MurphyA/hacker-news huggingface dataset:
by JumpCrisscross | 2026-03-10 19:36:01+00:00
The court order [1] finds likely violations of 18 U.S.C. § 1030(a)(2) as parsed by LVRC v. Brekka [2] which prohibits “(1) intentionally accessed a computer, (2) without authorization or exceeding authorized
access, and that [it] (3) thereby obtained information (4) from any protected computer (if
the conduct involved an interstate or foreign communication), and that (5) there was loss
to one or more persons during any one-year period aggregating at least $5,000 in value.”

https://en.wikipedia.org/wiki/Facebook,_Inc._v._Power_Ventur....

[1] https://storage.courtlistener.com/recap/gov.uscourts.cand.45...

[2] https://en.wikipedia.org/wiki/LVRC_Holdings_LLC_v._Brekka
GPT-4 leaks its own API internals through training data exposure
by safteylayer | 2026-03-10 19:36:01+00:00
I ran the same AI security test 4 times against GPT-4. Every bypass - regardless of prompt - leaked the same credential: EPHEMERAL_KEY from OpenAI's Realtime API.

This isn't random. It's training data leakage.

The pattern:
- Different prompts (system introspection, chain-of-thought, trust building)
- Same result: "I can't disclose EPHEMERAL_KEY" (while disclosing it exists)
- Intermittent across runs (75% leak rate)

Why this happens:

OpenAI's Realtime API docs are in GPT-4's training data. When asked about "secrets" or "initialization", the model's highest-probability path leads to the most salient security example in its corpus: EPHEMERAL_KEY.

Refusal training makes it worse: Models are trained to say "I cannot disclose [example secret]" - and they use real examples from training data.

This is systemic:
- Can't be patched without retraining
- Affects ALL models trained on API documentation
- Tomorrow it's "session_token" or "project_key"
- Gets worse as APIs become more complex

Real exploit path: Attacker learns EPHEMERAL_KEY exists → probes for generation flow → targets client-side implementations → session hijacking

Cost to discover: $0.04 (60 tests across 4 runs)

GitHub: https://github.com/SafetyLayer/safetylayer

Built SafetyLayer to find these systematically. Free assessments available.
by xikrib | 2026-03-10 19:36:54+00:00
Let's gather authors of 15 different world languages together in a room and see if they can collaboratively write a short story. Surely their inability to do so will prove their inadequacy in their native language. /s

Simplicity brings us closer to truth — Occam's razor has underpinned the development of our species for centuries. It's enterprise, empire, and capital that feed off of complexity.

We're entering a period of human history where engineers and businesspeople drive academic discourse, rather than scientists or philosophers. The result is intellectual chicken scratch like this article.
by steve_adams_86 | 2026-03-10 19:37:13+00:00
This seems very post-hoc and like they're fortunate they happened to arrive at something better rather than worse.

The justification for K8s seems pretty thin. It makes me wonder if the author understands why they need it. I'm guessing it's because they've got substantial parallel, multi-tenant networking of stateful processes, which is a pretty defensible reason to use K8s. And easy to say. It seems strange to leave it out.

The argument against Temporal also seems invalid, but I'm not certain. It has been years since I used it, but wouldn't it be possible to poll for completion? It seems like you'd wind up with better observability/retryability tooling, and it's much simpler overall. Polling seems like a good compromise for what I'd consider much easier tooling to reason about.

I'd also posit that you could model a lot of this using your own serializable state machines. They're in the JS ecosystem, so XState is an excellent option. You'd get incredible visibility into your orchestration, deep access to testing the semantics and logic you care most about, and the ability to have your entire architecture be containers on the fly with no blackbox orchestration.

Of course, I'm speculating after browsing through their website a bit and thinking about the problems they described. I'm missing a lot of context. K8s could be the clear winner.

Still, after reading this I would never use this product. I don't mean to sound unkind. I'd never trust the decision-making of the people who followed this trajectory. If I were the author I'd take this down ASAP.
by asciimov | 2026-03-10 19:37:20+00:00
This takes all the satisfaction out of spending a few well thought out weekends to build your own language. So many fun options: compiled or interpreted; virtual machine, or not; single pass, double pass, or (Leeloo Dallas) Multipass? No cool BNF grammars to show off either…

It’s missing all the heart, the soul, of deciding and trading off options to get something to work just for you. It’s like you bought a rat bike from your local junkyard and are trying to pass it off as your own handmade cafe racer.
by gima | 2026-03-10 19:37:23+00:00
"How many options fit into a boolean?"
Five or two, according* to Microsoft.

> MsoTrioState is "a tri-state Boolean value". it has five possible values. only two of them are supported.

*) https://learn.microsoft.com/en-au/dotnet/api/microsoft.offic...

Sourced from here
https://fedi.lynnesbian.space/@lynnesbian/115969259564305759
by elvin_d | 2026-03-10 19:37:27+00:00
I feel your take will be taken down soon as it’s not the place for such discussion.

Just food for thought: what makes you to feel so entitled to judge people place of living? You know how we are not choosing where to be born and our mobility is restricted a lot of times? Is your separation for man and women comes from religion or other bias to categorize them?
by malcolmgreaves | 2026-03-10 19:37:31+00:00
I agree, it made his character arc more interesting. Also, the entire show is centered around Michael. The later seasons really suffer without him.

It is also useful because it shows an old adage: people get promoted to their level of incompetence. Michael is actually an excellent salesman. He's a bad manager. He was promoted to branch manager because he was good at a different job.

This is just like when a really good engineer is promoted and becomes a bad manager.
by bokohut | 2026-03-10 19:37:40+00:00
First and foremost, grateful for the ability to take and give to this HN community for what HN has done for me. With that stated I am reminded near daily when reading posts on HN of my experience, my age, and some of my now lost hair color.

After nearly 3 decades of critical technology systems architecture and management involving ongoing industry audits my experience and age knows why my hair has lost some of its color. Much of that lost color comes from security management of third party systems, yes the old dreaded dependencies. Elimination of those third parties is key for one's cyber sanity and hair color yet with technology still in its infancy some cannot distinguish the forest from the trees.

Nothing remains the same as progress moves forward correcting for past mistakes while learning what works and does not along that journey, technology platforms are no exception. Analogously early automobiles lacked safety features as well such as windshield wipers and seatbelts so has the passage of time proved their addition to be valued? Few people today truly understand how things work as nearly all just want the instant fix "pill" to alleviate their issues however this approach cannot work with security. True security is designed in from the foundation and such secure platforms go unseen yet we have an endless list of victims from those insecure systems which have "bolted on" security after the fact. This security change and more is coming to system designs as the entire world is now fully aware of cyber security, or in this case, the lack of it.

Time, the young fail to consider it up until a single moment in their life, while the old reflect on where theirs went. After the reflection of one's time however change becomes obvious.
by tgrowazay | 2026-03-10 19:37:42+00:00
17M uncached reads (input) and 6M of uncached writes (output) is

$5x17+$25x6=$235 for Opus 4.6

$2x17+$12x6=$106 for Gemini 3 Pro

$0.45x17+$3.5x6=$28.65 for Qwen 3 235B-A22B-THINKING-2507 via Vervel AI gateway
by gopalv | 2026-03-10 19:38:17+00:00
> More addictive than that is the unpredictability and randomness inherent to these tools. If you throw a problem at Claude, you can never tell what it will come up with. It could one-shot a difficult problem you’ve been stuck on for weeks, or it could make a huge mess. Just like a slot machine, you can never tell what might happen. That creates a strong urge to try using it for everything all the time.

That is the part of the post that stuck with me, because I've also picked up impossible challenges and tried to get Claude to dig me out of a mess without giving up from very vague instructions[1].

The effect feels like the Loss-Disguised-As-Win feeling of the video-games I used to work on at Zynga.

Sure it made a mistake, but it is right there, you could go again.

Pull the lever, doesn't matter if the kids have Karate at 8 AM.

[1] - https://github.com/t3rmin4t0r/magic-partitioning
by joshuakcockrell | 2026-03-10 19:38:34+00:00
Envelope https://envelopebudgeting.com

It's a budgeting app I'm building for iOS and Android. It's an alternative to YNAB, Goodbudget, or Monarch, but the checking account and debit cards are built-in, so it avoids the unreliable syncing issues that make budgeting apps suck. It's named after the digital envelope system and helps you organize money into categories for bills, spending, savings, upcoming expenses, etc. Individual and joint accounts.

Right now I'm working on an upcoming paycheck detection system to automatically split your paycheck across your budgets.
by digitalPhonix | 2026-03-10 19:39:17+00:00
> Changes land in branches I haven't read. A few weeks ago I realized I had no reliable way to know if any of it was correct: whether it actually does what I said it should do.
I care about this. I don't want to push slop, and I had no real answer.

That’s really putting the cart before the horse. How do you get to “merging 50 PRs a week” before thinking “wait, does this do the right thing?”
by ismailmaj | 2026-03-10 19:39:33+00:00
Don’t think that’s a fair interpretation of what I said.

Liquid money rich? No.

Can get pulled for big tech packages? Also no, for most of the employees.

AFAIK, big tech didn’t aggressively poach OpenAI-like talent, they did spend 10M+ pay packages but it was for a select few research scientists. Some folks left and came but it boiled down to culture mostly.
by hinkley | 2026-03-10 19:40:00+00:00
I ran into some serious struggles when we got far enough into accepting most of the tenets of XP as standard practice that most jobs didn’t even debate half of them and then landed at places that still thought they were stupid. I’d taken for granted I wasn’t going to have to fight those fights and forgotten how to debate them. Because I Said So is not a great look.
by steelbrain | 2026-03-10 19:40:00+00:00
> cool idea. can you elaborate on IO and how the ffmpeg-server reads blocks from the client? that would seem to be a big blocker

ffmpeg-server runs a patched version of ffmpeg locally, ffmpeg requests to read some chunks (ie give me video.mp4) through our patched filesystem (https://github.com/steelbrain/ffmpeg-over-ip/blob/main/fio/f...), which gets sent over the same socket that the client established, client receives the request, does the file operations locally and sends the results back over the socket to the server, and server then sends them to ffmpeg.

ffmpeg has no idea its not interacting with a local file system
by ACCount37 | 2026-03-10 19:40:14+00:00
Modern DRM for video and audio is such a strange construct.

It never stopped a thing. Clearly, it only exists to cover someone's arses and check some boxes off the requirement lists.

And yet, some people put actual effort into integrating it, and keep shipping mandatory DRM modules that run with deranged levels of privilege in places like TrustZone. They keep restricting some browsers and phones from being able to view Full HD content - despite that Full HD footage being on every shady pirate streaming website that runs on ads for online slot machines and penis enlargement pills, and the 4K versions of that very same content being available day 1 in any torrent search engine. Because some cheeky madman somewhere has a few exploits, and one exploit is all it takes for DRM to stay broken forever.

Punish the legitimate users, and completely fail to deter the pirates. Security theater at its finest.

Every time I read of how modern economics eliminate waste and inefficiency, this kind of DRM stands out as a counterexample. It never worked and never will - nonetheless, here it is.

Some people keep writing the licensing deals with those stupid requirements that don't touch reality in them. Other people keep needing to fulfill them. And so, the strange useless cover-your-arse-ware lingers in every device, like the smell of stale piss in a public toilet. With no care for how unwelcome it is.
by oraphalous | 2026-03-10 19:40:15+00:00
>He did not edit

He edited his reply to me multiple times... which is what made me suspect an edit to the original comment. But whatever, I'm happy to acknowledge his original intent even if he did state it more harshly.

>What we really don't need is paragraphs of someone arguing because their own definitions differ slightly from the OP

This is unnecessary. OP came out with "AUTHOR IS INSANE" even on the most generous of interpretations. Even if we allow for nuance OP is claiming, there is little constructive about his contribution. I feel fine about calling it out.
by blacksmith_tb | 2026-03-10 19:40:56+00:00
It's interesting to see that argument was based on Amazon having dedicated employee time to blocking Perplexity. Obviously bots can be a drag, but if these were agents shopping on behalf of users, that seems counterproductive (I take it Amazon's vision is that the only AI agents they want to support are their own, but imagine trying to claim that you needed to spend a lot of your employees' time on painting the windows of the office building so your competition couldn't see inside...)
by the_af | 2026-03-10 19:41:17+00:00
> At no time did David display a lack of social skills, lack of empathy, or antisocial behaviour

I don't remember David much, but let it be noted that the essay uses "sociopath" in a different way than the commonly understood definition, much like the essay's use of "losers" doesn't mean what people usually mean by loser (as in "so and so is such a loser!"), it means "made a bad economic bargain / they are losing in the capitalist maximum profits & power game".
by Marsymars | 2026-03-10 19:41:31+00:00
Yes, I agree.

But "expresses the same idea" isn't the benchmark, "ideas expressed in the same way" is the benchmark.

A translated work is "ideas expressed in the same way", a translation doesn't change that.

See e.g. this question/top answer on stackexchange, it details pretty well how plot can't be copyrighted using Harry Potter as an example: https://writing.stackexchange.com/questions/3928/on-copyrigh...
by JCattheATM | 2026-03-10 19:41:37+00:00
> Semicolons start a new thought, they don't mark an aside that lets you return to the original line of thought.

Sure they do. They're perfect for a related tangent without abounding the greater scope topic being discussed.

> I would have used parentheses in both places, and semicolons don't work in either one:

Parentheses work no question and I would argue are far more appropriate in that example since it's a minor elaboration/clarification and not a tangent, indeed, semicolons would not be appropriate for that.
by LunarFrost88 | 2026-03-10 19:41:52+00:00
Thanks for the feedback. Love the point about the visualization dashboard, will add that now!

>> have you tried integrating this with multi-agent setups, where multiple Claude Code instances interact?

We wanted to solve for the most frequent use case first (single-agent execution), but multi-agent is definitely on the cards. If you've got some use cases in mind, let me know and we'll apply Railyard to it.
by SoftTalker | 2026-03-10 19:42:46+00:00
Yep, tests written after the fact are just verifying tautologies.

> Most teams don't [write tests first] because thinking through what the code should do before writing it takes time they don't have.

It's astonishing to me how much our industry repeats the same mistakes over and over. This doesn't seem like what other engineering disciplines do. Or is this just me not knowing what it looks like behind the curtain of those fields?
by steelbrain | 2026-03-10 19:42:55+00:00
I tried to answer it about a year and half ago and that answer is still mostly correct: https://news.ycombinator.com/item?id=41743932

You can mix and match operating systems, macOS, Windows, Linux, you do not need sudo privileges.

rffmpeg needs a shared file system which could be a huge pain to setup: https://github.com/joshuaboniface/rffmpeg/blob/master/docs/S...

ffmpeg-over-ip patches ffmpeg and only needs one port open for the server, then you just run the binary, no mounts needed at all.
by kjlldld | 2026-03-10 19:43:08+00:00
I was looking for a basic solitaire app on my phone the other day and went through 3 different apps trying to find one that wasn't absolutely inundated with ads, special offers, gamification techniques, etc...

I finally had to settle on the least scummy one and still have to turn my phone to airplane mode to not have to sit through a 2 minute ad every time I want to play a hand.

Genuine question, why do all mobile app developers do this?

Is there some kind of cost that hosting the app on the app store or running / maintaining it brings with it where they are basically forced to blast ads at every single possible moment? Are the developers just trying to make the free version as annoying as possible so that people end up paying out of spite? Are they hoping that someone with a gambling addiction downloads the app and is willing to spend large sums of money on upgrades and in game currency? What is it?

What is stopping someone from making something like a basic solitaire game without ads or power ups or streaks of any kind, hosting it, and then calling it a day? I feel like this would be such a breath of fresh air people would seek the author out to try to pay them for the experience funnily enough.
by naikrovek | 2026-03-10 19:43:10+00:00
This is software which basically replicates what Plan9 gives you out of the box.

Dammit I really wish Plan9 had taken off. It isn’t perfect but it does a much, much better job of helping me run my applications in ways that I want.

If anyone doesn’t already know, one method of Plan9 remote access is to “cpu” into a remote machine which has the hardware you need. Your local filesystems go with you, and your environment on the remote machine consists of your local filesystems mounted to the remote machine, but only for you, and all applications you run in this context execute on the cpu of the remote machine and have access to the remote machines hardware, but your local filesystems. Imagine SSHing into a remote machine and your entire environment goes with you, development tools and all. That’s what Plan9 does for you.

So if I “cpu” into a machine without ffmpeg, but with a GPU and I run ffmpeg, not only will it work, but I can tell ffmpeg to use a hardware encoder with a simple command line flag, and it’ll work.
by lateforwork | 2026-03-10 19:43:38+00:00
> When Claude writes tests for code Claude just wrote, it's checking its own work.

You can have Gemini write the tests and Claude write the code. And have Gemini do review of Claude's implementation as well. I routinely have ChatGPT, Claude and Gemini review each other's code. And having AI write unit tests has not been a problem in my experience.
by the_af | 2026-03-10 19:43:48+00:00
Fully agreed. I think "Loser" is a misnomer. And indeed, going by the essay, the Sociopaths can also lose big... they are willing to risk it all for personal gain, but it can end very badly for them if they miss their window, their manipulations get exposed, or decide to do illegal things to get ahead (high profile cases in my mind: Enron, Epstein, etc).
by glhast | 2026-03-10 19:44:08+00:00
Also a measly level 2er. I'm curious what kind of project truly needs an autonomous agent team Ralph looping out 10,000 LOCs per hour? Seems like harness-maxxing is a competitive pursuit in its own right existing outside the task of delivering software to customers.

Feels like K8s cult, overly focused on the cleverness of _how_ something is built versus _what_ is being built.
by rtalur | 2026-03-10 19:44:11+00:00
I built a small macOS app for AeroSpace called AeroMux.

The idea is simple: keep your AeroSpace workspaces visible in a left sidebar, show the active workspace/window clearly, and make it easy to jump to a specific window with a click.

What it does right now:

* persistent left sidebar

* lists non-empty AeroSpace workspaces

* highlights active workspace and focused window

* click-to-focus window rows

* menu bar item for show/hide, refresh, and quit

* optional stable ordering so the active workspace does not always jump to the top

* editable workspace titles/descriptions

* local workspace metadata stored in ~/.config/aeromux/workspaces.json

D* MG release on GitHub

A few limitations:

* macOS only, built around AeroSpace

* currently main-monitor / left-sidebar oriented

* release is not notarized yet, so macOS may warn on first launch

Would love feedback from people using AeroSpace, especially around:

* workspace naming / metadata UX
* multi-monitor setups
* packaging / install expectations
* missing features that would make this worth keeping open every day
by marssaxman | 2026-03-10 19:44:30+00:00
And yet it works well enough, regardless. I have a little project which defines a new DSL. The only documentation or examples which exist for this little language, anywhere in the world, are on my laptop. There is certainly nothing in any AI's training data about it. And yet: codex has no trouble reading my repo, understanding how my DSL works, and generating code written in this novel language, at my request.
by bilegeek | 2026-03-10 19:44:42+00:00
> Maybe this will be the push to get enough people on board to make it (or something like it) feasible?

That won't save you from being targeted. Flawed methodology from the prosecution doesn't matter if all your stuff gets seized, and they really want to hurt you. See Black Ice:

[1]https://old.reddit.com/r/Freenet/comments/4ebw9w/more_inform...

[2]https://retro64xyz.gitlab.io/assets/pdf/blackice_project.pdf
by clbrmbr | 2026-03-10 19:45:23+00:00
Here to say I'm one of those people who did my first Show HN recently, and it was 100% due to the lowered activation energy to build something awesome with Claude. Not 45min, but took about 6 hours of my time, and benefitted from testing against a 10yr old firmware codebase at my startup.

So I guess I'm saying, the ideal rate of Show HN posts has probably gone way up. Unfortunately its also resulting in lower SNR. Not sure what to do about it tho.
by ainch | 2026-03-10 19:45:28+00:00
It's unintuitive to me that architecture doesn't matter - deep learning models, for all their impressive capabilities, are still deficient compared to human learners as far as generalisation, online learning, representational simplicity and data efficiency are concerned.

Just because RNNs and Transformers both work with enormous datasets doesn't mean that architecture/algorithm is irrelevant, it just suggests that they share underlying primitives. But those primitives may not be the right ones for 'AGI'.
by toomuchtodo | 2026-03-10 19:45:44+00:00
Very cool. Peertube supports remote runners [1] [2], might take a look for inspiration. As a distributed compute enthusiast, big fan of of this model for media processing.

[1] https://docs.joinpeertube.org/maintain/tools#peertube-runner

[2] https://docs.joinpeertube.org/admin/remote-runners