MurphyA/hacker-news huggingface dataset:
by mdelmundo | 2026-03-12 14:44:19+00:00
Hi HN – one of the authors here.

This research explores how generative AI can dramatically lower the barrier to entry for robot hacking.

Using Cybersecurity AI (CAI) we analyzed three consumer robots:
– robotic lawn mower
– powered exoskeleton
– window-cleaning robot

In about 7 hours the system identified 38 vulnerabilities including firmware exploitation paths, BLE command injection and unauthenticated root access.

Historically this type of analysis required weeks of specialized robotics security research.

Happy to answer questions.
by criticas | 2026-03-12 14:44:23+00:00
Not at these prices :-) $150 - $200 for a sweater is not cheap. I think of fast fashion in terms of "how many times do I have to wear it to get my money's worth?" If the answer is less than the number of times I'd wear it in a year, it's fast fashion. Of course, if you're a thrift shop shopper, most fashion is fast fashion.
by throw0101d | 2026-03-12 14:44:32+00:00
> Voice is everything. Don't relinquish the best part of yourself.

One observation I ran across on the use of the em-dash ("—") was that if AI was given training data from writers that were considered good/great, and those writers tended to use em-dashes, then it would be unsurprising that AI 'learned' to use the character.

So the observer said humans should, if they already did so in the past, continue to use the em-dash now and going forward if it was already part of their 'personal style' in writing.
by array_key_first | 2026-03-12 14:44:54+00:00
In the past 20 years I've noticed a trend of companies making it harder and harder for me to give them my money.

For apartments, when I would look they wouldn't even bother to tour me half the time. I couldn't believe it.

I'm trying to give you thousands of dollars a month. In a CONTRACT. And you won't even show me the product I'm buying?

One place told me it was dark outside (4pm...), and they didn't feel comfortable touring me around the apartments. Jesus Christ, are we in Gotham? Many just ghosted my touring requests. One turned me down because it was raining (???). I would show up in person in the office, and many would still refuse to tour me.
by GaryBluto | 2026-03-12 14:45:03+00:00
I don't see why this matters, there are accidental civilian casualties in every war. This was unintentional, unlike Iran killing 30,000 of their own citizens, which was entirely deliberate.

If you can find evidence the United States directly targeted a school with the intent of killing children and not just due to outdated intel (and somebody setting up a school in what was once part of an Iranian Revolutionary Guard naval base), maybe I'd change my mind.
by ghaff | 2026-03-12 14:45:19+00:00
I use a 2015 MacBook Pro all the time--like right now. It does have 16GB of memory. It's what sits on my dining room table where I do most of my writing/browsing and which I take for travel. I do have an Apple Silicon MacBook Pro in my office but my downstairs "office" is a lot lighter and airier.
by et1337 | 2026-03-12 14:45:27+00:00
Based on my experience writing many games that work great barring the occasional random physics engine explosion, I suspect that trigonometry is responsible for a significant proportion of glitches.

I think over the years I subconsciously learned to avoid trig because of the issues mentioned, but I do still fall back to angles, especially for things like camera rotation. I am curious how far the OP goes with this crusade in their production code.
by CyberDildonics | 2026-03-12 14:45:37+00:00
I don't know an editor that doesn't have an option for using LF vs CRLF.

And I don't know any other languages that don't parse a carriage return.

The point is that it was intentionally done to antagonize windows even though they put out a windows version. Some people defend this by saying that it's easy to turn off, some people defend it by saying windows users should be antagonized.

No zig people ever said this was a mistake, it was all intentional.

I'm never going to put up with behavior like that with the people making tools actively working against me.
by lucumo | 2026-03-12 14:45:48+00:00
My college classes usually had one offline written test per quarter, and about half the classes had an assignment with them. I can see how those would be easier to cheat on now, though they were already hardly cheat-free. (Not just plagiarism, also free-riding on group assignments for example.) The written examinations carried the heaviest load precisely because of that.

Offline written tests solve the issue quite well. They scale well too. At least as far as assignments do.

People saying that oral examinations are the last bastion of cheat-free examinations are really over-stating the case.

> But some universities (maybe most) have massive classes where a professor may never have an actual conversation with some students.

Probably most yeah. At least it was my experience.
by thrance | 2026-03-12 14:47:02+00:00
The US killed many, many more civilians accross the world that Iran ever did. Yet you don't seem to care about that, why?

> And it's not a war started, its a "war" responding to decades of heinous, vicious, deadly funding of terrorist organizations, and bombing of innocent civilians.

As if the US hadn't been antagonizing Iran for decades. Trump broke the nuclear agreements (which Iran had been following), then refused to negotiate new ones, then joined Israel in their bloodlust for muslim blood. This war is aimless, and only serves to radicalize the Iranian people against Israel and the US. Which will inevitably result in even more bloodshed down the line.
by heraldgeezer | 2026-03-12 14:47:34+00:00
What was so annoying? Having to reboot for Windows updates/programs and MS Defender running?

Also, if the company is certified in some way there are audits for these things, you understand? Such as updates, backups, security, PAM, antivirus etc :)

Subvert these intentionally = bye bye. Logs don't lie. We see you.
by heraldgeezer | 2026-03-12 14:47:42+00:00
"Principle of least privilege" as MS calls it.

Do not use global admin or admin account as daily driver for one. Dont save it in browser etc either.

Limit roles, even within the application, here Intune.

Office 365 also has conditional access and many policy leavers to tweak, many cases of people locking themselves OUT of 365. So the gates work but you need to configure them.

"Break glass" global admin accounts now also require MFA. https://learn.microsoft.com/en-us/entra/identity/authenticat...
by heraldgeezer | 2026-03-12 14:47:49+00:00
It's not better.

But the internet in general is very leftist so they are all ok with giving Iran, Russia and China a free pass to do anything they want.

They are all oppressed by the evil west, you see. Read Marx or something they will say.

To be clear, I am Swedish. Yes we should have joined NATO sooner. We have helped USA with signalling spying since the 1950s, lookup the Catalina affair. As we should, by the way. Soviet and now Russia, is clearly our enemy. Russia aligns with China and Iran.

Yes, yes orange man bad.
by yaronsc | 2026-03-12 14:48:11+00:00
One pattern we've seen while building AI agents is that developers often have to make a frustrating choice between agent frameworks and workflow engines.

Frameworks like LangGraph, Strands, CrewAI, ADK, etc. already implement reasoning loops, tool execution, retries, and memory. But they typically don't provide durable execution—if the process crashes, the agent will restart from scratch. Some have very basic checkpoint systems that leave failure detection and resumption to the user, which is essentially the hard problem workflow engines solve.

The problem with workflow engines is they handle durability well but require developers to rewrite their agent logic inside the workflow system, which means rebuilding the agent framework from scratch.

This work aims to remove that tradeoff by allowing existing agent frameworks to get all the benefits of a durable workflow orchestrator without rewriting any part of their code.
by vova_hn2 | 2026-03-12 14:48:15+00:00
> IMO, good tests are relatively immutable. You should be able to have multiple valid implementations. You should add new tests to describe the new functionality of that implementation, however, the old tests should remain relatively untouched.

Taken to extreme this would mean getting rid of unit tests altogether in favor of functional and/or end-to-end testing. Which is... a strategy. I don't know if it is a good or bad strategy, but I can see it being viable for some projects.
by bennettnate5 | 2026-03-12 14:48:25+00:00
Here's a potential winning strategy: take a coin out of your pocket and flip it 100 times. If it lands heads 51 or more times, take both boxes; otherwise, just take the one. Provided the computer had anticipated you being the kind of person that would do this, it would anticipate you are probabilistically more likely to take the single box exclusively and put the million dollars in it. Regardless of the outcome of the coin tosses, you get that million dollar box, and you still get the added $1000 in the first box 49% of the time.
by delichon | 2026-03-12 14:48:48+00:00
I buy beef in bulk from a rancher, who sends me to get it from a USDA approved slaughterhouse. Which is a small family operation, so I've gotten to know them well too. They raise the most delicious lamb I've ever tasted.

But I have to drive clear across the state for it and it has tripled in price since covid. A lot of the best in life costs dearly.
by aneyadeng | 2026-03-12 14:48:59+00:00
Hi HN! I built this because I kept finding phantom npm packages in Copilot/Cursor output that passed ESLint just fine.

What it does:

- L1: AST-based structural analysis (hallucinated imports, logic gaps, security anti-patterns) — runs in <10s

- L2: Embedding recall for stale APIs and deprecated patterns

- L3: LLM deep scan for context coherence

Key difference from traditional linters: it's built specifically for AI code failure modes — hallucinated packages, context window breaks, over-engineering patterns. ESLint/SonarQube don't even look for these.

100% local (Ollama), self-hostable, free forever. GitHub Actions + GitLab CI integration included.

Would love feedback on what other AI code patterns you've seen that we should detect!
by WorldMaker | 2026-03-12 14:49:01+00:00
The only well supported and consistent argument I see in those links is that Safari is bad at PWAs. I agree with that. But (timely rant incoming) I also think everyone is currently bad at PWAs. The current ServiceWorker-based approach is brittle and hard to use because it is too low level and too tightly coupled to what seem to be Chrome-specific concerns. The previous manifest.json approach should have never been disabled in Chrome, it should have at least lived side-by-side and let developers vote by their feet, at least until a reasonably equivalent high-level manifest replacement was built.

I was just thinking about this this week because I have a webpage I built with offline capabilities and an excuse coming up where many of the webpage's users will be offline for a week but might have use for the webpage, but I can't easily turn it into a PWA because it was built as an MPA and there's no great high level tools for writing an MPA's ServiceWorker because most of the high level libraries are so (overly) focused on SPAs. I wish I could just put a manifest.json or some sort of zip archive users could download and have it share Local Storage.

I do pin a lot of this on Google engineers. The side effect is Safari is having a hard time implementing these "standards", but the real cause is the "standards" are over-complicated trash that are also hard to develop for. Everyone including the links you sent can see how Apple's App Store moat gives them an incentive to drag their feet on implementing these "standards" and yet no one is giving Google enough gruff for the conflict of interest with Google Play's moats and making over-complicated standards that are hard for anyone to use and harder for anyone else to implement is just another way to drag your feet and keep the whole web platform behind, without looking like you are dragging your feet.

It would feel different, too, if the fully declarative manifest.json approach hadn't briefly worked (well) in Edge (Spartan) and Firefox before Google derailed that standards train with "Chrome-first" ServiceWorker complications. Always seemed like one of the reasons that Microsoft just gave up on the web platform because they couldn't keep up with Google's machinations (and conflicts of interest) in Chrome.
by heraldgeezer | 2026-03-12 14:49:12+00:00
I mean country flags, not flagged as in "reporting".

Do you understand?

The account may be newer, but I am not, I assure you. If you want to go into personal attacks we can.

We in Sweden have had Islamist terror attacks plenty already. By supporting Iran you are sponsoring terror.

The Iranian regime just tried to murder a Swedish-Iranian:

https://www.tv4.se/artikel/7my3ReE6WsRs4GnFxj216U/uppgifter-...

USA embassy in Norway bombed by IDE

https://www.reuters.com/world/norway-police-apprehend-three-...

End of discussion.
by CyberDildonics | 2026-03-12 14:49:24+00:00
defer is still something you have to consciously put in every time so it destroys the value semantics that C++ has, which is the important part. You don't have to "just write defer after a string", you can just use a string.

The 'not a problem for me' is what people would say about manual memory in C too. Defer is better but it isn't as good as what is already in use.
by thecloudlet | 2026-03-12 14:49:36+00:00
Doing bitwise operations directly on raw pointers is a fast track to Undefined Behavior in standard C/C++. Emacs gets away with it largely due to its age, its heavy reliance on specific GCC behaviors/extensions, and how its build system configures compiler optimizations.

In modern C++, the technically "correct" and safe way to spell this trick is exactly as you suggested: using uintptr_t (or intptr_t).
by looselygoosy | 2026-03-12 14:49:43+00:00
I don't know that the influx of AI spam would necessarily result in people disengaging and choosing to seek out real content, though. Social media feeds have been serving up less and less content from our actual real life contacts for a while now (partly because people seem to be posting less). As long as it's engaging I think a significant chunk of people aren't going to care whether it's AI

(anecdotally, my mother loves AI generated videos, perhaps it's just novelty at the moment and it will wear off)
by stego-tech | 2026-03-12 14:49:43+00:00
Yeeeeeah, no school district needs or should have access to LPR databases. Period. Full stop.

Also though, we really need to destroy these things wholesale. If a local PD wants to run their own tech stack within their own boundaries using taxpayer money and operated by taxpayer citizens, then sure, I guess that's what the taxpayers want. This whole "private companies do the legwork of surveilling everybody and sell it piecemeal back to cops and private entities as a business" is flatly reprehensible and should be barred as a matter of law.

Fuck mass surveillance.
by scott_w | 2026-03-12 14:49:45+00:00
I totally agree, the upper chamber can and should make amendments to legislation. In this case, they made a generally good amendment to the Employment Rights Bill (allowing "at-will" dismissal up to the first 6 months rather than the initially proposed total ban).

However after that amendment was accepted, Conservative Peers (who hold a majority) initially voted against the bill again: https://bectu.org.uk/news/prospect-slams-house-of-lords-for-...

It was eventually passed a week later when the Lords accepted the Commons amendments but that second block on 11th December shouldn't have happened.
by gaborbernat | 2026-03-12 14:49:50+00:00
Practical guide to Python supply chain security covering the full stack: dependency pinning with hashes, vulnerability scanning in CI, SBOMs, Trusted Publishing with OIDC, package attestations via Sigstore, and delayed ingestion for organizations. Written from the perspective of both a PyPA maintainer and enterprise package infrastructure operator. Includes real attack case studies (Ultralytics, GhostAction, Shai-Hulud) and a phased roadmap for adoption.
by dakolli | 2026-03-12 14:50:06+00:00
Idk, this didn't happen in Iran. Literally not a single bit of evidence to prove these claims of violence of the state of Iran against its citizens.. Your consent has been completely manufactured. You people are trying to wash the sins of the genocide you just committed on the people of Gaza by creating a fake one in Iran, to justify your thirst for blood.

While I'm sure that it did happen, it certainly wasn't 30k people. There's tons of videos of provocateurs shooting shotguns at police... What happens anywhere in the world when you start shooting at police?

But in the case of Israel, land of the religious ethno-state that has been literally committing acts of terror for 3 years straight in 4k, on video.. they were allowed continue governing themselves after killing or wounding 30k innocent children...

So you tell me what happens?
by JumpCrisscross | 2026-03-12 14:50:16+00:00
> what will break the clock ?

So unlike money-market funds, these private-credit funds can gate withdrawals and extend and pretend by turning cash coupons into PIKs. So I don't actually see credit concerns directly driving liquidity issues for the banks that didn't hold the risk on their balance sheet glares Germanically.

Instead, I think the contagion risk is psychological. Which is an unsatisfying answer. But if there are massive losses on e.g. DBIP and DB USA halts withdrawals, then the 2% stock loss Morgan Stanley suffered when it capped withdrawals [1] could become a bigger issue.

[1] https://www.wsj.com/livecoverage/stock-market-today-dow-sp-5...
by showerst | 2026-03-12 14:50:19+00:00
I agree with this approach in general, but in reality this is just thinly veiled layoffs.

If you have thousands of career employees with houses and kids in school and you tell them to move to Ogden Utah or lose their jobs, they're going to react as you'd expect.

For greenfield projects though, or things like the FBI building that mix prime real estate with an outdated campus, spread the love.
by lowenbjer | 2026-03-12 14:50:33+00:00
I was part of building the streaming frontend for one of Sweden's largest broadcasters in Rails about 10 years ago. Handled 1M+ concurrent users on Heroku with horizontal scaling. Fun fact: someone on the team literally stayed up monitoring traffic during big live events. It worked. Rails was a great fit for that especially at the time.

I moved on, not because Rails failed me, but because the things I started building next (Streaming infra, APIs behind proxies, lots of concurrent HTTP work, infrastructure tooling, AI/ML) just fit better in other languages. I pick tools by the problem, not loyalty.

What I notice in this thread is a lot of "Rails vs X" framing when the real answer is boring: use Rails (if you like the vision and Ruby) when the complexity is in the data model and business logic. Use something else when it's in concurrency or infrastructure. The one-person-framework pitch is real, but it's for a specific shape of problem.

Also: God i miss writing Ruby, its a fantastically and beautiful language.

Also: Blast from the past: Ruby is a great DSL for Rails.
by gruez | 2026-03-12 14:50:39+00:00
>Isn't it a weird coincidence that soon after the US and Israel started an unprovoked and unnecessary war (that billionaires will profit handsomely from, as an aside) that we get stories like this to manufacture consent?

Are you suggesting that's an inside job and/or false flag attack? If it's not a false flag attack, why imply that the reporting must be to "manufacture consent"? Shouldn't you expect major hacks to be reported?
by antonyh | 2026-03-12 14:50:52+00:00
I think the definition of big is smaller than that. Mine was "too big to fit on a maxed-out laptop", effectively >8TB. Our photo collection is bigger than that, it's not 'big data'.

Or one could define it as too big to fit on a single SSD/HDD, maybe >30TB. Still within the reach of a hobbyist, but too large to process in memory and needs special tools to work with. It doesn't have to be petabyte scale to need 'big data' tooling.
Show HN: Mori – Test against production data, without ever touching production
by psrth | 2026-03-12 14:51:05+00:00
Mori is an open-source database proxy that lets you run your application locally against real production data without risking writes to production. It connects to your production database, clones the schema locally, and intercepts queries:
- Reads come from production
- Writes / migrations / deletes are executed only in a local shadow database
- Results are merged in real time so your app thinks the changes happened in production

So you (and your AI agents) can safely test your code in a verifiable environment (real production data) locally before you're ready to push.

Links:
- Demo -> https://moridb.sh/demo
- Repository -> https://github.com/psrth/mori
- Docs -> https://moridb.sh/docs

Motivation:
Most people ask Santa for a bicycle; every year, I've been asking for the ability to test in prod. The existing alternatives (branching, snapshots, seed dbs, staging dbs, good old pg_dump) are one or more of: (a) out of sync, (b) expensive to run (time and cost), (c) cloud / managed provider only. But as AI agents continue to write more code, our local testing frameworks need to keep up. Writing code shouldn't be artificially bottlenecked or a literal leap of faith.

Implementation:
The docs have a lot more information, but a summary:
- Support for PSQL/MySQL/SQLite + 6 more engines, each with custom AST-level query classification and rewriting
- In-flight cross-DB merging of prod data with local modifications
- Collision-free PK generation and support for foreign keys
- Full transaction support including CTEs, nested transactions, and savepoints
- MCP support: plug-and-play into Claude Code, Cursor, or wherever you get your tokens
- Exhaustive E2E test suite per engine

Safety:
I want to specifically call out the core design principle — that production should never be writable through Mori. This is enforced through four independent layers:

1. Query classification — every statement is parsed and classified as read or write before routing
2. Routing rules — writes are deterministically routed to the local shadow database, never forwarded
3. Shadow execution enforcement — even if classification is bypassed, the execution layer rejects any write targeting the production connection
4. Raw byte inspection — finally, outbound bytes on the production socket are inspected to ensure no write operation ever reaches prod

If any layer fails to classify a query, Mori refuses the statement entirely rather than risking a pass-through.

Note:
While I've validated (and extensively tested against our production database) all of the supported queries, there may (and will) be edge cases that I haven't discovered yet. If you hit an edge case, please open an issue - expanding the current coverage is my top priority!

If you want to see if this repo is a good fit for your workflow, you can checkout
> https://www.moridb.sh/docs/resources/compatibility.

Or, in the true spirit of this project, just go for it :)
> curl -fsSL https://moridb.sh/install.sh | sh
by larsmosr | 2026-03-12 14:51:20+00:00
The TalkBack issue is useful feedback, thank you. I tested with NVDA and VoiceOver but not TalkBack on Android. If light mode is reading individual words instead of a continuous block that's a real bug I want to fix.

On the broader point, I hear you, but I think there's a middle ground. Not all content is public knowledge. Some of it is premium, proprietary, or behind a paywall. The people publishing it should get to decide whether it becomes free training data.