MurphyA/hacker-news huggingface dataset:
by v3xro | 2026-03-06 10:42:46+00:00
The only way I see out of this crisis (yes I'm not on the token-using side of this) is strict liability for companies making software products (just like in the physical world). Then it doesn't matter if the token-generator spits out code or a software engineer spits out code - the company's incentives are aligned such that if something breaks it's on them to fix it and sort out any externalities caused. This will probably mean no vibe-coded side hustles but I personally am OK with that.
by adrian_b | 2026-03-06 10:42:47+00:00
Except for extremely cheap embedded computers, which save a few cents by not including a battery and a quartz resonator or oscillator for a real-time clock (as a timer suitable to be used as a RTC exists even in the cheapest microcontrollers), NTP is not a major security risk, because when used in the right way it should be used just to compensate the drift of the internal RTC, which should be trusted more than NTP (for the coarse time value).

Any unexplainable discrepancy between the internal RTC and what NTP reports should be interpreted as a possible spoofing of the NTP packets and such suspect values should not be used to update the internal clock. If the accumulated adjustments of the internal clock caused by NTP exceed a few seconds per day, the sysadmin must be alerted, as something like this can happen only when either the hardware is defective or something is wrong with NTP.

Unfortunately, there are many bad implementations that follow blindly what NTP says, without checking the timestamps for plausibility. Most better implementations are still not optimal, because they just limit the time steps of the internal clock to some value e.g. to 1 second, instead of recognizing outliers in the NTP timestamps and ignoring them.
by pranavchahal | 2026-03-06 10:42:51+00:00
Fair point, I agree.
I put together a more detailed technical write-up here on how the checks are done, where AI is used, and where it explicitly isn’t:
https://boardmint.io/posts/tech
There’s also a sample report on a real board in there.
And I’ve been running real boards through it pretty regularly to see what’s genuinely useful in practice, so if you have something you’d want me to test, feel free to share it. Happy to run it and post the output.
by wink | 2026-03-06 10:42:56+00:00
The permissions thing regarding Accessibility or Network Access is the worst. Half the popups make no sense (even to a programmer) and it just feels clunky.
(Bonus point: why is a tiling window manager or anything controlling windows or controls even sorted under Accessibility?)

I recently wanted to control some things with a MIDI device (mostly hardware mute for Slack/Teams etc) and need AppleScript for that.

But of course `osascript` is a different thing than the `Script Editor` and if you want to add a binary in the dialog you click the + button as described in the manual but of course it does not give you a way to select /usr/bin or /bin - just the view with Applications etc. Showing "hidden" files or dirs is easier on Windows and that says a lot.

(I suppose there must be a way, but I gave up finding it and just exported my stuff as an App in ~/Applications, I can add those.)
by throwaway2037 | 2026-03-06 10:43:51+00:00
Yeah, I agree. This sentiment is weird to me. As a counterpoint, look at Ben and Jerry's ice cream from the 1990s. It was such a cool brand back in the day, and made delicious high-fat ice cream. (I know, I know: They sold out. But I am talking about before the sell-out.) Also, look at Chobani Yogurt in this generation. Amazing product and stellar brand.
by hansmayer | 2026-03-06 10:43:55+00:00
> Consider this oversimplified example: You own a bakery. You have 10 people making 1,000 loaves of bread per month. Now, you have new semi-automatic ovens that allow you to make the same amount of bread with only 5 people.

That is actually the case with a lot of bakeries these days. But the one major difference being,the baker can rely with almost 100% reliability that the form, shape and ingredients used will be exact to the rounding error. Each time. No matter how many times they use the oven. And they don't have to invent strategies on how to "best use the ovens", they don't claim to "vibe-bake" 10x more than what they used to bake before etc... The semi-automated ovens just effing work!

Now show me an LLM that even remotely provides this kind of experience.
by r00tSid | 2026-03-06 10:44:02+00:00
Author here.

One interesting challenge while building PACO was avoiding false positives.

For example, some repositories use workspaces (like npm workspaces or monorepos) where dependencies may resolve locally instead of from public registries.

PACO currently checks the official registries (NPM, PyPI, RubyGems) and flags dependencies that appear unpublished or removed, but I'm still improving detection for monorepos and internal workspace dependencies.

If anyone has ideas or feedback on improving detection accuracy, I'd love to hear them.
by graemep | 2026-03-06 10:46:12+00:00
> As I understand it, the US Supreme Court has just this week ruled exactly this. LLM output cannot be copyrighted, so the only part of any piece of software that can be copyrighted is that part that was created by a human.

Your understanding is incorrect. The case was about whether an LLM can be an author, and did not whether the person using it can be (which will be the case). https://news.ycombinator.com/item?id=47260110
by thefounder | 2026-03-06 10:46:20+00:00
The issue is that you become lazy after a while and stop “leading the design”. And I think that’s ok because most of the code is just throwaway code.
You would rewrite your project/app several times by the time it’s worth it to pay attention to “proper” architecture. I wish I had these AIs 10 years ago so that I can focus on everything I wanted to build instead to become a framework developer/engineer.
by input_sh | 2026-03-06 10:46:59+00:00
The kid can learn and become better over time, while "AI" can only be retrained using better training data.

I'm not against using AI by any means, but I know what to use it for: for stuff where I can only do a worse than half the population because I can't be bothered to learn it properly. I don't want to toot my own horn, but I'd say I'm definitely better at my niche than 50% of the people. There are plenty of other niches where I'm not.
by fbilhaut | 2026-03-06 10:48:13+00:00
GLiNER is a really great research work. But putting this kind of things in production is just another job. Not trying to do self promotion here, but there are alternatives for this purpose, like gline-rs (https://github.com/fbilhaut/gline-rs). Support of GLiNER 2 models is on the way.
by embedding-shape | 2026-03-06 10:48:14+00:00
> Anthropic is clearly the better company over OpenAI

Why do people keep falling into traps of anthropomorphize companies like this? What's the point? Either you care about a company in the "for-profit" sense, and then money is all that matters (so clearly OpenAI currently wins there), or you care about pesky things like morality and ethics, and then you should look beyond corporations, because they're not humans, stop treating them as such. Both of them do their best to earn as much as possible, and that's their entire "morality", as they're both for-profit companies,.
by DavidVoid | 2026-03-06 10:48:36+00:00
There's an old German short film called Nicht löschbares Feuer (Inextinguishable Fire, 1969)[1] that I'm fond of. It was a protest film against Napalm and how some companies wouldn't really let their employees know what they were actually working on.

"I am a worker and I work in a vacuum cleaner factory. My wife could use a vacuum cleaner. That's why everyday I pick up a piece. At home I try to assemble the vacuum cleaner. But however I try, it always becomes a sub-machine gun.

...

This vacuum cleaner can become a useful weapon. This sub-machine gun can become a useful household appliance.

What we produce it depends on the workers, students, and engineers."

That last line is still very relevant today.

[1] https://www.youtube.com/watch?v=EnpLS4ct2mM
Show HN: Veil – On-device meeting transcription with 100% PII redaction
by nakaiwilliams | 2026-03-06 10:49:18+00:00
Solo dev from South Africa. Spent 3 months building this.

Every AI meeting tool sends conversations to the cloud. I trained my own PII model - 72M words, 100% catch rate on real meetings. Before anything touches AI, names become aliases, amounts scramble, identifiers vanish.

Everything runs on-device. Nothing leaves your machine.

Free for now - can't afford Apple's $99 notarization yet. Happy to answer questions about the tech.
by bob1029 | 2026-03-06 10:49:22+00:00
I believe the orange site's consensus was that it's approximately one additional mini fridge or dish washer worth of consumption on average. You've got users who use these tools barely 1k tokens per week. Assuming it's all batched ideally that's like running an LED floodlight for a minute or so. The other end of the spectrum can be pretty extreme in consumption but it's also rare. Most people just use the adhoc stuff.
by subscribed | 2026-03-06 10:49:33+00:00
I use SimpleLogin with custom domains but kinda meh.

Brilliant for quick creation of temporary emails, but app troublesome and doesn't show the all options, but much to my disappointment they don't do proper SRS, so it invalidates any, ANY benefits from DMARC or such.

Emails that with SRS would have a proper From, organisation logo from BIMI record, now immediately end up in Spam and are marked as phishing attempts.

I had a better success with personal postfix server forwarding my catch-all alias mail to Gmail than I have with SimpleLogin.

The only thing that is better is that replying to emails is easier, but that could be done while staying compliant with SRS.

I regret buying the subscription and I won't be extending it. Should've go with a proper email service, not a glorified alias generator.
by MickeyShmueli | 2026-03-06 10:49:33+00:00
the 1M context is cool but tbh the token cost problem nobody's talking about is tool schema bloat. before the model writes a single line of code it's already consumed thousands of tokens just ingesting function definitions. i've seen agent setups where 30-40% of the context window is tool descriptions before any actual work happens. the per-token price war is nice but if your schema is 10k tokens of boilerplate you're still burning money
by conductr | 2026-03-06 10:50:14+00:00
Regarding the latent demand topic, I don’t think it’s quite demand. It’s just vocalizing that someone else’s kid is cute. They may say they want one but they really don’t, so that’s not demand. It’s no different than seeing a puppy and saying “I want one” in a baby voice. That’s not latent demand. Because most likely they’ve already forgotten about your cute puppy 5 minutes later or when they think through all the inconveniences owning a puppy will introduce to their life, they realize they don’t actually want one bad enough.

I think it’s opportunity cost as well but more specifically in the sense of greed. People are greedy about living their best lives as an individual they don’t want to have to put someone else’s needs above theirs.

In a sense, the long period of wealth and stability the western world has experienced has pushed all of the seven deadly sins to their extremes. I think there’s a reason why these things are commonly labeled as sins and discouraged by most religions, it speaks somewhat of the purpose of religion, and it’s to help humanity function as a society given our natural tendencies are rather destructive. This is the pattern you’ve described, or underlying.
Show HN: LiveTok – AI Receptionist for Veterinary Clinics
by gustavogb | 2026-03-06 10:50:18+00:00
Hi HN! I'm Gustavo, building LiveTok (https://www.livetok.ai) – AI agents that handle phone calls and WhatsApp for veterinary clinics.

Vet clinics lose clients to missed calls. The front desk is juggling check-ins, anxious pet parents in the waiting room, and a phone that won't stop ringing. After hours, it goes to voicemail – and most people just call the next clinic on Google instead of leaving a message.

We built LiveTok to answer every call, 24/7. The AI receptionist books appointments, answers common questions about hours and services, and routes to a vet tech when the conversation needs human judgment. It handles the routine stuff so your staff can focus on the animals in front of them.

Clinics using it are seeing up to 40% more appointments – mostly from calls that previously went unanswered or to voicemail.

Setup takes about 5 minutes – connect your phone number, add your clinic's info and availability, and it's live. No coding required.

The interesting technical challenge has been voice quality and natural conversation flow. People calling about their pets are often stressed or in a hurry. The AI needs to sound calm, get to the point quickly, and know when to hand off rather than frustrate someone who needs a real person. We've tuned latency and interruption handling specifically for these high-stakes, emotionally-charged calls.

This month we're offering free trials – if you run a vet clinic or know someone who does, we'd love to have you try it. For the first few customers, we're also offering custom integrations with your practice management software if needed.

Demo: https://www.livetok.ai/industries/veterinary

Would love feedback from anyone who's built voice AI or worked on vertical SaaS for local businesses. What's worked for you on go-to-market?
by hrmtst93837 | 2026-03-06 10:50:27+00:00
BEAM offers concrete benefits for agent frameworks: cheap preemptible processes, OTP behaviors like GenServer and Supervisor, ETS or Mnesia for fast state, and clustering tools that make managing thousands of stateful agents and restarts tractable.

The tradeoff is heavy ML still lives in Python and on GPUs, so run models as external services over gRPC or HTTP or use Nx with EXLA for smaller on-node work, and if you need native speed use Rustler NIFs or ports but never block the BEAM scheduler or the node will grind to a halt.
by zackchen | 2026-03-06 10:50:33+00:00
This looks like Aseprite. Aseprite is already open source and you can get it for free, all completely legal. The only caveat is that you need to compile it yourself (which takes 2-5 shell commands). I think this is more than fair, but ripping off Aseprite is not so much. Their license also strictly prohibits that behavior.
by metalman | 2026-03-06 10:50:36+00:00
the way that female phisiology is optimised for child bearing centers on blood flow to the placenta (and a whole new human), and then the very sudden removal of that WHOLE system in a survivable way is focused on two things, one is that the internal structure of the womb, literaly acts as a mechanical shear to sever the placenta, and two, instant powerfull but highly controlled, clotting, which as we all know can sometimes
over or under react. that such a complex system can continue to function at all in zero gravity is a testement to how conservative natural design and engineering is,and "solving" the problem faced by female astronauts is going to require a much deeper understanding than throwing a hormone at it.
Nature has solved problems like this many times, by the simple expedient of throwing more males at it untill the problem goes away. or as I like to answer sometimes as to how I am going to solve a problem I say
"I will use anger and stupidity, wish me luck"
Show HN: Mybets.gg – A bet tracker and analytics dashboard
by mybets | 2026-03-06 10:50:37+00:00
Hi HN,

I'm the solo developer behind MyBets.gg.
I built this because trying to build a reliable bet tracker in Excel eventually becomes a nightmare of broken formulas, manual data entry, and fragmented history across different sportsbooks.

The goal of the project is to treat sports betting less like gambling and more like day trading. A good bet tracker shouldn't just record wins and losses; it needs to focus strictly on unit sizing, closing line value (CLV), and long-term bankroll management.

From a business standpoint, I managed to get 4 paying users ($60 MRR) early on, but then completely hit a wall. I realized that trying to rank a bet tracker on Google as a solo dev is a brutal SEO battle against massive casinos and affiliates. It burned me out, and I took a month away from the keyboard.

I'm back now, focusing purely on improving the product, the data visualization, and finding organic ways to grow.

I know gambling isn't everyone's cup of tea here, but from a pure data and analytics perspective, I'd love any harsh feedback on the UI, the data visualizations, or how the dashboard handles the math.

Happy to answer any questions about challenges of building in this space.
by ed_blackburn | 2026-03-06 10:51:20+00:00
This is becoming a wedge issue. It should not be. As an industry, we can solve this. As an industry, we have too. If we don't, legislators will do it for us. And they'll make a bad job of it. And if you petition your local legislator wherever yiu are in the world, then that's cool, but if this is solved locally, we will see serious fragmentation. As an industry projecting ones politics isn't going to make much difference.
by ekjhgkejhgk | 2026-03-06 10:51:21+00:00
As the sibling explained, it was sarcasm. It was satire of brain dead right wingers saying "stop making everything political" when political points apply, but then making things political politcal in stupid situations.

Example, someone shoots up a school, people say "if the Republican party hadn't obstructed gun legislation maybe this wouldn't have happened", they respond "StOp MaKiNg EvErYtHiNg PolItIcaL". But if the person is trans suddenly it's political.
by fvv | 2026-03-06 10:51:25+00:00
1. it's 1.5x , it's quite fast for the level of thinking it has

2. no if you are on subscription, it's the same, at 20$ codex 5.4 xhigh provide way more than 20$ opus thinking ( this one instead really can burn 33% with 1 request, try to compare then on same tasks ) also 8x .. ??? if you need 1M token for a special tasks doesn't hit /fast and vice-versa , the higher price doesn't apply on subscription too..

3. false, i'm on pro , so 10x the base , always on /fast (no 1M), and often 2 parallel instances working.. hardly can use 2% (=20% of 5h limit , in 1h of work ( about 15/20 req/hour) ) , claude is way worse on that imo
by tern | 2026-03-06 10:52:09+00:00
I know it's not anyone's fault exactly, but the current state of systems in general is an absolute shit show. If you care about what you do, I'd expect you to be cheering that we just might have an opportunity for a renaissance.

Moreover, this kind of thinking is incredibly backward. If you were better than me then, you can easily become much better than I'll ever be in the future.
by matrixgard | 2026-03-06 10:52:45+00:00
The SCIM provisioning piece is usually where it falls apart first. Even when both sides have Atlassian Access, the external org's IdP doesn't cleanly federate, so you end up with manually provisioned guest accounts that nobody deactivates when the contractor rolls off. Infosec says no to that, and they're right.

The harder part in defense/aerospace is data residency and CUI handling. Jira Cloud will never be on the approved list for anything touching export-controlled data, so you're back to Data Center on-prem — and now you're asking a prime contractor to open VPN tunnels to a supplier's DC instance, which their network team will reject outright. The "let's just use email" fallback isn't laziness, it's often the path of least compliance resistance.

What's the typical org size on the contractor side — are these large primes with mature IAM programs or mid-tier suppliers who barely have SSO themselves?
Show HN: Evalcraft – cassette-based testing for AI agents (pytest, $0/run)
by beyhang | 2026-03-06 10:52:47+00:00
Testing AI agents is painful. Every test run calls the LLM API, costs real money, takes minutes, and gives different results each time. CI? Forget about it.

Evalcraft fixes this with cassette-based capture and replay — think VCR for HTTP, but for LLM calls and tool use.

How it works:

1. Run your agent once with real API calls. Evalcraft records every LLM request, tool call, and response into a JSON cassette file.

2. In tests, replay from the cassette. Zero API calls, zero cost, deterministic output.

3. Assert on what matters: tool call sequences, output content, cost budgets, token counts.

run = replay("cassettes/support_agent.json")
assert_tool_called(run, "lookup_order", with_args={"order_id": "ORD-1042"})
assert_tool_order(run, ["lookup_order", "search_knowledge_base"])
assert_cost_under(run, max_usd=0.01)

It's pytest-native — fixtures, markers, CLI flags. Works with OpenAI, Anthropic, LangGraph, CrewAI, AutoGen, and LlamaIndex out of the box. Adapters auto-instrument your agent with zero code changes.

Also ships with golden-set management, regression detection, PII sanitization, and 16 CLI commands for inspecting/diffing cassettes.

555 tests, MIT licensed, `pip install evalcraft`.

Repo: https://github.com/beyhangl/evalcraft
PyPI: https://pypi.org/project/evalcraft/
Docs: https://beyhangl.github.io/evalcraft/docs/

Would love feedback from anyone testing agents in CI.
by embedding-shape | 2026-03-06 10:52:54+00:00
> but if you get paid to ship code it's about money.

Tip to budding software engineers: try to not work in these sort of places, as they're about "looking busy" rather than engineering software, where the latter is where real long-lasting things are built, and the former is where startup founders spend most their money.

The last paragraph is where the tricky and valuable parts are, and also where AI isn't super helpful today, and where you as a human can actually help out a lot if you're just 10% better than the rest of the "engineers" who only want to ship as fast as possible.
by matrixgard | 2026-03-06 10:52:55+00:00
The CloudWatch + kubectl + 4-other-tools triage loop is real — I've burned hours on that exact workflow at 2am during an incident. The pain isn't the tools themselves, it's that each one gives you a different slice of truth with no shared context, so you end up mentally joining logs across systems with no guarantee you're even looking at the right time window.

The SOC2 compliance estimate piece is interesting. In practice that's notoriously hard to do from infrastructure signals alone — a lot of what auditors actually care about (access reviews, change management evidence, vendor risk questionnaires) lives outside the infra layer entirely. Curious how you're approaching that part — are you generating evidence artifacts or more of a gap-assessment output?

Also, how are you handling credentials for multi-cloud — are you asking users to drop keys in or is there an OIDC/role-based flow?