MurphyA/hacker-news huggingface dataset:
by jensbontinck | 2026-03-05 16:38:34+00:00
This is a solid draft. glad to see it building on SPIFFE/WIMSE and OAuth rather than inventing new identity primitives. The "agents are workloads" framing in Section 3 is exactly right and should settle the debate about whether agents need their own identity model.

The Transaction Token pattern (Section 10.4) is particularly important. We arrived at something similar — short-lived ES256-signed tokens scoped to a single task with a 60s TTL, encoding the specific tools and operations authorized. The key addition we found necessary: embedding data classification and governance evidence in the token itself, so the token isn't just authorization ("you may call this tool") but also proof that scanning and policy evaluation happened. Makes the audit trail self-verifying.

One gap I'd flag: the draft covers the auth layer thoroughly but doesn't address the data protection layer: what happens to the content flowing through these authenticated channels. An agent can be
perfectly authenticated and authorized to call an LLM, and still send PII or credentials in the prompt. That's a different control plane (content scanning, classification, taint tracking) that sits
alongside auth, not inside it. Might be worth a forward reference to indicate this is complementary scope.

The static API keys antipattern callout in Section 6 is important. In practice, most agent deployments today still use long-lived API keys passed as environment variables. The gap between what this draft recommends and what people actually do is enormous.
by specialist | 2026-03-05 16:39:12+00:00
Terrific if it happens. I may even ignore the AI (valuation) bubble for the duration.

David Roberts (https://volts.wtf) has repeatedly noted that AI companies need the power, need it now, and have the capital to get it. So he (and others) advocate that Big Tech fund the grid improvements and new power generation.

Point #1 Virtual Power Plants

Roberts advocates adopting virtual power plants (VPPs). Think grid of grids, like the internet is a network of networks. Think peer-to-peer energy sharing. VPPs unlock dynamic load shifting, two-way energy sharing (think of all those roof top solar panels and powerwalls), and therefore -- most importantly -- reduces a grid's peak demand.

Also, there is a backlog of grid enhancing technologies available, just waiting for funding and incentives to line up.

Tangent: VPPs also enable new financial products, which will further accelerate electrification (of All The Things).

IIRC, our grids currently operate at 30% capacity. IIRC, The combo of enhancements and VPPs can boost that to 80% or higher. Which reduces the urgency for building more transmission and distribution infra. (In the short term; we still need to greatly embiggen our grid(s).)

It'd be kinda amazing if the urgency to build more data centers mooted the utility's opposition to improving our grid(s), thereby benefiting everyone everywhere.

Point #2 Solar + Battery

Further, solar + battery is the fastest, cheapest way to get new power generation. More so every year.

Yes, we still need to massively invest in All The Things to reach Net Zero and beyond. Wind, geothermal, nuclear (fission and fusion), hydro, every flavor of storage, de-carbonize industry and agriculture, conservation, rewilding, and everything else.

But at this moment in time, today, we need gigawatts of new generation and the grid that can support it. And I don't care how we get it.

Aside, IIRC, data centers are projected to demand just 5% our electricity supply. So society will be the net beneficiaries (on this axis).

Were Big Tech to fund the generation and grid that we need, maybe society will indulge some of Big Tech's less egregious offenses. https://en.wikipedia.org/wiki/Indulgence
by raggi | 2026-03-05 16:39:18+00:00
LGPL applies to the LGPL’d code, not to every piece of code someone might add to the repository or under the same name implicitly.

The claim being made is that because some prior implementation was licensed one way, all other implementations must also be licensed as such.

AIUI the code has provenance in Netscape, prior to the chardet library, and the Netscape code has provenance in academic literature.

Now the question of what constitutes a rewrite is complex, and maybe somewhat more complex with the AI involvement, but if we take the current maintainers story as honest they almost certainly passed the bar of independence for the code.
by ChildOfChaos | 2026-03-05 16:39:45+00:00
It seems like you are in some kinda bubble were you are getting feed doom and gloom, most of what you have said is just normal stuff and cycles the world goes through, the difference is you are connected to it more now.

What if you weren't connected to this? what if you didn't know? Ukraine/Iran/whereever, sucks for those people but if your always connected to everything, there is always something bad going on in the world, so you will always see it and it's too much to bare. Some people argue this is just sticking your head in the sand, but what is it that you can personally do? if you want to take up some form of activism in this area, go ahead, but if you aren't, then it should be ignored.

You only have a certain amount of **s to give, choose widely.

And focus on what is local to you, In the scale of the universe who cares about you? in the scale of the planet who cares about you? In the scale of your country who cares about you? in the scale of your city? Your street even, who cares about you? But on the scale of the people you know and interact with, your family, coworkers etc, who cares about the universe?

The problem is you are connecting yourself to the universes enitre problems and then struging to stay sane. No wonder.
by Tostino | 2026-03-05 16:39:51+00:00
"Europeans never actually colonized anything but America." The British colonized India, Australia, Hong Kong, and half the Middle East. France held Indochina, Algeria, and most of West Africa. The Dutch ran Indonesia for 350 years. Belgium's Congo is one of the most documented atrocities in modern history. Portugal colonized Mozambique, Angola, Goa, and Macau.

The Scramble for Africa carved up nearly the entire continent among European states at the Berlin Conference of 1884. That's not obscure history. You can make your point about Iran without pretending none of this happened.
by rustyhancock | 2026-03-05 16:40:05+00:00
Einstein and SR is an interesting case.

Nearly the entirety of the theory had already been laid out before Einstein.

Lorenz transforms contain the length contraction and local time, Poincaré had already written about E=mc^2 for radiation, he'd also set out the idea of relativity. All this before 1905.

Einstein's revolution was in turning that patchwork into a self contained theory with a couple postulates.

He had all the data he could want most of it from decades earlier.

We have approximately 0 experimental evidence at the GR/QFT boundary.

The best we have is Hawkings radiation something we currently can't possibly observe experimentally.

If we wanted to study the GR/QFT with a particle accelerator it would need to be the size of the Milky Way.
by sqbic | 2026-03-05 16:40:14+00:00
(Sorry for replying to this comment, apparently can't reply to the original post or the comment above.)

I've been using a software called AlDente by AppHouseKitchen on my MacBooks.

It still has some nice additional features over the new macOS Charing Limit feature, especially if using the licensed version (one time tiny purchase).

If just wanting to spare the battery of your older non-Tahoe Macs, even the free version works fine.

https://github.com/AppHouseKitchen/AlDente-Battery_Care_and_...
Show HN: Tracemap – run and visualize traceroutes from probes around the world
by solhuang | 2026-03-05 16:40:29+00:00
Hi HN,

I thought it would be fun to plot a traceroute on a map to visually see the path packets take. I know this idea has been done before, but I still wanted to scratch that itch.

The first version just let you paste in a traceroute and it would plot the hops on a map. Later I discovered Globalping (https://globalping.io), which allows you to run traceroutes and MTRs from probes around the world, so I integrated that into the tool.

From playing around with it, I noticed a few interesting things:

• It's very easy to spot incorrect IP geolocation. If a hop shows 1–2 ms latency but appears to jump across continents, the geolocation is probably wrong.

• Suboptimal routing is sometimes much easier to notice visually than by just looking at latency numbers.

• Even with really good databases like IPinfo, IP geolocation is still not perfect, so parts of the path may occasionally be misleading.

Huge credit to the teams behind Globalping and IPinfo — Globalping for the measurement infrastructure and IPinfo for the geolocation data.

Feedback welcome.
by shimman | 2026-03-05 16:40:32+00:00
It's not democracy if you can't destroy it. It's not democracy if the citizens cannot reject it. It's not democracy if it's being forced down your throat.

Sick of how SV/VC absolutely ruin words for their own monetary benefit.

How about you put up it up to a national vote and see what democracy gets you? I highly suspect that vast majorities of the electorate would want to nationalize this tech to benefit everyone rather than benefiting the few.

Democracy means there is a politics of rejection, rejection is normal in functioning democracies; what isn't normal are small handfuls of people capturing all collective human intelligence then claiming only they are allowed to benefit from it.
by danielmarkbruce | 2026-03-05 16:40:38+00:00
A lot. If you remember all the tariff announcements in the first months of 2025, the stock market tanked and it was an easy buy. The market then reasonably quickly realized many of these tariffs weren't going to persist. The payoff was fast, and the reason you didn't see a massive uptick in the market when the ruling came out was because it was already priced in at that point.

Just because something isn't obvious to you, it doesn't mean it wasn't obvious to a lot of people.
by WarmWash | 2026-03-05 16:40:51+00:00
Everyone is in it for themselves.

The world makes waay more sense when you really internalize that. It doesn't necessarily mean people are selfish, large groups often have aligned interests, but when an individuals interest alignment changes, then their group membership almost always changes too.

I'd be she has a bunch of pirated content and anti-copyright remarks from the golden age of piracy as well.
by burkaman | 2026-03-05 16:41:03+00:00
I understand your position but I disagree. If I were trying to predict whether the government is going to win in court, I think reading what the government's own lawyers think about the case would be valuable. If it were possible to pay for this I think people would, that's why I think it is material. Some random person's opinion is not relevant information, but the opinion of people directly involved in a case is.
by lapcat | 2026-03-05 16:41:19+00:00
> If that's how you judge what "empires" will be left in a decade, good for you, ignorance is a bliss sometimes I suppose.

I don't make such predictions. I'm not Nostradamus, and neither are you. I don't think anyone can predict what will happen exactly in a decade. After all, who predicted this a decade ago?

> ignorance is a bliss

This insult doesn't even make sense. I'm not experiencing bliss over the situation.
by john_strinlai | 2026-03-05 16:41:21+00:00
that distinction sort of misses the point i was trying to make.

sometimes users want something. that something might be a feature request, or it might be a feature removal. it doesnt really matter for the sake of my point(s):

a) ignoring your users requests can sometimes be a bad choice.

b) you might not necessarily understand every underlying problem that every user has. worse, you might think you understand the problem when you dont.

expanding on b: blizzard thought they understood their player base and the underlying problems of retail WoW. on multiple occasions, ion explicitly said stuff like "you think you want this, but you dont". they kept making changes to retail WoW to try and stop the hemorrhaging of players.

eventually they said "fuck it, we dont know why you want this, but here" (not a verbatim quote). it ended up being very profitable.
by D-Machine | 2026-03-05 16:41:28+00:00
An interesting thought, I myself have met at least a couple people that tried to break an addiction by switching to vape products that were essentially just flavour (no nicotine, no THC; THC vapes are common and legal in Canada) and somehow stayed just as addicted to the flavour / oral stimulation. So that sounds at least plausible to me.
by Lerc | 2026-03-05 16:41:31+00:00
There was a paper that proposed a content based hashing mask for traning

The idea is you have some window size, maybe 32 tokens. Hash it into a seed for a pseudo random number generator. Generate random numbers in the range 0..1 for each token in the window. Compare this number against a threshold. Don't count the loss for any tokens with a rng value higher than the threshold.

It learns well enough because you get the gist of reading the meaning of something when the occasional word is missing, especially if you are learning the same thing expressed many ways.

It can't learn verbatim however. Anything that it fills in will be semantically similar, but different enough to get cause any direct quoting onto another path after just a few words.
Show HN: Ouroboros – Post-quantum P2P messenger with zero servers
by OmarPrampolini | 2026-03-05 16:41:34+00:00
After watching too many "privacy" apps get subpoenaed or shut down, I wanted a communication tool that literally cannot be shut down because it has no servers to seize.
Ouroboros is a Rust-based P2P stack with two modes:
1. Live sessions: Two peers connect directly using just a shared passphrase. The passphrase deterministically generates identical network parameters on both sides, so they can find each other without any coordination server.
2. EtherSync spaces: Async file sharing and messaging in encrypted "spaces" that sync via gossip protocol when peers are online.
Key features:
- Post-quantum resistant (Kyber1024 hybrid)
- Works through most NATs (ICE multipath + Tor fallback)
- DPI evasion transports (experimental)
- 0 dependencies on centralized infrastructure
GitHub: https://github.com/omarsomaro/HANDSHAKE
Would love feedback from anyone interested in P2P/decentralized systems!
by pfdietz | 2026-03-05 16:41:39+00:00
It's straightforward. Consider what would happen (for example) if all the fuel in a reactor is compressed into a more compact configuration.

In a thermal reactor, there's no problem, as there's now no moderator. There was massive rearrangement and compaction of melted fuel at the TMI accident, but criticality was not going to be a serious issue for the fundamental reasons I gave above.

In a fast reactor? It can only become more reactive. Anything else there was only absorbing neutrons, not helping, and the geometric change reduces neutron leakage.

Edward Teller somewhat famously warned about the issue in 1967, in a trade magazine named "Nuclear News":

“For the fast breeder to work in its steady state breeding condition, you probably need half a ton of plutonium. In order that it should work economically in a sufficiently big power producing unit, it probably needs more than one ton of plutonium. I do not like the hazard involved. I suggested that nuclear reactors are a blessing because they are clean. They are clean as long as they function as planned, but if they malfunction in a massive manner, which can happen in principle, they can release enough fission products to kill a tremendous number of people.

… But if you put together two tons of plutonium in a breeder, one tenth of one
percent of this material could become critical. I have listened to hundreds of analyses of what
course a nuclear accident could take. Although I believe it is possible to analyze the
immediate consequences of an accident, I do not believe it is possible to analyze and foresee
the secondary consequences. In an accident involving plutonium, a couple of tons of
plutonium can melt. I don’t think anyone can foresee where one or two or five percent of this
plutonium will find itself and how it will get mixed with other material. A small fraction of
the original charge can become a great hazard."

(Natrium is not a breeder but the same argument holds.)

That no fast reactors have yet exploded is of course no great argument. How many fast reactors have been built, particularly large ones? Not many. And we've already seen a commercial fast reactor suffer fuel melting (Fermi 1).
by hedora | 2026-03-05 16:41:42+00:00
I really think a small amount of education on what LLMs actually are (document completers) and how context works (like present it as a top-level UI element, complete with fork and rollback) would solve most of these issues.

Given how they work, it's really not surprising that if it sees the first half of a lovers' suicide pact, it'll successfully fill in the second half. A small amount of understanding of the underlying technology would do a lot to prevent laypeople from anthropomorphizing LLMs.

I get the impression that some of today's products are specifically designed to hide these details to provide a more convincing user experience. That's counterproductive.
by airforce1 | 2026-03-05 16:42:09+00:00
I think there could be a market for "permissive/open models" in the future where a company specifically makes LLM models that are trained on a large corpus of public domain or permissively licensed text/code only and you can prove it by downloading the corpus yourself and reproducing the exact same model if desired. Proving that all MIT licensed code is non-infringing is probably impossible though at that point copyright law is meaningless because everyone would be in violation if you dig deep enough.
by DrScientist | 2026-03-05 16:42:46+00:00
> they don't need yet another API to describe it.

WebMCP isn't accessibility support for humans, it's accessibility support for agents, which despite all the hype, are less capable than humans in working out what's going on, and find functions and data schema's easier to understand than a web page designed for human ( whether that's a partially sighted human or not ).
by galaxyLogic | 2026-03-05 16:43:13+00:00
BUt LLM has seen millions (?) of other code-bases too. If you give it a functional spec it has no reason to prefer any one of those code-bases in particular. Except perhaps if it has seen the original spec (if such can be read from public sources) associated with the old implementation, and the new spec is a copy of the old spec.
by Gagarin1917 | 2026-03-05 16:43:39+00:00
>It is there to reduce our agency

Complete bullshit.

The individual has never had as much ability to take on large projects as they do now. They’ve never been able to learn as easily as they can now.

>to make it easier to fire us

As of now, the technology increases productivity in the average user. The companies that take advantage of that and expand their offering will outperform the ones that simply replace workers and don’t expand or improve offerings.

More capable employees make companies more money in general. Productivity increases lead to richer societies and yes, even more jobs, just as it always has.
by tverbeure | 2026-03-05 16:43:51+00:00
I'm sick and tired of the "No..., no ..., (just) ..." LLM construction. It's everywhere now, you can't open a social media platform and get bombarded by it. This article is full of it.

I get it, I should focus just on the content and whether or not an LLM was used to write it, but the reaction to it is visceral now.
by tovej | 2026-03-05 16:44:25+00:00
As someone who has implemented a fair few DSLs, lexical and syntactic analysis is pretty much the same anywhere, and the structure of the lexer/parser does not really depend on the grammar of the language.

And even semantic analysis is at least very similar in most PLs. Even DSLs. Assuming you're using concepts like variables and functions.

When it comes to codegen / interpreter runtimes, things start to diverge. But this also depends on the use case. More often than not a DSL is a one-to-one map to an existing language, with syntactic sugar on top.

I'm curious, what's the DSL you're working on?
by 7777777phil | 2026-03-05 16:44:29+00:00
The MCP point is right, though tbh MCP is more like plumbing than memory. Execution-time context for tools and resources. The world model is a different thing entirely, it needs to persist across sessions, accumulate, actually be queryable.

In practice it's mostly RAG over structured artifacts. Process docs, decision logs, annotated code and so on. Conversation history works better than you'd expect as a starting point but gets noisy fast and I haven't seen a clean pruning strategy anywhere...

On the format question imo nobody really knows yet. Probably ends up as some kind of knowledge graph with typed nodes that MCP servers expose or so, but I haven't seen anyone build that cleanly. Most places are still doing RAG over PDFs so. That tells you where the friction is.
by specialist | 2026-03-05 16:44:33+00:00
No ads. No algorithmic hate machine. Active moderation.

Two other fine examples of thriving online communities are metafilter and ravelry.

I'm sure there's many more on the web. I just don't get out much.

And many, many not on the web. Using discord, telegram, old school BBSes, etc. But, as dead Internet theory notes, they're not publicly visible and therefore not discoverable, not being indexed.
by pjc50 | 2026-03-05 16:44:35+00:00
> This lead to two of my female Jewish friends getting spat on and having their hair pulled on the tube and called murdering zionists

Do you think this is specifically and only due to that specific, single story, or do you think it might be a cumulative effect due to all the rest of what's been happening? Not that this excuses or justifies random attacks on other people simply because they happen to be Jewish, that's how the cycle of reprisal happens.
by pm215 | 2026-03-05 16:44:57+00:00
Even if there isn't any 3rd party code, the whole process of going through the codebase to confirm there really isn't any 3rd party code, and generally getting the legal department to sign off on it, is a lot of work in itself. My impression is that this kind of "historic source" release typically only happens if somebody sufficiently senior in the company cares enough to actively push it through. The default is that nobody does care that much, and it doesn't happen.

"Do nothing" has essentially zero downside for a big company that happens to have something of niche interest like this in its vaults.
by solenoid0937 | 2026-03-05 16:45:17+00:00
Sure the architecture is from 2017. But the gap between GPT-1 and frontier models today is not simply "more FLOPs" and as simple as "standing up PyTorch and vllm" - theres thousands of undocumented decisions about data, alignment, reward modeling, training stability, and inference-time strategies, and lots of tribal knowledge held by a small group of people who overwhelmingly do not want to work on weapons systems.

The dense model argument is self-defeating long term. Sparsity (MoE etc.) lets you build a smarter model at the same compute budget, so going dense because you can afford to waste FLOPs is how you fall behind b/c you never came up with the step function improvements needed.

Sure, the DoD invented HPC, but also invented the internet, and then the private sector made it actually useful.
by hedora | 2026-03-05 16:46:09+00:00
So, the false negative rate was 84%, but what was the false positive rate?

They have a table "AUTOMATIC SCAN RESULTS (263 URLS)" that sort of presents this information. Of the 9 sites that were negatives, they say they incorrectly flagged 6 as phishing.

With a false positive rate of 66%, it's not surprising they were able to drive down their false negative rate. Also, the test set of 254 phishing sites with 9 legitimate ones is a strange choice.

(Or maybe they need to work on how they present data in tables; tl;dr the supporting text.)