MurphyA/hacker-news huggingface dataset:
by GhrammR | 2026-03-04 03:55:28+00:00
I maintain open-source projects and got tired of reviewing "Agentic Slop"—PRs that contain hallucinated dependencies, unsafe memory pointers, and structural clones generated by AI tools. Existing scanners like CodeQL are too heavy to run locally on my 8GB laptop.

I built The Janitor. It is a deterministic, zero-copy static analyzer written in Rust.

The architecture relies on Tree-Sitter for polyglot parsing, memmap2 and rkyv for zero-copy registry access, and MinHash/LSH for duplicate detection. It does not use LLMs to guess intent.

The Benchmarks:
• Scans the Godot Engine (3.5M LOC) in 33 seconds using 58MB of peak RAM.
• In my recent gauntlet test, it caught GitHub's own copilot-swe-agent hallucinating a fake RCE vulnerability in the microsoft/vscode repository (PR #298806) by cross-referencing the PR text against the file-extension diff.
• It detects "Zombie Dependencies" (packages added to Cargo.toml/package.json but never imported in the source).

The CLI is free and BSL-licensed. I also built a SaaS wrapper that issues NIST FIPS 204 (ML-DSA-65) post-quantum cryptographic bonds for clean merges.

Happy to answer questions on the architecture or the memory mapping.
by vbezhenar | 2026-03-04 03:55:58+00:00
There are Intel CPUs which come with bundled RAM. For example Intel Core Ultra 5 238V. It's like SoM: RAM is mounted directly on the CPU package, not even soldered on the motherboard. I'm not sure what particular advantages does that bring over traditional packaging, maybe shorter wires to allow for faster turnarounds between CPU and RAM. But there's zero chance of upgrading or replacing RAM for sure.
by watersb | 2026-03-04 03:56:08+00:00
Although the lede suggests that this is about the consequences of healthcare costs in the United States, the research is from Denmark.

Even so:

Denmark has a universal healthcare system, [not] massive healthcare bills that usually ruin people's lives in the United States. Yet, the researchers suggest that economics still plays a big role... Patients who showed the steepest income declines had the strongest links between cancer and crime.
by albatross79 | 2026-03-04 03:56:13+00:00
It's a common sense definition that covers the broad features of AI as most people would have imagined it before LLMs came along. If you have a better one I'm open to it.

Also, agents are just LLMs with harnessing. Attaching a plow to a horse makes it more useful too, but it doesn't change the intrinsic nature of a horse.
by paulryanrogers | 2026-03-04 03:56:45+00:00
Why did Trump and friends boast about the alligators surrounding that detention camp?

They sure are in a rush to build more detention capacity, and unconcerned with the inhumane conditions therein.

Maybe we stop associating with people facilitating fascism before it reaches the point of mass graves? (Not as the only resistance, but a part.)
by Ronsenshi | 2026-03-04 03:57:30+00:00
What's weird about it? I'm not disputing that it might be fun for vibe coders. Just that they seem to really like using that particular word.

I love coding and it is fun for me. Vibe coding on the other hand - not fun at all. It feels to me like playing slots.

But then again, I never liked gambling.
by kjjoseph | 2026-03-04 03:58:40+00:00
Location: San Diego CA (USA)

Remote: Yes. I'm open to any combination of in-office or remote.

Willing to relocate: Yes. I'm a US citizen, but open to other locations if sponsorship is available.

Technologies: Mainly frontend: Javascript, Typescript, HTML, CSS, React, Vue, Sass; also have some backend experience: MySQL, Node.js, Go, PHP

Résumé/CV: https://kevinjoseph.net/resume

Email: (available at the above site)

Additional links: https://www.linkedin.com/in/kjjoseph/ https://github.com/kj-joseph

Hi, I'm Kevin. I'm an experienced (15+ years), versatile, mainly-front-end engineer. I'm seeking an opportunity to contribute to the success of a team while continuing to learn and expand my skills. I'm working in a non-technical role at the moment, but am attempting to get back into the engineering world.
by istillcantcode | 2026-03-04 03:59:13+00:00
I appreciate when games load fast (this one does). Its one of the signs I use to see if a game is worth my time. Most of the games I play, I am playing the game within 20-30 seconds of opening the game from my desktop. I'm naively assuming that in order for a game to load fast you have to have a good plan of what order to load things in. It feels like an attention to detail thing to me.
by 1vuio0pswjnm7 | 2026-03-04 03:59:14+00:00
"Siting there I realized, we were not the real target. It is the young people that are growing up conditioned to press accept, enter any details asked of them, and to not value their personal data."

I have seen (young) parents who are more addicted to this sort of careless internet use than their kids

It will take some years before the cycle is broken

Future generations will not be conditioned the same as prior ones

Perhaps "age verification" as a wake-up call could mark the beginning of the transition
by somenameforme | 2026-03-04 03:59:27+00:00
I think it's very safe to assume that no major US based platform has 'real' E2E encryption. They're almost certainly all a part of PRISM by now, and it'd contradict their obligations to enable government surveillance.

So the only thing that's different is not lying about it. Though I expect the other platforms are, like when denying they were part of PRISM, are telling half truths and just being intentionally misleading. 'We provide complete E2E encryption [using deterministically generated keys which can be recreated on demand].'
by neya | 2026-03-04 03:59:42+00:00
The fundamental problem is the verification loop for the average developer is grounded not in tests, but with results. Write code, reload browser, check output. Does it work the way I want? Good. We're done here.

Not write code, write tests, ensure all test-cases are covered. Now, imagine such a flaky foundation is used to build on top of even more untested code. That's how bad quality software (that's usually unfixable without a major re-write) is born.

Also, most vibe-coders don't have enough experience/knowledge to figure out what is wrong with the code generated by the AI. For that, you need to know more than the AI and have a strong foundation in the domain you're working on. Here is an example: You ask the AI to write the code for a comment form. It generates the backend and frontend code for you (let's say React/Svelte/Vue/whatever). The vibe-coder sees the UI - most likely written in Tailwind CSS and thinks "wow, that looks really good!" and they click approve. However, an experienced person might notice the form does not have CSRF protection in place. The vibe-coder might not even be aware of the concept of CSRF (let alone the top 10 OSWAP security risks).

Hence, the fundamental problem is not knowing about the domain more than the AI to pick up the flaw. Unless this fundamental problem is solved - which I don't think it will anytime soon because everyone can generate code + UI these days, I don't see a solution to the verification problem.

However, this is good news for consultants and the like because it creates more work down the line to fix the vide-coded mess because they got hacked the very next day and we can charge them a rush fee on top of it, too. So, it's not all that bad.
by jlongo78 | 2026-03-04 04:00:06+00:00
the control plane question is the right one to be asking. most people slap agents into tmux and call it done, then wonder why they cant reproduce what happened last tuesday.

the insight nobody talks about: session identity matters more than session management. if you cant address a specific agent conversation later, search it, or resume it mid-thought, youre just herding cats in a terminal. persistnece + indexing is the real primitive here.
by jlongo78 | 2026-03-04 04:00:14+00:00
nice work on this. local-first is the right call -- ive seen too many "AI terminal" tools phone home constantly for no good reason.

one thing worth exploring: multi-agent session management gets hairy fast. once you're running 3+ concurrent claude instances, the real pain isnt launching them, its knowing which session did waht and picking it back up later. full-text search across session history turns out to be the killer feature nobody asks for until they desperately need it.
by nebula8804 | 2026-03-04 04:00:27+00:00
I disagree, the software and excellent integration in the ecosystem has always differentiated Apple and even years later models from ASUS are still headaches when it comes to everything outside the panel. Its like when gamers used to compare Apple spec by spec (ie. CPU, RAM, Disk) and valued all the software they provide at $0.

These days they still value software at $0 but the specs have become quite competitive and many times exceed what the rest of the market offers.
by gritzko | 2026-03-04 04:01:48+00:00
At this point, the question is: why keep files as blobs in the first place. If a revision control system stores AST trees instead, all the work is AST-level. One can run SQL-level queries then to see what is changing where. Like

- do any concurrent branches touch this function?
- what new uses did this function accrete recently?
- did we create any actual merge conflicts?

Almost LSP-level querying, involving versions and branches.
Beagle is a revision control system like that [1]

It is quite early stage, but the surprising finding is: instead of being a depository of source code blobs, an SCM can be the hub of all activities. Beagle's architecture is extremely open in the assumption that a lot of things can be built on top of it. Essentially, it is a key-value db, keys are URIs and values are BASON (binary mergeable JSON) [2] Can't be more open than that.

[1]: https://github.com/gritzko/librdx/tree/master/be

[2]: https://github.com/gritzko/librdx/blob/master/be/STORE.md
by yogorenapan | 2026-03-04 04:02:39+00:00
I've learnt jujutsu. It took me a couple weeks to get it but 100℅ worth it. I've always intuitively understood git but jj does make a lot of annoying things easy. My commit history is now much cleaner than ever before. It's not for everyone though. Takes a lot of upfront investment to learn when git is often already good enough.
by Haven880 | 2026-03-04 04:03:14+00:00
Iphone is made by Chinese companies too. Same with Tesla. A lot of those components made by purely Chinese companies and yes can be trace to individuals who are CCP. It is extremely hard to source another purely away from any Chinese connections. If you say the main company is USA, you seems to ignore how the pager exploding setup was done. Go into any IT rooms in USA and you audit it as zero from China even if you ignore Taiwan as recognized by American law as part of China. We can't buy anything truly made non-China. Even F35 has some components (and that is official, unofficial we dont know) made in China. Google want to sell Motorola to American companies, not even Pentagon or NSA bother back then. Think about it, how hard to engineer a backdoor exactly same components (say capacitor) or motors during shipment for those phones.
by ggm | 2026-03-04 04:03:35+00:00
It is controversial.. amongst people who have concerns about private communications and society, from a regulatory and governance perspective.

It's uncontroversial amongst people who value their privacy.

The tension between the two camps (there are obviously nuances and this is a false dichotomy) is at a current peak. It's an ongoing controversy. It's a matter of public debate.

You might have liked it better if the angle had been "...which the government, controversially, wants to clamp down on" or something.
by rs545837 | 2026-03-04 04:04:33+00:00
This is the right question. Storing ASTs directly would make all of this native instead of layered on top.

The pragmatic reason weave works at the git layer: adoption. Getting people to switch merge drivers is hard enough, getting them to switch VCS is nearly impossible. So weave parses the three file versions on the fly during merge, extracts entities, resolves per-entity, and writes back a normal file that git stores as a blob. You get entity-level merging without anyone changing their workflow.

But you're pointing at the ceiling of that approach. A VCS that stores ASTs natively could answer "did any concurrent branches touch this function?" as a query, not as a computation. That's a fundamentally different capability. Beagle looks interesting, will dig into the BASON format.

We built something adjacent with sem (https://github.com/ataraxy-labs/sem) which extracts the entity dependency graph from git history. It can answer "what new uses did this function accrete" and "what's the blast radius of this change" but it's still a layer on top of git, not native storage.
by SL1C3DL4BS | 2026-03-04 04:04:42+00:00
Hey HN,

I got tired of seeing AI startups deploy autonomous agents that are one hallucination away from a catastrophic lawsuit. With the EU AI Act enforcement kicking in this year (August 2026), the current "prompt engineering" approach to AI safety isn't going to hold up in court.

So, I built Vericore OS. It’s an open-source, API-first compliance primitive that physically and cryptographically forces AI agents to behave. It acts as an immutable "Flight Recorder" and a hardware-backed kill switch.

Here is the architecture of how it works under the hood:

1. The 5,000+ RPS SQLite Hack (Write-Ahead Batching)
I needed the database to be fast, local, and causal-consistent, so I used LibSQL. But SQLite locks under heavy concurrent writes. To fix this, I locked the Go connection pool to MaxOpenConns(1) and built an asynchronous channel buffer. The HTTP handlers drop the AI audit logs into memory, and a single background worker batches thousands of Merkle tree appends into a single BEGIN/COMMIT transaction. Zero SQLITE_BUSY errors.

2. The Post-Quantum Merkle Mountain Range (MMR)
Standard audit logs can be altered by a rogue admin. Vericore maps every AI intent into an append-only Merkle Mountain Range written in Go. To ensure these logs survive the NIST post-quantum deprecation timeline, every leaf is stamped with a hybrid classical/Post-Quantum signature using Cloudflare’s CIRCL (ML-DSA / Dilithium3).

3. The FIDO2 Hardware Interceptor (FinOps)
I built a high-stakes transaction interceptor directly into the routing layer. If an AI agent tries to execute a low-level action, it goes through. If it tries to wire $1,000,000, the database halts the transaction and pushes a WebAuthn payload to the CFO. The money physically cannot move until the human touches their YubiKey, and that cryptographic signature settles the transaction.

4. The Causal Swarm DAG
If Agent A hallucinates data that triggers Agent B to make a bad decision, Vericore uses a recursive CTE in LibSQL to instantly map the Directed Acyclic Graph (DAG) of the blast radius and freeze the downstream causal chain.

5. ZKP HealthTech Enclaves
For HIPAA/GDPR routing, the platform uses a Rust/RISC Zero zkVM. The AI processes the plaintext patient data inside the enclave, but only the cryptographic receipt (the diagnosis) is stored in the MMR ledger. The patient data is completely blinded.

You can spin up the full bare-metal Kamal stack, or just use the SDK to secure your AI in 3 lines of code:
TypeScript

import { VericoreClient } from '@vericore/node-sdk';
const client = new VericoreClient(process.env.VERICORE_API_KEY);

// The AI intent is mathematically sealed; high-stakes actions halt for FIDO2
const receipt = await client.executeAction({
agent_id: "agent_treasury_01",
intent: "wire_funds",
payload_json: { amount: 5000000, vendor: "Acme Corp" }
});

The repo includes the Go API, Next.js Dev Portal, Node SDK, and the Tetragon eBPF kernel policies.

Would love feedback on the LibSQL batching implementation or the PQC Dilithium3 integration.

Repo: https://github.com/SL1C3D-L4BS/V3R1C0R3---Vericore-.git
by munchbunny | 2026-03-04 04:04:51+00:00
I generally agree with the take. At the moment the models and agents aren’t good enough for someone who isn’t trained to build and maintain a production system. So as long as Eng isn’t significantly more bandwidth starved than PM, PM’s writing production code is not a high leverage activity.

The key issue right now is that the models falter in the last mile, and the last mile is where you need the training and experience to make sure the thing that lands is production quality.

At some point in the next few years I believe the roles will merge. I suspect that PMs will be forced to specialize towards a discipline (design, data science, engineering, etc.) while engineers will also start to see more of their responsibilities covering former PM territory. Most engineers will probably become closer to “product engineers”.
by rationalist | 2026-03-04 04:05:12+00:00
You know what would be good for security:

Having physical disconnect switches (Bluetooth/Wifi, Modem, Power, Microphone/Speaker), and integrated lens cover like Lenovo laptops (at least for the front camera whereas a case can cover the rear cameras).

On a side-note:

Triple active SIM would be amazing, but one can dream. I would love to have a phone that has an active AT&T, T-Mobile, and Verizon SIM at the same time.
by Nevermark | 2026-03-04 04:05:19+00:00
• Having NPU cores since the M1, would seem to verify that running models has been a game plan for a while. LLMs coming along can only have increased that focus.

• Studios with Ultra Mx, now 4-way RDMA over Thunderbolt 5, and enormous RAM and SSD options, suggest a strong focus. I don't know what else that RAM would be intended for. Four Studio Ultras (total of 360 GPU cores with M5 Ultras?) with 2TB of unified RAM is a local model beast.

• They refashioned their GPU cores to better support both graphic and neural processing, despite already having focused NPU cores.

I would say they have been leaning into local models for several years.

I expect we will see more models being optimized for smaller sizes, as demand for them increases. With hardware performance and neural focus trending up, and model requirements/quality trending down, the next few years will be interesting times.

What would make me happy: Ultra x 2 (i.e. 2xUltra, 4xMax, 8xPro, 16xM5) packaging in the Studio. With 8-way RDMA. Mac Kong. Perhaps Apple will start making server cards again.
by munch-o-man | 2026-03-04 04:05:28+00:00
I mean...it works just fine without internet...host your own registry...or just build your own from Dockerfiles locally. Not saying it is the right use case for everything but I'm confused what you mean by docker doesn't work without the internet. Neither does pip, rubygems, apt, etc...unless you build locally or host your own repository. Can you elaborate on what exactly you mean because you probably have a point that I am just missing.
by efskap | 2026-03-04 04:05:30+00:00
> For starters, it is spelled “Alena” so people who see it in writing pronounce it the way it is spelled [...] Yes, it’s spelled with an e because there is a letter exactly like that but with two dots above it in the Russian language and it sounds more like o

I know the article is mostly about speech, but I wish the immigration process or w/e just went with <Alyona>.

<ё> in Russian never represents anything close to <e> in English. It's /ʲo/ (superscript j for palatalization of the previous consonant) and iotized to /jo/ word initially. Its use over <йо>/<ьo> is strictly etymological - йогурт "yogurt" could've easily been ёгурт.

We're already picking correspondences by sound, like transliterating <л> as <l> and not <n>. There's no reason to complicate things by bringing in Russian orthographic rules into English.
by jadowdl | 2026-03-04 04:06:03+00:00
Prophet Town LLC | Various Software Engineering Roles | US – Remote and Hybrid | English fluency required | Full-time | $150K-$260K annual total comp (multiple)

I’m the founder, trying to do “enlightened business.” We are a people-first, fully-remote (but some clients offer onsite…), boutique indie tech agency – building a team of talented, high integrity, and community-minded individuals, first, then building businesses around them, second. Our leadership staff are ex-Fortune 100; everybody touches code. Notable recent projects: internal tools for Anduril, and voltagepark.com.

We’re currently especially seeking:

Full-Stack Software Engineers
(Typescript/Javascript, React, NextJS, Ruby on Rails; Python; Devops, and third-party API integrations)

(Check back soon; more roles for at least QA Engineers, ML/AI, and DevOps posting later in March.)

Please apply using this Google Form: https://forms.gle/Bv5zVjQDjgaLWqSp7. Applicants who submit before March 15 will typically receive a reply by March 22. Tier3 roles are typically 5-10 y/o/e with $150-$180k annual total comp. Tier4 roles are 11-20 y/o/e, $215-$260k annual total comp. Higher tiers exist, and we welcome exceptional applications.
by akoboldfrying | 2026-03-04 04:06:14+00:00
Maybe this is what you meant, but the dangerous part is ensuring that the final claim being proved is correct -- the actual proof of that claim is, by design, something that can be quickly and mechanically verified by applying a series of simple rules to a set of accepted axioms. Even a human could (somewhat laboriously) do this verification.

I have no experience with this, but I'd expect the danger to arise from implicit assumptions that are obvious to a mathematician in the relevant subfield but not necessarily to an LLM. E.g., whether we are dealing with real-valued or integer-valued variables can make a big difference in many problems, but might only be actually explicitly stated once in the very first chapter (or even implied by the book's title).

There are also many types of "overloaded" mathematical notation -- usually a superscripted number means "raised to the power", but if that number is -1, it might instead mean "the inverse of this function".
by nextos | 2026-03-04 04:06:41+00:00
Formal specifications can be easier to write than code. Take refinement types in Dafny, for example. Because they are higher-level, you don't need to bother with tedious implementation details. By shifting our focus to formal specifications rather than manual coding, we could possibly leverage automation to not only develop software faster but also achieve a higher degree of assurance.

Of course, this remains largely theoretical for now, but it is an exciting possibility. Note high-level specifications often overlook performance issues, but they are likely sufficient for most scenarios. Regardless, we have formal development methodologies able to decompose problems to an arbitrary level of granularity since the 1990s, all while preserving correctness. It is likely that many of these ideas will be revisited soon.
by Haven880 | 2026-03-04 04:07:33+00:00
Korean and western made stuff guarantee to have such thing. CNC devices in Russia stopped working. Even NVIDIA gpu has back door according to China and NVIDIA had to settle this matter behind the scene with China government. At this point, your phone is 100% backdoorable by western government. The only thing protect you is you are non-threat and too small to be bother with.
by fiynraj | 2026-03-04 04:09:57+00:00
If you already have a good scripted workflow with Lighthouse + custom checks, Shipcheck will overlap with some of that.

The main difference is it bundles a bunch of launch checks in one place like SEO metadata, sitemap/robots, security headers, link crawling (broken links/redirect loops), basic accessibility/mobile checks, etc. Lighthouse alone doesn’t cover a lot of those.

So for someone with a custom pipeline, it’s mostly a quick external sanity check before launch. For founders who don’t run CLI tools, it replaces stitching together multiple audits.