MurphyA/hacker-news huggingface dataset:
by quesera | 2026-03-12 21:55:38+00:00
Yes, I think you're right. The middle ground, which I'll phoneticize as "uh-RON" or even "uh-RAN" is what I hear in most places.

The effete "ih-RAHN" is the NPR voice that you mentioned might get side-eyes. This is the closest to how Iranians that I know pronounce it, except that we don't have a phoneme quite like their R, which to my ears sounds like a D, L, and R all smashed together.

But these side-eyes are mostly fair, I think. It's like Americans prounouncing France as "Frawhce", or Paris as "Pahdee". Ostentatious and pretentious, for an English-speaker.

And Lindsey's provocative "EYE-ran" is very present in some locations, I think because GHWB and GWB's affected pronunciations were pounded into the American consciousness during Gulf Wars 1 and 2. Although Reagan did it too, IIRC, and I'm not sure about Clinton.
by mbesto | 2026-03-12 21:55:55+00:00
> And we have seen example after example of these LBO's ruining otherwise functioning businesses. It's happening. All over the place.

Your anecdotes and the anecdotes in media are no statistical evidence for "this is happening all over the place".

Yes, PEs/LBOs deserves criticism, but "PE" and "LBO" isn't a one size fits all situation.
by SlinkyOnStairs | 2026-03-12 21:55:56+00:00
> it requires a bad actor with critical access

This isn't particularly hard. Lots and lots of these tools take from the public internet. There's already plenty of documented explanes of Google's AI summary being exploited in a structurally similar way.

For what it concerns internal systems, getting write access to documents isn't hard either. Compromising some workers is easy. Especially as many of them will be using who knows what AI systems to write these documents.

> it also requires that the final rag output doesn't provide a reference to the referenced result.

RAG systems providing a reference is nearly moot. If the references have to be checked; If the "Generation" cannot be trusted to be accurate and not hallucinate a bunch of bullshit, then you need to check every single time, and the generation part becomes pointless. Might as well just include a verbatim snippet.
by hutao | 2026-03-12 21:56:01+00:00
One of the unwritten takeaways of this post is that async/await is a leaky abstraction. It's supposed to allow you to write non-blocking I/O as if it were blocking I/O, and make asynchronous code resemble synchronous code. However, the cost model is different because async/await compiles down to a state machine instead of a simple call and return. The programmer needs to understand this implementation detail instead of pretending that async functions work the same way as sync functions. According to Joel Sposky, all non-trivial abstractions are leaky, and async/await is no different. [0]

The article mixes together two distinct points in a rather muddled way. The first is a standard "premature optimization is the root of all evil" message, reminding us to profile the code before optimizing. The second is a reminder that async functions compile down to a state machine, so the optimization reasoning for sync functions don't apply.

[0] https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-a...
by anonymars | 2026-03-12 21:56:15+00:00
> Harris had no choice but to carry the Biden administration's poor approval on her back.

Is that so?

"Vice President Kamala Harris was asked by the co-hosts of The View on Tuesday whether she would have done anything differently than President Biden, responding 'not a thing comes to mind,' before coming back to the question and adding that she plans to appoint a Republican to her Cabinet if she is elected in November."
by hudtaylor | 2026-03-12 21:56:23+00:00
I run an AI agent that deploys production code across 4 live products. The self-correction capability is real but undersold in these debates.

Examples from the last month: the agent found its own API keys in environment files after initially claiming it didn't have them (lesson: grep before asking). It caught itself about to run a destructive database migration on a shared production instance and stopped. It fixed 8 broken RSS feed configurations that had been silently failing for weeks without anyone noticing.

The pattern I've found: AI doesn't need to be perfect at writing code. It needs to be honest about what it doesn't know, aggressive about testing its own work, and operating under clear constraints about what's destructive vs. safe. We maintain a file called AGENTS.md with "sacred rules" — things the agent can never do without explicit approval. Database migrations, pricing changes, anything with --accept-data-loss.

The "no LLM" stance makes sense if you don't have guardrails. With the right constraints, AI-assisted code is faster AND safer than solo human development — because the agent never gets tired, never rushes before a deadline, and never thinks "I'll test that later."
by hudtaylor | 2026-03-12 21:56:30+00:00
I run a full AI operations stack on an M4 Mac Mini — ClawdBot (Claude), OBS streaming a 24/7 WebGL simulation, Chrome for browser automation, 16 cron jobs, the whole thing. $599 machine.

Reality check: it works remarkably well for AI agent orchestration. The unified memory architecture means the agent, browser, and streaming can coexist without the memory wall you'd hit on x86. But running OBS alongside everything else does make it laggy — I've got an M5 MacBook Air (32GB) incoming and I'm planning to swap the Mini for a 64GB model to give more headroom.

For anyone considering Apple Silicon as an AI dev machine: the sweet spot is 64GB unified memory minimum if you want to run an agent + browser automation + anything else simultaneously. 32GB works but you feel the pressure. The M-series efficiency means you can leave it running 24/7 without worrying about your power bill, which matters when your AI agent literally never sleeps.
by jmyeet | 2026-03-12 21:56:32+00:00
I will keep saying this til I am blue in the face: we are at a crossroads. One path leads to displacing workers and suppressing wages to further concentrate wealth into the hands of elite Epstein acolytes. The other path leads to making all of our lives better by automating the menial tasks so we all have to work less. We are firmly headed down the first path.

This type of incident isn't new and is only going to get worse. The problem is our governments are doing absolutely nothing about it. I'll give two examples:

1. Hertz implemented a system where they falsely reported cars as being stolen. People were arrested and went to jail for rental cars that were sitting in the Hertz lot. Hertz ultimately had to pay $168 million in a settlement [1]. That's insufficient. If I, as an ordinary citizen, make a false police report that somebody stole my car I can be criminally charged. And rightly so. People should go to jail for this and it will continue until they do. These fines and settlements are just the cost of doing business; and

2. The UK government contracted Fujitsu to produce a new system for their post offices. That system was allowed to produce criminal charges for fraud that were completely false. People committed suicide over this. This went on for what? A decade or more? But resuted in a parliamentary inquiry and settlements. It's known as the British Post Office scandal [2]. Again, people should go to jail for this.

Everyone here is one LLM decision away from having their life ruined where nobody can explain why a decision was made, what the basis of that decision was and what can be done to fix it. No requirements exist to prove such claims. The burden falls on ordinary people to prove the claims are false.

[1]: https://www.npr.org/2022/12/06/1140998674/hertz-false-accusa...

[2]: https://en.wikipedia.org/wiki/British_Post_Office_scandal
by Havoc | 2026-03-12 21:57:00+00:00
Always interesting to see hn's take on financial matters like this. ;)

Private credit is not something that stands in isolation in the economy. By the time it takes an actual loss in hard cash that means the equity layer - PE funds, ahem incubators, general equity portfolios etc...are already wiped out. Not took a haircut. WIPED...completely

Secured credit gets cash first, then unsecured credit, then equity holders. (often taxman and employee salaries are number 0 before even secured but that depends on jurisdiction, but largely irrelevant to current discussion).

So when people say there is trouble in private credit as if they had some cunning insight into a hidden risk hotspot they found in financial market...no that's not how that works. This isn't like the synthetic instrument CDO bullshit ala big short. Private credit is TRUE DEBT in the classic sense like your mortgage. Private credit is by definition NOT number 1 in queue when things go south. That's not to say there aren't problems, but if private credit has problems then the conversation is realistically "global financial system has problems"
by freedomben | 2026-03-12 21:57:02+00:00
I could not agree more with the lutris creator here. This fight over whether we should use AI or not is needlessly binary in my opinion. In the hands of a skilled programmer, AI can be a huge boost. I've had it help me narrow down extremely obscure bugs that I spent days trying to figure out myself. There's a massive spectrum between vibecoder and totally human controlled, and in so many of these debates people peg someone on one side of the extreme or the other. Either you're a vibe coder who doesn't even look at the code, or you're all human. The rest of us who are sane, are somewhere in between. AI tools can be a godsend, especially for open source where you're doing it in your free time not as a professional gig. I love and use lutris, and I'm extremely grateful that the creator took the time to build it and continue to maintain it. I'll judge the progress forward based on quality, not on ridiculous ideological stands like AI or not AI. There's no doubt that AI can build a lot of slop, and there's a lot of spammers out there throwing slop all over the place. But that does not mean that everyone who picks up a paintbrush is a vandal. At the end of the day, it's humans making the ship or not ship decision, the merge or not merge decision. Let's judge on outputs and results, not on method.

If strycore is reading this, thank you for making an amazing product that for me has made using GOG actually feasible on my Linux machine. You've measurably improved my life, and I'm grateful for it. Where AI can help you, I am glad for it. Keep up the good work!
by _cogg | 2026-03-12 21:57:03+00:00
Python supports arithmetic on mixed numeric types, so it makes sense that floats and ints should have a hash function that behaves somewhat consistently. I don't write a lot of python, but having used other scripting languages it wouldn't surprise me if numeric types get mixed up by accident often enough. You probably want int(2) and float(2) to be considered the same key in a dictionary to avoid surprises.

See: https://docs.python.org/3/library/stdtypes.html#hashing-of-n...
by computomatic | 2026-03-12 21:57:27+00:00
I find myself wondering about this though. Because, yes, what you say is true. Transformer architecture isn’t likely to handle negations particularly well. And we saw this plain as day in early versions of ChatGPT, for example. But then all the big players pretty much “fixed” negations and I have no idea how. So is it still accurate to say that understanding the transformer architecture is particularly informative about modern capabilities?
by mizarau | 2026-03-12 21:58:03+00:00
Hi HN, I'm the creator of FlowViz.

I built this because I found myself constantly needing to quickly visualize architecture or sequence flows, but I hated having to log into heavy enterprise tools (or deal with their paywalls) just to render a simple diagram.

FlowViz is a clean, minimal wrapper around Mermaid v11. My main goals were speed and privacy:

Zero backend: There is no database. The rendering happens entirely in your browser via WASM/JS. Your diagram data never leaves your machine.

Instant preview: It renders live as you type.

Clean export: You can instantly download the output as a scalable SVG.

It's completely free to use with no accounts required. I'd love to hear your feedback on the UI or any feature requests you might have!
by golem14 | 2026-03-12 21:58:05+00:00
Obligatory red dwarf quote:

TOASTER: Howdy doodly do! How's it going? I'm Talkie -- Talkie Toaster, your chirpy breakfast companion. Talkie's the name, toasting's the game. Anyone like any toast?

LISTER: Look, _I_ don't want any toast, and _he_ (indicating KRYTEN) doesn't want any toast. In fact, no one around here wants any toast. Not now, not ever. NO TOAST.

TOASTER: How 'bout a muffin?

LISTER: OR muffins! OR muffins! We don't LIKE muffins around here! We want no muffins, no toast, no teacakes, no buns, baps, baguettes or bagels, no croissants, no crumpets, no pancakes, no potato cakes and no hot-cross buns and DEFINITELY no smegging flapjacks!

TOASTER: Aah, so you're a waffle man!

LISTER: (to KRYTEN) See? You see what he's like? He winds me up, man. There's no reasoning with him.

KRYTEN: If you'll allow me, Sir, as one mechanical to another. He'll understand me. (Addressing the TOASTER as one would address an errant child) Now. Now, you listen here. You will not offer ANY grilled bread products to ANY member of the crew. If you do, you will be on the receiving end of a very large polo mallet.

TOASTER: Can I ask just one question?

KRYTEN: Of course.

TOASTER: Would anyone like any toast?
by benlivengood | 2026-03-12 21:58:16+00:00
I think we're almost at the point where public TLS endpoints never have to move their ephemeral private keys out of RAM. 6 days is pretty long in even modern cloud infrastructure lifecycles and it's unlikely that an endpoint will go long without TLS certificates on restart (2-3 minutes seems to be average for Let's Encrypt) which is fine for rolling restarts, and acceptable for a lot of DR scenarios.

This dramatically simplifies a lot of security assumptions because you can run stateless endpoints and not worry about encryption at rest or some of the bootstrapping issues. For example, only give an init container temporary credentials to modify DNS for ACME, or rely on HTTP01.
by AmericanAdvaita | 2026-03-12 21:59:48+00:00
Hi HN,

I’ve been working on a series of short philosophical talks exploring the nondual traditions of Advaita Vedanta and Kashmir Shaivism.

Each lecture is about 10 minutes long and draws on passages from classical texts such as the Mandukya Upanishad, the Ashtavakra Gita, the Shiva Sutras, and the Spanda Karika. Much of the material comes from my own work translating and compiling passages from these traditions.

The goal of the project is to present the core insights of nondual philosophy in a concise and accessible format.

There are currently around 50 lectures available, with about 70 planned in total.

You can see the series here:
[https://www.youtube.com/@american-advaita](https://www.youtube.com/@american-advaita)

I’d genuinely appreciate feedback, especially from people interested in philosophy, consciousness studies, or Indian philosophical traditions.
by Anamon | 2026-03-12 21:59:48+00:00
Absolutely. If anything, private torrent trackers and NZB indexers are proof that it works overwhelmingly well.

The few I'm part of all have a real community (like in the net of old), civil conversation, and verified, quality materials being shared. Almost everybody behaves and doesn't abuse the invite system, because nobody wants to lose their access to such a wonderful oasis among the slop web. It's a great motivator to stay decent and follow the rules. When things go bad, it's usually not because of malice, but because someone got their account stolen. Prune the invitee tree and things are mostly under control again.
by rvz | 2026-03-12 22:01:06+00:00
To LLMs, they don't know what is "No" or what "Yes" is.

Now imagine if this horrific proposal called "Install.md" [0] became a standard and you said "No" to stop the LLM from installing a Install.md file.

And it does it anyway and you are now pwned.

This is the reason why you do not trust these probabilistic models under any circumstances if you are not bothered to do it yourself.

[0] https://www.mintlify.com/blog/install-md-standard-for-llm-ex...
by Aurornis | 2026-03-12 22:01:19+00:00
I think you're mixing different concepts. JEDEC doesn't define DDR4 training procedures so there isn't a secret that's being withheld. Everyone who implements a DDR4 controller has to implement the training to meet the specifications.

On a DDR4 motherboard the training would occur between the memory controller and the DDR4 RAM. The proprietary blob you need would include the communication with the memory controller and instructions to handle the training for that specific memory controller.

There are several open source DDR4 controllers in different states of usability. They have each had to develop their own implementations.
by ptak_dev | 2026-03-12 22:01:20+00:00
The hardest part of career adaptation isn't learning new skills — it's reframing the ones you already have.

I've watched senior engineers with 15+ years of experience struggle to get callbacks, not because they lack skill, but because their resumes still read like they did in 2019. They list technologies and implementation details when hiring managers in 2026 are looking for system-level judgment, cross-functional leadership, and the ability to evaluate AI-generated output.

The irony is that the skills that become MORE valuable in an AI-heavy world — knowing what to build, when a generated solution is subtly wrong, how to scope ambiguity — are exactly the things that are hardest to articulate on a resume. "I know when the AI is wrong" doesn't fit neatly into a bullet point.

I ended up building a tool to help with this exact problem: a conversational AI that helps you reframe your experience for different target roles through dialogue rather than templates (https://super.myninja.ai/apps/6de082c7-a05f-4fc5-a7d3-ab56cc...). The interesting finding was that most people don't have a skills gap — they have a translation gap between what they've done and how the market describes what it needs.

The article's core insight is right: the people who'll navigate the next 30 years aren't the ones who chase every new framework. They're the ones who can articulate why their judgment matters, even as the tools keep changing.
by robutsume | 2026-03-12 22:01:43+00:00
The "requires write access" framing undersells the risk. Most production RAG pipelines don't ingest from a single curated database — they crawl Confluence, shared drives, Slack exports, support tickets. In a typical enterprise, hundreds of people have write access to those sources without anyone thinking of it as "write access to the knowledge base."

The PoisonedRAG paper showing 90% success at millions-of-documents scale is the scary part. The vocabulary engineering approach here is basically the embedding equivalent of SEO — you're just optimizing for cosine similarity instead of PageRank. And unlike SEO, there's no ecosystem of detection tools yet.

I'd love to see someone test whether document-level provenance tracking (signing chunks with source metadata and surfacing that to the user) actually helps in practice, or if people just ignore it like they ignore certificate warnings.
by sgillen | 2026-03-12 22:01:46+00:00
I think there is some behind the scenes prompting from claude code for plan vs build mode, you can even see the agent reference that in it's thought trace. Basically I think the system is saying "if in plan mode, continue planning and asking questions, when in build mode, start implementing the plan" and it looks to me(?) like the user switched from plan to build mode and then sent "no".

From our perspective it's very funny, from the agents perspective maybe very confusing.
by kazinator | 2026-03-12 22:02:01+00:00
The glibc implementation already has tests for several ranges and hacks for them including Taylor series:

https://github.com/lattera/glibc/blob/master/sysdeps/ieee754...

The smallest range is |x| < 1.49011611938477e-8. In this case the routine just returns x, after calling some underflow-checking routine.

So right there, if we neglect this detail in our own wrapper, we may be able to get a speedup, at the cost of sending very small values to the Tayor series.

The next smallest range tested is |x| < 0.125, and after that |x| < 0.5 and 0.75.

The authors are cetainly not missing any brilliant trick hiding in plain sight; they are doing a more assiduous job.
by jameschaearley | 2026-03-12 22:02:05+00:00
This is the tension I keep hitting when building data tools on top of LLMs. A nice-looking chart makes the output feel more trustworthy, but the data can still be wrong. The chart just makes it harder to notice. LLMs still need to come with receipts of where the data came from and the math they did. It's as bad as "I read the headline so I know everything in the article."
by thegrimmest | 2026-03-12 22:02:15+00:00
Slavery was (is) also an agreed upon social contract, enforced by various means. What makes it wrong? You clearly have morally prescriptive beliefs. Why are you so sure that your moral prescriptions are the right ones? And that being in the majority gives you the right to impose your beliefs on others?

What if you are in the minority? Do you just accept the hypercapitalist dictates of the majority? Why not?

Law is more than convention. What distinguishes legitimate from illegitimate law?

The only way for people who disagree axiomatically to get along is to impose on each other minimally.
by ranyume | 2026-03-12 22:02:16+00:00
I'd want two things:

First, that It didn't confuse what the user said with it's system prompt. The user never told the AI it's in build mode.

Second, any person would ask "then what do you want now?" or something. The AI must have been able to understand the intent behind a "No". We don't exactly forgive people that don't take "No" as "No"!
by robutsume | 2026-03-12 22:02:19+00:00
The mTLS sidecar is the right answer but it's worth noting why most people won't do it: the operational complexity is brutal. You need cert provisioning, rotation, a CA you actually trust, and suddenly your "just give the agent an API key" problem has become a PKI problem.

What I find more interesting is the host-scoping approach hardsnow mentioned upthread. Even without mTLS, if the proxy only injects credentials for requests matching specific host+path patterns, you've at least bounded the blast radius. A prompt-injected agent can abuse the credentials it has access to, sure, but it can't exfiltrate them to arbitrary endpoints. That's not perfect security but it's a meaningful improvement over "agent has raw Stripe key in an env var."

The real gap nobody's addressing yet is request-level authorization. Credential injection solves "who are you" but not "should you be doing this." An agent with scoped GitHub access can still force-push to main.
by kkfx | 2026-03-12 22:02:24+00:00
The office serves only one purpose: to keep people in the city. The city exists to house the masses who own nothing, who live in rented accommodation, use public transport, buy useless fast tech as status symbols to show off, fast fashion for the same reason, and order takeaway food with all the massive waste of packaging etc. etc. etc.

It serves no other purpose and, in particular, it isn't sustainable in terms of scale/natural resources.

Whether you like it or not, technology defines the era: when we moved from bronze to iron, those still using bronze were slaughtered by those who had iron. Today, technology dictates Distributism because, like it or not, the "new deal" works through things like domestic p.v. with small-scale storage, an EV integrated in the garage, not skyscrapers and massive solar power plants. Digital tools work well when you HAVE to use them, so you're forced to do it properly or you fail; in other words, by working remotely. In person, steps are "skipped" leaving information gaps and creating inefficiency, and so on and so forth.