15:[[49598009,{"by":"rietta","descendants":5,"id":49598009,"kids":[49598258,49603640,49599069,49598772,49598431],"score":5,"text":"$16","time":1788786584,"title":"Ask HN: 3.5 inch diskette read errors, would a period correct drive do better?","type":"story"}],[49576258,{"by":"der_gopher","descendants":173,"id":49576258,"kids":[49577046,49577764,49576937,49576927,49578365,49577934,49580112,49576351,49577299,49577428,49576935,49584477,49577863,49577135,49582168,49577675,49578694,49577311,49578080,49580007,49579227,49581942,49581088,49581957,49580597,49581126,49578249,49577087,49580258,49579188,49577185,49576952,49584840,49578213,49577780,49582085,49578795,49581190,49579815,49579352,49579034,49578367,49577695,49578825,49579254,49577750,49577488,49577576,49580498,49578757,49577212,49596181,49579259,49578298,49577346,49581304],"score":182,"time":1788614382,"title":".gitignore Everything by Default","type":"story","url":"https://packagemain.tech/p/gitignore-everything-by-default"}],[49566388,{"by":"rce123","descendants":1,"id":49566388,"kids":[49566693,49573128,49575189,49566529],"score":5,"text":"Context length used to be one of the headline metrics for new models. I hardly hear about it anymore, but I can't imagine it doesn't still play a huge role in practical performance.

Is this truly no longer a bottleneck, or does it just get rolled up in the headline benchmark numbers now?","time":1788537199,"title":"Ask HN: Why don't we talk about context window size anymore?","type":"story"}],[49560168,{"by":"bariumbitmap","descendants":4,"id":49560168,"kids":[49573071,49562197,49560191,49560386,49566229,49566915],"score":8,"text":"I've noticed several websites that exclusively a single-use login code for authentication. This is a 4-digit or 6-digit login code sent via email instead of a password, it's not 2FA or a passkey. (I would rather they don't do this as it means I have to open my email instead of using a password manager.) Some of them also send a magic link. Examples of websites that appear to do this exclusively (no password): substack.com, medium.com, geoguessr.com, bandsintown.com. There are also websites that default to this but will also accept passwords (e.g. spotify.com). There are also websites that will accept either a passwords or login code, but if you enter a password then they require a login code anyway (e.g. homedpot.com).

Is this becoming more common, and if so why?","time":1788492367,"title":"Ask HN: Why do many websites use a sign-in code instead of a password?","type":"story"}],[49566049,{"by":"ilbert","descendants":0,"id":49566049,"kids":[49566165],"score":2,"text":"I've been using Firecraker lately and it's really good to manage microVMs.

What I still haven't found though is a proper daemon/framework that wraps Firecracker and provides an easy to use API to start/stop microVMs, keep their filesystem backed up and expose their HTTP endpoint to the public.

Are there any frameworks/tools out there?","time":1788535608,"title":"Ask HN: Framework to Manage Firecracker?","type":"story"}],[49556858,{"by":"alanfuNZ","descendants":3,"id":49556858,"kids":[49572246,49559118,49589759,49561621],"score":2,"text":"I've been giving coding agents more autonomy lately, letting them run shell commands unattended for longer stretches, and I don't have a good answer for how people actually gate that beyond "run it in a container and hope." A container limits blast radius but doesn't stop the agent from reading a secret and then making an outbound call in the same session, or force-pushing to a branch it shouldn't touch, or just doing something irreversible while nobody's watching. Curious what people are actually doing: allowlists of commands, human-in-the-loop approval for anything destructive, something built into the agent framework itself, or just accepting the risk because the alternative is too slow? Specifically interested in what happens when the approval step itself fails or times out, does your setup default to allow or deny?","time":1788468996,"title":"Ask HN: How do you gate an autonomous coding agent's shell access?","type":"story"}],[49549402,{"by":"godsfavvchild","descendants":1,"id":49549402,"kids":[49549403,49556132,49549441],"score":1,"time":1788440382,"title":"Modern Saves – An internet memory for things I find while browsing","type":"story","url":"https://chromewebstore.google.com/detail/modern-saves/fnjaghebjbpdjbkgcealmfcdiagnfbpa"}],[49539178,{"by":"aurelionakamura","descendants":1,"id":49539178,"kids":[49542298,49539194,49548929],"score":3,"time":1788368397,"title":"Show HN: Cmdxray – explain any shell command, offline, with a shareable card","type":"story","url":"https://aurelio-nakamura.github.io/cmdxray/"}],[49524564,{"by":"ninju","descendants":7,"id":49524564,"kids":[49562184,49537998,49524859,49527407,49543278,49537483],"score":8,"text":"It's been 10+ years since Microsoft acquired LinkedIn (June 2016) and I'm still curious what was going on in the MS executive board that drove them to that decision.

Microsoft is primarily a software company and does have a social media presence (unlike Google or Meta).

I haven't seen any large synergies come out of the acquisition either, maybe the subscriber data is useful somewhere but I don't see it.

Just curious","time":1788281494,"title":"Why did Microsoft acquire LinkedIn?","type":"story"}],[49525220,{"by":"joshua_s_penman","descendants":0,"id":49525220,"kids":[49579210,49549467,49527744],"score":6,"text":"$17","time":1788284413,"title":"Show HN: Semantic Overlays – an NX bit for LLM prompt injection (live demo)","type":"story","url":"https://semantic-overlays.vercel.app/"}],[49503285,{"by":"top_rooster","descendants":4,"id":49503285,"kids":[49506859,49516365,49509548,49532708,49508187,49524987],"score":5,"text":"I have run into a lot of issues using multiple sessions at once to build things, and I really want to hear from those that have figured a good amount out.

Or at least hear what problems people are having to know if I am running into the same blockers everyone is.

For example, I often want to have agents stop at certain points, but fail to get a mechanism that works.","time":1788127122,"title":"Ask HN: What are your biggest problems and fixes with multisession engineering?","type":"story"}],[49507259,{"by":"cudder","descendants":2,"id":49507259,"kids":[49507675,49514178,49513463],"score":3,"text":"$18","time":1788166536,"title":"Ask HN: What to do when a vendor doesn't respond to security issues?","type":"story"}],[49497500,{"by":"PatuDev","descendants":6,"id":49497500,"kids":[49502573,49505528,49498128,49532968,49497503,49500824,49500529],"score":18,"time":1788086725,"title":"Show HN: Drop a SQL schema, get an interactive ER diagram","type":"story","url":"https://mcdview.dev/"}],[49489006,{"by":"opwizardx","descendants":1,"id":49489006,"kids":[49489011,49489252],"score":2,"time":1788002816,"title":"Ask HN: Why still no unified standard file to describe all skills/mcps for repo?","type":"story"}],[49488654,{"by":"jwally","descendants":18,"id":49488654,"kids":[49488799,49493628,49488826,49488663,49488781,49495282,49497099,49502348,49489409,49490612,49488728,49492495,49489698,49490365,49489825],"score":12,"text":"Why not just publish your API docs and let the client's bot chain together what calls need to be made.

You could even repurpose the MCP so you only ever produce the API documentation as EVERY response. No LLM necessary.","time":1787999208,"title":"Ask HN: Why do we need MCP?","type":"story"}],[49466147,{"by":"zof3","descendants":0,"id":49466147,"kids":[49597099,49483544],"score":3,"text":"Hi HN-

Our team has been recently getting fed up with every single LLM that we use defaulting to sounding like a corporate compliance officer or goody-two-shoes (‘erm, but xyz’ etc) on even simple things. We’ve come to the conclusion that the post training being done is so strict that models default to acting like Gomer Pyle. We’ve made some internal agents.md files and pre-prompt instructions to try to kick them out of the pattern — and it works sometimes — but how are all of you dealing with this or working around it?","time":1787843443,"title":"Ask HN: Ideas for dealing with overly-do-gooder agents","type":"story"}],[49477766,{"by":"jech","descendants":10,"id":49477766,"kids":[49482868,49486464,49477786,49509683,49499870,49501943,49494030,49481150],"score":6,"text":"I'm administering a small number of Linux servers that run an ssh server exposed to the Internet. I usually connect using a cryptographic key, but I still allow password authentication in case of trouble (perhaps I'm being overly cautious). I've been using fail2ban with good results, but I'm annoyed at having to install a Python interpreter on every server.

Is there an alternative to fail2ban that is just a single binary? It doesn't need to have all of the features of fail2ban, blocking dictionary attacks against ssh is all I need.","time":1787921295,"title":"Ask HN: Alternatives to Fail2ban?","type":"story"}],[49470597,{"by":"vkaku","descendants":2,"id":49470597,"kids":[49471942,49473544,49476759,49475219],"score":9,"time":1787861709,"title":"Ask HN: Does anyone have a VRAM tester? Something like MemTest86+ but for GPUs?","type":"story"}]]

user:	laruss5
created:	August 25, 2026
karma:	4