MurphyA/hacker-news huggingface dataset:
by matthoiland | 2026-03-03 19:15:44+00:00
I've tried the LG UltraFine and LG UltraGear (w/144hz) ... still went with the Studio Display. Expensive, but my previous Thunderbolt display gave me 12 solid years – hoping the SD does the same.

Edit: Also consider the price of speakers, camera, hub, power, and the "it just works" factor.
by decodebytes | 2026-03-03 19:16:11+00:00
Hey HN. I'm Luke, security engineer and creator of Sigstore and other open source security projects. I've been building nono, an open source sandbox for AI coding agents that uses kernel-level enforcement (Landlock/Seatbelt) to restrict what agents can do on your machine.

One thing that's been bugging me: we give agents our API keys as environment variables, and a single prompt injection can exfiltrate them via env, /proc/PID/environ, or just an outbound HTTP call. The blast radius is the full scope of that key.

So we built what we're calling the "phantom token pattern" — a credential injection proxy that sits outside the sandbox. The agent never sees real credentials. It gets a per-session token that only works only with the session bound localhost proxy. The proxy validates the token (constant-time), strips it, injects the real credential, and forwards upstream over TLS. If the agent is fully compromised, there's nothing worth stealing.

Real credentials live in the system keystore (macOS Keychain / Linux Secret Service), memory is zeroized on drop, and DNS resolution is pinned to prevent rebinding attacks. It works transparently with OpenAI, Anthropic, and Gemini SDKs — they just follow the *_BASE_URL env vars to the proxy.

Blog post walks through the architecture, the token swap flow, and how to set it up. Would love feedback from anyone thinking about agent credential security.

https://nono.sh/blog/blog-credential-injection

We also have other features we have shipped, such as atomic rollbacks, Sigstore based SKILL attestation.

https://github.com/always-further/nono
by danudey | 2026-03-03 19:16:13+00:00
If you're a radiologist making $300k+ you're going to want to use certified displays so that you don't get sued for using non-approved devices for diagnostic use, and that's going to cost you maybe $6k for a 21" monitor.

https://www.monitors.com/products/jvc-cl-s500-rn?variant=427...

$3300 for a 27" display is ridiculous in comparison.

(Acknowledging that the link I provided is for a pair of monitors, but also those monitors are half price because they're refurbished)
by SiteToSocial | 2026-03-03 19:16:35+00:00
Hey HN, I built a tool that scrapes your website, generates Pinterest pins with AI, and posts them automatically every day.
You add your domain, it scans your sitemap and imports every page. For each pin, AI reads the page content, queries Pinterest's live search suggestions for high-traffic keywords, then generates an optimized title, description, and tags. Pins post throughout the day to look organic.
New Pinterest accounts that post aggressively from day one get shadowbanned. I built a 12-day warmup that gradually ramps from 0 to 15 pins/day to avoid that.
Paid plans:
$3/mo per site: uses your original images, AI handles titles, descriptions, and keyword targeting. Works for blogs and e-commerce stores.
$15/mo per site: AI also generates unique pin images from your page content.
$35/mo for clothing/shoes: AI generates images of models wearing your products (gender-aware).
Uses OAuth 2.0 with auto token refresh. No passwords, no browser automation.
I also built 3 free tools, no account needed:
Pinterest Title & Description Generator: sitetosocial.com/pinterest-title-and-description-generator
Pinterest Keyword Tool: sitetosocial.com/pinterest-keyword-tool
Pinterest Hashtag Generator: sitetosocial.com/pinterest-hashtag-generator
These work like the paid version same AI, same Pinterest data. The difference is the automation picks the best keywords by traffic and relevance automatically, while the free tools give you all the suggestions and you choose.
by stephc_int13 | 2026-03-03 19:16:35+00:00
This is very early.

If there is an AI boom, what we're seeing is its infancy.
Semi-autonomous coding is the first and most natural use case, thanks to vast amount of training material, opportunities for closed-loop RL with minimal human supervision and the eagerness of the community to try and embrace new tools.

But it is still not much more than QoL improvement at this stage, and maybe some velocity gains for the most hardcore users willing to spend time and money to stay at the bleeding edge.

But there is also a rather large appetite for local models, I am not sure the future of AI will be 100% cloud based.
by yoaviram | 2026-03-03 19:16:36+00:00
I just finished writing a post about exactly this. Software development, as the act of manually producing code, is dying. A new discipline is being born. It is much closer to proper engineering.

Like an engineer overseeing the construction of a bridge, the job is not to lay bricks. It is to ensure the structure does not collapse.

The marginal cost of code is collapsing. That single fact changes everything.

https://nonstructured.com/zen-of-ai-coding/
by brailsafe | 2026-03-03 19:16:42+00:00
To me, this is kind of like Telecom providers giving you bandwidth headroom that realistically should have been there for a long time, but removing the option to get a cheaper plan whether you'd otherwise pay for the upgrade or not.

Like for my last upgrade, I bit the bullet and upgraded to 1TB for the first time ever instead of base storage at Apple's absurd prices, so it's good, but if I'd not have been willing to spend money on that at all, they lifted the floor.

My cell phone plan has been increasing every year by small amounts, but my usage pattern hasn't changed, and meanwhile they've restricted HD streaming using Deep Packet Inspection or whatever, so I theoretically have a 100GB full speed cap but can't practically use more than 20gb anyway, so they're pricing the bandwidth into the contract but I can't save money by getting a lower ceiling
by sarkarsh | 2026-03-03 19:16:49+00:00
The ground truth file is the right idea but flat markdown breaks down fast once agents need to actually coordinate. They cant query it -- they just re-read everything.

We hit the same wall running parallel Claude Code sessions. Ended up switching to ctlsurf, which gives agents structured blocks via MCP -- task tables, key-value state, append-only logs. An agent can check "is anyone already on the auth module" by querying a table, not parsing prose. State survives across sessions too, so a new agent doesnt start from scratch.

The drift problem across parallel agents is exactly what convinced me flat files werent enough.
by softwaredoug | 2026-03-03 19:16:56+00:00
Manager or not I think the real risk is overly adapting your skills to one company. Managers becoming experts at one companies politics and cannot instead of general organizational dynamics. The devs who seem to only get by in this one team / codebase, and neglect general skills, looming down on outside info as buzzwords.

It seems smart at the time, and makes you more effective in the near term. But it might cause many of your skills to lose portability.
by ranger_danger | 2026-03-03 19:16:57+00:00
Potential real-world consequences, while they do exist, are simply too subtle to realize. Some actual examples of cookies being used against people:

- CBP has admitted to buying location/advertising data from brokers to use in helping locate people to arrest

- Phishing and identity theft can be made easier due to cookies... security researchers have even demonstrated 2FA bypass techniques based on it

- Price discrimination - Consumer Reports found that flight prices can fluctuate based on your cookies. Sometimes they would even raise the price if you kept searching for routes, as an indication that you were in a hurry, thus likely willing to pay extra.

- Healthcare discrimination - Companies have been found to raise healthcare prices or deny coverage due to cookie data aggregated via brokers where external sites tracked a person's health conditions based on what pages they visited (examples: fertility, cancer and mental health support groups)

- AI models or automated systems using cookie data to predict housing stability, creditworthiness, and employment risk without ever seeing your resume or credit report directly

- ProPublica found that Facebook was allowing advertisers to target their housing ads based on specific age/race groups stored in cookies

- Some recruiting firms have used cookies to infer personality traits and political leanings. Your employment application could be rejected or deprioritized based on that

- Based on the previous examples, I think it is not a far-fetched idea that websites and services could deny you access altogether based on data revealed by a combination of things like your browser fingerprint + brokered cookie data, such as political affiliation, estimated income, race/gender, health situation, etc. Imagine for example, not being able to order pizza because you badmouthed their favorite president online.

It's also harder to change your mind later and go delete a bunch of specific cookies to opt out when you could have just said no from the beginning.
by tuetuopay | 2026-03-03 19:16:59+00:00
Conversely, an app using native toolkits (at least the Windows ones) will have better chances of running fine under Wine. I've recently had the (dis)pleasure of trying to run some .Net monstruosity with Wine, and oh my got did it not work for obscure reasons.

But overall yeah, from a compatibility perspective, nothing beats Electron. I'm not sure we'd ever get an official Discord client on Linux otherwise.
Show HN: Focused input cuts LLM output tokens by 63% bench on CC with FastAPI
by nicola_alessi | 2026-03-03 19:17:01+00:00
I built an MCP server (vexp) that pre-indexes a codebase into a dependency graph and serves only relevant code to AI coding agents. While benchmarking it, I found something I wasn't looking for.
The expected results were straightforward: less input context → lower cost, fewer tool calls → faster. But the output token reduction was the surprise.

Benchmark: 7 tasks on FastAPI (the OSS repo, ~800 Python files), 3 runs/task/arm, 42 total runs, Claude Sonnet 4.6, both arms in --strict-mcp-config isolation.
Without graph: ~23 tool calls, ~40K input tokens, 504 output tokens, $0.78/task
With graph: ~2.3 tool calls, ~8K input tokens, 189 output tokens, $0.33/task
The 58% cost reduction and 22% speed improvement were expected. The 63% output token reduction was not.
When Claude gets 40K tokens of context (most irrelevant), it generates a lot of "let me look at this file... I can see that..." narration while it orients itself. When it gets 8K tokens of pre-filtered, graph-ranked context, it skips straight to the answer. The exploration filler disappears.
This seems like a general property of these models: noisy input → verbose output, focused input → focused output. I'd be curious if others have observed this in different contexts.

The approach: tree-sitter AST parsing → dependency graph in SQLite → single MCP tool (run_pipeline) that takes a task description, walks the graph, returns ranked context. Full source for high-centrality pivot nodes, compact skeletons for supporting code.
Savings varied by task type — code understanding tasks saved the most (-64%), bug fixes the least (-30%). Makes sense: the more exploration a task normally requires, the more waste there is to cut.

Code: the graph resolution is handwritten Rust. The MCP transport, SQLite schema, and benchmark harness were built with Claude Code (felt appropriate). The benchmark analysis scripts were 100% Claude.

Free tier at https://vexp.dev — 2K nodes, 1 repo, no time limit. Runs locally (tree-sitter + SQLite, no cloud).
by zoogeny | 2026-03-03 19:17:09+00:00
I actually agree on how unlikely it is but the wildcard is Trump. I mean, he is the kind of guy who just goes with his gut and he has already publicly supported getting rid of the time change, calling it a "50-50 issue" (on which to go with, standard or savings).

The worse case is he pushes a federal change to standard time, in which case I suspect BC would have to go along.
by kkfx | 2026-03-03 19:17:15+00:00
I simply do refuse such systems, so far using decentralized or distributed socials like Nostr, Lemmy (self-hosted) and VPNs as glorified proxies and that's just because there aren't enough co-Citizens to impose a significant change with a national general strike enduring as much as needed to makes the government RUN, literally, to avoid lifetime jail...
by alfiedotwtf | 2026-03-03 19:17:18+00:00
Thanks Tim… my memory is fuzzy - that was a lot of phones ago.

… and thank you for your continued effort! I have very big love for CyanogenMod/LineageOS, and that’s coming from a heavy pre-XDA user (I’ve had them all - PalmOS, Zaraus, XDA o2, Maemo, FirefoxOS, Ubuntu phone user).
by lxgr | 2026-03-03 19:17:20+00:00
Thank you for confirming!

I've long suspected as much, but I always found the API model name <-> ChatGPT UI selector <-> actual model used correspondence very confusing, and whether I was actually switching models or just some parameters of the harness/model invocation.

> One series is the Instant series, which is faster and more tuned to ChatGPT, but less accurate.

That's putting it mildly. In my experience, the "instant/chat" model is absolute slop tier, while the "thinking" one is genuinely useful and also has a much more palatable tone (even for things not really requiring a lot of thought).

Fortunately, the latter clearly identifies itself with an absurd amout of emoji reminiscent of other early chatbots that shall not be named, so I know how to detect and avoid it.
by sarkarsh | 2026-03-03 19:17:22+00:00
This is exactly where I landed too. But after a few months of serious Claude Code usage I realized flat markdown files are the wrong abstraction for agent memory.

CLAUDE.md works fine for static instructions -- "use this formatter, prefer this style." But the moment agents need to track state across sessions -- what tasks are pending, what decisions were made, what data they collected -- youre stuffing structured data into an unstructured format. I kept finding myself with 500-line CLAUDE.md files that were half prose instructions and half JSON blobs the agent was supposed to parse.

I switched to ctlsurf for this. It gives agents structured blocks they read and write through MCP -- typed datastores, key-value state, append-only logs, checklists -- so the project owns the memory, not the agent session. The agent queries only what it needs instead of loading an entire markdown file into context.

The AGENTS.md vs CLAUDE.md debate in this thread is interesting but its optimizing the wrong layer. The real problem isnt what you name the file, its that flat text is a lossy format for the kind of state agents actually need to persist.
by etothet | 2026-03-03 19:17:29+00:00
If you are reading this and you are thinking you want to become an engineering manager, I urge you to think long term what you want that to look like. I've seen too often that developers who want to become managers because they think it's the next inventible step aren't prepared for the people management and HR part of that role.

And, as you move up to Director and beyond, those higher often have much less to do with actual engineering than tasks that sort of surround the world of engineering - lots of organizing information and attending meetings.

I've seen too many developers who though they wanted to manage become victim to the Peter Principle [1].

There is nothing wrong with staying a developer, even if you're not "moving up" to some idealized title. If you like the work and you can tolerate the place you work, you're probably ahead of most people in our field.

[1] https://en.wikipedia.org/wiki/Peter_principle
by mort96 | 2026-03-03 19:17:32+00:00
I bought a bundle with 512GB of RAM and an older 24-core EPYC (7F72) + supermicro motherboard on ebay a bit over a year ago, it was really an amazing deal and has made for a truly nice NAS. If you're okay with stuff that's old enough that you can buy decommissioned server stuff, you can get really high-quality gear at surprisingly low prices.

Companies decommission hardware on a schedule after all, not when it stops working.

EDIT: Though looking for similar deals now, I can only find ones up to 128GB RAM and they're near twice the price I paid. I got 7F72 + motherboard + 512GB DDR4 for $1488 (uh, I swear that's what I paid, $1488.03. Didn't notice the 1488 before.) The closest I can find now is 7F72 + motherboard + 128GB DDR4 for over $2500. That's awful
by cthalupa | 2026-03-03 19:17:35+00:00
If anything, it's less, because you're giving up more RAM to the GPU.

Which, I mean, I love unified memory, as one of those weirdos that does do local LLM stuff and am contemplating if it's time to upgrade my m2 max.

But if you needed 32gb then you still need at least 32gb now. Unless swap on nvme disks is enough for you - and it isn't for me.
by Terr_ | 2026-03-03 19:17:40+00:00
I'm imaging an upcoming wedding that seems to be going well, until the mother of the bride starts sending out messages like: "Everyone is expected to meet at least a 'silver' contribution level of approved items on the gift registry. This is easy for anyone who truly cares about the bride and groom."

Although in this case, an angered "momzilla" can get you fired, freeze your bank account, etc.
by sarkarsh | 2026-03-03 19:17:42+00:00
This is good advice but it highlights the real issue -- were encoding agent workflow into markdown files and hoping the model follows instructions consistently.

AGENTS.md saying "run tests after edits" works until the agent decides it knows better, or the context window gets long enough that it deprioritizes the instruction. The language you write agents in matters way less than the state layer they operate on.

Ive been using ctlsurf for this -- structured blocks agents read and write through MCP. Task checklists the agent checks off, key-value state it updates, append-only logs of what it did. The project owns that state, not the agent session. Instead of "put a rule in AGENTS.md" you have actual task state the agent queries and updates, and a human can see exactly where it is.

The whole thread is debating Go vs Rust vs Python but the language is maybe 10% of what makes an agent reliable in production. The other 90% is state management, and right now most people are doing that with flat files.
by cortesoft | 2026-03-03 19:17:50+00:00
I am familiar with the GDPR. We had to do a lot of research when it came out (as well as the California version, the CCPA, where I live), and had to make some changes to how we dealt with data.

> There was a time where the Internet was the wild west and you could've easily been personally targeted and exploited. Businesses sold your data to whoever.

Yes, I remember when the internet was a much more dangerous place, in all sorts of ways. Browsers were not as secure, network security was not very robust. Most things were plain text. Hell, my friends and I used to run ettercap in our college dorm, because the entire dorm LAN was unprotected from ARP spoofing. Everything was sent in plain text, we would capture email passwords, AIM passwords, etc. We would play pranks on each other where we would spoof AIM messages to different people pretending we were someone else on the dorm floor.

I think some of the regulations have helped the internet be safer, but the tech is really what has changed.
Show HN: Dbcli – A Lightweight Database CLI Designed for AI Agents
by justvugg | 2026-03-03 19:17:53+00:00
I built dbcli, a lightweight database CLI designed specifically for AI agents that need fast, low-overhead access to relational databases.

The main idea is to make database introspection and querying simple and efficient when an agent has shell access. With a single command (dbcli snap), you can retrieve schema details, table relationships, and basic data profiling (column stats, ranges, cardinality) without stitching together multiple queries or tools. This helps reduce token usage and unnecessary round-trips in agent workflows.

Dbcli supports multiple databases, including PostgreSQL, MySQL, MariaDB, SQLite, DuckDB, ClickHouse, SQL Server, and others via optional drivers. It allows running queries, executing SQL files, and writing data directly from the CLI. There’s no server process or external service required — just install locally with:

pip install -e .

The goal is to provide a simple, agent-agnostic alternative to heavier protocol-based approaches, working with any system capable of executing shell commands.

I’d really appreciate feedback, especially from those building AI agents or tools that require structured database access.

Github repo: https://github.com/JustVugg/dbcli
by rafark | 2026-03-03 19:17:53+00:00
> Are they doubling down on local LLMs then?

I love the push to local llms. But it’s hilarious how apple a few years ago was so reluctant to even mention “AI” in its keynotes and fast forward a couple years they’ve fully embraced it. I mean I like that they embraced it rather than be “different” (stubborn) and stay behind the tech industry. It’s the smart choice. I just think it’s funny.
by sarkarsh | 2026-03-03 19:18:01+00:00
Hard agree that server-side MCP is the more interesting direction. Browser automation through MCP is a nice demo but its solving a problem most teams dont actually have.

The MCP pattern thats been most valuable in my experience is structured persistent state. I use ctlsurf for this -- agents read and write typed blocks through MCP. Datastores with queryable rows, key-value state, append-only logs. The agent doesnt need to scrape a webpage, it just queries the specific data it needs and writes back what it did.

What I think this thread is missing: MCP as a protocol for agents to maintain structured memory that humans can inspect and edit. Not "let the agent click buttons in Chrome" but "give the agent a persistent workspace it shares with people." Thats where MCP stops being a novelty and starts being infrastructure.
by ismailmaj | 2026-03-03 19:18:03+00:00
I bought the M4 air given that the consensus was also that it was the best value for 1k, but I ended up returning it and went for pro base model for a few reasons (still valid for M5 AFAIK from a bit of research):

- pro motion (120hz screen).

- better display brightness which is important when there is a bright sun outside.

- 1 more USB-C port and HDMI port (no dongle hell).

- 20% more battery life.

- This is more personal, but 13" is too small and 15" is too big, so 14" MBP worked best for me (~25 HFOV with a stand + KBM).

It's hard to justify saving 400 bucks given the gap between the models, but the decision is closer since the air has 16GB memory by default since M4 AFAIK.
by tstrimple | 2026-03-03 19:18:06+00:00
Nope. The right explicitly supports the policies that lead to the direct concentration of wealth and power and rise of fascism. If the right constantly sides with the oppressors, they are the oppressors. This should be trivial to see just by looking at voting records. It's all very public and you've got decades of history worth of it to review. Both sides are not the same. The right chooses to align with the top 0.01% making them firmly part of the problem.
by cpfohl | 2026-03-03 19:18:10+00:00
I swear this is my fault. I can go weeks without doing infra work. Github does fine, I don't see any hiccups, status page is all green.

But the day comes that I need to tweak a deploy flow, or update our testing infra and about halfway through the task I take the whole thing down. It's gotten to the point where when there's an outage I'm the first person people ask what I'm doing...and it's pretty dang consistent....