MurphyA/hacker-news huggingface dataset:
Show HN: Dirsv – live reload server for dir browsing, GFM, and more filetypes
by letientai299 | 2026-03-04 09:21:38+00:00
I write a lot of markdown in Neovim — learning notes with KaTeX math, design docs with Mermaid/D2 diagrams, cross ... I also browse repos offline and preview static sites. No single tool handled all of that with live reload. So I built dirsv.

It's a single Go binary with an embedded web UI, use fsnotify for watching filesystem, and send WebSocket events to reload the browser page.

I also build dirsv.nvim that auto start dirsv at repo root (or current working dir if it's not a git repo), then open right URL for current buffer in the browser.

Disclosure: majority of the code was written by claude, incrementally, while I'm doing code review, testing and designing.
by sd9 | 2026-03-04 09:23:15+00:00
I've recently got into red/greed TDD with claude code, and I have to agree that it seems like the right way to go.

As my projects were growing in complexity and scope, I found myself worrying that we were building things that would subtly break other parts of the application. Because of the limited context windows, it was clear that after a certain size, Claude kind of stops understanding how the work you're doing interacts with the rest of the system. Tests help protect against that.

Red/green TDD specifically ensures that the current work is quite focused on the thing that you're actually trying to accomplish, with the added benefit of growing the test suite over time.

It's also easier than ever to create comprehensive integration test suites - my most valuable tests are tests that test entire user facing workflows with only UI elements, using a real backend.
by d0nk3yhm | 2026-03-04 09:23:15+00:00
I made a debugger toolkit that runs as an injected DLL and hosts an MCP server inside any x64 process.

I’ve been using it for a couple of weeks now, and it has made reverse engineering much faster for me. Work that used to take hours now takes a fraction of the time. I’ve already used it for a few game modding projects, and it works especially well when combined with an SDK dump of the target, using Claude or Codex having the dump as context.

It also pairs nicely with a Ghidra or IDA MCP setup if you want to dig deeper during analysis (if you don't have function names or classes dump to work with.)

Sharing it here in case it’s useful to others
by mathw | 2026-03-04 09:23:22+00:00
Reactive UIs may have been made popular on the web, where they're an absolute nightmare, but native code does them better still.

Best time I ever had in a job was writing WPF applications in C# using ReactiveUI. Once we really understood the underlying model we were plugging stuff together so easily. It is a really good model, but I can't see how React is a good example of it.

Of course I had lots to complain about then, WPF had bugs, C# has a number of big problems, but it was, overall, very nice.
by mrkeen | 2026-03-04 09:23:27+00:00
> The future we are barreling towards is one where the PM is the most important role in a company

Our productivity went up when our PM was absent. The impact was significant enough to be recorded and discussed at the following retro. And it's happened more than once.

We work on software systems. The PM larps as a software professional. When the PM is absent, our standups are rich with discussion about the state of the software, and what the next step is. When the PM is present, he is an information sink, not an information source. He asks stupid questions and needs things dumbed down. The developer's goal is to make sure the software works for the customer, now and forever. The PMs goal is to report to his boss, who is even less in touch with what's going.

There is no glamour in 'make the system fulfil its primary purpose', so the PM will always pull engineering focus away from that.
by pjc50 | 2026-03-04 09:23:34+00:00
The problem with this discussion is that this is a wonk solution for wonkish times. You're trying to thread the needle between various reasonable compromises. Ironically due to social media, that is simply not how politics and lawmaking works any more. Instead it's an emotionally driven fight between various different sorts of moral panic, and the only option is to get people more mad about surveillance than "think of the children".

You might be able to get somewhere by getting a tech company on your side, but they generally also hate adult content and don't mind banning it entirely.

(people are not going to get age verification _banned_ any time soon! That's simply not going to happen!)
by ferdzo | 2026-03-04 09:24:10+00:00
It's an interesting feature, but it's pushing my buttons lately. Specifically on Cloudflare it is on by default, and on the free tier you can't disable it and you need a business plan for it. Which I think is stupid, but never the less it's causing us problems. We are trying some split-dns setup for a company "intranet", and if the site's have be accessed before, the ECH is remembered. So the browser tries and it eventually fails with ECH Error or on Firefox it just hangs like it's loading all the time. And it's so frustrating, because sometimes it works, sometimes it doesn't, you can clear cache and stuff and it still won't work, sometimes it works in Incognito sometimes it doesn't. This is not a real problem, but since we haven't fully switched to the "intranet" and we use some of the WAF features of Cloudflare sometimes it is so frustrating.
by luke14free | 2026-03-04 09:24:21+00:00
Hey HN,

We built a benchmark that tests how LLMs behave when they have to hold a difficult debate position against an adversary.

We took 6 frontier models, paired them in structured disputes (business conflicts, ethics dilemmas, property disputes, family disagreements), and forced them to argue opposing sides before a third LLM mediator. Each model gets a position to defend and a fixed number of turns. A separate judge panel scores the outcome.

The interesting part isn't who "wins" but rather what the disputes reveal about post-training behavior. Some models fold almost immediately, conceding points they shouldn't. Others hold firm on weak positions when a smarter move would be strategic compromise.

We ran this as a Swiss tournament (like chess) - 10 rounds, ~300 matches total, every case played twice with sides swapped to cancel position bias. Three independent frontier judge LLMs score each ruling, majority vote decides the outcome.

A couple of things we noticed:
- models tuned hardest to be agreeable are the ones that lose most, they tend to concede points mid-argument even when holding a strong position
- some models argue much better when they're on the "sympathetic" or "morally comfortable" side of a dispute than when they're assigned the harsher position. E.g., a model might crush it defending a tenant against eviction but argue poorly when it has to defend the landlord's right to evict

P.S. For every match read the full argument transcript.
by ceritium | 2026-03-04 09:24:33+00:00
Great, I have a MacBook Pro M5 for work which i know IS really fast because the whole suite of specs run in les than two minutes, but except for that my "old" air m1 with 16g of ram feels super snappy.

I am just excited waiting future releases (in 5 or 10 years) able to run local llms for coding.
by kingname | 2026-03-04 09:24:41+00:00
Like most of you, I've lost count of how many times I've gone through this loop: try my usual password → "must contain a special character" → try again → "cannot be the same as your last 3 passwords" → give up and reset.

The irony is that every website already has these composition rules — they just don't show them until you fail. So I built a Chrome extension that surfaces the password requirements directly below the input field before you start typing.

How it works:

* Detects password fields automatically on any website

* Looks up the site's password rules from a community-maintained database

* Displays min/max length, required character types, special character restrictions, etc. as a small card below the input

The extension never reads, stores, or transmits your actual passwords. It only displays publicly available composition rules. No account required, no tracking — just an anonymous ID to prevent spam contributions.

The rule database currently covers 30+ major sites (Chase, Google, Microsoft, etc.) and is fully community-driven — anyone can contribute missing rules. The whole thing is open source.

I'd love feedback from the HN community, especially:

Sites you'd want covered that aren't in the database yet

Ideas for detecting password rules automatically (scraping help text, etc.)

Whether this is something you'd actually install

GitHub: https://github.com/kingname/dont-reset-password

Landing page: https://drp.kingname.info
by rs545837 | 2026-03-04 09:24:54+00:00
That's exactly what inspect does (https://github.com/ataraxy-labs/inspect). It uses sem's entity graph to triage PRs: classifies every change, scores risk based on blast radius and dependents, and groups related changes together.

We are still benchmarking it on diverse benchmarks, and working on it as a research direction. Also working on a diff viewer in rust.
by ksaj | 2026-03-04 09:25:18+00:00
I think it is fair to say that internal dialog includes whatever mode someone primarily thinks with internally. If it is words, images, or kinesthetic, only the modality is different. I don't see how these modes wouldn't constitute internal dialog if that's how people think internally. These are the primary ways people generally do form their internal world.

There are also olfactory (imagine smelling cinnamon in a slice of apple pie) and gustatory (think of vinegar). These two don't tend to occur in dialog form, but they can enhance or reinforce the other modes. Animals like dogs might not agree with that suggestion.
by Traster | 2026-03-04 09:27:03+00:00
I think this is... fine? Am I just totally naive. I think it's fine to say "You don't really have privacy on this app" - as long as there are relatively good options of apps that do have privacy (and I think there are). TikTok is really a public by default type of social media, there's not much idea of mutual following or closed groups. So sure, you don't have privacy on tiktok, if you want it you can move to snapchat or signal or whatever platform of your choice.

Like, it's literally a platform that was run under the watchful eye of the CCP, and now the US version is some kleptocratic nightmare, so I just don't see the point in expecting some sort of principled stance out of them.

In some ways I think it's worse for places like Facebook to "care about privacy" and use E2EE but then massively under-resource policing of CSAM on their platform. If you're going to embrace 'privacy' I do think it's on you to also then put additional resources into tackling the downsides of that.
by AnthonyMouse | 2026-03-04 09:27:30+00:00
> If there's no particular problem with schemes that are like that then we don't necessarily need a blanket ban on age verification.

There is a problem with schemes like that.

The way computer security works is, attacks always get better, they never get worse. A scheme that nobody has found any privacy holes in when it's enacted will have one found a week after.

The way governments work is, the compromise bill passes if the people who care about privacy support it because then it has the votes of the people who care about privacy and the people who want to ID everyone. But then when the vulnerability is found, the people who care about privacy can't get it fixed because they can't pass a new bill without also having the votes of the people who want to ID everyone, and those people already have what they want. More specifically, many of them then have what they really want, which is to invade everyone's privacy, as they were hoping to do once the vulnerability was found.

Which means you need it to be perfect the first time or it's already ossified and can't be fixed. But the chances of that happening in practice are zero, which means it needs to not happen at all.
by arch-choot | 2026-03-04 09:27:45+00:00
Glad that it's published, I'd been following it since ESNI draft days. Was pretty useful back when I was in India since Jio randomly blocked websites, and cloudflare adopted the ESNI draft on its servers as did Firefox client side which made their SNI based blocking easy to bypass.

There was a period where I think both disabled ESNI support as work was made on ECH, which now is pretty far along. I was even able to setup a forked nginx w/ ECH support to build a client(browser) tester[0].

Hopefully now ECH can get more mainstream in HTTPS servers allowing for some fun configs.

A pretty interesting feature of ECH is that the server does not need to validate the public name (it MAY) , so clients can use public_name's that middleboxes (read: censors) approve to connect to other websites. I'm trying to get this added to the RustTLS client[1], now might be a good time to pick that back up.

[0] https://rfc9849.mywaifu.best:3443/
[1] https://github.com/rustls/rustls/issues/2741
by hresvelgr | 2026-03-04 09:27:50+00:00
> It is much closer to proper engineering.

I would not equate software engineering to "proper" engineering insofar as being uttered in the same sentence as mechanical, chemical, or electrical engineering.

The cost of code is collapsing because web development is not broadly rigorous, robust software was never a priority, and everyone knows it. The people complaining that AI isn't good enough yet don't grasp that neither are many who are in the profession currently.
by akimbostrawman | 2026-03-04 09:28:05+00:00
Let's see how much those EU charter papers are worth when you get arrested for a tweet, which happens a lot.

Vague Hate speech laws alone can utterly remove any of those "human rights". In Germany and the UK people get charged for jokes or sarcastically criticizing politicians all the time. That is not free speech or even free expression regardless how much you want to cope to own musk or whoever the news told you to hate this week.
by llbbdd | 2026-03-04 09:28:36+00:00
As far as I can tell after a quick Google, you can't share your Qt UI with the browser version of your app. Considering that "lite" browser-based versions of apps are a very common funnel to a more featureful desktop version, it makes sense to just use the UI tools that already work and provide a common experience everywhere.

The same search incidentally turned up that Qt requires a paid license for commercial projects, which is surprising to me and obviously makes it an even less attractive choice than Electron. Being less useful and costing more isn't a great combo.
by chneu | 2026-03-04 09:28:41+00:00
Traffic behavior, in general in the PNW, has gotten way worse. When I say worse I mean selfish. I think since COVID people are just more selfish.

I don't just mean assholes who do what they want. People just don't give a crap about others on the road at all anymore. A lot of folks who probably think they're driving "safe" are just driving selfishly slow and not following the law(super late blinkers, failing to move predictably with traffic, braking in traffic long before entering a turn lane).

It's definitely worse nowadays. I can think of plenty of reasons why. But really I think our society, generally, has started to reward selfish behavior. Or at least not punish it nearly enough to deter it's spread.
Ask HN: How do you catch OpenAPI drift before the UI breaks?
by losalah | 2026-03-04 09:29:22+00:00
OpenAPI feels great until it doesn’t.

Our loop is always the same:
A UI flow breaks → backend says “spec is outdated” → someone spends 30–60 minutes in Devtools figuring out what the server actually returned → then we argue whether backend/spec/frontend should change.

I want drift to be caught during normal dev/staging usage while clicking through the app. Real traffic, real accounts, real data. Not just CI tests validating what we already expect.

If your team handles this well, what works?

Do you do runtime validation (client/proxy) that logs schema mismatches with enough context to fix fast (operationId, request id, response body/diff)?
Gateway enforcement?
Contract tests that actually reflect reality?
Something else boring but reliable?

Also, what’s the slow part for you when drift happens, mapping to the right operation, getting a repro across envs/accounts, or turning Devtools into a clean ticket/PR?
by Nursie | 2026-03-04 09:30:35+00:00
> You need to 100% trust those verification services.

First link - mitigation: use a well supported standard like OIDC, not a home-cooked scheme. Duh.

Second link - this is part of the problem such schemes as verifiable credentials are designed to address, random third parties collecting ID they don't need.

Yes, any system needs to be executed well. Neither of these really display that.
by Terr_ | 2026-03-04 09:30:40+00:00
The way I see it, I don't have much direct control over the actualities of that kind of nation-state spying stuff. However:

1. I can direct my consumer-dollars towards the vendors that promise to respect ownership and privacy in general, and they will also have the most to lose if they are caught enabling spying.

2. Defense in depth. Security features generally add to the spying's difficulty, expense, or risk of detection, and that in turn decreases the incentive for abuse.
by conartist6 | 2026-03-04 09:32:48+00:00
Wow, I read your company description and I can confirm that we are competitors in the fiercest, most direct sense. We're both want to create the dev platform of the future, but our philosophies could not be any more polar opposite.

I hate AI. I fucking hate it. It doesn't help that the people who are infatuated with it keep shitting on me endlessly. 100,000 people scream that I'm obsolete, I'm replaceable, that I'm effectively worthless without an AI by my side, without that big ol condom stretched over my brain.

So out of spite, perhaps, I give my blood sweat and tears to my work and what I build I build for others who care so much it hurts and who live their struggles in blood and in sweat and in tears. My wrists are in so much pain that I can barely sleep at night but I don't stop coding.

You make clear that you will fight to give AI as much advantage as it can possibly have over people. "We're done building for human hands," says your website.

I will fight with all I have to give human hands as much advantage as they can get over AI.
by benj111 | 2026-03-04 09:33:52+00:00
I think the 'children can't consent' concept generally works.

I think the 'animals can't consent' thing is a retroactive justification for what is either ick, or a religious hangover.

I've had female dogs on heat try to hump me. Is that not consent?

We don't get dogs permission before breeding them.

The concept of bodily autonomy for animals is basically non existent.

The argument was originally that it was 'unnatural' but gay rights put the nail in the coffin there. 'consent' sounds good, but it isn't what's going on. It's the same 'unnatural' position, without the intellectual honesty.

Problem for me is. I kind of agree with the current cultural position. But there's no actual framework around it, and I don't like arbitrary rules for arbitrary reasons.
by chneu | 2026-03-04 09:34:04+00:00
I'm American and I find the way Americans misuse words, or completely misrepresent a concept, so we don't have to accept our failings to be really short sighted.

Americans lie to ourselves constantly to perpetuate our mistakes. We twist the meaning of words so we don't have to admit how selfish/shitty we can be.

You're right. Most Americans won't come out and say what they mean, so they'll dance around it. That's how so many racist Americans can say they aren't racist.
by 9935c101ab17a66 | 2026-03-04 09:34:53+00:00
That article is hardly conclusive. It states the biggest reason for the unpopular response was a belief that the incidence of traffic accidents involving young children walking to school increased. It also states that wasn’t factually supported.

It also cites one opinion poll. And we have to keep in mind this happened FIFTY years ago.

I’m not even a permanent DST advocate. It’s just weird to me the link you shared does nothing to substantiate your position.

Update: my suspicions were correct — there was a public panic caused by parents groups that had no basis in fact:

> Considerable opposition to observing DST during the winter had come from school groups, such as the National School Boards Association, which expressed concern over darkness during the morning school commute.[47][48]

> When members of Congress introduced legislation to repeal the practice, they stated it jeopardized children's safety, citing the deaths of eight schoolchildren in Florida since DST had been enacted a few weeks prior

Ironically:

> A meta-analysis by Rutgers researchers found that permanent DST would eliminate 171 pedestrian fatalities (a 13% reduction) per year
by AdamN | 2026-03-04 09:34:54+00:00
Oh man I hated that monitor. It's the only one I've ever bothered to go through the return process for. I was excited about the aspect ratio but the pixel density was just terrible for me.

I love my LG UltraFines though. I'm tempted by the upgrade though because my displays are dual 24" and I wouldn't mind just going to a single 27" display so I can focus better.
by replooda | 2026-03-04 09:35:27+00:00
1. He spoke truth. xkcd 538 may make people believe and claim 2+2=5, but it won't rewrite math or make a previous claim of 4 less correct.

2. If you think a post like his can invite no serious negative consequences at all, thus requiring no modicum of courage, we'd all like to hear about your past few years in a bunker.

3. If nothing else, the other post is useful, in that it provided additional information. Yours carries all the value black-pill bromides usually do, which is...
by dubeye | 2026-03-04 09:36:15+00:00
he doesn't need to process every invite. There is the murky middle ground, but it would be easy enough to pick out one a week say, from the list, as there are still tells (often related to details which deviate from generic) that allow quite reliable selection.

If nothing jumps out, it's not like he is losing out, it's just 10 minutes a week work to find that genuine invite.

I suspect it's more the human admin around the invite that is grating. It's not just AI invites that mess you about

I'm not doubting spam exists, but there is many using AI as an excuse to cut services they have other motives for avoiding
by nineteen999 | 2026-03-04 09:36:47+00:00
Flipside: how much RAM and storage do you need? What do you need it for?
What are you going to fill it with? Vibe code? Porn? Pirated movies? One man's treasure is another's trash I suppose.

FWIW I didn't downvote you, I don't have much use for a Rust compiler at all, let alone a toy one written in PHP.

"It's time to end this madness" - this is like trying to shut the barn doors after the horses have bolted and are on a cruise ship that's already sailed, drinking martinis by the pool.

People are having fun with a new way to code, trying things out they couldn't have ever done before. It's been just over a year since Claude code was launched, blowing the doors off all of the other coding models. Compared to the years of hype around cryptocoins and all the GPU cycles wasted on that, this is a bresh of fresh air for many people.
by MrBuddyCasino | 2026-03-04 09:37:00+00:00
It seems a lot of people have forgotten how BigCorp IT used to work.

- request some HW to run $service

- the "IT dept" (really, self-interested gatekeeper) might give you something now, or in two weeks, or god help you if they need to order new hardware then its in two months, best case

- there will be various weird rules on how the on-prem HW is run, who has access etc, hindering developer productivity even further

- the hardware might get insanely oversubscribed so your service gets half a cpu core with 1GB RAM, because perverse incentives mean the "IT dept" gets rewarded for minimizing cost, while the price is paid by someone else

- and so on...

The cloud is a way around this political minefield.