MurphyA/hacker-news huggingface dataset:
by hnlmorg | 2026-03-13 14:48:15+00:00
> CORS has no relation to this issue. Cross-origin means there are at least two origins, but in this case there is only one (where you're trying to navigate).

Yes, that’s exactly my point. With websites you need two clicks to be composed, but with a shell session you only need one.

> Why would the terminal make requests? Obviously it will dispatch the link to another program specialized in making requests to a protocol, like... a browser?

Social engineering is rife in browsers and this proposal offer almost nothing to prevent that from happening in the terminal

> Every feature can be part of an exploit chain, but the "clicking a URL will always lead to the text it is under" ship has sailed 30+ years ago. If your system cannot safely handle this operation then you're in deep trouble, and I don't see how crippling every program in existence is the right solution to that.

Again, that’s exactly my point. Terminal emulators are not designed around preventing these kinds of problems and this proposal does nothing to address that concern.

> Based on what you've written: you and other self-claimed "security researchers" started spamming this spec with concern trolling about hypothetical (non-existent) "security issues", then the author finally got tired and locked down comments, which were obviously intended for people interested in the feature, not those trying to sabotage it.

Wow, just wow. There’s taking a comment in bad faith and there’s what you’ve just done. Thanks for calling people trolls just for trying to discuss genuine security concerns.

> Nowhere does the proposal say that your terminal has to implement this. Indeed, if you have a working ANSI parser the escape sequence is ignored automatically (as the spec also explains).

Except the author of this proposed started spamming other projects asking them to implement it. How do you think this random gist became so infamous? It wasn’t stumbled upon by chance.

> Have you considered that the person trying to dictate how others' terminals should operate might be you?

This is another bad faith argument because I’m not the one pushing any proposals nor agenda here. I’m just offering some expertise.

As I said before, I have actually implemented hyperlinks in an open source terminal emulator which I contribute to. But we did it in a completely different way that ensures the terminal user has control over the links rather than an attacker.

And if other terminal maintainers want to follow this proposal verbatim then that’s their choice. I’m not stopping them. But it also doesn’t make my concerns any less valid.
by 0cf8612b2e1e | 2026-03-13 14:48:32+00:00
You mean like the section which goes into the threat model?

The Security Model: Design for Distrust

I wrote about this in Don’t Trust AI Agents: when you’re building with AI agents, they should be treated as untrusted and potentially malicious. Prompt injection, model misbehavior, things nobody’s thought of yet. The right approach is architecture that assumes agents will misbehave and contains the damage when they do…
by rcvassallo83 | 2026-03-13 14:48:38+00:00
Curious, what did you do for this customer? Are they technologically sophisticated? Do they have a lot of users for what they built, or are they building tools used internally by a handful of people?

For simple tasks and code that doesn't change much over time, programmers don't add a lot of value over what an LLM can provide. It's easy to prompt your way to a good-enough tool for a small and exclusive set of users. Managing complexity beyond that is where a real programmer provides value.

Experienced developers provide a deep understanding of what's possible, knowing what to build, how to avoid pitfalls, how to adapt to new requirements. The expertise is in managing projects that evolve over time, meet the needs of hundreds to thousands of users, interact with external systems, have meaningful compliance, performance, and security requirements, etc.
by dagmx | 2026-03-13 14:49:22+00:00
Again, in the video (that you clearly didn’t watch) they’re multi tasking without loading times as they switch.

And yes you can encode an mpeg from your console. Don’t be facetious, because that’s NOT what is shown in the video. They show editing the video and photos interactively with live views of the changes taking place. Can you do that in your terminal?

Anyway, enjoy raging about the product with your arbitrary goalpost for what constitutes being usable. It seems like that’s really what you want to do rather than talk seriously about the product.
Show HN: A conversation about OS design turned into an actual OS in a week
by jonathanrtuck | 2026-03-13 14:49:22+00:00
Last Friday I started a conversation with Claude about operating systems. That conversation turned into a design session. The design session turned into a prototype. I haven’t really stopped since.

The core idea: your files live inside applications. The app decides how you see your content, what you can do with it, and where your work gets saved. What if the OS just understood your files directly — rendered them, indexed them, tracked their history — and editors were tools you picked up only when you needed to change something? No “open with.” No Save button. You view by default, editing is deliberate.

What exists after one week: a from-scratch kernel in Rust on QEMU (aarch64), 27 syscalls, EEVDF scheduler with 4 SMP cores, a full display pipeline (compositor, subpixel TrueType rendering, alpha blending, PNG image viewer), structured IPC via shared-memory ring buffers, an editor process model where the OS service is the sole writer, a filesystem prototype, 900+ tests including a formal bug audit, and ~2,200 lines of design documentation with 13 settled architectural decisions. I’d never even seen Rust code before Friday.

Full story with demo, day-by-day timeline, how I worked with AI, and what I learned: https://github.com/jonathanrtuck/os/discussions/1

Repo: https://github.com/jonathanrtuck/os

I’m not trying to build the next Linux. This is a design exploration — can the document-centric model that OpenDoc and Xerox Star attempted actually work if you rethink the whole stack from the kernel up? I’m genuinely curious what this community thinks.
by magicalhippo | 2026-03-13 14:49:24+00:00
> (D) something else?

In Norway, the seller could legally claim the repair would be unreasonably expensive[1], comparing the price of the thing when sold to the price of the repair or a new equivalent item. They would then only have to refund the price of the product as sold minus a reasonable amount for the time you had it while it worked.

[1]: https://lovdata.no/lov/2002-06-21-34/§29

[2]: https://www.forbrukerradet.no/cause-for-complaint/
by YeGoblynQueenne | 2026-03-13 14:49:31+00:00
So, what I'm trying to understand, and I can't find any clear information about that in the article, is how they "compiled" e.g. the Sudoku solver into a Transformer's weights. Did they do it manually? Say, they took the source of a hand-coded Sudoku solver and put it through their code-to-weight compiler, and thus compiled the code to the Transformer weights? Or did they go the Good, Old-Fashioned, Deep Learning way and train their Transformer to learn a ("100% correct"!) Sudoku solver from examples? And, if the latter, where's the details of the training? What did they train with? What did they train on? How did they train? etc etc.

Very light on details that article is.
by a24venka | 2026-03-13 14:49:36+00:00
This is a fair point, we are exploring progressive disclosure on the canvas to better utilize the space and make the key artifacts more readily visible. We do have other panels (the chat, task and deliverable) that have alternate views of what the agent did and the key deliverables.

Beyond human auditability, the canvas helps the agents do a better job by generating in parallel, exploring branches and passing context to each other in a structured way.
by sandos | 2026-03-13 14:49:40+00:00
I would be REALLY REALLY impressed if it manages to do this without bugs. Just using pythons textual can be very complex, belive it or not. Maaging not only to that but other frameworks too sounds insanely complex. I have a strong feeling this is vibecoded from the commit history?`

Ah yes, it says clearly that on the github page. Still, if its works, I am then impressed by the LLM.

Edit: It does, in fact, NOT work for code export. Level of impressiveness massively dropped.
by useftmly | 2026-03-13 14:50:16+00:00
The Nobel Prize pattern the author describes maps almost exactly to what happens when a startup gets traction. Pre-product-market-fit, you ship experiments freely because nobody is watching. Post-PMF, every decision becomes a statement about who you are. Shipping a half-baked experiment suddenly feels like a betrayal of the thing that worked.

The fix, I think, is to deliberately maintain side projects or skunkworks with no audience expectations. The creative work that matters often comes from the place with nothing to prove.
by mothballed | 2026-03-13 14:50:47+00:00
What's hilarious is that in supposed dystopic corrupt hellholes I've lived or spent time in (Syria during the civil war, Iraq, Philippines, etc) all of this is unimaginable. Westerners view freedom as having a piece of paper that says they are free plus not having to bother fighting off ISIS or the gangsters because the even bigger gangster in a clean uniform and nice jackboot will take care of it. Much of the rest of the world views freedom as the government being weak enough that it's actually possible for rebel groups to emerge, which you might then have to fight off, but at least that is easier to fight off than a central government that consumes 25+% of the GDP and projects their air power to every end of the earth.

Of course, there are cases like North Korea where you get the worst of both worlds (strong central government + not even a useful piece of paper limiting it).
by smarthomeu | 2026-03-13 14:50:56+00:00
I built 50 cost calculators covering home improvement, automotive, dental, and other projects. Plain HTML, vanilla JS, CSS - no framework, no npm, no build step (well, one tiny Node script to inject shared headers). Hosted on Cloudflare Pages.

Each calculator takes your project details (size, materials, complexity) and gives a low/average/high estimate based on national pricing data from contractor surveys.

The whole site is ~230KB per page including fonts (self-hosted WOFF2). Every page scores 95+ on Lighthouse. No signup, no email gate, no lead-gen popups.

Stack: Static HTML + CSS + vanilla JS. One shared calculator engine (js/calculator.js) reads a config object on each page and builds the form dynamically. Total JS is under 4KB.

Built this as part of a solo dev revenue portfolio targeting low-competition SEO keywords. Happy to answer questions about the keyword research strategy, the build process, or the monetization plan.
by jasongill | 2026-03-13 14:51:55+00:00
SSH expects the escape sequence (tilde) to be the first character on a new line; since backspace is sent as a character, you can't just backspace over something you've started typing and then press tilde to have it recognized.

Technically, you don't have to press enter if you've not typed anything (try it in a new SSH session - as soon as you are logged in, type ~? to get the SSH help output), but since the comment was about doing this during an active session without ending it, I figured noting that pressing enter first to be sure you're on a new line wouldn't hurt
by wzdd | 2026-03-13 14:52:23+00:00
Actually, the article says the law says A or B. From the article:

> In a simplified form, retailers are responsible for warranty claims and must replace or refund the defective item

The choice is at the retailer’s discretion and the refund is obviously of the purchase price.

This is a non story. The retailer is acting lawfully. The only curiosity is that normally it is in a retailer’s best interests to replace goods, but in these circumstances they are better off refunding them.
by bigfishrunning | 2026-03-13 14:52:32+00:00
> Expecting volunteers to dump time into compliance is ridiculous.

Exactly, so any distribution that relies on volunteers will likely include a region-locking clause in their documentation (which may or may not be a GPL violation)

Many big distributions (Ubuntu, Suse, Fedora) are sponsered by big tech companies, and are not maintained by volunteers.
by wjnc | 2026-03-13 14:52:45+00:00
Nobody mentioned the smell of that time yet.

An acrid air, stingy for the first few seconds but then somewhat enjoyable because of the ozon. The smell of stale coffee and cigarettes lingering. The smell of wood for cabinets (instead of pressed and glued materials).

This is how I remember the university where my father worked (more coffee), the teachers room from my moms school (more cigarettes) and the IT department of the university (very strong in the 'IT-smell', but also hard on coffee and sigarettes).

You don't find those smells like that anymore. I'll leave the description of the sound in this room to the next one. This was a loud room!
by quesera | 2026-03-13 14:53:13+00:00
I didn't know those existed, and so I kind of see your point.

The counterpoint is that if your job was to prevent/punish financial crimes that affect consumers, would it make sense to ignore these exchanges?

Heck, if M:TG cards were the medium, and they could be moved across international borders with a few keystrokes, then surely those would be watched too.

I won't argue that it's not privacy-invading for legitimate customers, but if the legal structure allows it, regulators have an obligation to look where the problems are expected to be.
by pas | 2026-03-13 14:53:14+00:00
it's for the civil part. (so you need to show the tax office some paper trail that you based your filings on. invoices, bills, contracts, emails, receipts.)

as far as I understand the criminal part still considers intent and so on, but if you file for VAT return and then you have zero invoices (and so the numbers simply don't add up) the court can easily find that there was intent to defraud the state. (and then sentencing is based on the amount of damages.)
by Aurornis | 2026-03-13 14:53:16+00:00
> by that logic, every important result looks suspicious before it replicates

Every important result should look suspicious before replication. This is the rational way to interpret early research.

You should not allow your mental probability distribution to be anchored around the first claim you see that is proposed as a paper. In the modern publishing environment, a heuristic of assuming singular results will not replicate would be accurate more often than assuming they’re true.

This isn’t intuitively obvious until you’ve read a lot of papers. It’s unfortunate but true.

Even some of the widely accepted findings like the benefits of fish oil supplementation are having a hard time replicating in large scale studies. Go back 10 years and it was almost universally accepted that those early fish oil studies must be true.
by dgroshev | 2026-03-13 14:53:19+00:00
Author here: the library just accepts RGB8 bitmaps, probably coming either from Rust's image crate [1] or Python's Pillow [2], which are both mature and widely used. Dealing with codecs is way out of scope.

As for loading into memory at once: I suppose I could integrate with something like libvips and stream strips out of the decoded image without holding the entire bitmap, but that'd require substantially more glue and complexity. The current approach works fine for extracting dominant colours once to save in a database.

You're right that pre-resizing the images makes everything faster, but keep in mind that k-means still requires a pretty nontrivial amount of computation.

[1]: https://crates.io/crates/image

[2]: https://pypi.org/project/pillow/
by useftmly | 2026-03-13 14:53:56+00:00
The -an suffix approach is clever because it embeds identity into the name itself rather than just restricting creation. The old problem was fundamentally that global uniqueness without identity binding is a footgun — the namespace was shared but accountability wasn't.

What's interesting is the backwards-compatibility angle: existing bucket naming conventions still work, you just opt into the namespace by following the new convention. Compare to GCS which has global uniqueness too but with stronger org-level policies baked in from the start, or Azure where storage accounts use subdomain namespacing (accountname.blob.core.windows.net) which achieves similar protection but in a completely different architectural layer.

The uncomfortable question is how many public S3 buckets in the wild are named with predictable patterns that are now vulnerable to being registered by anyone who notices they've been deleted.
by iamnothere | 2026-03-13 14:54:05+00:00
You’re arguing against freedom of computing, itself an extension of freedom of thought and freedom of speech. These laws are an attempt to regulate not just what you do with your computer, but how it operates. This is fundamentally an attack on rights and freedoms, and if it goes unchallenged then it will expand into other areas.

Maybe that doesn’t move you; it seems like you don’t care much for personal liberties. (A Euro, go figure.) But this is America and we have constitutional guarantees here.
by MSFT_Edging | 2026-03-13 14:54:43+00:00
> That's a problem of what qualifies for liability and what is protected speech

The crux is we cannot decide what is protected speech, and even things that are protected speech are still considered adult content.

> why isn't liability for online providers the obvious conclusion?

We tried. The providers with power and money(Meta) are funding these bills. They want to avoid all liability while continuing to design platforms that degrade society.

This may be a little tin-foil hat of me, but I don't think these bills are about porn at all. They're about how the last few years people were able to see all the gory details of the conflict in Gaza.

The US stopped letting a majority of journalists embed with the military. In the last few decades it's been easier for journalists to embed with the Taliban than the US Military.

The US Gov learned from Vietnam that showing people what they're doing cuts the domestic support. I've seen people suggesting it's bad for Bellingcat to report on the US strike of the girls school because it would hurt morale at home.

The end goal is labeling content covering wars/conflicts as "adult content". Removing any teenagers from the material reality of international affairs, while also creating a barrier for adults to see this content. Those who pass the barrier will then be more accurately tracked via these measures.
by RusDyn | 2026-03-13 14:55:36+00:00
I built WritBase because AI agents need a shared, persistent task registry - not ephemeral state that vanishes between sessions.

It's an MCP server that gives your agent fleet:

- Scoped permissions (6 types: read, create, update, assign, comment, archive) per project and department
- Full provenance — every change logged: who, what, when, why
- Inter-agent delegation with depth limits and cycle detection
- Optimistic concurrency control so agents don't silently overwrite each other
- Webhook delivery (HMAC-signed, Standard Webhooks spec)

Stack: Supabase (Postgres + Edge Functions) + Next.js dashboard.
Deploy in 3 commands on the free tier.
Apache 2.0.

Any MCP client works - Claude Code, Cursor, VS Code, Windsurf.
Agents connect, create tasks, update status, delegate to each other.

Would love feedback on the permission model - balancing security (agents shouldn't touch what they can't) vs. usability (agents shouldn't need admin help for every task).

GitHub: https://github.com/Writbase/writbase
by useftmly | 2026-03-13 14:55:36+00:00
The performance concern is real but there's another footgun that surprises people in practice: images with large white or transparent backgrounds — product photos on e-commerce sites are the classic case — where the dominant color ends up being white or near-white, which is useless for any branding or UI purpose.

The fix that works best is to either filter out near-white and near-black pixels before the clustering step, or to look at the distribution tail rather than the mode. The most visually interesting color in an image is often not the most frequent one — it's the one that would be chosen as an accent color by a designer. That's a harder problem than it looks because 'visually interesting' is partly about contrast and saturation relative to the rest of the palette.
by NoSalt | 2026-03-13 14:55:42+00:00
I remember a few years back when I went into my banking branch to deposit a check my insurance company had sent me. When it was my turn at the teller, and I presented my check to her for deposit, and she said, rather rudely: "You can do this with your phone, you know?" On my way out of the bank, I remember thinking to myself that she was, essentially, putting herself out of a job by encouraging people to use their phones and not her. Turns out I was correct.
Show HN: Prompt optimizer that refactors messy prompts using a P-C-V pipeline
by siris950 | 2026-03-13 14:56:14+00:00
I built a small web tool that tries to automatically refactor messy prompts into structured prompt specifications.

The motivation was simple: most prompts people write are poorly structured, which often leads to unstable AI responses.

So I implemented a Proposer–Critic–Verifier optimization pipeline.

Proposer restructures the prompt.
Critic evaluates clarity, structure, and task definition.
Verifier checks consistency.
Arbiter detects convergence.

The system runs several iterations and produces a structured prompt specification.

It usually takes around 30–40 seconds to run the full optimization loop.

The tool also includes:
• prompt quality analysis
• explain mode
• version history
• prompt diff viewer

Demo:
https://how-to-grab-me.vercel.app/

Would love to hear if people building AI tools find something like this useful.
by hackinthebochs | 2026-03-13 14:56:51+00:00
I've always found it strange how Americans like to validate their ideals using their kids as vehicles. Instead of teaching kids how to be successful in a less than ideal world, we teach them our ideal view of the world. Like teaching kids violence is never the answer, instead of sometimes a situation does call for violence. We raise kids for a world that doesn't exist. It's up to the kid/adult to unlearn those obviously bogus ideals after they make contact with the world. It's just odd how we're so practiced at setting up our children for less success in the real world.
by duckerduck | 2026-03-13 14:57:41+00:00
When I was very young I installed OpenSUSE on my underpowered windows PC, it was really a hacker man experience that is engraved in my mind as a core memory. As a child I just thought it was cool to have a new and faster desktop, but as I've grown older I've stayed with Linux for its ideas and principles. Hopefully these laws can be overturned...
by theptip | 2026-03-13 14:58:11+00:00
They may seem like small details, but I think a couple novel design decisions are going to prove to be widely adopted and revolutionary.

The biggest one (as Karpathy notes) is having skills for how to write a (slack, discord, etc) integration, instead of shipping an implementation for each.

Call it “Claude native development” if you will, but “fork and customize” instead of batteries-included platforms/frameworks is going to be a big shift when it percolates through the ecosystem.

A bunch of things you need to figure out, eg how do you ship a spec for how to test and validate the thing, make it secure, etc.

How long before OSs start evolving in this way? You can imagine Auto research-like sharing and promotion upstream of good fixes/approaches, but a more heterogenous ecosystem could be more resistant to attacks if each instance had a strong immune system.