MurphyA/hacker-news huggingface dataset:
by lcnPylGDnU4H9OF | 2026-03-13 13:11:49+00:00
If they can't make the bucket before you do then they are not "bucket squatting", and they can't do so for a salted and hashed bucket name without knowing the salt at runtime.

The public/private distinction seems moot here, too: the salt is a throwaway since you just need the bucket name.

Even if you do need to keep track of the salt, it should be safe for the attacker to know, at least with respect to this attack, because you already own the bucket which the attacker would otherwise hoard.
by ThunderDanOAE | 2026-03-13 13:12:03+00:00
I built a small desktop tool that scans a project folder and generates a progress report based on real activity.

Workspace Snapshot Generator

It detects new and modified files, active folders, and recent development activity.

The goal is to make it easier for freelancers and small teams to explain project progress to clients.

Reports export as HTML and Markdown.

Runs locally, no Git required.

Demo:
https://daniel043apps.gumroad.com/l/wgs
by oytis | 2026-03-13 13:12:10+00:00
Yeah, that's what I mean - prototypes. The caveat is though that before agentic coding skills to build a prototype and skills to build a production system were generally the same, so a prototype did not only provide a demonstration of what is possible in general, but what your team of engineers can do specifically. Now these skills will diverge, so prototypes will not prove anything like that. They are still going to be useful for demonstrations and market research though.
by jeswin | 2026-03-13 13:13:55+00:00
> Linux gets a bad reputation because 20-ish years ago Ubuntu sent out free CDs and became the dominant OS.

I've been an Ubuntu user for 20 years, and RedHat and Suse prior to that. Ubuntu just worked. Debian had packages for everything, including from 3rd party vendors. It lets me focus on my work, and not worry about the OS, or compiling packages, or finding installers. When I had issues (rare), the large user base meant that someone had already figured out a solution to the problem.

The flavor of Linux doesn't matter so much in my opinion.
by andrewaylett | 2026-03-13 13:14:53+00:00
One big difference between the UK's historic constitutionalia and the US is that the UK generally recognises that we only do things a certain way because agreeing how to change them is too hard, while the US appears to think that they do things in their certain way because that's the right way to do them.

Specific examples for the UK: inducting politicians into the Privy Council in order to qualify them for security briefings, Henry VII powers, and ministers' authority deriving from the seal they're given by the sovereign. Which would almost make as much sense if it were a marine mammal as it does being a stamp.

The thing being, they work well enough. And if you want to replace them, you need to work out what to replace them with and how.
by xorcist | 2026-03-13 13:15:05+00:00
You may not like the trivial answer: The same way as we do everything else. How do we get people to show up for work? How do we get people to respect data security boundaries? None of these are questions of technology. The answer is culture. We need to create a strong shared culture of caring, by hiring people that care and putting them in an environment where caring is appreciated.
by aeyes | 2026-03-13 13:15:26+00:00
Mark Pilgrim isn't even the original author, he just ported the C version to Python and contributed nothing to it for the last 10 years.

If you take 5 minutes to look at the code you'll see that v7 works in a completely different way, it mostly uses machine learning models instead of heuristics. Even if you compare the UTF8 or UTF16 detection code you'll see that they have absolutely nothing in common.

Its just API compatible and the API is basically 3 functions.

If he had published this under a different name nobody would have challenged it.
by theowaway213456 | 2026-03-13 13:15:42+00:00
You can tunnel a port over SSH and get a web UI locally, though it's not commonly done. I feel like more people would actually do this if tunneling a port was just ever so slightly easier (like, you're already SSH'd into a box, then you run a command, then you somehow automatically get a tunnel for that command's UI port plus a local browser window open to the page)
by uecker | 2026-03-13 13:16:18+00:00
I am not sure this is a mischaracterization. The C provenance model also exists, even as a form of an ISO TS. The Rust model copied the basic concepts and even the terminology from us. The reason the C model is is not in ISO C 23 but in a separate TS is because compilers are not able to implement correctly at this time due to bugs. But neither do they implement the Rust model correctly because of the same bugs.

One should also point out that basic provenance is already part of the ISO C standard for a long time (but not under this name). That a precise technical specification is needed is only because the exact details were not clear and there are inconsistencies and differences between and even inside compilers. Rust having a precise model does not make these problems automatically go away just as the ISO TS does not.
by nzach | 2026-03-13 13:16:24+00:00
I not sure that Embedding Anomaly Detection as he described is either a good general solution or practical.

I don't think it is practical because it means for every new chunk you embed into your database you need to first compare it with every other chunk you ever indexed. This means the larger your repository gets, the slower it becomes to add new data.

And in general it doesn't seems like a good approach because I have a feeling that in the real work is pretty common to have quite significant overlap between documents. Let me give one example, imagine you create a database with all the interviews rms (Richard Stallman) ever gave out. In this database you will have a lot of chunks that talk about how "Linux is actually GNU/Linux"[0], but this doesn't mean there is anything wrong with these chunks.

I've been thinking about this problem while writing this response and I think there is another way to apply the idea you brought. First, instead of doing this while you are adding data you can have a 'self-healing' that is continuously running against you database and finding bad data. And second you could automate with a LLM, the approach would be send several similar chunks in a prompt like "Given the following chunks do you see anything that may break the $security_rules ? $similar_chunks". With this you can have grounding rules like "corrections of financial results need to be available at $URL"

[0] - https://www.gnu.org/gnu/incorrect-quotation.html
by mvdwoord | 2026-03-13 13:16:27+00:00
Can not see them fuck it up more than my own government spending millions to pour concrete into our own excellent natural gas wells (while selling whatever did come out under market price to other countries), and our neighbors on the east celebrating while they blow up nuclear power plants. At least the US and Israel have a chance of improving their position in the geopolitical landscape. We are just slowly then swiftly committing suicide.
by lm28469 | 2026-03-13 13:16:49+00:00
> it was decades of very intense proxy wars: Yemen, Syria, Iraq, Gaza, Lebanon. Iran didn't hesitate to attack oil assets

Compared to the US and Israel who only mind their own business and never do any shady things of course. Russia says the same thing about the US in Ukraine, but there it's a dirty propaganda lie, when it comes to Iran it's just the Real Truth ™
by aspenmartin | 2026-03-13 13:16:49+00:00
How about people that understand things are changing whether anyone likes it or not and want to stay relevant. What about the people who care about the end product and not rabbitholing design decisions on a proof of concept. What about someone who understands there is more nuance than assuming people with a different perspective on AI are lesser than or lower than people who resist the technology. You may feel you know the “right way” but to everyone else who is interested in operating in a world changing beneath our feet and not whining about the fact that everything will be different, and denigrating the people who want to succeed in it, this opinion is not exactly convincing. You want to cludge your way through a problem you’re welcome to but it’s not necessarily logical to suggest this is the only “right” way and infer that people who build with AI don’t like “understanding systems”.

When I build with AI I build things I never would have built before, and in doing so I’m exposed to technologies, designs, tools I wasn’t aware of before. I ask questions about them. Sure I don’t understand the tools as deeply as the person who wasted like 10 hours going down rabbit holes to answer a simple question, but I don’t really see that as particularly valuable.
by 8organicbits | 2026-03-13 13:16:57+00:00
There's a lot of online documentation about passive DNS. Here's one example

> Passive DNS is a historical database of how domains have resolved to IP addresses over time, collected from recursive DNS servers around the world. It has been an industry-standard tool for more than a decade.

> Spamhaus’ Passive DNS cluster handles more than 200 million DNS records per hour and stores hundreds of billions of records per month, providing you with access to a vast lake of threat intelligence data.

https://www.spamhaus.com/resource-center/what-is-passive-dns...
by neya | 2026-03-13 13:17:14+00:00
Damn, had to scroll a couple of comments to find this:

Anthropic donated $20 million to Public First Action, a PAC that promotes Republican Senator Marsha Blackburn and her sponsored Kids Online Safety Act (KOSA), a bill that will force everyone to scan their faces and IDs to use the internet under the guise of saving the children.

The legislative angle taken by companies like Anthropic is that they will provide the censorship gatekeeping infrastructure to scan all user-generated content that gets posted online for "appropriateness", guaranteeing AI providers a constant firehose of novel content they can train on and get paid for the free training. AI companies will also get paid to train on videos of everyone's faces and IDs.

As for why Blackburn supports KOSA:

Asked what conservatives’ top priorities should be right now, Senator Blackburn answered, “protecting minor children from the transgender [sic] in this culture and that influence.” She then talked about how KOSA could address this problem, and named social media platforms as places “where children are being indoctrinated.”

If Anthropic, the PACs it supports and Blackburn get their way with KOSA, the end result will be that anything posted on the internet will be able to be traced back to you.

https://www.cnbc.com/2026/02/12/anthropic-gives-20-million-t...
by lionkor | 2026-03-13 13:18:00+00:00
I fully get that! I understand how people get to that conclusion. What I don't understand is why I repeatedly see people online, also on HN (as you can see), who claim that Putin "stated" that he wants to rebuild the USSR, when I can't find any source that he did.

> making it required reading in the Russian military academies, maybe

Yeah, I think he did.

> So Putin maybe didn't say it.

That's my concern. When people make the statement that he did, when he didn't, they essentially preempt any reasonably discussion and start it off on the entirely wrong foot.

If I want to have a discussion with my neighbor about him not cleaning up his own trash, surely I would not start the discussion with "you LOVE living in trash, don't you", even if I can reasonably deduce that he does. It just turns the entire discussion hostile to make claims that aren't supported, and it weakens all subsequent arguments!
by jbstack | 2026-03-13 13:18:17+00:00
Interesting idea, but:

> Design once, generate production-ready code for your framework of choice. Switch targets without touching your design. Alpha notice: Code export is not functional yet. We're actively working on it — check back soon.

In other words, it isn't at all usable right now. You can't produce a TUI with it, not even a limited one.
by ucsandman | 2026-03-13 13:18:25+00:00
One design question I ran into was where governance should actually live in an agent stack.

If you put guardrails inside the prompt, the model can ignore them.

If you put them inside the agent framework, they can be bypassed.

DashClaw tries to solve this by intercepting actions instead of prompts. The agent can reason however it wants, but execution goes through a policy layer.

Curious how others are approaching this.
by PaulHoule | 2026-03-13 13:18:37+00:00
"A Chromebook doesn’t teach you that"

But seriously, if you go to school today they will make a point to put you on the slowest, weakest Chromebook available because they're terrified that you're going to play Krunker.

The result is you become an adult and you'll never buy a Chromebook. It's the same way that being bullied on the schoolbus means you become an adult who'll never ride public transit.

https://ithacareuse.org/

will sell you a desktop computer for around $150 (e.g. four of them for the price of a Neo) which will put an enterprising young person on a much better path to learn about computers than the Neo ever will.

Now you might say I'm being Orwellian but I really think Swift/XCode/iOS is "slavery" and the web platform is "freedom". I mean dev tools are fully competitive for the web platform, I can write my application once and run it on desktop and phone and tablet and VR headset and game consoles and all sorts of things I don't even know about it. I never have to ask permission if I want to deploy an app or update it. I don't have to pay anyone 30% of my revenue.
by happytoexplain | 2026-03-13 13:18:38+00:00
>floats can't represent whole numbers exactly as they get further from zero.

>error accumulates in floating point arithmetic, so calculated keys may not match constant keys

Yes, but the parent used a toy example. It's a programming fundamental that you shouldn't be converting magic numbers to floats or doing math with floats without considering inaccuracy. These problems apply everywhere programmers use floats - they must understand them, regardless of whether they are using them as hash keys or any other purpose.

>Do you really want 2.0 and 2.00001 to refer to different objects?

Yes, very much so. They are different values. (Assuming you are using 2.00001 as shorthand for "a float close to 2")

The advantage of common primitives being hashable is theoretically very high. In Swift (where NaN hashes to a different value every time, since that makes sense), hashable primitives makes hashability composable, so anything composed of hashable parts is hashable. And hashability is important not just for storage in maps, but all sorts of things (e.g. set membership, comparison for diffs, etc).

The upsides of floats being hashable is potentially much higher than the downsides, which mostly stem from a programmer not understanding floats, not from floats being hashable.
by daveguy | 2026-03-13 13:18:45+00:00
I think we are still 25+ years away from that kind of automation. People are still confusing plausible text generation with adaptable dynamic intelligence. See also: "Shall I implement it? No."[0] We are getting some awesome tools that sound like science fiction from decades ago, but the intelligence is hollow and brittle. In my opinion, we just don't have the algorithms or computational bandwidth necessary.

[0] https://news.ycombinator.com/item?id=47357042
by ghoulishly | 2026-03-13 13:18:49+00:00
(Author of the post here) The post was inspired by the Neo and provoked by a certain YouTuber’s review of it, but yeah it’s about the Neo in the same way that The Old Man and the Sea is about fishing.

I wrote about the Mac in general since that’s what I know, but I imagine if I grew up in the Windows world and liked Windows more, I would have a similar experience with my dad’s old ThinkPad or something.
by watwut | 2026-03-13 13:19:12+00:00
That is completely different argument. Yes, I exceeded speed limit here and there. I am not deluded enough to think it was "unavoidable" or "impossible to drive slower".

It is perfectly possible to drive and obey all speed limits. It is even technically easy. Us people choosing not to do so, because we are impatient, feeling competitive against other drivers or because we just think we can get away with it now does not make it impossible.
by snek_case | 2026-03-13 13:19:20+00:00
I've always thought of myself as more "centrist" (feel free to make fun of me), but seeing so many tech CEOs cheer for layoffs and destruction of the job market has been a bit of a wake up call. Also just being confronted with the sheer idiocy of these people. They are making hundreds of millions of dollars a year, but they barely understand the tech they are cheering for. They act as though being broadly "bullish on AI" and being overly enthusiastic about its short-term potential was some kind of visionary stance, when in fact they are just repeating the same ideas as every other idiot in the silicon valley VC bubble.

My personal bet would be that in the medium term, there will be a reversal of the idiotic belief that you can immediately just lay off developers because of LLMs. If your developers are more productive because of LLMs, you still have an advantage by having more developers than the competition. There's also a lot of institutional knowledge that's just not documented. You fire key people, you can cripple your organization.

In the longer term, I think AI will eventually take jobs, and unfortunately, it will have major negative societal impact. I doubt that our governments will be proactive in trying to anticipate this. They will just play damage control. There's probably going to be an anti-AI social movement. You'll have the confluence of more and more disinformation and AI slop online along with more and more job loss. There are probably going to be riots. Some people think UBI is inevitable. I think the problem is that if the government puts UBI in place, they will only give you the minimum necessary so that you don't starve. Just enough to afford to rent a bedroom, eat processed food and stay online all day.
by Aldipower | 2026-03-13 13:19:31+00:00
And at least the "performance nightmare" is an irony from today's perspective as the Flash player wasn't actually slow at all! It was the incapability of the Safari browser to handle plugins in a good way and on mobile devices. Today's implementations of mobile application, JavaScript heavy applications and websites are much much more performance heavy.

ActionScript3 was a very suitable language.
by MrJohz | 2026-03-13 13:19:31+00:00
More recently, it's been designed so this is the case. Namespaces, enums, and the property constructor shortcut thing were all added relatively early on, before the philosophy of "just JS + types" had been fully defined.

These days, TypeScript will only add new features if they are either JavaScript features that have reached consensus (stage 3 iirc), or exist at the type system only.

There have been attempts to add type hints directly to JavaScript, so that you really could run something like TypeScript in the browser directly (with the types being automatically stripped out), but this causes a lot of additional parsing complexity and so nothing's really come of it yet. There's also the question of how useful it would even be in the end, given you can get much the same effect by using TypeScript's JSDoc-based annotations instead of `.ts` files, if you really need to be able to run your source code directly.
by ndriscoll | 2026-03-13 13:20:39+00:00
> App and website developers shouldn't be burdened with extra costly liability

Why not? Physical businesses have liability if they provide age restricted items to children. As far as I know, strip clubs are liable for who enters. Selling alcohol to a child carries personal criminal liability for store clerks. Assuming society decides to restrict something from children, why should online businesses be exempt?

On who should be responsible, parents or businesses, historically the answer has been both. Parents have decision making authority. Businesses must not undermine that by providing service to minors.
by ROllerozxa | 2026-03-13 13:20:45+00:00
Oh yes. I'm Swedish and I do have to admit I have looked up quite a lot of people on these kinds of sites. It's become so normalised to do this even though I also feel like it would be better as a whole if they just did not exist in the first place.

Last update I heard about something being done about it was this:

https://www.regeringen.se/pressmeddelanden/2024/11/utredning...

Not sure what the current status is.
Show HN: Build Your Own OpenClaw – A step by step guide
by zane__chen | 2026-03-13 13:20:57+00:00
A step-by-step tutorial to build your own AI agent, from a simple chat loop to a lightweight version of OpenClaw.

*18 progressive steps* that teach you how to build an minimal version of OpenClaw. Each step includes:

- A `README.md` going through key components and design decision.
- A Runnable codebase.
by aspenmartin | 2026-03-13 13:21:36+00:00
I don’t know it’s fair to characterize the LLM community as being ignorant and rediscovering PSP/TCP. I in fact see that as programmers rediscovering survival analysis, and most LLM folks I know have learned these perspectives from that lens. Could be wrong about PSP, maybe things are more nuanced? But what is there that isn’t already covered by foundational statistics?
by ses1984 | 2026-03-13 13:21:36+00:00
Normally you buy into something like SP500 via something like an ETF, something with a very low fee because it’s managed entirely automatically via simple algorithms.

How can you invest in SP500 minus TSLA without racking up exorbitant fees?

Unless such a fund already exists, you’d be managing it yourself and pretty much wiping out any gains any time you rebalanced.
by Nzen | 2026-03-13 13:22:30+00:00
I recommend listening to DJ Earworm's mashup of the top song across the world [0] to hear a greater variety of countries, albeit for this or last year.

[0] https://www.youtube.com/watch?v=UDZ78RbAdxU 11 minutes

In fairness to this post, they probably posted as much as they could get easily and consistently. I feel like the same situation reigns for country history in book shops. When I go to a used book store in Queens, New York, I'm not apt to find any books about Jaipur, India. But, if I were to go to Mumbai, India, I could probably find something. So, maybe we should prevail upon or sponsor people in Africa to volunteer their lists.
by ydlr | 2026-03-13 13:23:09+00:00
When it comes to software specifically, there are a couple advantages of capitalist ownership:

1. Access to cash. While software does not require much physical capital (factories, equipment, raw materials, etc) those with capital have easier access to cash and can therefore scale much quicker.

2. Intellectual Property. In software industry, workers do not just use capital to make finished goods. They produce new capital out of their imaginations and that capital (which lasts 120 years, never breaks down, never deteriorates) is typically owned those who put up the cash. That makes their advantage grow over time.

None of that is insurmountable, but we are a long way from having the organization or political support to overcome them.
Tell HN: Claude two rate limits don't know about each other
by mustaphah | 2026-03-13 13:23:21+00:00
I was using Claude actively today right before my weekly limits reset. Weekly quota is now fresh - 0% used. But the session limit doesn't care. It's still at 100% from the previous session, so I'm locked out for another ~4 hours despite having a full week of quota available.

I get that session limits exist to manage burst load, but shouldn't a weekly reset also reset the session? Feels like a gap in the UX.

Screenshot: https://ibb.co/67D7tNHN