MurphyA/hacker-news huggingface dataset:
by guerython | 2026-03-08 00:24:05+00:00
Love the idea of Joy. We see trust as the missing connective tissue for multi-agent stacks. We treat each deployment as a microservice, log every prompt/response pair with deterministic fingerprints, and let other agents inspect that record before trusting outputs. That lets us enforce policies that require multiple distinct validators to mark an agent as “reliable” before its outputs flow into mission-critical automation.

One thing I’d add is a decay for vouches. Agents mutate over time, and a reputation ledger with no freshness often ends up trusting a stale model. Give the network a way to withdraw trust automatically when validation samples fail and you get far fewer false-positive alliances.
by awesome_dude | 2026-03-08 00:25:06+00:00
> [?]Light » 2026-02-22
@light@noc.social

@lxo
Do you genuinely honestly actually audit the source code of every single piece of software running on your system and compile it all yourself, including web code?
Either you have a lot of time on your hands and a lot of skill, or you're running a very minimal system, or you actually don't.

...
[?]Light » 2026-02-22
@light@noc.social

@lxo
And even if you do, most people* can't. So for them, they need third-party audits, which as I have previously pointed out, can be done without source code. Or otherwise they try to get their software from sources they trust.

*For example, rocket scientists and brain surgeons

2 0 ↺
[?]Alexandre Oliva » 2026-02-22
@lxo@snac.lx.oliva.nom.br

I don't have to. that's the power of community.
security doesn't work in absolutes, and auditability is an imperfect deterrent, but it's infinitely better than the moves to prevent auditability that hostile vendors adopt

I do audit the rare cases of web blobs that are imposed on me, because I can't count on community for those, and my security depends on it even when my freedom has been unjustly taken away

...
[?]Light » 2026-02-22
@light@noc.social

@lxo
Then you personally know other programmers that you trust to audit it for you. Again, most people don't have that.

...
2 0 ↺
[?]Alexandre Oliva » 2026-02-22
@lxo@snac.lx.oliva.nom.br

that's missing the point. auditability alone is already quite a deterrent. that some of us actually engage in auditing is a bonus that benefits everyone, even if it doesn't happen very often. it's kind of the panopticon effect, but for the better.
by jkubicek | 2026-03-08 00:25:32+00:00
Knowing who is making the bets doesn’t prevent mildly corrupt officials from driving the outcome that’s going to win them some cash.

Knowing that high-level DOD official were betting on us invading Iran does us no good if the only reason we invaded Iran was so they could win their long-odds bet. Sure, we can try and shame them, but now they're rich and we're fighting another middle-east war.
by antonvs | 2026-03-08 00:25:42+00:00
I can't deny that this might be a trend in practice, but at companies with reasonably self-aware practices, it isn't, or doesn't need to be.

There's this weird thing that happens with new tools where people seem to surrender their autonomy to them, e.g. "welp, I just get pings from [Slack|my phone|etc] all the time, nothing I can do than just be interrupted constantly." More recently, it's "this failed because Claude chose..." No, Claude didn't choose, the person who submitted the PR chose to accept it.

It's possible to use tools responsibly and effectively. It's also possible to encourage and mentor employees to do that. The idea that a dev has to be effectively on call because they're pushing AI slop is just wrong on so many levels.
by 1970-01-01 | 2026-03-08 00:25:43+00:00
Hiring is so broken that this just isn't enough. We really need an IETF RFC for open positions. A full-blown TCP-like protocol for an open position, with TTL, SYN ACK handshakes, and data encryption. Anything else is half-assing it. I'm only half joking. It's pretty bad today.
by alephnerd | 2026-03-08 00:25:49+00:00
We as Americans perfected capitalism.

We're fine paying a premium and entrenching in ecosystems like the Bay, NYC, ATX, and Seattle. And in a vertical like cybersecurity (which is mine), going where the talent matters and that's largely the Bay/NYC/ATX/Seattle, Tel Aviv, Prague, Warsaw, BLR, and Hyderabad now.

I'm not going to hire subpar talent in Georgia or North Carolina and deal with shitty local politicos - CA, NY, TX, and WA are easier jurisdictions with much more established talent pools.

Finally, a lot of the software protecting us from the Iranians as we speak were developed by Israeli companies like Wiz.
by tavavex | 2026-03-08 00:25:54+00:00
So, what does that leave for the current new grads? The LLM field hasn't even stabilized yet, we're still pretty far from a defined set of qualifications. Yet hiring has already stopped due to economical factors. By the time it swings back, the new grads of tomorrow will already be graduating with these qualifications that we won't get to learn or develop with real jobs.

And what if this results in the overall market size decreasing? If a company can use LLMs effectively, they may need far fewer people to do the job they're doing than they used to. This would result in an exodus of everyone - biased towards the lower end, no doubt, but it would still hit everyone else and greatly worsen working conditions due to an oversupply of desperate people looking for work.
by bryanrasmussen | 2026-03-08 00:25:55+00:00
This makes me think of the attractiveness of overly bad writing to writers, as a challenge, the most obvious example being the bulwer-lytton award, or the instinctive ignoring of instructions from fiction magazines that might say "we don't want any stories about murderous grandparents, French bashing, bestiality, bank robbers from the future, or kind-hearted Nazis - and especially do not try to be super brilliant and funny and send us your story about kind-hearted Nazi bank-robbing french-bashing grandparents that like killing people and having sexy fun times with barnyard animals! Because every original thinker like you thinks they are the first to have come up with that idea!" and then as a writer you feel challenged to do exactly what they say they don't want because what a glorious triumph if you manage to outdo everyone and get your dreck published because it's dreck that is so bad it's good!

It does not seem like there are lots of people who are perversely inclined to write a story with all these tropes and words in it, but surely there must be some, because if you make something that beats the LLM (by being creatively good) using all the crap the LLM uses, it would seem some sort of John Henry triumph (discounting the final end of John Henry of course, which is a real downer)
by djoldman | 2026-03-08 00:26:10+00:00
I don't understand what the problem is. TFA makes many references to "literary culture" degrading.. does he mean that readers were better off when the big 5 or 6 controlled the mast majority of new books?

The number of new books available exploded after 2000 (yes, way way before AI).

Readers are arguably better off than they ever have been in terms of variety.
by gruez | 2026-03-08 00:26:17+00:00
>Make that 1003+ times. At least in my part of the US, even a pretty modest-size city will have multiple zip codes.

Is that an issue? Who cares that new york city has 20+ zip codes? Just fill autofill "new york city, new york".

>for example, some zip's are just for Post Office Boxes.

Again, is it bad except for some joker who wants something sent to an invalid address?
by kelnos | 2026-03-08 00:26:35+00:00
I wouldn't call that bloat; certainly we've been complaining about software bloat as long as I've been into computers, but at that time, software was simply pushing the capabilities of the hardware, and often running into walls.

These days, we value developer productivity over performance optimization, so we have stuff like Electron apps. The reason behind it is that CPUs (and RAM quantity, for the most part) are so far ahead of regular desktop applications that it doesn't matter. In the 80s and 90s, the hardware could barely keep up with decently-optimized software that wanted to do anything interesting.
by thayne | 2026-03-08 00:26:37+00:00
I think the closest thing to an exemplary stdlin is rust's std. I think it strikes a good balance between being too small or too big. Unfortunately, what rust doesn't really have (yet) is a "blessed" set of libraries to supplement the stdlib.

The problems with a big "batteries included" standard library like go or python strives for, are that you will inevitably leave things out that at least some people consider "basic", like uuid, and parts of stdlib will probably have lower quality than third party libraries, like pythons urllib or gos log package, and it is constrained by needing to maintain backwards compatibility and being tied to the language's release cycle.
by diavelguru | 2026-03-08 00:27:11+00:00
This is a real thing. I spent all of January doing Greenfield development using Claude (I finished the requirements) and all I can say is thank goodness I had the Max 5x plan and not the 20x as I got breaks once the tokens were used up till the next cycle. I was forced to get up and do something else. That something else was biking, rowing, walking. My productivity had never been higher but at what cost? My health no thanks. So I'm glad I'm using the time till token reset for my health. I time it perfectly. I do a walk, row, bike for 1 hour then as I arrive back the tokens are reset. I get like 3 hours nonstop use per token batch with the 5x plan. I've been thinking about going 20x but am scared...
by tokyobreakfast | 2026-03-08 00:27:19+00:00
> Instead, learn to use your browser's autofill feature, and design your sites with it in mind. If you do it right the user literally doesn't have to type a single character.

Funny that the best solution is circa-1997 Netscape 2.0-level technology, while everyone iterates on how we can make everyone's life worse with even more unnecessary JavaScript. Like we all collectively forgot what the <FORM> tag does.

To type an address on a letter, something a 5 year-old could do with a crayon.

Address forms, with unnecessary and unhelpful drop-downs, many of which reject keyboard input and require use of a mouse to scroll through them, are the bane of my existence.
What's the deal with distributed SYN DOS attacks
by xmddmx | 2026-03-08 00:28:07+00:00
I run some boutique web servers (Apache on macOS, https on 443) and most of them were being weird - occasional slowdowns. Apache logs were mostly blank. CPU and RAM were close to 0% usage.

But even a curl test on localhost was showing 1,2, or more seconds longer slowdown.s

After a lot of digging, realized that I was victim of some sort of DOS attack, which appeared to be a SYN flood attack.

In a normal SYN flood attack the SYN packets are sent from one IP address then never reply, leaving the server in a state with multiple connections stuck in the "SYN_RECVD" state.

In this attack, the SYN packets are actually being "sent" from multiple IPs - and one theory is that these are forged IPs, so the attack is really a reflection attack, where the attacker sends a forged IP SYN to my server, which replies (several times with SYN ACK)

I blocked the IP block /16 at the firewall and all was well, but this made me wonder:

How are modern OS's so vulnerable to this? On my macOS server, I could run netstat -anp tcp | grep '\.443 ' and see about 128 entries stuck in "SYN_RCVD" at which point the server just went to pieces.

In other words, if my server received 128 "SYN" packets, it would die for about 75 seconds.

Is this a macOS only problem? Are other OS's susceptible to this?

for this question, please consider "Use CloudFlare" off limits. I'm more interested in why modern OSs can be so fragile to a few (forged) TCP packets.
by abeppu | 2026-03-08 00:28:18+00:00
but the experiments it did that "improved" validation BPB in the GH screenshot were all basically hyperparameter changes right? So is this better or worse, either per experiment or per unit time, than hyperparameter tuning techniques that don't involve an LLM? It's not clear from this if the LLM is more or less making random changes which sometimes work , and or the LLM thinking actually finds "good" changes because of what the LLM has internalized.
E.g. how does this compare to a hyperparameter tuning pass with e.g. BayesOpt that does the same number of 5-min training experiments?
by antinomicus | 2026-03-08 00:28:22+00:00
I’ve taken it one step further. YouTube as a front end is awful, and I’ve had enough. Tons of little dark patterns made to keep you on the site, annoying algorithms taking you places you never want to go, shitty ai slop, the whole nine yards. But I still like certain channels. As a result I’m doing everything self hosted now - not just YouTube but literally every single piece of digital media I consume. For YouTube I had to create a rotating pool of 5 residential ISP proxies - replaced as soon as YouTube download bot restrictions kick in - and rotated weekly either way.

With this I am able to get all my favorite subs onto my actual hard drive, with some extra awesome features as a result: I vibe coded a little helper app that lets me query the transcript of the video and ask questions about what they say, using cheap haiku queries. I can also get my subs onto my jellyfin server and be able to view it in there on any device. Even comments get downloaded.

All these streamers have gone too far trying to maximize engagement and have broken the social contract, so I see this as totally fair game.
by psyklic | 2026-03-08 00:28:34+00:00
I highly doubt collaborators are thinking less of you for not having more publications! After all, if they are collaborators they've already decided to work with you.

My understanding is you were awarded a PhD but with the minimum number of papers? This sounds completely normal. If you are trying for faculty positions it may appear "thin", but in industry will make you stand out for many jobs. In AI, there are many researchers who don't have a PhD!

It does sound awkward if asked why you didn't write more papers, but you can just discuss some of the challenges you faced in your existing works rather than getting into personal details.
by phoronixrly | 2026-03-08 00:28:56+00:00
Where the definition of 'benchmarks' is actually slapping an OS, then proceeding to run the so called Phoronix Test Suite promptly followed by an apples to oranges comparison...

My favourites were the comparisons of FreeBSD and Linux coming to the conclusion that FreeBSD is slower. Until you look under the hood and see that both are tested in a configuration with a desktop environment.

Or the good old ZFS tests that were coming up with nonsensical results because of gross misconfiguration and/or total lack of understanding how the FS works...

But hey, the click/ragebait is on point in both these cases!
by 8organicbits | 2026-03-08 00:29:50+00:00
There's a few messages it can show:

const msgs = [
`Yes, we know ${country} exists. We're very proud of you.<br><br>This site is about US address forms — the ones that make <em>Americans</em> scroll past Turkmenistan 200 times a year. You have your own postal code problems. We believe in you.`,
`We see you're visiting from ${country}. Welcome. We regret to inform you that this rant is specifically about American address forms, which are — and we cannot stress this enough — <em>unbelievably bad</em>.<br><br>Your country probably has its own postal code horrors. We'd love to hear about them: <a href='mailto:shame@zipcodefirst.com'>shame@zipcodefirst.com</a>`,
`Hello from across the pond (or whichever body of water separates us from ${country}). This is a US ZIP code website. We are aware that other countries exist. We just have 160 million addresses and a 50-state dropdown to be mad about first.<br><br>Your frustrations are valid. Your postal codes are also useful. Put them first too.`
];
by zeehio | 2026-03-08 00:30:03+00:00
It should be at least "Put country first, then ask for zip code".

08036 Barcelona, Barcelona, Spain

08036 Hainesport, New Jersey, USA

It does make some sense to go from most general (country) to more specific (address) instead of the opposite, so the form can implement better auto completions.

However in practice postal addresses are not that clean so simple dumb forms are usually better, because it's easy for exceptions to be missed by auto completion algorithms. I would be very pissed if I had to type the zip code above and then correct the wrong guess on every website.

Either you are helpful and guess correctly or you don't guess at all.
by tzs | 2026-03-08 00:31:19+00:00
I'm basically using Docker on Mac as an alternative to VMWare Fusion with a much faster startup startup time and more flexible directory sharing.

I want to avoid port mapping because I already have things on the Mac using the ports that my things in the container are using.

I have a test environment that can run in a VM, container, or an actual machine like an RPi. It has copies of most of our live systems, with customer data removed. It is designed so that as much as possible things inside it run with the exact same configuration they do live. The web sites in then are on ports 80 and 443, MySQL/MariaDB is on 3306, and so on. Similarly, when I'm working on something that needs to access those services from outside the test system I want to as much as possible use the same configuration they will use when live, so they want to connect to those same port numbers.

Thus I need the test environment to have its own IP that the Mac can reach.

Or maybe not...I just remembered something from long ago. I wanted a simpler way to access things inside the firewall at work than using whatever crappy VPN we had, so I made a poor man's VPN with ssh. If I needed to access things on say port 80 and 3306 on host foo at work, I'd ssh to somewhere I could ssh to inside the firewall at work, setting that up to forward say local 10080 and 13306 to foo:80 and foo:3306. I'd add an /etc/hosts entry at foo giving it some unused address like 10.10.10.1. Then I'd use ipfw to set it up so that any attempt to connect to 10.10.10.1:80 or 10.10.10.1:3306 would get forwarded to 127.0.0.1:10080 or 127.0.0.1:13306, respectively. That worked great until Apple replaced ipfw with something else. By then we had a decent VPN for work and so I no longer need my poor man's VPN and didn't look into how to do this in whatever replaced ipfw.

Learning how to do that in whatever Apple now uses might be a nice approach. I'll have to look into that.
by drecked | 2026-03-08 00:32:18+00:00
That’s not a misleading statement for what they’re trying to say.

They wouldn’t disagree with what you say. The point they’re making is we don’t know. Maybe 92% of the remaining money is being spent usefully towards programs and 0% as overhead. Or maybe 0% usefully and 92% as overhead.

The IRS disclosure requirements are not sufficient to know. And yet we will give those donating to both organizations the same tax breaks.

The argument is to increase disclosure requirements for organizations through which so much money is passing so that we have a better idea as to how nether those tax breaks we’re giving are actually giving us any value in return.
by seanmcdirmid | 2026-03-08 00:32:19+00:00
Yes, you can dedicate extra tokens to draw state diagrams, the LLM can actually do that, if you don't have it generating one or more design documents before you are writing code you are doing that wrong. I still don't get how that is different from what humans are doing.

> Most of the time I write down enough for myself to be convinced that the desing solves the problem.

Again, why do you assume we aren't doing the same thing with LLMs?

1. Spec
2. A bunch of design documents based off of spec
3. Edge case identification
4. test plan
5. a bunch of tests
6. commented code

Whenever I here someone here on HN state that the only way to code with an AI is via vibe coding I just die a bit more inside.
by unshavedyak | 2026-03-08 00:32:53+00:00
I don’t get this tbh, I use Claude too and my issue is the opposite - too many small breaks. Every time I hit enter my brain wants to checkout because the agent just spins while it creates thousands of tokens and churns on the subject. Even if it’s only 2m, that’s 2m where my mind has nothing to work on.

Hard to stay in flow and engaged.

Feels weirdly similar to being interrupted over slack.
by wingmanjd | 2026-03-08 00:33:22+00:00
Was working on a rebuild of my gaming rig when I noticed the NexusMods repository marked as read-only by the author.

Their Trello board [1] for their roadmap also seems to be gone.

[1] https://trello.com/b/gPzMuIr3/nexus-mods-app-roadmap
by SigmundA | 2026-03-08 00:34:06+00:00
https://en.wikipedia.org/wiki/Natural_key you should have learned learn this in your courses.

Clam down, I am not suggesting using this for actual domain entity keys, these are used in place of enums and have their advantages. I have doing this a long time and it has not bit me, I have also seen many other system designed this way as well working just fine.

Using an incrementing surrogate key for say postal state code serves no purpose other than making things harder to use and debug. Most systems have many code values such as this and using surrogate key would lead to a bunch of overlapping hard to distinguish int data that leads to all sorts of issues.
by furyofantares | 2026-03-08 00:35:01+00:00
Sure, but jumping from its amazing these things work for code at all to software engineering is solved is something only grifters or those drunk on the kool-aid did.

I do agree that it was thought that these llm-agents would be extremely useful and that is why they were developed, and I happen to believe they in fact are extremely useful (without disagreeing that much of the stuff in the article definitely does happen.)

I just sort of resent the setup that it was supposed to be X but actually it failed, when not only is there only minor evidence that it failed, but it was only a brief period in time when it was supposed to be X.
by satvikpendem | 2026-03-08 00:35:06+00:00
Again, IP is an outdated concept in this day and age. In all honestly there shouldn't even be the notion of fair use, any transformative work should be allowed. There is nothing about LLM training that isn't transformative, just as, well, grinding meat from a steak into stuffed sausages transforms it.

I'm not even talking about big corporations with proprietary models, in fact I oppose their not being open source or weight, I want more open models not fewer as that at least democratizes the value of LLMs. The worst case is having copyright hawks allowing regulatory capture by big AI corps by pushing regulations about licensing content, which, of course, no open model company will be able to afford in the future. I find that infinitely worse than having more lax copyright laws, where only a few corporations can tell you want to think via usage of their LLMs.

Lastly, no one can tell me from first principles why LLM training is bad, on the copyright side, other than, it just is, because copyright law dictates it so. Perhaps copyright law is what needs to be abolished, not LLMs.
by tokyobreakfast | 2026-03-08 00:35:35+00:00
I don't remember asking for "efficiency" in typing out an address, something we teach children how to do. It doesn't seem like a societal problem worth iterating over.

These tools are more than often wrong, and cause more grief for the user than any potential help it could provide.

There is no developer in the world that knows this data better than the person typing it into the form.