MurphyA/hacker-news huggingface dataset:
by mrajagopalan | 2025-09-14 23:20:04+00:00
Following the MCP security discussion -https://news.ycombinator.com/item?id=45199713

I've written up our approach to securing AI tool calling through cryptographic enforcement rather than prompt engineering.

The core problem: we're mixing control and data planes without security boundaries. When an LLM with tool access processes untrusted input, you get intent hijacking, tool chaining, and context poisoning. The LLM fundamentally cannot be the boundary - it's trained to follow instructions, not evaluate them.

The insight: treat every AI entity like an untrusted network service. We give LLMs, tools, and agents cryptographic identities and enforce policies at tool boundaries (where the actual damage happens). This creates an "Authenticated Workflows" pattern - like mTLS but for AI interactions.

Intent is signed before the LLM sees it. Tools verify signatures independently. Policies are cryptographically bound to invocations. Even if the LLM is completely confused by prompt injection, it can't forge these signatures.

We've validated this with SecureOpenAI and SecureMCP implementations that block injections that would otherwise succeed. The challenge was making it transparent to developers - they just call tool(params) while security happens underneath.

Blog post with technical details: https://www.macawsecurity.com/blog/zero-trust-tool-calling-f...

Would love feedback from anyone building production AI systems. Are others seeing these attack vectors in the wild? How are you approaching defense?
by thephyber | 2025-09-14 23:20:09+00:00
I think initially I did it because I had high network privileges in my position at a company which had an immense amount of sensitive data on important companies. Kind of a deep thought exercise to be hyper vigilant in my position of responsibility.

Later, I think I stretched the thought exercise to start identifying new business opportunities (trying to find value in protecting against each of those things I identified).

At the same time I grew “professionally paranoid”, I was learning about epistemology and skepticism (to try to understand the cultural and political changes of the last decade). It’s been a wild ride.
by dripton | 2025-09-14 23:20:20+00:00
We do have unit prices, but sometimes they vary the unit from product to product within the same product category, making them useless for comparison. This one is by weight, this one is by volume, this one is by count. At that point you have to do all the math yourself, which most people won't.

I don't know whether that's done intentionally. Hanlon's Razor says to assume not without proof.
by thisoneisreal | 2025-09-14 23:20:51+00:00
I think you're hitting on the fact that there are multiple variables that contribute to "quickness." Having digested a lot of background material is definitely part of it and ties to the higher up posts about e.g. Churchill. Also a way intelligence can correspond to it, in the sense that more intelligent people have often digested more topics. But there also seem to be people who are less distractable, more tuned in to what is going on, and more able to tie current happenings to their body of knowledge and make a joke or whatever.
by carlosjobim | 2025-09-14 23:21:06+00:00
> Leverage: I can't get a $700k loan to put into equities but I can for a home.

Exactly, and most people wouldn't even be able to get half of that for investing in a business that turns a profit and employs local people. So that's why all money is rushing into real estate and the industrial world is dying now. And death is forever.
by phist_mcgee | 2025-09-14 23:22:30+00:00
Take a look at stoicism. Not the pop modern version but the ancient roman and greek traditions of Seneca, Epictitus, and Marcus Aurelius.

Essentially letting go of controlling our lives in ways that cause suffering. Accepting that bad things can and do happen. Realising that life is temporary and we should focus ourselves on things in our power that make us a person of better character. Everything else is out of our control and should be accepted without judgement.

It's brought a lot of comfort to me over the years.
by kjkjadksj | 2025-09-14 23:22:34+00:00
While that is true, no one needs betty crocker food to survive. There is plenty of food in the grocery store that is basically not essential at all and exist because of price and value proposition, and this is the stuff people are turning away from now that the price doesn’t support the value. Even among stuff like cuts of meat, people are probably shifting to cheaper cuts and bulk deals.
by dghlsakjg | 2025-09-14 23:22:44+00:00
Before I got LASIK, I wore contacts but travelled with glasses. There are a huger variety of reasons that you might use contacts even if you have your glasses available. In fact, everyone I know with contacts also always has a pair of glasses that goes with them on travels.

In my case I worked onboard tall ships. Contacts let me be on deck in inclement weather without worrying about spray, fog, or losing a pair of glasses, let me use any pair of sunglasses instead of a ~$250+ pair of prescription glasses, as well as things like diving and snorkelling without needing a $150 prescription mask.
by rob_c | 2025-09-14 23:22:46+00:00
In what possible scenario is burning cash vs keeping a fraction of it a bad financial decision?

I can only imagine it makes financial sense to rent if you live somewhere where you're not paying off someone else's mortgage and are paying a fair renting price. (Otherwise paying your own mortgage just makes more sense)

As an actual honest question, where in the world is like that any more?
by 9x39 | 2025-09-14 23:23:02+00:00
It’s true over leveraging seems to be the American way, but GP was saying, I think, that homeownership does not have the risk of a landlord ending an otherwise mutually accepted relationship.

If this is still accurate, a third of renters could theoretically be told the rent is doubling or learning the lease is ending. Depending on the health of the market, that can be a major risk, and not everyone can or wants the flexibility of a rental at all times.

https://www.bls.gov/spotlight/2022/housing-leases-in-the-u-s...
by PaulHoule | 2025-09-14 23:23:27+00:00
I don't think there are good or bad wine growing regions as much as there are places where people have figured out how to make good wines. The Finger Lakes had a bad reputation once but people figured out Rieslings and some more affordable whites that reputation changed. More recently it was famous for soda-pop sweet wines like Red Cat but I've had some dry reds lately that weren't as bad as what I had 20 years ago.

People are making progress in Utah too

https://en.wikipedia.org/wiki/Utah_wine
by zelphirkalt | 2025-09-14 23:23:42+00:00
It already took a mountain of resisting the network effect to get at least some half of my friends to chat with me on Signal. The chances to get them to move to something more obscure, that has any additional friction is low and the effort in convincing them will be high. That's not to say I won't try, but man I hope it doesn't come to that.
by MostlyStable | 2025-09-14 23:23:45+00:00
There are professional bakers that use cake mix. Cake mix is basically the exact same ingredients as one would use if making their own, sometimes with the addition of ingredients that are usually improvements but that almost no home baker would regularly carry. Among all the various pre-packaged/pre-prepared ingredients, dry cake mix is probably the one for which pretentiousness about quality makes the least sense. And this comes from someone who never uses them and makes 100% of my own cake batter....but that's because my family bakes enough that I always have all the of the necessary ingredients on hand, so there is almost no extra convenience for us.
by bb88 | 2025-09-14 23:23:48+00:00
You would think that's the mechanism, but there seems to be evidence that points to lower BMI with cannabis use.

Mouse study: https://medschool.uci.edu/news/new-research-may-explain-why-...

Human study: https://www.liebertpub.com/doi/10.1089/can.2024.0069

Many people might have removed alcohol intake with cannabis use, to reduce overall caloric intake.
by malshe | 2025-09-14 23:24:09+00:00
> Here where I live the minimum price for rent is monthly mortgage installement, meaning that you'll pay for rent at least as much as you'd pay for mortgage.

When you own, the mortgage payment is the floor on your monthly cash outlay. by contrast, when you rent, the rent is the ceiling on your monthly cash outlay. So even when they are identical, homeownership is way costlier because of all the other costs one "forgets" to consider while making this comparison. HOA dues, home insurance, property tax, maintenance, etc. add up to thousands of dollars each year. As a renter, you don't have to consider any of these beyond your rent.
by ethin | 2025-09-14 23:24:11+00:00
Yep, agreed. Don't get me wrong, the Intel/AMD docs are amazing. But even getting the hardware to a usable state (where I define usable as "something that can enumerate PCI devices on the system, even without PCIe") is an absolute pain that really just shouldn't exist. I know that RISC-V ahs it's own tough spots but... IMO it's a lot faster to get up and running with because it doesn't have 10000 execution modes with tons of different requirements you need to do for each mode, and on and on and on and on. (Yes, I'm exaggerating a bit.)
by Jtsummers | 2025-09-14 23:25:18+00:00
Try having vision worse than 20/200 and getting around without glasses. When I traveled, pre-contacts, I always packed a spare and a repair kit. With contacts, I pack one pair of glasses, a repair kit and spare contacts, its essentially the same prep and experience. Except now I have peripheral vision and can wear whatever sunglasses I have on hand. They also don't fog up like glasses do, which makes the transition in and out of buildings in hot, humid climates where AC is prevalent less annoying.
by Bender | 2025-09-14 23:27:01+00:00
Would you swap your $2M house for a $2M motorhome?

No. Homes flucuate in value but could go up. A home gives one a place to handle a legal mailing address. Motorhome vagabonds have to get a PO box and that has limitations depending on the state for some government agencies and some companies. Some won't accept a PO box, there are tricks around this but the internet is closing the loopholes. This can also have an effect on the census.

Motorhomes do not appreciate in value. Motorhomes are significantly more costly to maintain, especially the expensive ones. I would instead buy a much more affordable small home with more land and a very affordable flat bed off-road truck and bolt a camper add-on on top of it. I could then take said camper to many more remote places and more scenic views usign less fuel and not having to navigate a bus. I can also remove the camper and put on a snow-mobile rack or a flat-bed or stake-bed or rent a 5th wheel camper or tow horses. Oh yeah, the truck with simple modifications can get 25mpg. The $2M bus conversion will get about 6mpg on a good day, going down hill. It's much harder to find a general mechanic to work on an expensive motorhome than to work on a common truck. Don't get a flat tire on that bus conversion, most mechanics do not have the gear to deal with the CTIS or the special tool to remove the run-flats and many wont even try. The motorhome can high-center on a drive-way. Towing a motorhome of that size is very expensive and that assumes they can get into whatever crazy angle one managed to get wedged into. One also has to know ahead of time what roads to not go down in that motorhome. GPS will not tell you that you can not turn around. It is also assumed one must get a lengthy and expensive service plan. I could go on for hours.

tl;dr Money pit, don't fall for it.
by loktarogar | 2025-09-14 23:30:02+00:00
My point is it doesn't have to be a complete solution to replacing plastic to be able to have some benefits to replacing some plastics.

You can have local manufacturing processes so that it doesn't have to get stuck in a truck in Texas for a month.

And there'll still be uses for the long lived plastics. You don't have to use one plastic for everything - like we don't today.

Building a box that can last for centuries when you're only going to use it for 25 minutes and toss it is pretty wild if you think about it.
by yencabulator | 2025-09-14 23:31:05+00:00
Large stable projects are very much wary of wide-scale changes their codebase. What they have is tested working by decades in production. Especially with C where tooling is brittle.

Let me put this way: If you submit a code prettifying patch to the Linux kernel, it will not be accepted. The risks aren't worth it.

The only real way forward is full migration away from C, for which a better scope is a separate project.
by sugarpimpdorsey | 2025-09-14 23:31:07+00:00
This will not impact Chrome in any meaningful way because - in typical Google fashion - they invented their own bullshit called CRLSets that does not perform OCSP or CRL checks in any way, rather periodically downloads a preened blacklist from Google which it then uses to screen certificates.

Most people don't realize this.

It's quite insane given that Chrome will by default not check CRLs *at all* for internal, enterprise CAs.
by modeless | 2025-09-14 23:31:19+00:00
Emitting CO2 is not morally wrong in an abstract sense. It is only bad to the extent that it has bad effects. The major bad effect is warming. If that is mitigated, then the need to reduce CO2 emissions is legitimately lower and that's OK! The other bad effects of CO2 emissions are less bad than warming. The only really concerning one at realistic CO2 concentrations is ocean acidification, and there may be other ways to address that too.

Human CO2 emissions will eventually decline naturally due to the meteoric rise of solar and the eventual exhaustion of economical sources of fossil fuels. We can't increase fossil fuel consumption forever, and CO2 will not continue to rise forever. But it will rise to a point where we will need to implement a proactive solution for warming, regardless of what the EU does or doesn't do. Pretending that emissions reductions alone are going to save the world is doing everyone a disservice.
by surreal_ | 2025-09-14 23:31:53+00:00
hi folks in ai/ml,

we built slidebee to solve a problem we all face: turning a dense paper into a decent presentation takes hours.

slidebee does it in minutes. you paste a url, we generate the slides.

see for yourself: reasoning in latent space: https://slidebee.genmini.ai/slides/20250910_054156/slides/pr...

rl for agents: https://slidebee.genmini.ai/slides/20250908_044442/slides/pr...

how it works: it's not just a text summarizer. our ai has multimodal understanding. it parses the whole paper—text, figures, tables, and equations—to build a coherent story.

our open source promise: we want to build this with the community. if this post gets 200 upvotes, we promise to open-source the entire project. this will tell us it's a tool worth maintaining and evolving together.

join now at: https://slidebee.genmini.ai/
by LorenPechtel | 2025-09-14 23:32:22+00:00
My wife is from a time and place were divorce was almost unheard of. At first she was appalled at what she saw as bed-hopping here. But over time she came to realize that it really came down to stay in an unhappy situation or split and try to find someone you're happy with. Of the relationships of her cohort she is close enough to know the situation most are dead, no love, no sex. Nothing but saving face.
by red369 | 2025-09-14 23:32:23+00:00
I don't know much about this area at all, but it seems like it would be neat to have a plastic that stood up well to heat and moisture, but you could leave it soaking in some petrol/diesel/oil liquid, and it would melt into that and leave you with something still useable.

As I write this, it sounds like I'm just describing something like petrol in a solid form at room temperature. Perhaps there's something a little less far-fetched that people are working towards?
by strcat | 2025-09-14 23:32:26+00:00
QubesOS provides strong compartmentalization between virtual machines defined by the user, but it doesn't provide better protection against exploitation within those guests. Network drivers are a special case due to running in a dedicated VM. Applications and guest operating systems are just as vulnerable to exploitation. They're not hardened operating systems but rather traditional desktop OSes with a weak privacy and security model. QubesOS similarly doesn't provide any significant protection against data extraction in the After First Unlock state. It's nearly entirely focused on compartmentalization at the granularity of a whole OS.

GrapheneOS is focused on privacy and security overall including protecting applications and the OS from exploitation in general. GrapheneOS does use sandboxing and compartmentalization to improve security. Hardware-based virtualization is one of the GrapheneOS hardware requirements (https://grapheneos.org/faq#future-devices) and is used through Android's virtualization framework. It's provided by pKVM on Pixels and Gunyah on Snapdragon. Making more use of virtualization beyond isolating system services via microdroid and running a desktop OS via Android's virtual machine management app (Terminal) is planned and being gradually worked on. It's part of what we work on overall, not the whole picture or primary focus. It will be a bigger focus over time as hardware improves to make it more viable.

Smartphones didn't have a lot of memory for virtualization until recently and GrapheneOS needs memory for other protections too. The Pixel 6 was the first Pixel with CPU hardware virtualization support and the Pixel 10 is the first with native GPU hardware virtualization support not requiring proxying to the host for GPU acceleration. Secure GPU acceleration is quite important for making it into a highly usable feature, especially on a phone, so the hardware was not ready yet and still isn't on most other devices. QubesOS largely doesn't have that available either, but laptop or desktop hardware is more powerful.
by CoastalCoder | 2025-09-14 23:32:31+00:00
Different people can have different goals / purposes for the same institution.

Marriage is one example.

Another that comes to mind is going to college. Some see it as a chance to discover themselves, others see it as essentially a training program for specific careers.

From your profile, I'm guessing you approach this from a Judeo-Christian perspective? If you believe the institution of marriage is defined and ordained by God, then your normative view of it makes sense. Just be aware that not everyone in this discussion will share those assumptions.
by litoE | 2025-09-14 23:32:32+00:00
This was also our experience while owning three homes in single-family neighborhoods over a 35-year period. We knew our neighbors enough to say "hello", but that was it, and we never associated with them. However, 13 years ago we bought an apartment in a large high-rise condominium building. To our surprise - because that was not a consideration when we moved - we have made many good friends among our neighbors. We go out to dinner together, we invite each other to our homes and to family celebrations. The downside is an aspect of communal living. For example, we needed a new carpet in the building's lobby, so all the owners voted on the color. The majority chose green and we hate green, but we have to live with it.
by wyager | 2025-09-14 23:32:46+00:00
> A good test is one that evaluates candidates on the tasks that they will do at the workplace

Systematizing this is not feasible. The next best thing (in terms of predictive power for future job success) is direct IQ tests, which are illegal in the US. Next best thing after that are IQ proxies like coding puzzle ability.

> If a candidate's performance improves with practice, then so what?

It means the test isn't measuring anything useful. The extremely broad spectrum skills that benefit a software/eng role aren't something you can "practice".

> The only thing we should care about is that the interview performance reflects well on how the candidate will do within the company.

Agreed, which any Goodhartable test will never do.
by malshe | 2025-09-14 23:32:47+00:00
> Living in Germany, I do have quite a few protections as a renter. My landlord can't arbitrarily hike prices, etc.

A few years ago, I became quite interested in buying an apartment in Germany for rental income. My German friends thought it was a terrible idea. After reading more about it, I realized it would have been a huge mistake!
by jrmg | 2025-09-14 23:33:01+00:00
I wouldn’t want to be the lawyer who one day will have to argue how a device with USB C and a rechargeable battery can be classified as “disposable”.

I thought the point of making them like this was that they technically are reusable, so they can sell them (to people who for some reason keep buying them and throwing them away!) in places where disposable vapes are banned.
by PlanksVariable | 2025-09-14 23:33:09+00:00
0% this - neighborhoods with single family homes are more likely to have families, and kids often create friendships that carry over to parent friendships. And if anybody in the neighborhood takes the initiative to plan block parties, dinner parties, etc., that really helps a community take root.

This just doesn't happen as often with apartments, where people are more transient and more likely to be single and/or childless.
by thephyber | 2025-09-14 23:33:16+00:00
This is one of the best heuristics (because it’s such an short+easy to memorize). I learned it from my mother who is kinda low tech, but understood risk.

But ultimately, it’s a heuristic and is imperfect.

One example thing which bypasses weakness to this heuristic: when you import a programming language library or a “curl pipe bash”: how much research do you do to verify the authenticity of the library, the security of the package and contributors, that you didn’t typo and accidentally install a lookalike malware, etc? And then every time you take an action which updates the same thing, are you equally as rigorous and vigilant as the first time?
by ndriscoll | 2025-09-14 23:33:47+00:00
With the numbers I had it only takes 1-2 years to save 1 year of runway, so just do that first (presumably you've had a chance to save before getting your 250-300k income anyway). I suppose that the type of people to spend 6k on rent probably aren't saving much, but they could if that were their goal for some reason.
by latchkey | 2025-09-14 23:34:01+00:00
I travel around the US and Canada in my campervan and I've noticed that it feels like a lot more people live in RV's now, which enables you to buy something and park it nearly anywhere (location wise) that you can find space. There are RV parks all over. Depending on where you decide to be, it probably isn't a bad solution and worth considering if you do want to own something, but don't want or can't commit to a whole house.
by gerdesj | 2025-09-14 23:34:10+00:00
This is a novel material with a set of properties and a production "story" that looks rather cool - recycled vines.

If those parameters meet the requirements for a material that you need to use then cool. Use it. I don't see any attributes in this article, which is fine but "stronger than ..." is a bit weak.

The biodegradeable thing is probably going to be key if this stuff can hold hot liquids without poisoning the imbiber or can make plackey bags without falling to bits within seconds.
by mdnahas | 2025-09-14 23:34:41+00:00
Love Signal - Thanks!

Testing backups is important, separate of when you try to restore. It sucks hard to find out your backup is bad only when you go to need it. I highly recommend the quick, beautiful, and informative Tao of Backups.

Mike Nahas, Designer of Par2 file format

http://taobackup.com/