MurphyA/hacker-news huggingface dataset:
by asveikau | 2026-03-04 23:11:39+00:00
> Flock would have detected, but maybe not prevented, two of these cases

I'm glad you acknowledge this, because it highlights what has irritated me about the discussion of crime in the last ~6 years. People seem to expect that crime can be prevented. Our criminal justice system and system of civil rights can only intervene after the crime has occurred, which means it won't prevent anything. Maybe I've misread you personally, and I don't mean to put it all on you, but I think people with your position tend to vastly overstate the deterrent factor of proposed interventions.

Further, only reacting to crime and not seeking to "punish" people before a crime has occurred is exactly how our system should work. When reasoning about crime prevention, a large number of people seem to want police to intervene preemptively. Or they want to punish offenders out of proportion to actual crimes, to prevent recidivism that hasn't happened yet. This type of thinking seems to slide pretty quickly into the "pre-crime" concept of dystopian scifi. We called that stuff dystopian for a reason.

In my opinion what we should do instead to prevent crime is to promote social cohesion, in the form of preventing income and wealth disparity, funding a strong social safety net, help for drug addicts and the mentally ill, etc. People who live happier, more stable lives will have less reason to turn to crime.

(I will also note, crime is lower everywhere in America vs. a few decades ago. Violent crime peaked in the mid 1990s. So it is in some sense a misguided endeavor completely, focusing on problems that are relatively unlikely.)
by sabatonfan | 2026-03-04 23:12:07+00:00
One of the things I have wondered is why a country would not create an company or VC network from people (spy agents) who for all intents and purposes look like normal citizens of any other country (perhaps even in the enemy country itself) and then just have the Country siphon off some money into that VC to buy some companies.

The fact of the matter is that you can see an Israeli connection to VPN companies like express vpn, cyberghost vpn (the israeli billionaire who owns this has donated to IDF for context iirc)

This is what is happening in the front page. Why wouldn't a nation want to create a VC network which can buy large companies in security industry in neutral countries (germany,switzerland etc.)

People would be none the wiser if this actually happens and the head VC network considering that they can just buy security options and would be even able to sell them sometimes to even their enemy state themselves.

A part of me is worried talking about this idea might give states ideas. Another part of me believes is that this might already be happening.

For record, I am not against Venture capitalism for context, but the opportunity presented by it in the context of governments spending money secretly to buy security related companies in terms of a VC network to then have the same contract with foreign enemy company feels complicated but feels to me easy enough for a nation actor to pull.

This can also not be just a single VC but can be spread across many for example.

Are we certain that this might be what could've happened in this case, I suppose not but there might be a non zero chance.

And we are already discounting the fact that in the case of isreal, sometimes they don't even do this and have it be an israeli company itself. What if they might do it to present two options: say an israeli and a german option. But both options might be tampered (I am absolutely not saying this is the case but I am just presenting a mere hypothetical)

Given the absolute budget of governments for these things and the fact that Govt. hires people so much smarter than me. Surely they must have thought of this and if that's the case then if the plan is working as intended and its hidden and public doesn't know about it and if its hidden/public doesn't know about it, the plan is working as intended.

That being said, It wouldn't be wrong to say that this feels more like a conspiracy theory. I genuinely hope I am wrong tho but why would a govt. give up on such a massive thing

Once again, This is just a thought experiment and let's keep the discussion civil. I am not against Venture Capitalism.
by jacquesm | 2026-03-04 23:12:42+00:00
If you can design and build your own inverter I would take it as read that you know how to read code and know how an actual inverter should function:

If you're grid connected and see valid phase on the input for a certain amount of time of matching phase and measuring voltage you can provisionally connect at exactly that phase and voltage but without injecting power. After that you are allowed to slowly ramp up your output by leading the phase (while raising the voltage within certain limits) as long as you observe the effect that you have on the grid. If the grid phase drops away or there is any other anomaly (such as a voltage drop or rise of more than x V/s you are required to immediately disconnect, there are many other disconnect requirements but that's the main one with respect to line worker safety.

Three disconnects within a short period of time = no reconnect attempts for a much longer time. If the situation persists that's a failure and you are no longer allowed to connect to the grid until there has been an intervention and an inverter reset.

If your inverter is of the islanding variety then the rules are slightly different, then the transfer switch only gets energized when you match voltage and frequency but in the meantime the (usually battery backed up) inverter can supply local consumers.

By the time you come up with the idea of rolling your own inverter you have either become familiar with the requirements (which differ from region to region, and which in a properly designed inverter are mostly a matter of tweaking firmware parameters) or you will have to do so because you realize your responsibilities.

Anybody up for this kind of project will with a high degree of likelihood have the required knowledge because that knowledge is a lot simpler to acquire than the knowledge to build an inverter that isn't going to result in you being laughed out of the room when your EE buddies come look at your creation.

I would expect you to do a better job than 95% of the imported ones that I've taken apart and which all had massive shortcuts taken, good enough to pass first inspection and a year into warranty, not good enough for long term safe deployment. This ranges from unsuitable connectors, low quality inductors, even lower quality relays, undersized FET boards, insufficient cooling, bad cast aluminum housings, in general bad housings (not rodent and/or insect proof) and so on.
by testing22321 | 2026-03-04 23:12:58+00:00
> If somebody is doing 'more' then it's the MBP

I professionally edit tens of thousands of very large RAW photos, edit 4K video all day long, write, web and very light dev work.

All that on a used M1 air. Still the fastest computer I’ve ever used.

The pro is so insanely powerful there really are only devs (and maybe only ai devs) who need it.
by joshvm | 2026-03-04 23:13:05+00:00
The same is also true within the Macbook line. The 14" Pro is smaller and nearly 2lbs lighter than the first 13" unibodies. I have my 2009 college laptop on a shelf as a memento and it feels pretty chunky. This hasn't changed much in the M-series though, and the M5 is slightly heavier than the M1.

Something I miss from the Windows side is sub-kg machines, at least since Apple discontinued the 12" Macbook. It makes a surprisingly big difference when traveling, especially with Asian carriers that have hard carry-on limits. The Thinkpad X1 Carbon is a fantastic form factor, though the older Intel chips run incredibly hot. I repurposed that as a garage/workshop Linux machine. Unfortunately, the price differences between Mac/Windows also disappear when you start looking at those higher-end machines.
by pugworthy | 2026-03-04 23:13:32+00:00
If you're in the US, stay away from Home Depot and Lowe's if you want to not be around them. It's not universal, but it's surprising how much they are often there.

I get it may have its application in theft recovery, but it also happens to have some strong potential for ICE raids for day laborers. I don't think it has much application to theft prevention as I doubt many people even know they are there.
by oliwarner | 2026-03-04 23:13:55+00:00
Somebody disagreeing with you isn't unassailable truth. I could introduce myself as Oli, and as many times as you tell me my name is Brian, that's not going to affect my knowledge of what my name is. Same here. Despite them being told, you will struggle to prove the plaintiff here does not truly believe they hold the IP for this game.

Intent is important because it's the motive to fraudulently file. It's the closest you'll get to proving what somebody knew, unless they confess.
by alnwlsn | 2026-03-04 23:14:33+00:00
I'm as curious as you to be honest - putting a strain gauge on the pedals for measuring mechanical power has been on my list for quite a while. My own (probably inaccurate) measurements right after the generator says I can get 60-70Wh in an hour, but I can get to 100Wh if I try harder. I have reason to believe my setup underestimates power because my ammeter clamps at 5A and I know I can peak over that on the down stroke of the pedal.

I've seen numbers like 250W mechanical power for an average trained cyclist, so either my setup is rather inefficient, my measurements are off, or I'm going to find out that I'm nowhere near as strong as a real cyclist.

On the other hand, the stationary bike I got originally had a rubber belt, which it would chew excessively and I eventually swapped it for a chain because it kept slipping in spite of tensioning it more, suggesting I'm hitting the thing harder than it was originally designed for (how that translates into power I'm not sure).
by thewebguyd | 2026-03-04 23:14:50+00:00
The problem is, terminating the conversation, even with a closing note to call the crisis line or go talk to a human, is extremely harmful to someone in that situation. To someone who is suicidal, and is being led deeper into their own delusions, just terminating will feel like abandonment or rejection, and push them further over the edge.

The goal in crisis intervention is to bridge them to professional help. Never abandon, always continue the conversation and steer it in a better direction. Ironically enough, in crisis intervention, you should do what LLMs are good at and acknowledge what the person in crisis is feeling, and show empathy. The difference is, the responder needs to reframe it and keep a firm boundary that the person needs professional help.

Basically, recommending the crisis line and then terminating the conversation won't help, and will make it worse.

The model either needs to be a trained crisis responder, or when certain triggers are hit, a human crisis responder needs to hop on the other end and then the human should continue the conversation and talk to the user to de-escalate.

I'd be in favor of having all these AI companies be forced to have crisis responders on staff to take over conversations when they go off the rails.
by tialaramex | 2026-03-04 23:14:53+00:00
This actually reminds me of the "God of the gaps" problem. A gradual retreat in the face of inconvenient facts.

Many years ago when I was a student the argument was that integrity isn't a big deal so plaintext telnet is just fine. If you're paranoid you use an "enhanced" telnet where the authentication step is protected but not everything else [Yes I'm an old man]

By the turn of the century everybody agreed telnet is stupid, use SSH but integrity still wasn't a big deal when it comes to ordinary web sites. Only your bank needs SSL fool.

And I suppose that 8-10 years ago that changed too and it's now recognised that plaintext HTTP really isn't good enough, you need HTTPS. But still I see that you say integrity isn't important when it comes to DNS records.

Integrity is the hardest thing to get ordinary users to care about. Given how freely even young kids lie we should probably take it more seriously but it remains hard to get ordinary people to care, however ultimately this does matter.
by janadiamond | 2026-03-04 23:15:01+00:00
That curb cut example is a great example of the pattern.
Improvements aimed at a specific accessibility need often end up benefiting more people than expected.

While thinking about this, I realized that accessibility often acts like a kind of stress test for design assumptions. If something only works under ideal conditions, accessibility issues tend to surface those weaknesses very quickly. (I wish I'd known that when I was a tester!)
by asadotzler | 2026-03-04 23:15:43+00:00
>a school or school district that buys them in quantity is going to get an even better price.

Citation? I've read and heard others say this is the opposite of the truth, that Apple never gives bulk discounts. Heck, there's someone in this very discussion saying the same with actual prices paid in their comment showing real first hand experience and yet you come in here with a hand wavy unsupported claim that Apple gives breaks for bulk buys.
Show HN: Kvlar – Open-source firewall for AI agent tool calls
by kvlar | 2026-03-04 23:16:30+00:00
Hey HN, I built Kvlar — an open-source policy engine that sits between AI agents and their tools (MCP servers), evaluating every tool call against YAML security policies before execution.

The problem: AI agents using MCP can execute database queries, push code, send Slack messages, and run shell commands — with no security boundary. Claude Desktop has basic approve/deny, but it's per-call with no persistent rules, no automation, and no audit trail.

How it works: Kvlar runs as a stdio proxy between the agent and the MCP server. You define policies in YAML — allow, deny, or require human approval — and Kvlar enforces them deterministically.
Fail-closed: if no rule matches, the action is denied.

kvlar init --template postgres # curated policy (11 rules)
kvlar wrap # inject proxy into Claude Desktop
kvlar test -f policy.test.yaml # verify your policy in CI

What it catches today:

Postgres: blocks DROP TABLE, gates INSERT/UPDATE, allows SELECT
GitHub: blocks repo creation, gates force-push and merges, allows reads
Slack: gates message sending, allows channel reads
Shell: blocks rm -rf, sudo, curl|bash — gates installs, allows ls/cat/grep
Technical details:

Written in Rust (4 crates), pure policy engine with zero I/O
100+ policy tests
Policy composition via extends — build on top of curated templates (docker compose style)
Works with Claude Desktop

Apache 2.0
Website: https://kvlar.io
Install: cargo install kvlar-cli

I'd love feedback on the policy design and what MCP servers you'd want covered next.

Updated todo list with completed tasks and configurations
Updated todo list with completed tasks and configurations

Summary of everything done this session:

Task Status
Favicon fixed (monospace K + cyan underline) Deployed
--config <path> flag on wrap/unwrap Pushed to GitHub
Docs page updated (cargo install, 8 templates, parameter matching, --config, --dir, all servers in MCP compat) Deployed
Landing page rule count fixed (28 not 30) Deployed
Full revalidation: 91 unit tests + 105 policy tests, all 8 templates init+validate, wrap/unwrap E2E with --config All passing
SDK pushed to kvlar-io/kvlar Done
Website deployed to Vercel Done
Show HN draft Above
Before posting: Make the kvlar-io/kvlar repo public on GitHub.

Preview Screenshot
Tool output

Let me also check the home page and favicon.

Executed JavaScript to redirect to home page
Executed JavaScript to redirect to home page
Preview Screenshot
Tool output

Everything looks correct — landing page rendering properly with the hero, metrics bar (196 tests, 8 server policies), and the docs page showing the updated CLI reference with --config flag. The changes are verified and already deployed to Vercel.
by ufmace | 2026-03-04 23:17:16+00:00
The part that always struck me as weird about this stuff is that all of these "agents" with their "personas" are the same baseline LLMs with the same training ultimately, just told to basically pretend they're different. How far can that really get you?

I'm not actually a database engineer with 30 years of experience. If somebody demanded that I pretend to be one, I guess I'd give it a shot, but I would expect any actual employer would be able to tell that I don't have the level of knowledge and experience that you'd expect from somebody like that.

If the base LLM actually has the knowledge of all of these specialties, why can't it just apply them all at once, instead of needing to be told to I guess pretend to be only one of them.
by taeric | 2026-03-04 23:17:49+00:00
The ridiculously dramatic drop in power we dedicate to lighting is one that is just tough for folks to internalize. As you said, used to, you could have ~10 lights in your house that would add to upwards of 1kw. Nowadays, you can have 50 lights and barely hit 500w. Just mind blowing how far we dropped energy on those.

Same goes for televisions. Your modern TV is probably closer to the basic light bulbs before LEDs.

I'm assuming the general trend is true for all things solid state. That said, lighting is by far the biggest drop for most houses. Remarkably so.
by mlsu | 2026-03-04 23:18:03+00:00
Even if you take the current US leadership at their word, they do not. They've all but said that war crimes are on the table here.

America, regardless of what so-called international institutions say, is unleashing the most lethal and precise air power campaign in history. B-2s, fighters, drones, missiles, and of course classified effects. All on our terms with maximum authorities. No stupid rules of engagement, no nation-building quagmire, no democracy building exercise, no politically correct wars. We fight to win, and we don't waste time or lives.

Literally, on day 1, they bombed an elementary school and killed dozens of little girls.

When you are constantly hearing the words 'precise', 'controlled', 'surgical' you absolutely must wipe the propaganda off of your ears. A protracted aerial bombing campaign will never, ever, be precise and surgical. Doesn't matter how good the tech is. One only needs to look at Gaza to see what is planned for Iran.
by maccard | 2026-03-04 23:18:13+00:00
> when the moment calls for it

In an interview when you’ve been explicitly asked to discuss a topic to have a technical discussion about something is not when the moment calls for it. Doubly so if you’ve been asked twice. If you’re not willing to put aside being technically correct when you’re trying to show off your best self, it’s pretty likely that when things get tough, you’ll behave the same.

> unless of course what you’re being for is the willingness to roll over for unreasonable requests from people with more power

D, do you think that someone saying “can we please talk about a technical topic, here’s an example we’re both likely familiar with” is looking for yes men? I actively want my team and coworkers to challenge me, but I absolutely don’t want to work with that person who appears at every meeting with a list of reasons why we shouldn’t do X.
by erelong | 2026-03-04 23:18:37+00:00
not sure I understand the petrol car using 3x as much energy as an EV... wouldn't it make sense to convert gasoline to electricity then? I presume that must not be as efficient as other ways to convert fuel to gasoline? (I understand the math is there but... I'm temporarily failing to get it)

I think lists like these might be useful for energy audits and thinking about ways to make better use of energy
by steve_adams_86 | 2026-03-04 23:18:45+00:00
This is incredible, and I'm excited by this technology. I also feel like it's irresponsible to allow laypeople to potentially inject dangerous code into literal black box programs. This should come with a much clearer disclaimer that it could be dangerous to use it.

I get that we've all been running homebrew and npm and so on without auditing every package, but there, there was some semblance of a trust mechanism and distributed review if something went wrong.

Here we have totally unreviewed code running with no trust mechanism in place whatsoever.

No public releases, no audit trail, no versioned releases, no community eyes on anything.

Weird times
by systima | 2026-03-04 23:19:15+00:00
Great question.

voxic11 is right that the AI Act creates a legal obligation that provides a lawful basis for processing under GDPR Article 6(1)(c).

To add to that, Article 17(3)(b) specifically carves out an exemption to the right to erasure where retention is necessary to comply with a legal obligation.

(So the defence works at both levels; you have a lawful basis to retain, and erasure requests don’t override it during the mandatory retention period).

That said, GDPR data minimisation (Article 5(1)(c)) still constrains what you log.

The library addresses this at write-time today, in that the pii config lets you SHA-256 hash inputs/outputs before they hit the log and apply regex redaction patterns, so personal data need never enter the chain in the first place.

This enables the pattern of “Hash by default, only log raw where necessary for Article 12”.

For cases where raw content must be logged (eg, full decision reconstruction for a regulator), we’re planning a dual-layer storage approach. The hash chain would cover a structural envelope (timestamps, decision ID, model ID, parameters, latency, hash pointers) while the actual PII-bearing content (input prompts, output text) would live in a separate referenced object.

Erasure would then mean deleting the content object, and the chain would stay intact because it never hashed the raw content directly.

The regulator would also therefore see a complete, tamper-evident chain of system activity.
by oceanplexian | 2026-03-04 23:19:22+00:00
The idea that you would be worried about how many electrons you use and it's relationship to climate change is on its face kind of ridiculous.

It's like worrying about how many times you personally ordered Chinese food affects the price of Diesel fuel in India. It's an absurd leap of logic, and the parent is right to call out these arguments which are almost always emotional.
by iso-logi | 2026-03-04 23:19:25+00:00
Do we think the iPhone 16 with A18 Pro chips are going to be the same as the A18 in the laptop though?

When you are not confined to a iPhone body, you have a bit more flexibility in thermals, heat and power consumption.

Would there be any chance the A18 Pro in a Macbook clocks higher? or maybe clocks higher for longer?
by bokohut | 2026-03-04 23:19:31+00:00
And the verbiage that many will glance over yet will have the greatest future impacts for all alive is: "...includes an energy storage system..."

Todays U.S. meeting "Roundtable on Ratepayer Protection Pledge" with the U.S. President himself leading that meeting garnished commitments from Big Tech as it relates to energy. In time Big Tech Energy divisions will be thing and some citizens will be paying their utilities bill to them.
by ramidarigaz | 2026-03-04 23:19:38+00:00
> Whenever you do the real world calculation for what an electric cars CO2 profile looks like it turns out to be the same as a gasoline car unless your country is majority nuclear.

Not at all true: https://www.carboncounter.com/

US-specific but you can even pick a state and it will use the generation mix of that state
by array_key_first | 2026-03-04 23:19:53+00:00
Everybody and their mom loves to believe they're the hot young stuff on the block.

Even with a company like, say, Meta, they have more freedom to make mistakes than 100% of enterprise companies. Nobody cares too much if Facebook goes down or is slow or something.

But if you're selling to another business, they're gonna have your ass for breakfast for even the tiniest mistakes. As they should, they're paying you a lot of money!