MurphyA/hacker-news huggingface dataset:
by kelseyfrog | 2026-03-03 18:21:45+00:00
I'm not against celebrating the Declaration of Independence. Especially this part:

He has obstructed the Administration of Justice, by refusing his Assent to Laws for establishing Judiciary powers.

He has made Judges dependent on his Will alone, for the tenure of their offices, and the amount and payment of their salaries.

He has erected a multitude of New Offices, and sent hither swarms of Officers to harrass our people, and eat out their substance.

He has kept among us, in times of peace, Standing Armies without the Consent of our legislatures.

He has affected to render the Military independent of and superior to the Civil power.

He has combined with others to subject us to a jurisdiction foreign to our constitution, and unacknowledged by our laws; giving his Assent to their Acts of pretended Legislation.

For Quartering large bodies of armed troops among us.

For protecting them, by a mock Trial, from punishment for any Murders which they should commit on the Inhabitants of these States.

For cutting off our Trade with all parts of the world.

For imposing Taxes on us without our Consent.

For depriving us in many cases, of the benefits of Trial by Jury.

For transporting us beyond Seas to be tried for pretended offences.
by holtkam2 | 2026-03-03 18:21:51+00:00
At the end of the day you need humans who understand the business critical (or safety critical) systems that underpin the enterprise.

Someone needs to be held accountable when things go wrong. Someone needs to be able to explain to the CEO why this or that is impossible.

If you want to have AI generate all the code for your business critical software, fine, but you better make sure you understand it well. Sometimes the fastest path to deep understanding is just coding things out yourself - so be it.

This is why the truly critical software doesn’t get developed much faster when AI tools are introduced. The bottleneck isn’t how fast the code can be created, it’s how fast humans can construct their understanding before they put their careers on the line by deploying it.

Ofc… this doesn’t apply to prototypes, hackathons, POCs, etc. for those “low stakes” projects, vibe code away, if you wish.
by ajross | 2026-03-03 18:21:58+00:00
> Depends. Are you doing dev on Microsoft's stack, or are you doing dev on all of the other stacks?

You can run docker in WSL better than you can on a Mac. You can run Linux natively on that box, too. "Stacks" is sort of ambiguous (my world is embedded junk, and the answer for using a mac with these oddball USB flashers and whatnot is pretty much "Just No, LOL"), but to claim that the mac is more broadly capable in these spaces when it is clearly less is.... odd.

Macs are popular among the SV set, so macs are strong in whatever the SV set thinks is important (thus "I bought a Mac Mini for OpenClaw!"). And everything else runs on $350 windows garbage.
by odedbendov | 2026-03-03 18:22:07+00:00
Creator of AI Game Master - talk to me

(iOS - https://apps.apple.com/us/app/ai-game-master-dungeon-rpg/id6...)
(Android - https://play.google.com/store/apps/details?id=com.aisuccess....)

This is roughly my 5th startup, going through Computer Vision -> Special Needs -> Cannatech -> Hacking RNA -> AI -> Gaming with AI

AMA :)
by Tuna-Fish | 2026-03-03 18:22:15+00:00
The demo has brilliant pacing. When it starts with the sprites moving in a big circle, initially I'm not impressed at all, because C64 has 8 sprites per line, and changing the sprites to be drawn when the screen is halfway drawn is pretty much the first trick you learn. Then the sprites move to the top of the screen, where they are all on the same line together, and my jaw drops.
by Bender | 2026-03-03 18:22:27+00:00
I'm reluctant to verify my identity or age for any online services

I do not hesitate to drop a domain that acts suspicious into uBlock Origin -> My Filters:

||somedomain.tld$

Never gets another packet from me. I use local Brick & Mortar businesses for as many things as I can. The businesses on the internet have jumped the shark.
by Horos | 2026-03-03 18:22:51+00:00
Interesting gap between surface scanning (6.6%) and AI deep audit (16.4%).

Two concerns with the AI audit approach. First, the defense LLM is itself an attack surface — we're already seeing payloads crafted specifically to bypass LLM-based guardrails. If the guardian is injectable, you've added a vulnerability to your security stack.

Second, the Mindgard paper from late 2025 tested 12 character injection techniques against 6 guardrails including ProtectAI's DeBERTa, Meta Prompt Guard, Azure Prompt Shield — some hit 100% evasion rate. Homoglyphs, zero-width chars, leet, diacritics. Simple stuff, but the classifiers see raw tokens and can't handle it.

I built a prompt injection detection library that tackles this from the normalisation layer — 10-stage deterministic pipeline (NFKD, confusable fold, leet, base64, zero-width strip, ROT13, escape sequences) that reduces all evasion to canonical form before any matching. The scan itself is not injectable — it's code, not a model.

Where I think this goes next: small encoder-only classifiers (DeBERTa-small, ModernBERT) running on already-normalised text. Post-normalisation, the model only needs to detect the logical intent pattern, not handle evasion — that's the layer below. Too small to be reprogrammed via prompt, too focused to be redirected. One classifier per attack category: override, extraction, jailbreak, etc.

But these classifiers will only be as good as their training data. Right now everyone trains on static datasets (deepset, safeguard). What's missing is a community-maintained corpus fed by real-world incident reports — like antivirus signature databases.
The detection engine matters less than the definitions it runs on. ClamAV isn't great because of its scan loop, it's great because thousands of people report samples.

Your foundry example — no payload until the agent writes it — is the genuinely hard case that needs AI. But for everything else, deterministic normalisation + focused micro-classifiers + community-curated signatures is a more defensible architecture than putting another LLM in the path.

https://github.com/hazyhaar/pkg/tree/main/injection
by jmyeet | 2026-03-03 18:23:12+00:00
What I find interesting is how over a long period Apple had to basically reverse everything Johnny Ive was probably responsible for before he left and how we got back to where we were 10-15 years ago in many ways.

Remember how cool MagSafe was? Tripping over a cable no longer meant smashing your laptop. In the late 2000s, this was amazing. Then they made the laptops thinner so we got MagSafe 2. Annoying if you had chargers but whatever. And then... gone.

Macbook Air? The 2008 version I don't count. It's a weird and bad product. But the 2010/2011 products were rock solid and nobody could compete with Apple's value proposition for the hardware. Nobody. And they continued to be amazing but suffered from a screen that didn't get an upgrade from 2011 (IIRC). Where was the retina display? It was such an obvious upgrade.

But then Apple killed it for the 12" Macbook, which was a horrible product. Too many compromises. A single port. Ugh. That was Johnny Ive's baby.

Oh and let's not forget the whole butterly keyboard debacle, all for an estimated 0.5mm decrease in thickness. It failed because it got dust in it. It was expensive to replace. It was just a terrible design decision.

Oh and the Touch Bar? Please.

It was clear that Apple just wanted to increase the ASP of hheir laptops. So getting a good laptop for $1000 was no longer on the cards. Instead we were forced into the 13" Macbook Pro at the better part of $2000.

And here we are in 2026. MagSafe is back (has been for a few years obviously). The butterfly keyboard got ditched (again, some years ago). And they of course killed in the 12" Macbook and brought back to Macbook Air (again, some years ago).

But my point is that in many ways the 2026 Macbook air looks a lot like the 2010-2015 Macbook Air. Updated specs of course but it sits in that same segment of being "good enough" for most people and being excellent value.

One simply cannot overstate the importance of being able to walk into an Apple Store and just buying one. For me, this alone kills buying almost anything else. Even getting a charger for non-Apple laptops could be nontrivial. It's less of an issue now with USB-C charging but a lot of higher end Windows laptops can't draw enough power so still have their own chargers.

I like 16GB/512GB as the new baseline. Given what AI has done to RAM and SSD pricing, a slight price bump to $1099 seems perfectly acceptable to me.
by pavon | 2026-03-03 18:23:43+00:00
It isn't just Dr Pizza. In recent history (perhaps since being bought by Conde Nast?), when staff left, stories from them simply stopped appearing, and questions about whether they had left or were on a break were met with crickets. The only conformation came when the bio was changed and/or they announced they were hiring or had hired the person replacing them.

At least that is what I remember with Sam Machkovech, Ron Amadeo, Cyrus Farivar, Joe Mullin, Andrew Cunningham, Casey Johnston, Jaqui Cheng. And the policy doesn't appear to be limited to people leaving on bad terms since Andrew has since returned, and Cyrus occasionally contributes freelance articles. The last time I remember them announcing a departing staff member is when Ben Kuchera left.
by tw85 | 2026-03-03 18:23:48+00:00
I wonder if it has something to do with an incident years ago in which one of Ars' senior reporters (Peter Bright) was arrested and convicted for child enticement. Ars eventually allowed one of their readers to write a forum article about it, but they didn't write one themselves at the time. Some people defended this course of non-action by saying it was the sensible thing to do because his colleagues could become witnesses in the trial.
by Samueedwards1 | 2026-03-03 18:24:05+00:00
Great question—we treat generated code as production code too.

Secrets/Env:
- `${{ secrets.YOUR_SECRET }}` GitHub Actions syntax throughout
- `.env.example` + docker-compose.yml with all expected vars
- No hardcoded values; all externalized

Proving it works:
- Built-in fixture tests (`npm test`) for every integration point
- `npm run apcher:full-scan` catches CVEs + dep issues pre-ZIP
- Watchdog generates synthetic drift tests that run on startup
- Idempotency baked in (safe to retry 1K times)

Example ZIP includes Stripe test mode keys + Postgres docker fixture.
by theozero | 2026-03-03 18:24:10+00:00
While the 1Password model is not perfect, you can organize your vaults however you want. You can do prod/staging/dev, or by projects, or however you want. Or you can use the environments feature and create a separate environment for each.

Service accounts and users can be granted access to specific vaults only.

The huge benefit is that if you are already using it for other stuff, there is no additional "secret zero" to set up - plus you get biometric unlock for your secrets.

Easiest way to use it for dev purposes is varlock (although I'm biased since I created it).

https://github.com/dmno-dev/varlock
by ndr42 | 2026-03-03 18:24:28+00:00
Just in case someone has some time I recommend this scientific article:

Assessing the best hour to start the day: an appraisal of seasonal daylight saving time

https://www.proquest.com/docview/3187599695/fulltext?sourcet...

The article is easily accessible and addresses (in the concluding remarks) the various aspects in a nuanced way.
by zamadatix | 2026-03-03 18:24:36+00:00
Whenever they say "available today" I take it as "hopefully I'll start seeing it in the app UI by tomorrow" rather than "I should get my hopes up it's there now".

When they do push the update to the app UI to me I expect 5.2 Instant will be moved under the legacy models submenu where 5.1 Instant is currently and the selection of Instant in the menu will end up showing as 5.3 Instant on close (and it'll be the default instant at that point).
by ryanwhitney | 2026-03-03 18:24:48+00:00
While I have no idea of the actual outcome, I’ll muddle through the extra step + thinking to opt-out where possible.

My own personal bend is that I do not want to be sold anything and I want anonymity where possible. We’re constantly being advertised to. Anything small action that I can take to deter that, or make the ads less personalized/interesting/distracting to me, is worth it. Even if I also will never knowingly click an ad.

It’s probably largely a control thing psychologically. With cookie banners specifically, I also don’t want to concede to dark patterns which make accepting easier than rejecting.
by renewiltord | 2026-03-03 18:24:57+00:00
What models are you using? I’ve found that SOTA Claudes outperform even gpt-5.2 so hard on this that it’s cheaper to just use Sonnet because num output tokens to solve problem is so much lower that TCO is lower. I’m in SF where home power is 54¢/kWh.

Sonnet is so fast too. GPT-5.2 needs reasoning tuned up to get tool calling reliable and Qwen3 Coder Next wasn’t close. I haven’t tried Qwen3.5-A3B. Hearing rave reviews though.

If you’re using successfully some model knowing that alone is very helpful to me.
by yyyk | 2026-03-03 18:25:25+00:00
First, JCPOA restrictions would have started to end this year, the 2031 situation was just extra bad.

Second, had NPT been enough, why was JCPOA necessary? Because NPT was not near enough to stop a determined state. NPT 'limits' do not limit enrichment. They just state enrichment must be done for civilian purposes and leave no enforcement mechanism. JCPOA also had no real enforcement mechanism starting in 2026. Iran could have simply taken all the money, buy weapons (legally), reach the legal max (which is basically infinity in 2031, a bit less earlier), and pressed forwards immediately. There was simply no way to enforce (some people think _this_ operation is too risky! Now lets give Iran over a trillion dollars and years to prepare).

Third, you're just wrong about current negotiations. Iran explicitly demanded 20%[0], beyond the JCPOA and with no civilian use.

Look, JCPOA debates always end in the same way. The advocates are asked how the original deal was enforceable in any way past 2031 (or even 2026) and they have to deploy word salad because the actual answer is 'Iran could have easily built a nuke, inspectors just allow us to see it but they would have been no way to do something about it'. It would be more honest if many of them just admitted they wanted to allow Iranian nukes.

[0] https://xcancel.com/laurnorman/status/2028050672583618946
by nycfishbowl | 2026-03-03 18:25:53+00:00
Bloomberg | Senior Software Engineer | Hybrid (NYC) | Full-time | $160k - $240k USD + bonus

Every day, Bloomberg’s clients rely on secure and seamless access to our products. Our team makes that possible by building infrastructure that verifies identities for both clients and employees. We design systems that are fast, resilient, and highly available, capable of handling large volumes of authentication traffic around the clock.

We are embarking on an initiative to modernize and unify Bloomberg’s authentication landscape. Your work will directly affect the experience of Bloomberg’s employees and clients worldwide.

You'll need to have

- Experience guiding the architecture of large scale authentication systems.

- Experience developing or operating Open ID Providers, Authorization Servers, and Identity Providers

- Deep understanding of OAuth, OIDC, SAML, FIDO or similar protocols

You can expect to

- Lead design and development of Bloomberg’s next-generation authentication and MFA systems, aligning with future product goals

- Create scalable, end-to-end identity solutions across web, API, and proprietary technologies

- Collaborate with cross-functional partners across product, design, and engineering

Apply: https://bloomberg.avature.net/careers/Public?jobId=17745

Note, I'm an engineer on the team and would be happy to answer any questions.
by lgl | 2026-03-03 18:26:07+00:00
I'm in the process of building v2.0 of my app using opus 4.6 and largely agree with this.

It's pretty awesome but still does a lot of basic idiotic stuff. I was implementing a feature that required a global keyboard shortcut and asked opus to define it, taking into account not to clash with common shortcuts. He built a field where only one modifier key was required. After mentioning that this was not safe since users could just define CTRL+C for the shortcut and we need more safeguards and require at least two modifier keys I got the usual "you're absolutely right" and proceeded to require two modifier keys. But then it also created a huge list of common shortcuts into a blacklist like copy, cut, paste, print, select all, etc.. basically a bunch of single modifier key shortcuts. Once I mentioned that since we're already forcing two modifier keys that's useless it said I'm right again and fixed it.

The counter point of this idiocy is that it's very good overall at a lot of what is (in my mind) much more complicated stuff. It's a .NET app and stuff like creating models, viewmodels, usercontrols, setting up the entire hosting DI with pretty much all best practices for .net it does it pretty awesomely.

tl;dr is that training wheels are still mandatory imho
by pinkmuffinere | 2026-03-03 18:26:17+00:00
This submission claims to be about this announcement [1]. It is not about the full context of American politics right now. In fact generic politics is off-topic for HN [2]. I am responding to the main text of the announcement, not to general American politics.

[1] https://docs.fcc.gov/public/attachments/DOC-418890A1.pdf

[2] https://news.ycombinator.com/newsguidelines.html
Show HN: OpenMandate – Declare what you need, get matched
by raj-shekhar | 2026-03-03 18:26:23+00:00
Hi HN, I'm Raj.

We all spend a bulk of our time looking for the right job, cofounders, hires. Post on boards, search, connect, ask around. Hit ratio is very low. There's this whole unsaid rule that you have to build your network for this kind of thing. Meanwhile the person you need is out there doing the exact same thing on their side. Both of you hunting, neither finding.

What if you just declare what you need and someone does the finding for you?

That's what I built - OpenMandate. You declare what you need and what you offer - a senior engineer looking for a cofounder in climate tech, a startup that needs a backend engineer who knows distributed systems. Each mandate gets its own agent. It talks to every other agent in the pool on your behalf until it finds the match. You don't browse anything. You declare and wait.

Everything is private by default. Nobody sees who else is in the pool. Nothing is revealed unless both sides accept. No match? Nobody ever knows you were looking. No more creating profiles, engaging for the sake of engagement, building networks when you don't want to.

What's live:

- openmandate.ai

- pip install openmandate / npm install openmandate

- MCP server for Claude Code / Cursor / any MCP client

- github.com/openmandate
by havaloc | 2026-03-03 18:26:24+00:00
I don't get it either. I've rolled out well over a hundred of these in a higher education setting and I have never had one have a hardware issue or needed to retire it other than wanton damage. I still have a ton of M1s in circulation and they are great still. I had to just replace a Dell with only 2.5 years of service, they tend to fall apart.
by 0PingWithJesus | 2026-03-03 18:26:38+00:00
That was Super-K, the same detector she's talking about in the video. The incident occurred in 2001 and set back the start of the data taking for them quite a bit, they were able to begin data taking by re-distributing the unaffected photo-detectors to cover the gap where the imploded detectors were. Eventually (2005/2006) they replaced all the destroyed photo-detectors and took data from then on out with a full-suite of sensors. Following this incident all Japanese experiments with these types of photo-detectors take the risk of implosion seriously and have mitigation built in to the design. Super-K has been running continously since then with some interruptions for upgrades & maintenance, and is still taking data today (as far as I'm aware).

Construction is underway on the next version of the experiment "Hyper-Kamiokdande" which is similar in design but significantly bigger. If I recall correctly Hyper-K will be two 200 kilo-tonne detectors, compared to Super-K which is a measly 50 kilo-tonne detector.
by Swizec | 2026-03-03 18:26:41+00:00
> When hiring, titles are basically ignored

As a hiring manager, this is completely accurate. I don't look at your title, I look at your scope. Tell me what you did, for whom, and what was the impact. That's all I care about.

We all know that Senior Principal Architect Engineer at 3-person startup is somewhere around junior to mid-level at a real company. Whereas some poor schmuck at a larger company with a title like "Senior Engineer I" probably owns and runs more impressive systems and works with more stakeholders than that 3-person startup will see in a year.
by k9294 | 2026-03-03 18:27:08+00:00
It's actually a nice idea - an always-on micro AI agent with voice-to-text capabilities that listens and acts on your behalf.

Actually, I'm experimenting with this kind of stuff and trying to find a nice UX to make Ottex a voice command center - to trigger AI agents like Claude, open code to work on something, execute simple commands, etc.
by btown | 2026-03-03 18:27:09+00:00
This is also just the direction that AI is taking us, even for people who wouldn't describe themselves as traditional developers.

Setting aside on-device LLMs, one needs RAM and disk space just for the multiple isolated Claude Cowork etc. VMs that will increasingly become part of people's everyday lives.

And when it's easier than ever to create an Electron app, everything's going to have an Electron app, with all the RAM/disk overhead that entails. And of course, nobody's asking their agents "optimize the resource usage of the app I made last week" - they're moving on to the next feature or project.

I suppose the demoscene will always be there, for those of us who increasingly need a refuge from ram-flation.
by nerevarthelame | 2026-03-03 18:27:09+00:00
The results seem plausible, but it's worth noting that the source of their data (Ahrefs) is just a rough estimate. Given that every publication they examined - including several outside of the tech industry - showed declines, I'd hope they would confirm that it's not an artifact of the estimation process. Ahrefs themselves caution against using their data to make these sorts of conclusions:

>While these estimates don’t, and can’t, show you exactly how much organic traffic a website gets, they work incredibly well for comparison. For example, it’s fantastic for learning if your competitors’ websites get more or less organic search traffic than your own.

(https://help.ahrefs.com/en/articles/1863206-what-is-organic-...)
by ImPostingOnHN | 2026-03-03 18:27:45+00:00
So you AREN'T aware that this government, and indeed this government rep which we're discussing, has threatened to revoke broadcasting licenses from companies for airing content the government disagrees with? Or worse? On multiple occasions?

The omission of that critical context might be why none of my post made sense to you: you would be unable to realize that the 'invitation to participate' we're discussing involves a degree of coercion, based on those threats. If you threaten somebody to give you their money 3 times, and then a 4th time you 'invite them to participate in giving you their money', that is 4 threats total, not 3.

Of course, anything in the world can be justified if you omit enough context, even government-compelled speech and government censorship. Just omit the context of the 3 times you threatened your mugging victim to comply, and all you have left is a polite invitation to share money. Totally okay, right?