MurphyA/hacker-news huggingface dataset:
by alephnerd | 2026-03-13 14:24:50+00:00
> Many small distros are hobby distros...

Then region lock. You don't have to support California or NY or ...

> Different states are passing different requirements that often contradict each other. This is going to be a nightmare

Create regional feature flags or region lock. It's a solved problem.

> So you’re saying that we should expect those laws too

They already de facto exist contractually speaking.

> Because before now “code is speech” has ruled, and the US government have not been able to be so invasive about how computers should work

The mindset around tech regulation shifted after the 2016 election and Jan 6th. The maximalist tech civil libertarian view on privacy was an anomaly from the late 1990s to early 2010s when tech was viewed as inconsequential.

The 2016 election and Jan 6th showed otherwise.

---

The overlap between Linux daily drivers and "voters who can flip an election in California, NY, or <insert_state_here>" is nonexistent.

This also appears to be a front-run at reducing the risk of an Australia-style regulation being proposed.

Edit: can't reply

> Europe realized this with their new infosec liability regulations

European organizations (from private sectors to government agencies) sidestep this by contractually mandating SBOM and dependency requirements.

You end up with the same result, but it's essentially regulated via contracts instead of the law.

> Expecting volunteers to dump time into compliance is ridiculous. Not because they oppose the idea, but because huge swaths of the internet run on people doing something for free -- and they'll just do something else if governments begin threatening them

That's a decision a lot of governments and organizations are fine with.

OSS where maintainers are hired by sponsor organizations is already the norm, and government-backed OSS is becoming increasingly common in the EU and much of Asia.

Hobbyists who don't wish to comply can region gate within their license - that solves your liability risk and will keep regulators happy.
by officeplant | 2026-03-13 14:25:00+00:00
Countercountercountercounterpoint: Yes and like every other age verification scheme in the US the underlying idea is privacy erosion. With a side serving of censorship given most dev's can't be bothered to implement these age verification schemes into their software so users might just end up gated out of applications if their OS goes through with this nonsense.

Other states are even worse, creating another way to have your buddy buddy lobbyist folks fire up a new business opportunity to make money as a verification service.
by butILoveLife | 2026-03-13 14:25:12+00:00
Huh... I am the opposite.

I want my kids exposed to the brutal realities of the world asap.

I reflect that my innocence caused me to make some extreme major mistakes as a young adult that took a decade to show itself. I cannot go back, and now I am suffering terribly.

I blame my parents at least a little bit, but I blame western idealism more majorly.
Proton's Swiss Myth: US Jurisdiction via Cloudflare and FAA Arbitration Clauses
by MissMajordazure | 2026-03-13 14:25:16+00:00
The "Swiss Sanctuary" is a Network and Legal Mirage

As a Business customer, I performed a technical and legal audit of Proton AG’s current infrastructure. The results show a systemic disconnect between their "100% Swiss" marketing and their actual operational routing and legal framework.

1. The Technical Leak: Routing via AS13335 (Cloudflare)
A simple traceroute to mail.protonmail.ch reveals a critical interception at Hop 5.
- Node: cloudflare.belgiumix.net (185.1.127.13)
- Owner: Cloudflare, Inc. (US Entity)
- Jurisdiction: US CLOUD Act

By routing business traffic through US-owned CDNs before it even touches Swiss soil, Proton effectively places user metadata and transit traffic under the jurisdiction of the Patriot Act and CLOUD Act. The "Swiss Jurisdiction" promise is nullified the moment a packet hits a Cloudflare node.

2. The Legal Dol: Section 13 and the FAA
Proton’s Terms of Service (Section 13) explicitly mention the Federal Arbitration Act (FAA).
How can a company sell "Swiss Privacy" while binding European Business users to US Federal Arbitration laws? This is a textbook case of contractual inconsistency. You cannot market immunity from US overreach while embedding US legal mechanisms in your core contract.

3. The Transparency Gap: 89%+ Compliance Rate
Proton’s own 2023-2025 transparency reports show they complied with over 24,000 legal orders.
- 2024: 94% compliance (10,368 orders honored).
- Mechanism: Swiss BÜPF (Art. 26) forces active collaboration.
The "No-Log" policy is a marketing layer that disappears the moment Europol pings the Swiss MPC. The recent French climate activist case and the Paris Court of Cassation ruling on IPTV filtering prove that Proton is now a de facto arm of EU/US law enforcement.

4. The Diversion: Justice Theater vs. Technical Sovereignty
Recently, Proton sued Apple over App Store fees. This is "Privacy Washing." While they fight Apple for 30% commissions, they fail to defend the technical sovereignty of their network routing. They prioritize "Justice Theater" over the basic engineering requirement of a private service: avoiding US-controlled transit nodes.

Conclusion: Contractual Nullity for Dol
For a Business user, this is not a matter of "refund policy," but a matter of Nullity for Dol (Art. 1116 Civil Code / Art. 28 Swiss CO). The consent was obtained through fraudulent claims regarding the real nature of the data routing and legal protection.

If you are a security professional, stop looking at the "CERN" labels and start looking at the Hop 5. Proton has traded its Swiss bunker for a US-hosted storefront.
by cestith | 2026-03-13 14:25:30+00:00
I think I understand the trepidation a lot of people are having with prompting an LLM to get software developed or operational computer work performed. Some of us got into the field in part because people tend to generate misunderstandings, but computers used to do exactly what they were told.

Yes, bugs exist, but that’s us not telling the computer what to do correctly. Lately there are all sorts of examples, like in this thread, of the computer misunderstanding people. The computer is now a weak point in the chain from customer requests to specs to code. That can be a scary change.
by a24venka | 2026-03-13 14:25:36+00:00
That is definitely a valid way of using Spine as well. You can just work in the chat and consume the deliverables similar to how you would in other tools.

The canvas helps when you want to trace back why an output wasn't what you expected, or if you're curious to dig deeper.

Even beyond auditability, the canvas also helps agents do better work: they can generate in parallel, explore branches, and pass context to each other in a structured way (especially useful for longer-running tasks).
by jwrallie | 2026-03-13 14:25:50+00:00
I started using Linux when I was in high school. I got my first job years later because I knew my way around Linux much better than other candidates. My OS never tried to track my age to prevent me doing what I wanted. I used to live in one of these places where OSs should report user’s age and I am glad my kid will grow up in one that doesn’t (yet?).
by dwa3592 | 2026-03-13 14:27:19+00:00
if you understood the article, please correct my understanding -

they created a new training dataset which also has computation solving step by step (multiplying two numbers or playing sudoku) and then trained a transformer on it- as a result, the model performs the computation(multiplying two numbers) "inside" itself instead of calling calculator (or python)?

++ And they also figured out how to make attention faster?
by ndriscoll | 2026-03-13 14:27:22+00:00
So I agree that operating systems and device developers should not be liable. That's putting a burden on an unrelated party and a bad solution that does possibly lead to locked down computing. I meant that liability should lie with service providers. e.g. porn distributors. The people actually dealing in the restricted item. As a role of thumb, we shouldn't make their externalities other people's problems (assuming we agree that their product being given to children is a problem externality).
by _pdp_ | 2026-03-13 14:27:24+00:00
The main issue is not so much if it needs to run inside a container or not (and to be honest there are even better isolation models, why not firecracker vm). The main issue is what are you going to do with it.

It does not really matter.

IMHO, until you figure out useful ways to spend tokens to do useful tasks the runtime should be a second thought.

As far as security goes, running LLM in a container in just simply not enough. What matters is not what files it can edit on your machine but what information it can access. And the access in this case as far as these agents are concerned is basically everything. If this does not scare you you should not be thinking about containers.
by quesera | 2026-03-13 14:27:41+00:00
Because 10% of US citizens (legitimate voters) do not have the forms of ID required in these proposed laws, and it can be expensive and time-consuming to get those forms of ID which are not otherwise required for their lives (QED), and they might not do so strictly for voting.

Some people think disenfranchisement is bad. Others see it as useful.

Specifically, PartyB thinks those people with inadequate ID skew toward PartyA voters. This has been the accepted wisdom for decades. So they are incentivized to make it harder for them to vote.

Interestingly though, PartyB might be wrong about the current population. PartyA, and those against disenfranchisement and imaginary crises in general (I count myself in this third group), do not want to blow up centuries of precedent especially if the consequences are likely to be undemocratic and unfair.
by vova_hn2 | 2026-03-13 14:27:56+00:00
I used the word "context" in a purely technical sense in relation to LLMs: the input tokens that you send to an LLM.

Every time you send what appears as a "chat message" in any of the programs that let you "chat" with an "AI", what you really do is sending the whole conversation history (all previous messages, tool calls and responses) as an input and asking model to generate an output.

There is no conceivable scenario when sending "<tons of tokens> + no" makes any sense.

Best case scenario is:

"<tons of tokens> + no" -> "Okay, I won't do it."

In this case you've just waisted a lot of input tokens, that someone (hopefully, not you) has to pay for, to generate an absolutely pointless message that says "Okay, I won't do it.". There is no value in this message. There is bo reason to waste time and computational resources to generate this message.

Worst case scenario is what happened on the screenshot.

There is no good scenario when this input produces a valuable output.

If you want your "agent" or "model" or whatever to do nothing you just don't trigger it. It won't do anything on it's own, it doesn't wait for your response, it doesn't need your response.

I don't understand why, in this thread, every time I try to point out how nonsensical is the behavior that they want is from technical perspective (from the perspective of knowing how these tools actually work) people just cling to there anthropomorphized mind model of the LLM and insist on getting angry.

"It acts like a bad human being, therefore it's bad, useless and dangerous"

I don't even know what to say to this.

P. S. If you wind this message hard to read and understand, I'm sorry about it, I don't know how to word it better. HN disallows to use LLMs to edit comments, but I think that sending a link to an LLM-edited version of the comment should be ok:

https://chatgpt.com/s/t_69b423f52bc88191af36a56993d55aa8
by user_7832 | 2026-03-13 14:28:14+00:00
It's pretty cool! I cross "validated" with the charts of where I'm from and the results seem to be fairly accurate.

One question/request: How did you get the data, and would it be possible to filter by language or genre?

TBH I'm actually trying to chase which songs were popular when I was a kid - for example I distinctly remember Astronomia (Tony Iggy) being massive in the club/party "scene" (and even in malls I think!) - but these charts only give what everyone was listening to - so they're pop songs in the local language.
by alecco | 2026-03-13 14:28:21+00:00
You are missing the point. The real purpose is to control the Internet and free speech. They've been trying this for ages. Now the excuse is protecting children. Soon terrorism will be back. And don't forget aոtisеmіtism, too.

Not exactly a good moment for this particular caste of politicians/elites to pretend they care about children's well-being!
by shimman | 2026-03-13 14:28:40+00:00
Something I realized while doing more political campaign work is how inefficient most self hosted solutions are. Things like plausible or umami (analytics) require at least 2 gigs of ram, postiz (scheduled social media planner) requires 2 gigs of ram, etc.

It all slowly adds up where you think a simple $10 VPS with 2 gigs of ram is enough but it's not, especially if you want a team of 10-30ish to work sporadically within the same box.

There can be a lot of major wins by rewriting these programs in more efficient languages like Go or Rust. It would make self hosting more maintainable and break away from the consulting class that often has worse solutions at way higher prices (for an example, one consulting group sells software similar to postiz but for $2k/month).
by altairprime | 2026-03-13 14:29:06+00:00
> During this incident, we discovered we had crossed a scale threshold where our log ingestion pipeline was being rate-limited and quietly discarding logs. Ironically, we ended up with less information as a result, which made it significantly harder to reconstruct what was actually happening.

Last year they posted about using New Relic, Datadog, and Grafana. Would this ‘silent deletion of log data due to quota’ problem be characteristic of any one of them in particular, or is it something we have to watch out for with all of them?
by YeGoblynQueenne | 2026-03-13 14:29:27+00:00
>> So then, when you see this picture (and remember, it might only be showing half of the whole setup), do you think "wow, cool, they got to wrangle all of that", or do you think "OMG they had to wrangle all of that"? It's an important distinction to make, and I think someone's gut reaction to this amount of hardware in one place might influence how they approach building new systems.

It's a very good point. Like, I have some stuff that eats up RAM like a, a very hungry thing, so I went online to see if I could buy some old server blade with a couple TB of RAM from ebay. I found a few, refurbished, not in a horrible condition, not prohibitively expensive (I'm not currently funded, as such) and I remember this distinct feeling, like a frisson of excitement at the thought of having access to ~20 times more POWER than I usually have...

... and then I cooled down, didn't buy a server, and instead rented one with "only" 256 GB RAM until I could fix my stuff so that it now runs with up to 8GB on my laptop. Still expensive, but we're getting there.

Morale of the story: don't know. I prefer to find ways to make software go faster than rely on hardware? I get the feeling I'm very alone on this, seeing as everyone's talking about putting nuclear-powered server farms in space and whatnot.
by peanut-walrus | 2026-03-13 14:29:32+00:00
Why the hell is this a name suffix instead of just using subdomains?

myapp-123456789012-us-west-2-an

vs myapp.123456789012.us-west-2.s3.amazonaws.com

The manipulations I will need to do to fit into the 63 char limit will be atrocious.
by pixl97 | 2026-03-13 14:29:48+00:00
>create an infrastructure for total surveillance

I mean, we're talking about age verification in the OS itself in some of these laws, so tell me how it doesn't.

Quantity is a quality. We're not just seeing it for porn, it's moving to social media in general. Politicians are already talking about it for all sites that allow posts, that would include this site.

So you tell me.
Ask HN: AI Agents took my programming job. What can I do?
by butILoveLife | 2026-03-13 14:29:56+00:00
I had a customer meeting today, and the customer announced that he did not need me. He did everything he wanted in 2 days.

Things I don't really believe in:

>Someone needs to tell the AI what to do and check. No... I'm a middle man, I actually make it worse because we are playing telephone.

>I can train people how to set up, use AI, and do it safely. No... Claude is going to build their own OpenClaw-like system.

Maybe I can work for some gigantic company, but I sank a few years into my own company that was doing well making custom software.

My question:

What is the value that experienced programmers are going to provide?
by bonoboTP | 2026-03-13 14:29:59+00:00
I think the tells of AI video are becoming more subtle, similar to language. It's no longer so much that the visuals are categorically impossible, such as mangled hands or impossible geometric arrangements of objects, but you can still see style and composition that is more frequent in AI video (but could be possible in a real video as well in principle).

Such as higher production quality, too beautiful people, a kind of stock photo sheen, etc. Of course if you use special LoRAs or prompts and input images, it's possible to leave the stock footage style, but most people don't bother with it, just like most people use stock ChatGPT in its default voice with its favorite trope-filled cadence etc.
by SkyLemon | 2026-03-13 14:30:04+00:00
Two things:
1) Don't look at your choices in the past with your now knowledge of the future. That's not how it works, we are not Gods.
2) Do what you love, what brings you joy work is often a means to an end in this regard. (Work, by it's nature is often not fun, but it is often not your life.)

We all (currently) enter and exit this world in the same manor. It's the bit in between that matters. We all could be hit by a car tomorrow or live to be 120. Most of us don't get to know. You got an reality check and a potential expiration date. Congrats, you know more then most of us, and yes, can make more accurate plans. But live, because you likely will!

Now, answer me this. Why should you live your life any differently? And if there is something, should you not have been doing that anyway?
by CuriouslyC | 2026-03-13 14:30:10+00:00
I built an agent framework designed from the ground up around policy control (https://github.com/sibyllinesoft/smith-core) and I'm in the process of extracting the gateway from it so people can provide that same policy gated security to whatever agent they want (https://github.com/sibyllinesoft/smith-gateway).

My posts about these aspects of agent security get zero engagement (not even a salty "vibe slop" comment, lol), so ironically security is the thing everyone's talking about, but most people don't know enough to understand what they need.
by verisimi | 2026-03-13 14:30:28+00:00
I think the personal pronoun you use is very interesting.

In your case, you seemed to be representing the common idea of a different culture, ie 'your society thought our society was this or that', eg 'Muslims think western societies to be greedy and unkind'.

Do you really think of yourself as one of many? If so, which type do you identify as? And then, do you think you are personally responsible for the actions of others of your type?

I personally think the general usage of a general collective pronouns to be inevitably misleading, but has the benefit of allowing one's preferred poor and unsubstantiated beliefs to be stated as indisputable fact.
by raw_anon_1111 | 2026-03-13 14:30:53+00:00
Small companies don’t need to work together for the economies of scale. There are companies called PEOs including YC company Rippling.

Basically you are “co employed” by your company and the PEO. For all day to day stuff, you work for your company, for the purposes of taxes, insurance, etc you work for them.

https://www.rippling.com/products/hr/peo
by gjm11 | 2026-03-13 14:30:57+00:00
It was worse than you remember. You could have 640x256 in monochrome, or 320x256 with 4 colours, or 160x256 with 16 colours (which IIRC was actually 8 distinct colours plus 8 flashing versions of them).

The game Elite did something extremely evil and clever: it was actually able to switch between modes partway through each frame, so that it could display higher-resolution wireframe graphics in the upper part of the screen and lower-resolution more-colourful stuff for the radar/status display further down.
by thenickdude | 2026-03-13 14:30:58+00:00
If you ever produce and share a signed link for e.g. S3, this link contains your access key ID in it. Turns out you can just slice and decode your Account ID out of that access key, it's in there in base32:

https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f...
by alephnerd | 2026-03-13 14:31:09+00:00
> encouraging everyone to openly flaunt the law

> But maybe that’s just me

If you are fine taking the legal liability and are open to civil and criminal prosecution, go right ahead.

Western jurisdictions tend to cooperate on extradition as well, and American free speech laws are significantly more expansive than those in the EU, Canada, or ANZ so taking a principled approach wouldn't be a viable defense if you decided to go and incite via that route.

> fighting via lawfare

That is being done.

> and media

You heard about it via the media.
by swiftcoder | 2026-03-13 14:31:18+00:00
> It's a programming fundamental that you shouldn't be converting magic numbers to floats or doing math with floats without considering inaccuracy.

This is all well and good in a language that makes you declare distinct floating point types, but in python things are maybe not so clear cut - the language uses arbitrary precision integers by default, and it's not always crystal clear when they are going to be converted to a (lossy) floating point representation

Yeah, the programmer should probably be aware of the ins and out here, but python folks often aren't all that in the weeds with the bits and the bytes
by phlakaton | 2026-03-13 14:31:39+00:00
Agree with all this, but am not sure how it applies to this case. This seems rather the opposite behavior: accelerated bad de facto behavior because de jure enforcement is infeasible.

We are seeing this in the world of digital media, where frivolous DMCA and YouTube takedown reports are used indiscriminately and with seemingly little consequence to the bad actor. Corporations are prematurely complying with bad actors as a risk reduction measure. The de jure avenues to push back on this are weak, slow, expensive, and/or infeasible.

So if you ask me what's the bigger threat right now, stricter or less strict enforcement, I'd argue that it's still generally the latter. Though in the specific case of copyright I'd like to see a bunch of the law junked, and temporal scope greatly reduced (sorry not sorry, Disney and various literary estates), because the de facto effects of it on the digital (and analog!) commons are so insidious.
by Dagger2 | 2026-03-13 14:31:44+00:00
Plenty of people are switching v4 off. Facebook run basically all of their datacenters without v4. T-Mobile USA use only v6 on their network. Thread only supports v6 in the first place

There are plenty of other places doing the same thing, but these examples alone should be sufficient to disprove "no-one is willing to turn v4 off".
by saltpath | 2026-03-13 14:32:02+00:00
The token cost difference is the metric nobody's capturing. 5K vs 210K tokens for the same JWT forgery isn't just efficiency — it's the blast surface. A contained agent leaves a narrow call trace. A thrashing one touches five APIs, retries three times, leaks context in every hop. If your proxy logs the full call chain with timestamps and response sizes per hop, that cost delta becomes a measurable risk signal, not just a billing line. The hard part isn't the instrumentation, it's getting teams to route agent traffic through anything they don't own.