MurphyA/hacker-news huggingface dataset:
by xivzgrev | 2026-03-10 21:29:59+00:00
"In the next 10 years, Colley’s goal is to earn enough to go back to making Roblox games as a hobby."

Kid is making $400k PER MONTH...and he wants to do this for 10 YEARS before he is comfortable retiring. Apparently his FIRE number is $40M.

Everyone's threshold is different and personal. But I think it can reflect a level of anxiety about the cost of living. You aren't OK having $1M or even $10M - you need something far beyond before you feel OK to quit. It's not his fault, more of something the young generations are facing as their parents struggle with the relentless cost of living vs stagnated wages for most except the "laptop class".
by Imustaskforhelp | 2026-03-10 21:30:09+00:00
Some of it has to do with roblox being free.

(I don't have a minecraft account) but Trust me when I say this but within developing countries especially. You can find 3-4 people out of 1 who plays on hypixel but can't because they can't pay for the game usually when we are really young which is also roblox's most major userbase.

I can imagine Hypixel being atleast 2x and a rough estimate of 5x more the size if they support Cracked Minecraft accounts for example.

Btw, this is also the reason why aternos is so popular within some communities because a free server which can have cracked option. Sign me up starts happening in bulk.

Me and my friends had an aternos server. It was truly something out of this world meeting them tomorrow after having 10 people together in a minecraft server.

I was the person though who spent way too much time and had less stacked gear lol in the end because some of my friends were like bandits haha, who stole my stuff from caves and in general, I have spent much of my time in minecraft during the starting (nothing -> diamond) then afterwards (diamond -> end/netherite)

Anyways my point is that we all could've definitely been on hypixel and something similar if Hypixel supported crack client. For example 11 of us or more played the game one time or another (not sure) within our single class of 50 people and only one of the guys had an minecraft account.

One of my friends literally got into some cash-app type stuff with a shady tetris to earn money app which showed ads to earn 25$ just so that he can buy minecraft to play on hypixel and the game fundamentally required something impossible and my friend felt so depressed at the time and he's one of the smartest people I know. A) people are easy to scam, B) he and many of us had so much desperation to play on hypixel in general.

You can get an alt (and I used to) for free or very cheap which would work everywhere unless on hypixel which had stricter rules and the difference between account prices could be 10x back or more that at that point its just better to make a minecraft account just for hypixel or similar. (I remember seeing accounts for 3$ or something that would work everywhere except hypixel)

I asked him if I should write a blog post to name and fame the company but he denied and he was truly sad that day :(

All of this combined can show how Roblox truly hits a jackpot with it being a free game. Most people might not pay but because of the perceived fame of the game and the number of people playing it. The people who pay would be more likely to pay and I see some people/kids who really look for ways to make robux online.

So with all of this, its easy to see how these (usually teen developers like us) can make something which can land 100k$ as unachievable that sounds.

one of my friends racked in quite a lot of money making 3d sprites in blender for these roblox people and in exchange used to have them buy blender extensions. Those extensions were truly a lot of money if he had to go buy them.
by trevxr | 2026-03-10 21:30:20+00:00
Hi HN, I posted Rampart here a few weeks ago. Since then it's gone from v0.1 to v0.8.6 with some substantial changes, so I wanted to share an update.

Rampart is a policy engine that sits between AI coding agents (Claude Code, Codex, Cursor, Cline, OpenClaw etc.) and your operating system. Every shell command, file operation, and MCP tool call gets evaluated against your rules before it executes. Denied actions never run.

What's new since last time:

- Response scanning: blocks credentials (AWS keys, SSH private keys, GitHub tokens) from entering the agent's context window. This is the gap most people miss: your .env file is inside your project folder, so directory sandboxing doesn't help. Rampart catches the secret in the tool response before the agent ever sees it.

- Temporary rules: `rampart allow "docker build " --for 1h` expires automatically. `--once` for single use. Useful when you need to unblock something without permanently weakening your policy.

-Policy from audit: `rampart init --from-audit` watches what your agent does in monitor mode and generates a policy to match. Easier than writing rules by hand.

- MCP proxy: `rampart mcp -- npx @server` enforces policy on any MCP server. `rampart mcp scan` auto-generates deny-by-default policy from a server's tool definitions.

- Native integrations: one-command setup for Claude Code (PreToolUse hooks), Codex (LD_PRELOAD), or any agent (shell wrapping).

Architecture: single Go binary, YAML policies, <10µs per evaluation, hash-chained audit trail. Intercepts via native agent hooks, LD_PRELOAD, $SHELL wrapping, or MCP proxy depending on the agent.

Some interesting things we found while dogfooding: agent runtimes wrap commands in `/bin/bash -c`, which broke our glob-based command matching (fixed in v0.8.6). Claude Code's enterprise sandbox uses bubblewrap with `--unshare-net` but restores network via a Unix socket proxy bridge — Rampart's hooks fire before the sandbox, so they're complementary. And our own self-modification protection caught the agent trying to run `rampart allow` to weaken its own rules during development.

Apache 2.0, no dependencies, ~58k lines of Go. Happy to answer questions about the architecture or threat model.
Trion: A Behavioral Oracle That Derived Truth from On-Chain History Not Price
by analyshd | 2026-03-10 21:30:43+00:00
Over $3B has been lost to oracle manipulation in DeFi — the systems that tell protocols what assets are worth can be temporarily fooled by moving spot price on a reference exchange.
TRION reads the accumulated behavioral history of every asset instead of price. Behavioral history cannot be temporarily moved.
The novel security contribution: security based on Kolmogorov complexity of behavioral history — ontologically impossible to fake, not computationally hard.
I am the solo inventor. Complete specification is CC0. 57 formulas, 19 signal types, 4 formal proofs.
Looking for a technical co-founder — a Rust or Python engineer who reads the spec and wants to build Level 0 together. Happy to answer any technical questions.
by moosehater | 2026-03-10 21:31:26+00:00
Do you feel like you are still learning about the programming language(s) and other technologies you are using? Or do you feel like you are already a master at them?

Do you ever take the time to validate what one of the agents produces by going to the docs? Or is all debugging/changing of the code done via LLMs/agents?

I'm more like level 2 right now and genuinely curious if you feel like learning continues for you (besides with agentic orchestration, etc.) And if not, whether or not you think that matters.
by adrian_b | 2026-03-10 21:31:53+00:00
It does not even break classical encryption (though classical encryption needs higher security margins if attacks using quantum computers are possible).

It breaks only classical public-key encryption.

Public-key encryption is not necessary within a closed organization, e.g. for the personal use of an individual or group of individuals, or within a spy agency or for military applications, though it can make slightly simpler the process of key distribution, which otherwise needs an initial physical pairing between devices.

The most important application of public-key encryption is for allowing relations between parties who have never met in person, by the use of digital signatures and of Diffie-Hellman key establishment protocols.

This has been essential to enable online shopping and online banking, but not for the more traditional uses of cryptography.
by jandrese | 2026-03-10 21:32:15+00:00
I think the minivan is the perfect vehicle for electrification. It's used mostly for short trips. Getting rid of the engine means you can greatly shorten the nose and improve cargo area, or just make it easier to park. People don't use them to tow. The people who own them have a garage. Yet nobody seems all that interested in making one. The EV Hummer doesn't count, it's a giant expensive monstrosity. You want something affordable and kinda boring but practical.
by crazygringo | 2026-03-10 21:32:40+00:00
What you write doesn't make any sense. You say it's "silly to expect a comment to be neutral" but the comment is "as neutral as possible" and then answer if the commenter was neutral with "yes". Those aren't consistent.

I don't know what definitions of neutral or value judgment you're using, but I hope you can use this as a learning opportunity. The original comment has the obvious implicit judgment that a greater CO2 footprint is a bad thing. This is shared context. It is so obvious it doesn't need to be explicitly stated, any more than "murdering people is bad". The purpose of the comment is clearly to shame the person for having such a high carbon footprint, otherwise there's no purpose in bringing it up. I don't know what your purpose was in trying to deny that. But if you genuinely didn't understand before, I hope now you do, and that this has been helpful in improving your reading comprehension or understanding of shared/implicit context.
by dang | 2026-03-10 21:32:41+00:00
The problem is that there are now so many attempts to get "real quality feedback" that the entire system is in danger of collapsing. Imagine how you'd feel if Gemini pointed the rest of the internet at your inbox! Or a thousand people showed up in your garden, all wanting your attention. This isn't so far from that; HN is not so big a place, and there are only two of us supporting it.

What would be best is for you to poke around the site a bit and get familiar enough with it to decide if you'd like to be a part of the community or not. If so, you're welcome! you aren't the first person to feel a bit lost here as a new user, because the site is rather minimal and cryptic—but your eyes will adjust if you keep reading it over time.

If, on the other hand, you're not interested, that's totally ok, but then please don't try to promote your projects here. HN is a community, and the way to get attention for your things is to first give attention to other people's things.

I don't want to specify X, Y, Z criteria technically because that would just be an invitation to game the system. Worse, Gemini will then tell you "first do X, then do Y and Z, and then you'll get that 'real quality feedback'".

What I want Gemini to tell you (and everyone else!) is "don't use Hacker News primarily for promotion - they have a rule against that. Instead, participate in the community for the intended reason—intellectual curiosity—and after a while, it will become clear how the culture works and how to share your projects there".
by zamalek | 2026-03-10 21:32:43+00:00
> Review by a senior is one of the biggest "silver bullet" illusions managers suffer from.

My manager has been urging us to truly vibe code, just yesterday saying that "language is irrelevant because we've reached the point where it works - so you don't need to see it." This article is a godsend; I'll take this flawed silver bullet any day of the week.
by smsm42 | 2026-03-10 21:33:08+00:00
PRNG is not intended to use information sent into it in a substantive way (in other words, for PRNG does not matter if what you feed into is is Shakespeare's sonnets or white noise). Sure, if your machine is an electronic analogue of a shredder, then yes, the result is not a derivative work in any sensible meaning. But LLMs are not that kind of a machine.
by cpgxiii | 2026-03-10 21:34:05+00:00
I think the story is a bit more complicated. Core succeeded precisely because Intel had both the low-power experience with Pentium-M and the high-power experience with Netburst. The P4 architecture told them a lot about what was and wasn't viable and at what complexity. When you look at the successor generations from Core, what you see are a lot of more complex P4-like features being re-added, but with the benefits of improved microarch and fab processes. Obviously we will never know, but I don't think you would get to Haswell or Skylake in the form they were without the learning experience of the P4.

In comparison, I think Arm is actually a very strong cautionary tale that focusing on power will not get you to performance. Arm processors remained pretty poor performance until designers from other CPU families entirely (PowerPC and Intel) took it on at Apple and basically dragged Arm to the performance level they are today.
by CuriouslyC | 2026-03-10 21:34:16+00:00
The thing blocking level 8 isn't the difficulty of orchestration, it's the cost of validation. The quality of your software is a function of the amount of time you've spent validating it, and if you produce 100x more code in a given time frame, that code is going to get 1/100th as much validation, and your product will be lower quality as a result.

Spec driven development can reduce the amount of re-implementation that is required due to requirements errors, but we need faster validation cycles. I wrote a rant about this topic: https://sibylline.dev/articles/2026-01-27-stop-orchestrating...
by tzs | 2026-03-10 21:35:31+00:00
Note that this is talking about ads when you watch via their TV app, not when you watch on your computer in an ordinary browser.

The ad experience in the browser is interesting. I've watched several videos today with no ad blocking and have only seen a couple of ads which were skippable after 5 seconds.

For the last year I've doing this on YouTube.

• I start the day with ad blocking turned off.

• As long as all the ads I get are skippable after 5 seconds, and any ads that are not pre-roll ads are not too close to the previous ad, I just skip and my annoyance level stays low. I get annoyed if the ads during the content are not well spread out.

• If they put in a non-skippable ad but it is close to 5 seconds (6 seconds and 15 seconds seem to be the two shortest lengths for non-skippable ads) and it is not followed immediately by another ad I treat it like a 5 second skippable ad.

• If a 6 second non-skippable ad is followed immediately by a skippable after 5 seconds ad, my annoyance level rises some. If they only do this a couple times in a day I'll probably let it slide.

• Any 15 second or more non-skippable ad raises my annoyance level a lot.

• If my annoyance level gets too high, by either (1) a 15+ second non-skippable ad or (2) too many of those things that are annoying but not as annoying then ad blocking gets turned on any open YouTube tabs get refreshed so it will apply to them.

• Any ad they show me that is actually relevant and useful is not counted when evaluating annoyance level. This only happens rarely.

I haven't kept stats but it definitely feels like over the first couple of months of doing this they changed the ad lengths, intervals, and how often they show me non-skippable ads in a way that avoids annoying me enough to turn on ad blocking. I now sometimes go over a week without turning on the ad blocker.
If the differentiation is domain and GTM?
by alwynjosephp | 2026-03-10 21:35:51+00:00
I’d appreciate perspectives from founders here (and any YC partners if they happen to see this).

I’m starting a company in the supply chain software space. My background is in the industry — ~20 years selling enterprise technology into supply chain leaders. I’ve previously helped scale enterprise tech businesses from tens of millions to hundreds of millions in revenue in COO/CEO roles.

The product I’m building focuses on autonomous decision systems for supply chains — essentially software that can sense disruptions, decide optimal responses, and execute actions across enterprise systems.

One important nuance:
I’m building this on top of an existing AI platform partner that already provides a lot of the core technical infrastructure (data ingestion, agents, orchestration, etc.). The differentiation we’re adding is deep supply chain domain intelligence, decision workflows, and enterprise GTM.

Because of that, I’ve been approaching the team build as:

• founder (domain + product + GTM)
• strong hired CTO / engineering team

rather than searching for a technical co-founder with equal equity.

I know YC and many investors often emphasize having a technical co-founder, which makes sense for companies where the core risk is building the technology itself.

In this case, the bigger risk feels like productizing the domain problem and selling into enterprise supply chain organizations, not inventing new AI infrastructure.

So my question:

In situations where the differentiation is domain + product + GTM, and the underlying technology layer is already available, is a technical co-founder still essential?

Or is hiring a strong CTO early a reasonable path?

Curious how YC partners or founders here think about this tradeoff.

Would appreciate candid perspectives.
by slyfox125 | 2026-03-10 21:35:59+00:00
For those who are only familiar with Linux (or Windows): don't relegate yourself to any one system. FreeBSD has its benefits and so does Linux (and Windows, though that shrinks by the day - and MacOS). Use the best tool for the job at hand and enjoy things for what they are. Personally, I find enjoyment and usefulness in all of them (BSD, Linux, Mac, Windows), and use them all regularly (daily to weekly).
by dillon971222 | 2026-03-10 21:36:11+00:00
Senior Software Engineer with 8+ years building scalable microservices and distributed systems on AWS. Expertise in Node.js, Nest.js, and Go, designing Swagger-based APIs and event-driven architectures using DDD and CQRS patterns. Proven track record improving system reliability and reducing latency by up to 40% through Lambda integrations, containerized CI/CD pipelines, and robust unit and integration testing. Experienced in fintech solutions, including wallet integrations and KYC workflows, within agile teams.

Location: 6164 Reynolds St, West Palm Beach, FL 33411
Remote: Yes
Willing to relocate: Yes

Technologies:
• Languages: Golang, Python, JavaScript/TypeScript, SQL, Bash
• Frontend: React, Next.js, Vue.js, Tailwind CSS, Redux
• Backend & Architecture: Golang (Gin, Echo, gRPC), Microservices, Event-Driven Architecture, REST & GraphQL APIs, Domain-Driven
Design (DDD), CQRS, Async Messaging, Spring, Node.js, Nest.js, API Design
• Cloud & DevOps: Docker, Kubernetes, Helm, AWS (ECS, Lambda, S3, RDS, CloudWatch), Terraform, GitHub Actions, Jenkins, CI/CD
pipelines
• Data & Messaging: PostgreSQL, MongoDB, Redis, Kafka, RabbitMQ, MySQL, Supabase, Relational Databases, Non-relational Databases
• Observability & Security: Prometheus, Grafana, OpenTelemetry, Jaeger, API Security, OAuth2, JWT, Role-based Access Controls
• Professional Practices & Paradigms: Agile/Scrum, Code Reviews, System Design, Mentorship, Reactive Programming, Object-Oriented Programming (OOP)

Resume/CV: https://drive.google.com/file/d/1_G2AHfA1aKyTw9XyyL2_ygjyQY5...
Email: dillonjohnson971222@gmail.com
by hexaga | 2026-03-10 21:36:16+00:00
There is a nontrivial amount of RL training (RLHF, RLVR, ...), so it would be reasonable to call it an RL model.

And with that comes reward hacking - which isn't really about looking for more reward but rather that the model has learned patterns of behavior that got reward in the train env.

That is, any kind of vulnerability in the train env manifests as something you'd recognize as reward hacking in the real world: making tests pass _no matter what_ (because the train env rewarded that behavior), being wildly sycophantic (because the human evaluators rewarded that behavior), etc.
by hkonte | 2026-03-10 21:36:42+00:00
The "formal letter" framing is right, and spec-driven development takes it further: you are not just writing clearly, you are decomposing the request into named sections that the model can reason about independently.

Role, context, objective, constraints, output format. These map almost directly to how a well-written spec is structured. The difference between a vague prompt and a good one is usually that the good one has all those pieces present, even if implicitly. Making them explicit and separate removes the ambiguity.

Built github.com/Nyrok/flompt around this: a visual canvas to decompose prompts into those blocks and compile to XML. The spec-driven angle validates why structure beats raw text.
Ask HN: What are some good AI usage policies?
by recvonline | 2026-03-10 21:37:42+00:00
I am looking into different AI usage policies in Open Source software.

One good example is Ghostty: https://github.com/ghostty-org/ghostty/blob/main/AI_POLICY.md

I just want to get inspired and get as much pros/cons as possible to form and write my own!
by tristramb | 2026-03-10 21:37:50+00:00
"Around Easter 1961, a course on ALGOL 60 was offered in Brighton, England, with Peter Naur, Edsger W. Dijkstra, and Peter Landin as tutors. I attended this course with my colleague in the language project, Jill Pym, our divisional Technical Manager, Roger Cook, and our Sales Manager, Paul King. It was there that I first learned about recursive procedures and saw how to program the sorting method which I had earlier found such difficulty in explaining. It was there that I wrote the procedure, immodestly named Quicksort, on which my career as a computer scientist is founded. Due credit must be paid to the genius of the designers of ALGOL 60 who included recursion in their language and enabled me to describe my invention so elegantly to the world. I have regarded it as the highest goal of programming language design to enable good ideas to be elegantly expressed."
- C.A.R Hoare, The Emperor's Old Clothes, Comm. ACM 24(2), 75-83 (February 1981).
by tylerjaywood | 2026-03-10 21:38:37+00:00
Watches are precise machinery that require maintenance and well known watch brands take great pride in the longevity of their pieces, meaning they provide support for the lifetime of the watch (you will pay for this though). Typically, every 5-10 years you send them in for a service. Overtime, the little pieces and minuscule drops of lubricant wear and age and need replaced. Visibility into these metrics can help you keep an eye out for problems.

Higher end watches also get external certifications that reflect different precision standards. Some examples: METAS, COSC, or Rolex Superlative Chronometer if you are Rolex and need to be special. They have different specs, Superlative Chronometer is +/-2 sec per day. If it's out of spec and you're under warranty, you may be entitled to a free adjustment by a service center. Otherwise, overtime, as the performance degrades, it's a signal you may need a service.

There's also the risk of magnetization. If the delicate machinery becomes magnetized, you'll see BIG swings, like +/- minutes per day. Demagnitization is something any watchmaker can do quickly. (There is inherently some risk posed by the phone itself having a lot of magnets, but modern watches are typically built to resist magnetization to varying degrees -- look at the Rolex Milgauss as an example of best-effort magnet resistance)

Watches will also perform variably depending on position. If you know your watch is -4sec/day on your wrist, but +6sec/day face down, you can effectively manage it's accuracy by placing it face down over night and never have to unscrew the crown but keep a true time. This is a very common use case.

Hope that covers the general cases. This app avoids a lot of even deeper complexity, like beat error and amplitude which are deeper metrics describing the movements performance and guide watchmakers to know which screws to adjust which way.