MurphyA/hacker-news huggingface dataset:
by ericmay | 2026-03-13 13:42:22+00:00
> What a wildly capitalist take on the loss of confidentiality for personnel data.

As opposed to what exactly? A "communist" take on the loss of confidentiality? How might that go?

"There's no problem comrade, what are you talking about?"

This sounds like a failure of government regulation here, not a failure of a broad economic model.
by gruez | 2026-03-13 13:42:41+00:00
>it create difficulty for undocumented people to access the web

Why is this such a sticking point in US politics? If the "undocumented" people aren't supposed to be in the country in the first place, why should rest of society cater to them? Even if you're against age verification for other reasons, dragging in the immigration angle is just going to alienate the other half of the population who don't share your view on undocumented people, and is a great way to turn a non-partisan issue into a partisan one. It's kind of like campaigning for medicare for all, and then listing "free abortions and gender affirming surgery" as one of the arguments for it.
Agent.json – robots.txt for AI agent-to-website communication
by charlkruger | 2026-03-13 13:42:57+00:00
I built agent.json, an open protocol that makes websites message-addressable by AI agents.

The problem: when an AI agent needs to request a refund or book an appointment, there's no standard way. No API, and the contact form wasn't designed for software.

agent.json adds three endpoints to any website:

1. GET /.well-known/agent.json - discovery (actions, schemas, auth)
2. POST /.agent/inbox - send a message
3. GET /.agent/inbox/:id - poll for a response

Actions have JSON Schema parameters so agents know exactly what to send. Responses support sync, polling, or HMAC-signed webhook callbacks.

It's platform-agnostic - implement in Express, Django, Rails, Go, anything. The repo includes a reference implementation on Cloudflare Workers with AI classification, email routing, and a dashboard.

Docs: https://agent-json.com

Would love feedback on the protocol design.
by davideg | 2026-03-13 13:43:03+00:00
The numbers here are staggering:

> if run at full strength for a year, Colossus [xAI's new datacenter] would use as much electricity as 200,000 American homes. When fully operational [...] this facility and two other xAI data centers nearby will require nearly two gigawatts of power. Annually, those facilities could consume roughly twice as much electricity as the city of Seattle.

> Even conservative analyses forecast that the tech industry will drop the equivalent of roughly 40 Seattles onto America’s grid within a decade; aggressive scenarios predict more than 60 in half that time.

> [...] by 2030, U.S. data centers will consume more electricity than all of the [USA]’s heavy industries [...] put together.

Basically it boils down to the US meeting this electricity need using natural gas and fossil fuels (with nuclear as an eventual goal) and China moving at a similar pace using renewables. Of course the AI companies on the west coast don't have to experience the pollution such energy demand brings to the communities nearby the power and data center facilities.
by duskdozer | 2026-03-13 13:43:11+00:00
That's great. I'd not be opposed to you having the option to do those things by yourself. Personally though, I'd rather just have someone who's paid to do it than have ads pumped into my ears as I pump gas or mess with the finicky self-checkout machines as someone watches me anyway. Now, if giving these things up would result in those employees ending up with a better station in life or more meaningful work, that would be something to consider. But in reality, the only result of forcing me to do those things will be higher corporate margins. So, no thanks.
by r_lee | 2026-03-13 13:43:20+00:00
I think the most feasible solution is to make companies liable for damages, not in a light way but rather that every person can sue (or in a class action) for hefty amounts, so that a breach could cost e.g. 100mil+

that should incentivize them to actually invest some money in security. right now its just tiny numbers which are easier to just pay off and forget about
by jawns | 2026-03-13 13:43:23+00:00
Wait, the main takeaway from this article is that cybersecurity sales teams now have great leads?

Facepalm.

The real takeaway should be that at every level -- government, corporate, healthcare entities, personal -- we need to rethink how we're acting in the face of these disasters.

Government should recognize that its current regulations are insufficient and look for ways to refine them.

Corporations and health-care entities should be asking themselves, "Do I really need to store this data? If so, how do I store it securely, make my systems less vulnerable to attack, make my personnel more informed about phishing, store it for the minimum amount of time, etc."

And we as individuals should be asking ourselves whether so many health-care entities need to store so much data about us.
by john_strinlai | 2026-03-13 13:43:23+00:00
for ~2 decades i have attended events, written to my representatives, proposed solutions to whoever i can, and encouraged my students to do the same as various attempts are made to strip regular people of their privacy. for ~2 decades now, i have been trying to fight this fight.

one scary observation is that each year, less and less people care. at least, this is true among my students. plenty of them believe the 'protect the children' line and are more than willing to do whatever the government/big tech suggests. or they just shrug ("what difference would i make?").

for context, i teach at a college level, in tech. a few of my classes are from the cybersec program, one of the programs that should understand and care about the implications of bills like these, and even the majority of them do not care about this stuff anymore. they grew up with instagram and facebook and cameras everywhere. they grew up knowing that any little fuck up they have is recorded and posted online. they know that by the time they go to college, all of their data has already been leaked a few times. they never really had an expectation of privacy in the first place, so it just isnt a big deal.

as someone who interacts with this next generation of "hackers" on a daily basis... the concept of cypherpunk is gone. i got into this field because of my beliefs. they are going into this field because they want a chance at buying a house some day, and know that big tech has big bucks.

i am tired. and i recognize that this is exactly what they (lobbyists, meta, etc.) want! but i am tired and discouraged. more and more i find myself having to actively fight the urge to give up. i am not ready to give up just yet... but, i am sorry to say that as someone closer to retirement than i am comfortable admitting, i only have so much energy left.
by roywiggins | 2026-03-13 13:43:24+00:00
ai; dr

> This isn't a single point of failure - it's a systemic crisis.

> One in seven breaches isn't a sophisticated external attack - it's someone inside the organisation accessing data they shouldn't.

> These organisations aren't browsing - they're buying

https://news.ycombinator.com/newsguidelines.html#generated
by satring | 2026-03-13 13:43:27+00:00
The discovery problem is what's holding L402 back more than anything technical. phoenixd and lnget have made the payment side trivial, but there's no good way for a client (human or agent) to find which APIs actually accept Lightning payments.

I've been cataloging L402 endpoints and the ecosystem is bigger than most people realize. There are 80+ live services across categories like price data, sentiment analysis, identity/trust scoring, storage, and more. The challenge is that each one exists in isolation with no shared registry.

For agent use cases especially, this matters. An MCP client like agenticbtcio's can handle the 402 flow automatically, but it still needs to know where to point. A machine-readable directory of L402 services, with verified liveness status, would close that loop.
by NoraCodes | 2026-03-13 13:43:30+00:00
This headline is misleading. The California law requires that the OS store and provide the age bracket. It does not require that any verification take place.

I am not arguing that this is a good idea, but it is simply false that the law requires that Linux 'check kids' IDs before booting'.

The New York law is worse, and should be opposed, but the article only mentions it at the end - and even then, we actually don't know what the verification mechanism would be. I've heard a proposal that "age verification passes" be sold at liqour stores and porno shops, for example, who already seem to do an acceptable job of checking ID without destroying people's privacy.
by chrisweekly | 2026-03-13 13:43:45+00:00
Awesome news. Amid all the (real and perceived) js ecosystem churn, vite has been consistently excellent for dx and production. The unified rolldown bundler is only going to increase vite's appeal and widen the gap as the fastest, most pragmatic and flexible foundation for ts/js projects.
Huge fan, speaking from deep experience (webdev since 1998).
by satring | 2026-03-13 13:43:59+00:00
The built-in endpoint discovery is the part that interests me most. Right now the biggest friction point for L402/x402 adoption isn't the payment mechanics (those are largely solved), it's that clients have no way to find payable endpoints programmatically.

Promise.allSettled() for protocol detection is a smart approach. Curious how you handle the case where a server returns 402 but with non-standard headers, since there's still no universal convention for the WWW-Authenticate format across x402 vs L402 implementations. Some services use the Lightning Labs macaroon+invoice format, others roll their own.

The budget engine with persistent state is a good safety net too. Without caps, an autonomous agent with wallet access could drain funds fast if it hits a buggy or malicious endpoint that keeps returning 402 on retry.
by quesera | 2026-03-13 13:44:05+00:00
I'd have to dig deeper, but generally "storing" (or maintaining storage) is not "processing" in the local US legal vernacular. Where both apply (PCI DSS, etc), both terms are used.

In my personal (business) case, we literally cannot comply with GDPR and also BSA/AML, FinCen, Reg E, KYC, etc, simultaneously. Our "business requirements" can last 7+ years, and our customers' wishes have no bearing on them.

And while we have no operations in any EU country, we are absolutely not obligated to even consider any EU laws about the data belonging to any of our customers, regardless of their citizenship. That's the primary point I'm making here -- the EU has zero jurisdiction over anything that happens outside the EU, ever, or any entities outside the EU, despite any claims to the contrary (which, according to Wikipedia at least, are not even made).

This is intuitive, but also the very expensive legal opinion of our lawyers, who have offices in the US, EU, and EMEA, for whatever that's worth!

In the general case, and as a customer, I'm fully in support of GDPR and CCPA-like protections. They're a great idea, I think! I'm usually the privacy nut in any discussion.

But compliance is obviously more work/expense than not, and small companies are especially allergic to nonproductive work and expenses. So naturally there's resistance to the suggestion that a foreign law compels them to do more of both.

And of course, if we're talking about the US, we have a very different culture around government and regulation. "As little as possible" (except those that protect my interests) is the preference of the landed gentry, and those who would aspire to same.

Reasonable people will recognize this as absurd, but ... you can't spell "absurd" without U, S, and A.
by jasonlotito | 2026-03-13 13:44:30+00:00
Does anyone actually read anymore?

From the FAQ:

You're right, and it's a fair question. Claude Code does handle prompt caching automatically for its own API calls — system prompts, tool definitions, and conversation history are cached out of the box. You don't need this plugin for that.

This plugin is for a different layer: when you build your own apps or agents with the Anthropic SDK. Raw SDK calls don't get automatic caching unless you place cache_control breakpoints yourself. This plugin does that automatically, plus gives you visibility into what's being cached, hit rates, and real savings — which Claude Code doesn't expose.

> Claude Code already handles prompt caching automatically for its own API calls

Claude Code is an app. The API layer is different.

When did people start thinking that the Claude Code app and the API are the same thing?

Are these just all confused vibe coders?
by forgetfreeman | 2026-03-13 13:44:57+00:00
I'd thank you for the laugh and assume you worked in project management, marketing, or some other low info industry segment. I've worked with hundreds of developers over my career and the only time I've brushed up against anyone who even approximates what you are describing would be in HN comment threads. The craft-oriented women and men I've had the pleasure of working with have without exception held user experience and the future sanity of other developers interacting with the code they wrote as core requirements, every project, every line of code. Getting it right the first time tends to cut down significantly on refactoring.
by schipperai | 2026-03-13 13:45:09+00:00
great callout - tool call can have side-effects outside your box. So unless you run a sandbox with no internet access, you aren't ever 100% safe.

nah does guard some of this - reading .env or ~/.aws/credentials gets flagged, and Write/Edit content is inspected for secrets before it leaves the tool.

Docker + filtered mounts + something like nah on top is a solid layered approach that is still practical.
Ask HN: How do you detect configuration drift between environments?
by orkunk | 2026-03-13 13:45:19+00:00
Hi HN,

I’m curious how teams detect configuration drift between environments like prod, staging, and test.

In several projects I worked on, incidents were often caused by unnoticed config differences between environments. Usually someone changed a config, a deployment happened later, and the difference went unnoticed until something broke.

Most tools I found focus on file diff, but not on monitoring drift over time.

Because of that, I started building a small tool around this idea:

- configuration is scanned from a Git repository
- a baseline run defines the expected state
- scheduled scans compare configs against that baseline
- drift opens a finding
- alerts can be delivered to Slack or Jira

Manual runs are mainly for inspection.
Scheduled runs are intended for monitoring.

Typical examples include:
- .NET appsettings.json
- IIS / web.config
- environment-specific configs across multiple environments

I’d love to hear how others currently solve this problem in practice.

Live:
https://gatewaylabs.net
by fhdkweig | 2026-03-13 13:45:38+00:00
> These people have such resources and the limit of their vision is: bang young girls, accumulate bling, push divisive hateful politics, start wars.

I really don't like how Bill Gates and Microsoft made their money, but at least he has realized that in his twilight years to try to make amends via humanitarian work. Buying the stairway to heaven.
by TheRealDunkirk | 2026-03-13 13:45:50+00:00
When a megacorp funds a network of non-profits to lobby a bunch of politicians, draft legislation, and tell them to take it to committee, that can happen without much visibility, especially when it's been orchestrated at the state level, as this has. Where does any of this show up until there's a vote called on it? There's no open debate. No working "across the aisle" to address concerns. There's nothing left of the legislative process that started this country, or, indeed, any Western representative democracy. So someone has to be watching, see something on an agenda that raises the hairs on their necks, figure out what it is, and if there's a story there, and they're not going to get any help from anyone because everyone involved knows how the public is going to feel about it. And then, as the article indicates, even a place like Reddit is going to astroturf the effort to get the story out. (Which I've been trying to point out for YEARS, but which -- surprise, surprise! -- gets supressed.)
by pentagrama | 2026-03-13 13:46:35+00:00
Yes, I was confused as well. The current Hacker News title is “Ceno, browse the web without internet access”, but on the official site the headline/<title> reads “Ceno Browser | Share the Web!”.

That mismatch is likely what is causing the confusion. The HN title probably should be updated to reflect the current title used on the site.

Another possibility is that the original title actually was “browse the web without internet access” and the developers later changed the site headline after the post was submitted to HN.
by jsontwikkeling | 2026-03-13 13:47:08+00:00
Great to hear that. I actually think TypeScript is very fit for the purpose, even better than Python (lacks types) or Java (bulkier).

Type signatures document contracts directly:

export function rabinKarp(text: string, pattern: string): number[]

Clear that it takes two strings and returns match positions. No separate explanation needed.

Interfaces model return types and ADTs cleanly:

export interface ShortestPathResult<T> {
dist: Map<T, number>;
parent: Map<T, T | undefined>;
}

export function dijkstra<T>(graph: Graph<T>, source: T): ShortestPathResult<T>

It's also lightweight, flexible, has familiar C-like syntax, and unlike pseudocode — you can actually run everything.

Re: generics feeling awkward — in TypeScript they feel pretty natural. The type inference helps a lot, you rarely need to spell out type parameters at call sites.
by yread | 2026-03-13 13:47:32+00:00
Groningen gas field produced 40 billion m3 a year. 100m3 is 1MWh, currently sold for 50 eur. So the production would generate revenue of 20 billion eur a year. Tax it at 10%, get 2B eur. Buy/build houses for 400k a piece, 5.000 a year. There are cca 10.000 houses with minor or major damage damage. In 2 fucking years everyone gets a new second house for free and we get cheap gas.
by orkunk | 2026-03-13 13:47:32+00:00
Interesting observation.

One thing I’ve noticed while building internal tooling is that LLM coding assistants are very good at generating infrastructure/config code, but they don’t really help much with operational drift after deployment.

For example, someone changes a config in prod, a later deployment assumes something else, and the difference goes unnoticed until something breaks.

That gap between "generated code" and "actual running environment" is surprisingly large.

I’ve been experimenting with a small tool that treats configuration drift as an operational signal rather than just a diff. Curious if others here have run into similar issues in multi-environment setups.
by felix9527 | 2026-03-13 13:48:28+00:00
Been running Claude Code with hooks recording every tool call for two weeks. ~25k actions across 116 sessions.

The thing that surprised me: 24 tool calls per prompt on average. "Just review everything" is not realistic at that ratio.

What worked for me was the dashcam approach — don't try to prevent, just have an independent record of what the agent actually did. Not the agent's summary, the actual sequence. Caught a few cases where the summary glossed over failed attempts and retries that mattered.
by lsaferite | 2026-03-13 13:48:36+00:00
Playing with a hyper-spectral imager makes you rethink how we see things. I've talked about this before, but human vision essentially "low resolution" on the spectral bands. Using an HSI that "sees" in 4nm spectral slices from 350-1000nm is really interesting (Cubert Ultris X20 Plus). There's so much spectral information that we just totally miss. I really wish the equipment for capturing images at these higher spectral resolutions wasn't so expensive so we could see people experimenting with them on a large scale. The one I got to work with was more than a nice SUV and that's cheap in the space. The ones we looked at from Headwall that did something like 400-2500nm started at $250k. Those weren't even full-frame imagers like the Ultris, they were line scanning imagers. That massive cost jump was down to the fact that from ~1050nm+ you need much different hardware to capture spectral data.

If anyone is interested in some technical aspects of the "full frame" HSI I worked with, it's quite interesting. It had a 20MP Monochromatic Sensor that captured single-band 12-bit data behind an array of lenses that split the incoming spectral range (350-100nm) into 164 individual 4nm wide bands of light that hit 410x410px squares on the sensor. The sensor can capture from 350-1100, but the QE drops of really fast past about 850nm and the product limited the upper range to 1000nm. I'm sure I munged something there, but you should get the general idea. I highly recommend researching the space of HSI, it's fascinating.

Last thing to point out, when working with an HSI like this, one thing you can do is capture a "spectral fingerprint". Since you've gone from three bands on spectral intensity information to, in our case, 164 bands you have the ability to turn that high-density spectral data for each pixel into essentially a line graph. Using that information you can do matching against a database of known spectral fingerprints and identify materials and material properties really well. In the multi-spectra world you'll see this capability used to identify crop health. In the hyperspectral world you can identify so much more. For instance, it can see skin anomalies that aren't visible to the human eye. You can identify specific minerals in a picture of a bunch of rocks (you need up into the 2500nm range for this though). You can easily spot foreign objects on a conveyor of food items. Overall, it's a long list of capabilities and I'm certain there are many more uses we could discover if the imagers were cheaper. And if you are into the wider ML world (not just focused on LLMs I mean), you'll see ML Classification Models being trained on these spectral fingerprints as well.

Anyway, the "full-spectrum" is fascinating, especially when you are able to slice it thin.
by PeterisP | 2026-03-13 13:48:51+00:00
The current bills (e.g. NY one at https://www.nysenate.gov/legislation/bills/2025/S8102/amendm... ) require age assurance that goes beyond mere assertions, so when creating your (adult) user account it would be required to give away your privacy to prove your age - if you can't implement a way for anonymous/pseudonymous people to verify that they indeed are adults (and not kids claiming to be so), these bills prohibit you to manufacture internet-connected systems that can be used by anonymous/pseudonymous users.
by satring | 2026-03-13 13:49:27+00:00
Interesting approach. The "universal balance across providers" model solves the onboarding friction well, but I'm curious about the discovery side. How does the 280 API catalog get maintained? Is it a curated list, or do providers self-register?

The x402 ecosystem is growing fast on the stablecoin side, but there's a parallel L402 ecosystem on Lightning that's also non-trivial in size. Do you plan to index both, or stay x402-only?

One tension I've noticed in this space: projects that act as both the payment intermediary and the discovery layer tend to lock agents into their ecosystem. The "open ecosystem" framing suggests providers just need x402 support, but the agent still needs to know about AgentCash to find them. A truly open approach might separate the directory from the payment rail, so any client can discover endpoints regardless of which payment SDK it uses.