MurphyA/hacker-news huggingface dataset:
by belai | 2025-11-17 16:38:36+00:00
Hey HN,

I'm a Senior SW. I built this with a friend (who is a Staff Software Engineer) as we both want to grow in the space of MCP/ Agent security and Agents Identity and Access Management (IAM).

We build MCPShark around solving security issues in MCP adoption. For example, currently, the adoption of MCP servers expose teams into security vulnerabilities such as tool poisoning, rug-pull attack etc. Thus, we built MCPShark.

MCPShark is a Wireshark like network traffic analysis tool for MCPs. It can easily integrate with developer IDEs and we intend to solve following problem.

The problem: You have ZERO visibility into what's happening. When Claude calls your MCP server, you can't see:

- What requests are being made - What data is being sent - Why tool calls fail - If there are security issues

Here's what MCPShark does: Think tcpdump + Wireshark, but specifically for MCP protocol.

Current features:

- Capture all HTTP requests/responses between IDE and MCP servers - Wireshark-like forensic analysis interface - Aggregate multiple MCP servers (HTTP and stdio) - Filter by method, status, session, server - SQLite audit logs

Status: Alpha. Still testing, rough edges. Works with Cursor, Windsurf, Claude Desktop.

We appreciate your genuine feedback. We like to solve real problems and make an impact.

- Is lack of MCP visibility a real problem for you? - What debugging/security features would help most? - Developer debugging vs security monitoring - which matters more? - Should we integrate with security tools like Invariant Labs' mcp-scan? - Above all, are we solving a real pain point. What pain points you'd like us to solve?

Links:

GitHub: https://github.com/mcp-shark/mcp-shark Desktop app (WIP): https://github.com/mcp-shark/mcp-shark-app

We're serious about agent security and IAM. Doing this part-time but committed. Open to all feedback, especially critical feedback. Happy to answer questions about implementation, architecture, or MCP in general.
by jll29 | 2025-11-17 16:38:44+00:00
Reminds me that a friend of mine wrote a Ph.D. thesis on "um" a couple of years ago:

Nicholson, Hannele B. M. (2007) DISFLUENCY IN DIALOGUE: ATTENTION, STRUCTURE AND FUNCTION PhD. thesis, University of Edinburgh, Edinburgh, Scotland, UK, available online: https://era.ed.ac.uk/bitstream/handle/1842/1763/Nicholson%20...

But "um" may not be quite the same as "aha" for English native speakers (and Japanese native speakers may use both "um" and "ahm" as disagrement).
by jonahx | 2025-11-17 16:39:44+00:00
I instinctively agree there is an important difference.

If you try to define systematically what that difference is, though, it's not obvious. At the end of day, I think it's something like "degree of difficulty" or "amount of thought", which are vague concepts. Yet most would agree what the author here did requires more skill and thinking than typing "image of celtic knot" into Gemini.
by karmakaze | 2025-11-17 16:40:12+00:00
If this is being developed, it should have a more modern description. Comparing it to Gopher is fine as a historical point, but comparing it to http/html is more useful today. I read the faq for geeks and didn't learn much:

> 1.1.1 The dense, jargony answer for geeks in a hurry

> Gemini is an application-level client-server internet protocol for the distribution of arbitrary files, with some special consideration for serving a lightweight hypertext format which facilitates linking between hosted files. Both the protocol and the format are deliberately limited in capabilities and scope, and the protocol is technically conservative, being built on mature, standardised, familiar, "off-the-shelf" technologies like URIs, MIME media types and TLS. Simplicity and finite scope are very intentional design decisions motivated by placing a high priority on user autonomy, user privacy, ease of implementation in diverse computing environments, and defensive non-extensibility. In short, it is something like a radically stripped down web stack. See section 4 of this FAQ document for questions relating to the design of Gemini.

Annoyed that for a system about plain text links, there's no link to "section 4".

The transport sounds like http without saying so. It doesn't go into why it doesn't use http. I'd probably be fine with HTTP and Markdown + image/video links. Maybe the Gemini document capabilities/scope is better but they're not described.

Edit: they are in "4.1.2"[0] Be warned, there's still a lot of beating-around-the-bush.

> 4.1.2 I'm familiar with HTTP and HTML. How is Gemini different?

[0] https://geminiprotocol.net/docs/faq.gmi#412-im-familiar-with...

Edit 2: Seems opinionated in many stupid-by-todays-needs ways. It feels like text-web made by some group of deniers.
by brendoelfrendo | 2025-11-17 16:40:43+00:00
> I could probably set it up with caddy and some plugins, but then I still need to expose the service and port forward.

Not so! I have custom domains on my Tailnet with Caddy. You just need to set up Caddy to perform the ACME DNS challenge to get certs for your domain (ironically I use Cloudflare for DNS because they make it very easy to set this up with just an API key). No plugins or open ports needed.
by bluGill | 2025-11-17 16:40:53+00:00
Compilers often allow things in 11 that technically are not there until some later standard. Or sometimes things they have always allowed finally got standardized in a later version. Setting your standard to 11 if that is what you want to target it a good first step but don't depend on it - the real tests is all the compilers you care to support compile your code.

Even if you only target 11, there may be advantages to setting a newer version anyway. Sometimes the standard finally allows some optimization that would work, or disallows something that was always error prone anyway. I would recommend you set your standard to the latest the compiler supports and fix any bugs. Solve your we have to support older standards problem by having your CI system build with an older compiler (and also the newest one). C++ is very good at compatibility so this will rarely be a problem.
by HAL3000 | 2025-11-17 16:41:07+00:00
> It takes extraordinary skill to successfully juggle multiple ventures.

That's a myth. I've done that, and I know a lot of people who do that. Do you think Musk is writing sparse attention code for Grok? Does he even know how Grok's architecture works under the hood? Or that he designed the data centers? I mean, you delegate stuff. The only hard thing is getting the right people, but if you're a hyped up billionaire, it's easy mode because you can pay a lot, and people want to work for you. You just create an environment where they can achieve things.

There are times when the majority of your work is simply attending public meetings, podcasts, and doing interviews. People really overestimate what's involved in the work of a billionaire CEO. The people actually making things happen in space industry or AI work harder, longer, and solve more complex problems than any CEO and in some cases they need to work hard against the CEOs to actually make things happen.
by bilbo0s | 2025-11-17 16:41:14+00:00
I would ask for it to give me one line of a song in another language, broken down into sections, explaining the vocabulary and grammar used in the song, with call out to anything that is non-standard outside of a lyrical or poetic setting.

I know no one wants to hear this from the cursed IP attorney, but this would be enough to show in court that the song lyrics were used in the training set. So depending on the jurisdiction you're being sued in, there's some liability there. This is usually solved by the model labs getting some kind of licensing agreements in place first and then throwing all that in the training set. Alternatively, they could also set up some kind of RAG workflow where the search goes out and finds the lyrics. But they would have to both know that the found lyrics where genuine, and ensure that they don't save any of that chat for training. At scale, neither of those are trivial problems to solve.

Now, how many labs have those agreements in place? Not really sure? But issues such as these are probably why you get silliness like DeepMind models not being licensed for use in the EU for instance.
by ilaksh | 2025-11-17 16:41:26+00:00
From an AI integration perspective, I am hopeful that Cloudflare may be able to improve "performance on the cheap" for replicate's models a little bit.

Replicate has had multiple ways to deploy for auto scaling and you can just keep running periodically to keep the system in a booted and warm state, but that has always seemed like it would be too expensive for a broke bootstrapper like me so I avoided it and model popularity was a big deciding factor. Also because of that and the potential for boot up, in general I avoided it for latency-sensitive things.

I guess there is a limit to what you can do. At some point someone has to spend the money to have the resources stay ready.

But with Cloudflare, theoretically the pool of potential users goes up, and it becomes more likely for someone to have already booted your model.

At the moment I am especially interested in performant and easy ways to run models like "sensefvg/InteractiveOmni-8B" or Qwen 2.5 Omni or models that are even more all in one than that like OpenAI Realtime or Gemini Live.

Now that Ernie 5 launched with (Omni) multimodality built in, I think within six months, developers are going to start to expect speech-to-speech capability from major AI lab releases or product line ups. I feel like eventually the spatial-temporal understanding of video models will be merged in too to make the models understand the world better. But speech in and speech out is closer to being a standard expectation.

Instead of running three models for STT->LLM->TTS with a bunch of tricks like eager end of turn or speculative decoding that basically mean you run the LLM twice or on two different models, and possibly getting shut down by API rate limits, the speech to speech models are a single model that both understands and generates audio as well as text such as for function calls.

This is probably an annoying comment because I am immediately trying to increase the requirements to not only being every model for cheap, but every model for cheap in in a low latency real time streaming way. I just happen to have a contract now that has shown me that multimodal like voice to voice is much more convenient but also much more expensive and fewer options.

Replicate has been so awesome though. Within like a day of me requesting InteractiveOmni, lucataco had it up. So another annoying comment, I sure hope he got paid.
by pzo | 2025-11-17 16:41:34+00:00
They already did and they had Worker AI for quite a while [0]. But I think it didn't catch up and they have there very old models.

Overall I think it's a good acquisition for both of them. Replicate would have to have more competitive pricing to compete with fal.ai

[0] https://developers.cloudflare.com/workers-ai/models/
by Demiurge | 2025-11-17 16:41:39+00:00
Also, the protocol is pretty much a holdover from the earliest days, before encryption, or complicated NATs. I remember using it with just telnet a few times. It's pretty cool, but absolutely nobody should be using FTP these days. I remember saying this back in the 2005, and here we are 20 years later, someone still lamenting dropping FTP support from a browser? I think we're decades overdue.
by aerostable_slug | 2025-11-17 16:41:42+00:00
> My neighborhood is very safe and we have no such cameras.

Good for you.

> why do you think cameras are the only solution?

Straw man.

I want to deter criminals from even thinking about targeting my neighborhood. The appearance of surveillance might serve as a powerful deterrent. Inclusion on a site that warns criminals where ALPR cameras are located would be a boon to this effort. Convincing decoy camera housings, the subject of my post, might be enough to get the neighborhood listed without actually having go forward with a full Flock installation.

Let me be extremely clear: there's no member of the set of humans that actively avoid ALPR cameras that I want coming to my home uninvited. Not a single one.
by yawaramin | 2025-11-17 16:42:26+00:00
Things are more expensive when we keep reinventing the wheel and trying to do new things instead of just reusing proven designs. Remember that solar power also used to cost wheelbarrows of cash back in the day. When you do something repeatedly, it becomes less expensive over time.

Nuclear is actually the leader in waste management. No other energy source has as complete a story. Eg what happens to solar panels when they EOL in 25 years? They go into landfills and leach toxic chemicals into the ground. These chemicals, like lead and cadmium are toxic forever. They have no 'half-life' in which their toxicity reduces.
by ajross | 2025-11-17 16:43:40+00:00
No? The "corresponding compiler flag" is a new feature. I mean, who told folks at Bell Labs in 1978 how the GCC --std= arguments would work in the coming decades? Legacy code is legacy, it doesn't know it needs to use the correct flags. When it was a greenfield project, it was the default!

Like, think about it: if you think the defaults should be good for greenfield projects, then greenfield projects won't be using the correct flags (because if they are, then the whole argument is specious anyway). And when C++34 shows up, they're going to be broken and we'll have this argument again.

Compatibility is hard. But IMHO C++ and gcc are doing this wrong and C is doing it much better.
by theanomaly | 2025-11-17 16:43:47+00:00
We're running Aurora PostgreSQL 15.12, which includes the fix mentioned in the release notes. Looking at this comment and the AWS documentation, I think there's an important distinction to make about what was actually fixed in Aurora PostgreSQL 15.12.4. Based on our experience and analysis, we believe AWS's fix primarily focused on data protection rather than eliminating the race condition itself.

Here's what we think is happening: Before the fix (pre-15.12.4):

1. Failover starts

2. Both instances accept and process writes simultaneously

3. Failover eventually completes after the writer steps down

4. Result: Potential data consistency issues ???

After the fix (15.12.4+):

1. Failover starts

2. If the old writer doesn't demote before the new writer is promoted, the storage layer now detects this and rejects write requests

3. Both instances restart/crash

4. Failover fails or requires manual intervention

The underlying race condition between writer demotion and reader promotion still exists - AWS just added a safety mechanism at the storage layer to prevent the dangerous scenario of two writers operating simultaneously. They essentially converted a data inconsistency risk into an availability issue. This would explain why we're still seeing failover failures on 15.12 - the race condition wasn't eliminated, just made safer.

The comment in the release notes about "fixed a race condition where an old writer instance may not step down" is somewhat misleading - it's more accurate to say they "mitigated the consequences of the race condition" by having the storage layer reject writes when it detects the problematic state and that is probably why AWS Support did not point us to this release when we raised the issue.
by dfabulich | 2025-11-17 16:44:22+00:00
In part 1 of this article, the author wrote, "XSLT is an essential companion to RSS, as it allows the feed itself to be perused in the browser"

Actually, you can make an RSS feed user-browsable by using JavaScript instead. You can even run XSLT in JavaScript, which is what Google's polyfill does.

I've written thousands of lines of XSLT. JavaScript is better than XSLT in every way, which is why JavaScript has thrived and XSLT has dwindled.

This is why XSLT has got to go: https://www.offensivecon.org/speakers/2025/ivan-fratric.html
by DoomDestroyer | 2025-11-17 16:44:23+00:00
I would argue that it is the opposite. People expect an info dump and everything explained to them. I remember watching Captain America: The Winter Soldier (I think it was the last movie I watched in theatre) and pretty much everything was explained to the audience. Guy Richie has character intro screens like Street Fighter in his movies.

Even in movies where everything is explained e.g. in Blade where they will have a scene where someone explains how a weapon works, I've noticed in a recent viewing of the movie that people forgot the explanations of the gadgets he has. In Blade they have a James Bond / Q like conversation between the characters to say "this weapons does X against vampires" and sets the weapon for later on in the movie and people forgot about it.

I watched "The Mothman Prophecies" and quite a lot of the movie was up to interpretation and there was many small things in the film that you might overlook e.g. there is a scene in a mirror where the reflection in the mirror is out of sync with his movements, suggesting something supernatural is occurring and he hasn't realised it yet. While I love the movie, there is very few movies like that.

If you watch movies before the 90s. A huge number of movies will have characters communicate efficiently and often realistically.
by corysama | 2025-11-17 16:44:40+00:00
For one, the project started in 2019 https://geminiprotocol.net/history/ So, I guess Google should rename their LLM?

For another, to do that we'd have to follow something like the prescription drug naming process https://globalhealthnow.org/2024-07/why-do-prescription-drug...

That way, instead of "Gemini", they could have named it something like "Cymbalta", "Xeljanz" or "Cialis" :P
by troupo | 2025-11-17 16:44:50+00:00
> Comparing absolute usage of an old standard to newer niche features isn’t useful. The USB feature is niche, but very useful and helpful for pages

So, if XSLT sees 10x usage of USB we can consider it a "niche technology that is 10x useful tan USB"

> The fact that those two features are used similarly

You mean USB is used on 10x fewer pages than XSLT despite HN telling me every time that it is an absolutely essential technology for PWAs or something.
by NebulaStorm456 | 2025-11-17 16:44:59+00:00
I gave an advice to my friend who is doing a startup. I told him it probably won't work out. But we continue with our own line of thinking because the outcome totally depends on reality. Also, my friend can tack on lot of ifs later on (if only this and this and this had happened, I would be successful) to "prove" himself right. It might be possible that with no decisive outcome favoured by reality, we would both continue to be right in our heads.
by 1vuio0pswjnm7 | 2025-11-17 16:45:03+00:00
"Even more so when you attach any sort of DNS name to it, especially when you use TLS and the certificates, guessing because they end up in a big index that is easily accessible (the "transparency logs")."

I have accessed websites that do not use ICANN DNS nor TLS, sometimes on ports other than common ones like 80, 443, etc.

The term "website" to me means an IP address from which an operator publishes hypertext (HTML) and responds to HTTP requests

But others might define "website" differently

On home network for experimentation I create own TLDs in custom root.zone and use non-TLS per packet encryption to serve HTML over UDP instead of TCP

The blog post refers to "safe haven"

Usually "safe haven" means there is something that one is seeking protection from

It is not clear from the blog post what the author believes "the internet" was previously a safe haven from

Not to mention the www != the internet

It's possible the broader internet, including many "unused" ports between 0-65536, could be a "safe haven" from the web what with "AI bots"
by jlarocco | 2025-11-17 16:45:27+00:00
> It's more like how to put a modern day car dash over an F16 fighter jet.

Yeah, that's probably a better analogy.

> If only it weren't a full time job just maintaining a basic emacs config.

I've heard that before, and I don't get it. I might spend 20 minutes a month updating my config, but it's really a set it and forget it thing for me. What are people doing that requires so much work?
by toomuchtodo | 2025-11-17 16:45:31+00:00
Solar panels are recycled at almost 100% of total materials. Redwood Materials (founded by Tesla's former CTO) has already established a supply chain to ingest and recycle EV and stationary storage batteries at scale. The problem is that the hardware is lasting longer than expected, and meaningful recycling volume does not yet exist.

Conversely, ~95,000 metric tons of nuclear waste in the US does not have permanent storage or recycling solutions, as of this comment, and there is no plan for long term storage or recycling. Nuclear generation is experiencing a negative learning curve; we keep spending more the more we attempt to build it.

(solar PV panels have a 25-30 year service life, at which point they will still produce power at ~80-85% initial rating, batteries have a 15-20 year service life, with sodium ion chemistries estimated to have up to 50 year service life assuming once daily cycling)

https://www.epa.gov/hw/solar-panel-recycling

https://www.energy.gov/eere/solar/articles/beyond-recycling-...

https://e360.yale.edu/features/solar-energy-panels-recycling

https://www.cnbc.com/2025/11/09/nuclear-power-energy-radioac...

https://www.gao.gov/nuclear-waste-disposal

https://decarbonization.visualcapitalist.com/visualizing-all...

(nuclear power accounts for about 10% of electricity generation globally, as of this comment)
by yawaramin | 2025-11-17 16:45:53+00:00
> If you can find someone unsophisticated to invest in a fission reactor that takes billions of dollars and 10-15 years to build

Unsophisticated investors like the Chinese government? 'Nearly every Chinese nuclear project that has entered service since 2010 has achieved construction in 7 years or less.'

https://thebreakthrough.org/issues/energy/chinas-impressive-...
by mike_hearn | 2025-11-17 16:46:01+00:00
> Do. the. math. and. think.

OK then, where's your math?

tptacek is right, this whole discussion is silly because it revolves around what exactly "bad" means which is subjective. But if you want to really do calculations about this, you'd need to price out total expected revenue over your time preference window for each scenario. It's not at all obvious which one would win because it depends on at least these variables and probably more:

1. Over what time period you care about. "You" here means a hypothetical pharma executive who cares about his/her incentives. If symptom management makes a billion dollars repeatedly but each billion takes 200 years, and a cure makes a billion dollars once but in five years, nobody rational will want to sell symptom management.

2. Related to (1) what expected market returns are in future.

3. What price premium you can charge for a cure vs symptom management. The former is more valuable to customers.

4. How fast competitors can catch up. Imagine you find both symptom management and a cure for disease X. You keep the cure a secret and bring the subscription to market (for a price much less than what a cure would command). Six months later a competitor releases a cure, simultaneously wiping out your market and capturing all the immediate revenue. That would have been a bad move.