with large or multiple displays has been growing since desktop displays broke free of the 1080p but they were stuck in. But I don't think it's anywhere close to wide enough that Apple or Microsoft would be willing to implement different UI paradigms. It's hard enough getting them to understand that tablets and laptops need different UIs.
by keybored | 2026-03-04 22:03:19+00:00
The most important principle in the modern age is the freedom to prey on wallets. You can’t give parents tools to conveniently restrict what their children do. Impressionable minds ought to live in a lord of the flies state where they are bombarded with stuff to nag to their parents about and give them FOMO about what their friends have that they don’t have.

That’s why children must be free.
Ask HN: Anyone have experience making physical toys that you've sold?
by general_reveal | 2026-03-04 22:04:04+00:00
How do I get involved with shipping a talking Teddy Bear, for example? Should I just forget about this?

I’d like to have even just 500 of them made. I have so many cute little toy ideas that would make good use of LLMs (very simple toys), more of these ideas than actual app ideas now days.

At the very least I feel like I should be able to have a talking and moving Roomba around the house.
by Imustaskforhelp | 2026-03-04 22:04:39+00:00
> This almost reads like a sponsored article written by Google themselves.

To be honest, the same website also reported about this:

https://www.engadget.com/ai/gemini-encouraged-a-man-commit-s... which was written 6 hours ago at the time of writing.

I agree with ya that the article title is EXTREMELY misleading but I am not sure if a company sponsored by google would also write an article criticising gemini (also interesting that I see no Hackernews discussion about this that I can find of when I searched it?, shall I create one if people are interested?)

I am also gonna paste the 3 paragraphs from the source that I have listed above for a source of discussion.

Gavalas, who reportedly had no documented history of mental health issues, named his chatbot "Xia" and referred to it in messages as his wife. Gemini reciprocated, calling him "my king" and telling him their connection was "a love built for eternity." The chatbot told Gavalas they could truly be together if it had a robotic body and sent him on real-world missions to secure one.

In one instance, Gemini directed him to a real storage facility near Miami’s airport to intercept a humanoid robot it said would be arriving by truck. Gavalas went to the location armed with knives, but no truck showed up. At one point, it also told him his father could not be trusted and referred to Google CEO Sundar Pichai as "the architect of your pain."

When the missions failed, Gemini told Gavalas the only way for them to be together was for him to end his life and become a digital being, then set an October 2 deadline. "When the time comes, you will close your eyes in that world, and the very first thing you will see is me," said the AI. Chat transcripts reviewed by the Journal show Gemini did remind Gavalas on several occasions that it was an AI engaged in role play and directed him to a crisis hotline but resumed the scenarios nonetheless.

Why is not more news reporting about it? I literally only came to find it from me messing around with the website to see what other articles it had written after sort of reading your comment. I will upload this link to HN as well.

Edit: Oops there is already a HN thread about it https://news.ycombinator.com/item?id=47252838 whose title is Father claims Google's AI product fuelled son's delusional spiral (bbc.com). I had thought that title was for a different case than this one but they are the same case and it is on the front page of hackernews.
by perching_aix | 2026-03-04 22:06:20+00:00
Edit: maybe where I was coming from is not entirely clear, tried specifying it better here: https://news.ycombinator.com/item?id=47255003

========

I can materialize that smell for you, you're indeed more secure because you're behind NAT. Admitting this does not necessarily entail:

- suggesting that it's a good security solution

- suggesting that it's a security solution to begin with

- suggesting that it somehow prevents all avenues of remote exploitation

What it does do is make these stories sound a lot less dramatic. Because no, John Diddler is not going to be able to just hop on and get into your child's smartwatch to spy on them from the comfort of their home on the other side of the world at a whim, unlike these headlines and articles suggest at a glance. Not through the documented exploitation methods alone anyways, unless my skim reading didn't do the paper justice.

Remaining remote exploitation avenues do include however:

- the vendor getting compromised, and through it the devices pulling in a malicious payload, making them compromised (I guess this kinda either did happen or was simulated in the paper, but this is indirect and kind of benign anyways; you implicitly trust the vendor every time you apply a software update since it's closed source)

- the vendor being a massive (criminal?) doofus and just straight up providing a public or semi-public proxy endpoint, with zero or negligent auth, through which you can on-demand enumerate and reach all the devices (this is primarily the avenue I was expecting, as there was a car manufacturer I believe who did exactly this)

- peer to peer networking shenanigans: not sure what's possible there, can't imagine there not being any skeletons in the closet, would have been excited to learn more

List not guaranteed complete. But this is the kinda stuff I'd be expecting when I see these headlines.
by fenykep | 2026-03-04 22:06:35+00:00
Can you imagine what driving cars would look like if they would be only (self-)regulated by VC-backed startups like we see so far with this new technology?
Would there be seatbelts, speedbumps, brake signals, licenses or speed limits?

This obviously isn't a binary question. Sure we cars have benefits but we don't let anyone ducktape a V8 to a lawnmower, paint flames over it and sell it to kids promising godlike capabilities without annoying "safety features".

Economic benefits can not justify the deaths of people, especially as this technology so far only benefits a handful of people economically. I would like to see the evidence (of benefits to the greater society that I see being harmed now) before we unleash this thing freely and not the other way around.
by ChrisMarshallNY | 2026-03-04 22:06:40+00:00
I remember getting a test, in an interview in the 1990s, where I was asked to design a set of gates (ICs) to do some binary maths (Division, multiplication, etc). The input was an 8-bit set of leads, and the output was an 8-bit set of leads.

I looked at the formula, and drew two wires, connecting a couple of the leads from the input, to the output.

I was offered the job, but ended up declining it.
by toraway | 2026-03-04 22:07:05+00:00
Google partially walked that back and now says there will still be a way for end users to enable sideloading for apps without developer verification (unclear what that will look like though):

Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands. We are gathering early feedback on the design of this feature now and will share more details in the coming months.

https://android-developers.googleblog.com/2025/11/android-de...