MurphyA/hacker-news huggingface dataset:
by amironi | 2025-10-15 12:02:28+00:00
I built ContextGuard after discovering that 43% of MCP servers have critical security vulnerabilities. MCP (Model Context Protocol) is the new standard that lets Claude Clients(Desktop, Windsurf, Cursor, etc.) access external tools and data sources - think of it as a plugin system for AI assistants.

The problem: When you give those clients access to your filesystem, databases, or APIs through MCP servers, you're opening up serious attack vectors. Prompt injection, data leakage, and path traversal attacks are all possible. Most developers building MCP servers don't have security expertise, and there wasn't an easy way to add protection.

What ContextGuard does: - Wraps your MCP server as a transparent security proxy - Detects 8+ prompt injection patterns in real-time - Scans for sensitive data (API keys, passwords, SSNs) in responses - Prevents path traversal attacks - Rate limiting to prevent abuse - Comprehensive JSON logging for auditing - <1% performance overhead

Technical approach: - TypeScript-based stdio proxy - Pattern matching + heuristics for threat detection - Works with any MCP server using stdio transport - Zero code changes needed - just wrap your existing server - All detection happens synchronously in the request/response flow

The README includes a testing section where you can see the same attacks succeed on an unprotected server vs being blocked with ContextGuard enabled. It's pretty eye-opening to see how easy these attacks are.

Why open source: Security tools need transparency. I want the community to audit the detection patterns, contribute new ones, and help identify blind spots. Plus, MCP is still early days - we need to establish security best practices together.

Roadmap: Currently working on SSE/HTTP transport support, a web dashboard for monitoring, and a custom rule engine. Planning to offer Pro features for enterprises (team management, priority support, advanced analytics) while keeping the core security features free and open source forever.

I'd love feedback on: 1. What other attack patterns should I prioritize detecting? 2. Is the web dashboard a must-have or nice-to-have? 3. Any blind spots in the current detection logic? 4. Should I focus more on detection accuracy or performance?

The project is on GitHub with full docs and examples: https://github.com/amironi/contextguard

You can try it right now: npm install -g contextguard contextguard --server "node your-mcp-server.js"

Happy to answer any questions!
by grafmax | 2025-10-15 12:03:01+00:00
We would benefit from more civic engagement, but let’s not mischaracterize the situation. Those with more money really do have more power, which they use to buy more influence directly through legalized bribery or indirectly through media control. A choice between two candidates is like that between Coke and Pepsi, one a bit sweeter than the other but both manufactured by the ownership class. Consider the Gaza genocide, corporate handouts, mass surveillance - it is a long list of what politicians support contrary to popular will. The solution is indeed more civic engagement - not simply being satisfied with voting in a rigged system and going home but engaging in other forms of popular power like labor organizing as well. It’s our economy they rely on and we have real power to shut it down through solidarity and mass strikes. What we need to up our game, especially in this time as our democratic institutions are being completely unraveled.
by CuriouslyC | 2025-10-15 12:03:02+00:00
The person using 25 plugins is giving bad advice. The agent isn't going to need all those tools at once, and each tool burns context and causes tool confusion. Enable MCPs for the specific task you're going to have your agent do.

The trick is to create deterministic hurdles the LLM has to jump over. Tests, linting, benchmarks, etc. You can even do this with diff size to enforce simpler code, tell an agent to develop a feature and keep the character count of the diff below some threshold, and it'll iterate on pruning the solution.
Ask HN: Is your Facebook feed also full of video mimicking pedophilia or hate
by oulipo2 | 2025-10-15 12:03:07+00:00
Since a few weeks there is an avalanche of videos in my Facebook feed (I haven't asked for anything of the sort) with "very young girls in evocative swimsuits" (think: Donald Trump's favorite age range), or fake MAGA people interview, or people just throwing a fit in public (AI generated, meant to make the audience enrage)

All of this:

- costs CO2 emissions

- costs real dollars

- is pushing the society toward more and more hate and divergence

why do we accept this shit? Also engineers working in AI, is that really the world you want to build?
by hylaride | 2025-10-15 12:03:16+00:00
> After Stallman launched the GNU project, the emergence of GNU licensed kernel for x86 architecture was inevitable. It just happened that Linux became that kernel. Had it not, the GNU project folks led by rms would have inevitably made their own.

I'm not sure this is guaranteed. GNU and the FSF have absolutely provided an enormous amount to the concepts and implementation of OS software. No doubt about it. Without it Linux would not exist, but it doesn't mean that'd have resulted in a widely used GNU alternative.

BUT, GNU/FSF also has a long history of losing focus on coding and spending a lot of time on political and philosophical arguments. I think it more likely BSD may have headed to where linux ended up than GNU. Linux was successful because they moved forwards and arguments were settled relatively quickly (for better and worse), whereas Hurd got stuck in development hell as people argued over how pure the microkernel architecture should be, pushing away people who just wanted things to work - including volunteers. During the crucial period over the 1990s, open source software needed to get things done (kind of like a startup). There are videos out there of people speaking at conferences about their work on Linux, and RMS being in the audience interjecting that it's "GNU/Linux" every time Linux was uttered. Who wants to work in an environment like that?

Even today, people are looking at more and more alternatives to important GNU software because of stagnation or other technical merits. GCC has lately seen alternatives become more common, as an example.

This also ignores the hostility the FSF historically has/had towards the commercial industry. Torvalds largely accepted patches from anybody if the code worked as intended.

Maybe something could have come out, but my gut tells me that people would have gravitated to something else that worked.
by robocat | 2025-10-15 12:03:30+00:00
Yeah...

Unfortunately the link you chose is crappy. It is a qualitative study debunking the claim "some researchers have propagated a myth that lower sodium might increase the risk of CVD, This article analyzes the eight articles as a case study" (paraphrased). Too little salt is not the issue, why would that paper be useful?

The clear advice is to lower salt intake, but from what I can tell statistical data doesn't show that doing that actually lengthens life. Admittedly, cause and effect is difficult science, even in well funded large population studies. Correlations and case studies are much easier science.

Personally I don't have a horse in the race because I have a relatively low salt intake: I don't like the taste of over-salting and I also try to avoid high-salt foods because they are often crappy industrial foods (correlation).

I did google for papers before making my original comment, but I struggled to find any papers I liked. I remember that one paper in particular was a meta-study: I really really hate those.

Edit: I asked Gemini, and it referenced this paper: https://www.jacc.org/doi/10.1016/j.jacc.2016.07.745 which seems fairly balanced: the first sentence is a soft "The relationship between lower sodium intake and total mortality remains controversial". I did a couple more follow-on prompts and Gemini referenced results from Britain lowering salt in processed foods "A 36\% decrease in mortality rates from stroke and ischemic heart disease (heart attacks) during the period of the salt reduction program.". https://g.co/gemini/share/42637d5a2dfb I feel embarrassed rereading my prompts since they show my ignorance and other problems, but the eventual AI results are interesting. Asking the right questions is hard...
by jacquesm | 2025-10-15 12:04:16+00:00
Hypothetically for obvious reasons, I would put a socket on the outer wall of my garage with a sign saying 'do not use'. This would enable an enterprising person to siphon off up to 3600 Watts continuously while the breaker in my garage would be in the 'on' position. I could use my home automation setup to determine whether there is a surplus generated and only enable that socket through remote control as well.
by heavyset_go | 2025-10-15 12:04:53+00:00
No OS vendor wants you to do that, unless you're using a desktop, and then Google wants you to use Chrome. They all want a 30% cut of revenue and/or platform lock-in. They'll rely on dark patterns and nerfing features to push you to their app stores.

Similarly, software vendors want you to use apps for the same reason you don't want to use them. They'll rely on dark patterns to herd you to their native apps.

These two desires influence whether it's viable to use the web instead of apps. I think we need legislation in this area, apps should be secondary to the web services they rely on, and companies should not be allowed to purposely make their websites worse in order to get you on their apps.
by rybosworld | 2025-10-15 12:05:01+00:00
If a person dies from being a daily smoker for 30 years - is that primarily an age-related cause of death? Or does it just take a long time for the damage you've done to finally catch up?

A habit (or habits) that slowly damages your body and significantly shortens your life span is quite different from the natural march of aging that eventually gets us all.

Heart disease is the same as smoking in 80% of cases. The other ~20% are primarily genetic and much harder to avoid.

https://www.nhlbi.nih.gov/news/2023/numbers-know-healthy-hea...
by akagusu | 2025-10-15 12:05:08+00:00
> Open source loses this war because proprietary devices are streamlined.

"Open source" didn't loose because it didn't fight anything. It was exactly "Open source" that enabled Google to dominate the smartphone landscape.

FSF and many other have been warning us for decades that Android been open source didn't matter because firmware, play store and many other components of Android were proprietary.

People gave a shit to them and now do you want to blame them for the results?

The diversity of projects were not and are not the problem. The problem is people that do nothing and only criticize.
by ajross | 2025-10-15 12:05:30+00:00
Does person A have a home? Then A, 100%. Regular citizens can get non-inflation-indexed, heavily-government-subsidized loans at leverage ratios[1] institutional investors could never dream of. And that's a better inflation hedge than almost anything. The home value inflates but your mortgage payments stay the same for decades.

The inability of people, even otherwise smart HN commenters, to reason about how inflation works has been really shocking to me.

[1] Literally 5x their net worth, or "20% down" in the local jargon
by ajross | 2025-10-15 12:06:24+00:00
Dying from smoking is age related! How many lung cancer deaths are there in 20-something chain smokers?

Honestly I think you're interpreting "age related" differently than the upthread discussion. The point is to renormalize a cause of death to something like "lost years of life". So if you have a preventable death (from smoking, say) that kills people with on average 10 years of life left, that should be less notable than one (maybe homicide) that kills people with 60 years to go on average.
by Bender | 2025-10-15 12:06:44+00:00
I get what you are saying but POTS in my location is still copper. I know because I dug it up when putting in a cattle guard. I will have to splice it back together and run it somewhere other than under my driveway which I had paved. 811 marked it as disco/not-in-use. The telco accidentally leaked their plans to run fiber everywhere so I might wait for them to do that. If it ends up being VoIP then maybe I would still have SMS capability for poor mans 2FA? Maybe the competition will drive the cost of my existing fiber down. To userbinator's point the end result will be no more options to install applications. It would just be a phone. I would be back to good old fashioned NSA voice monitoring.
by tasuki | 2025-10-15 12:06:55+00:00
> I am a programmer, not a rubber-stamp that approves Copilot generated code

That's just, like, you opinion?

Anyway, I don't see what the fuss is about. It's one of the two...

- Either the LLMs are very good and replace programmers. Yay, automation - we always cheer for that! Instead of working, humanity can, like, go fishing or something.

- Or the LLMs aren't that good and don't replace programmers. Yay, jobs!
by lazide | 2025-10-15 12:07:02+00:00
Because they bought Bitcoin and gave it to the scammer, and that Bitcoin is even worth more now, so that’s the ‘most fair’ recompense.

After all, if someone stole $1k of gold from someone a decade ago, is giving them (now deflated) $1k USD fair, or is giving them the same physical amount (now worth) $3k in gold fairer? Even if they bought the gold because the scammer asked them too.

The ‘fair enough’ treatment would be to give them the dollar equivalent at the time they gave the bitcoin to the scammer, and the rest goes… to the gov’t? As ‘payment’ for recovering it all and making the payment happen? Or to penalize the scammers? But actually the victims lost a lot of monetary value due to inflation, and lost gains from bitcoin price increasing.

The ‘meh, won’t get anyone run out of town with pitchforks’ is the gov’t seizes the bitcoin, punishes the offenders (how?), and somehow gives warm fuzzies to the victims without actually giving them anything to make their financial pain any better. Aka business as usual. Bonus points if you make them give more money to another party to do it (aka the ‘class action shuffle’ that has gotten popular in the last few decades).
by nchmy | 2025-10-15 12:07:15+00:00
Don't major browsers essentially auto update? And to the extent that a device is so old that it can't support newer versions, surely it must be VERY old and perhaps is somewhat likely to be replaced sooner than later.

I think I'll probably carry on with not supporting browsers that don't have Sec-Fetch-Site. The alternative, Csrf tokens, actually causes me immense issues (they make caching very difficult, if not impossible).

(and I say all of this as someone who is specifically building something for the poorest folks. I'm extremely aware of and empathetic to their situation).
by eigart | 2025-10-15 12:07:24+00:00
That is correct. The historical price for consumers is by my guesstimate $0.03-0.05 USD, now it’s at least double. Grid fees come on top of that.

The anger is completely out of proportion, IMO, as the net effect is probably very positive. 1. Hydro is typically state owned and taxed at a very high rate 2. 50% of the price difference between markets is pocketed by the public grid operator (reducing grid fees) 3. We also import power when needed and typically at a net profit.
by squeedles | 2025-10-15 12:07:49+00:00
Why is this in the least surprising? It's just the natural successor to what everyone used to do with the trade magazines thirty years ago. Back then you filled in a profile questionnaire to get a free subscription, so every basement hacker turned into the manager of a 500-person division with control of a $1m capital budget. The magazine didn't want to check because it would damage the demographic numbers that they pitched to advertisers. The advertisers knew that there was some liar's poker being played but everyone just rolled with it.
by tialaramex | 2025-10-15 12:07:55+00:00
I believe there's a Rust RFC for a way to write mandatory tail calls with the become keyword. So then the code is actually defined to have a tail call, if it can't have a tail call it won't compile, if it can have one then that's what you get.

Some languages I was aware of are defined so that if what you wrote could be a tail call it is. However you might write code you thought was a tail call and you were wrong - in such languages it only blows up when it recurses too deep and runs out of stack. AIUI the Rust feature would reject this code.
by ImaCake | 2025-10-15 12:08:03+00:00
> LLMs struggle with simplicity in my experience

I think a lot of this is because people (and thus LLMs) use verbosity as a signal for effort. It's a very bad signal, especially for software, but its a very popular signal. Most writing is much longer than it needs to be, everything from SEO website recipes, consulting reports, and non-fiction books. Both the author and the readers are often fooled into thinking lots of words are good.

It's probably hard to train that out of an LLM, especially if they see how that verbosity impressess the people making the purchasing decisions.
by Phil_Latio | 2025-10-15 12:08:07+00:00
Well the whole clean energy transformation in Germany has a tax payer burden of 3 trillion or more till 2045. Frances nuclear plants didn't even receive 1 trillion of subsidies in total since their existence (according to my quick research). But let's say France and Germany are even in subsidies or France pays slightly more: I thought it's about Co2? Again: France has 1/6 of the Co2 emissions compared to Germany. Just by that metric it's a colossal failure!

When you say Germany can't just build nuclear plants now you are right. But the solution can't be to expand solar and wind, while destroying coal and nuclear plants - which is what they do. The last minister for these matters had the unironical idea to shutdown industry when the renewables don't produce. The idea was to move from a demand driven industry, to a supply driven industry. Total madness. The idea to produce wind in the south of Germany is part of such madness.
by jcattle | 2025-10-15 12:08:19+00:00
That would work if the energy was actually free. Instead, since it is a single market, as soon as curtailment kicks in you do not get the energy for free anymore, you get it for the price you pay for the gas plants that replace the wind generation which can't be transmitted.

This also doesn't change if you consume all the energy at the place where it is produced, since you still need to supplement the normal load with gas. There's only two ways out of this: split the markets, or build transmission.

Oh well.
by sunshine-o | 2025-10-15 12:08:20+00:00
Like OpenBSD Theo de Raadt who was know to be quite toxic. But in the end its project is still going and highly praised after 30 years.

Let me frame it another way:

Software is like soccer, big tech is the FIFA, free software is you amateur football team.

- The FIFA will always tell you they love amateur soccer.

- The FIFA can be run by MBA, manager but your local group of friend/team cannot.

- Someone (probably the FIFA) is telling you your local team need the manager types for you to play soccer with others.

- If an overweight man who never played soccer come to invite you to play soccer in the weekend for free you might not go. If Pele come you will go.

- If an overweight man who never played soccer offer you a job at FIFA you will probably accept because you love soccer and for the money.

- The FIFA is more interested in people watching TV and ads on Sunday than people playing soccer outside. Ultimately they want you to love soccer but it need to be their way. And their way is watching TV and buying their jersey.

This is probably why Theo de Raadt might be a big A-Hole and said no to the FIFA but he is a good player and still have a fit team having fun outside every Sunday.

I wouldn't have bet on this outcome 20 years ago.

All those open source now corrupted foundations with the beautiful websites and the big titles and leadership pages pretend to be something they are not.
by pjmlp | 2025-10-15 12:08:36+00:00
Not at all, because Pascal is more strongly typed, and has features that C is still yet to acquire in type safety.

Non exaustive list:

- proper strings with bounds checking

- proper arrays with bounds checking

- no pointer decays, you need to be explicit about getting pointers to arrays

- less use cases of implicit conversions, requires more typecasts

- reference parameters reduce the need of pointers

- variant records directly support tags

- enumerations are stronger typed without implicit conversions

- modules with better control what gets exposed

- range types

- set types

- arenas

There was plenty of Pascal code on Mac OS including a Smalltalk like OOP framework, until C++ took over Object Pascal's role at Apple, which again it isn't C.

I love the "but it has used Assembly!" usual rebutal, as if OSes written in C weren't full of Assembly, or inline Assembly and language extensions that certainly aren't C (ISO C proper) either.

If you prefer, Zig is a modern taken on what Modula-2 in 1978, and Object Pascal in the 1980's already offered, with the addition of nullable types and comptime as key differentor in 40 years, packaged in a more appealing syntax for current generations.
by padjo | 2025-10-15 12:08:55+00:00
Yeah I think it’s fair to say that in many circumstances people would use masculine as a pejorative and not get called out for being sexist. There’s some historic power imbalance stuff at play there, but it’s still sexist.

If you have problems with some type of behaviour it’s much better to say exactly what they are rather than appealing to some platonic notion of sex characteristics, which is both offensive and poorly communicates your position.
by blakesterz | 2025-10-15 12:10:10+00:00
I guess the answer is no, and there's a couple quotes in there near the end:

One rep I had known for years finally admitted the truth off the record. "Dude, we know," he said. "Everyone knows. But if we filtered it all out properly, our revenue would drop 40% overnight, and investors would have a meltdown."
by Tor3 | 2025-10-15 12:10:23+00:00
Good water heaters are key. Mine is 200 liters and I've experienced cold water exactly once in three decades: One day 3 guests took hour-long showers each. Normally a family of five will never experience cold water.

The one I'm getting now has two coils, one to quickly heat water at the top half, the second to heat from the bottom - they're never on at the same time. Internal heat around 75 C, mixed to cooler on the way out, and it can keep hot water for 2 weeks if disconnected from power.
by p_l | 2025-10-15 12:10:25+00:00
Well, unless you invest non-trivial extra work, you're going to start showing up on grid monitoring and finally someone will drill down in problem looking for broken substation and find you doing exactly the things that caused the problems and the reason for it being illegal to "just hook up".

It's just that often in many places law lagged in ways of dealing with islanded operation, and semi-islanded cases (where you invest in serious gear to separate your local micro grid from external grid preventing the issues that cause technicians to show up and report you)
by mherrmann | 2025-10-15 12:10:28+00:00
I use Claude Code every day and find that it still requires a lot of hand-holding. Maybe codex is better. But just in my last session today, Claude wrote 100 lines of test code that could have been 20, and 30 lines of production code that could have been 5. I'm glad I do not have to maintain 300 kloc of 100% AI-generated code. But at the end of the day, what counts is velocity and quality, and it seems OP is happy. The tools certainly are useful.