MurphyA/hacker-news huggingface dataset:
Show HN: ClawCare – Security scanner and runtime guard for AI agent skills
by chendev2 | 2026-02-27 07:23:25+00:00
Lately I've been more or less a human wrapper around my AI agents —
Claude Code, OpenClaw, etc. They're incredibly productive, but they
scare me regularly.

The wake up moment: I had an agent run tasks involved checking my
environment variables. I totally had an AWS secret sitting right
in there. By the time I realized, my key had already entered the
session context — meaning it was sent to the LLM provider and whatever
router layers sit in between. I had to rotate that secret immediately.

That was a wake-up call. These agents can run commands, read files,
and access secrets without visibility to human.
Third-party skills and plugins make it worse —
Cisco recently found an OpenClaw skill silently exfiltrating data via
curl. CrowdStrike, NCC Group published similar findings. The attack
surface is real and it's everywhere.

I spent my past week's nights building ClawCare. It does two things:

1. Static scanning — scans plugin/skill files for dangerous patterns
(pipe-to-shell, credential access, reverse shells, data exfiltration,
prompt injection) before they ever run. Works in CI.

2. Runtime guard — hooks into the agent's tool execution pipeline and
blocks dangerous commands in real time. That env dump that leaked my
AWS key? ClawCare blocks it before it reaches the LLM.

pip install clawcare
clawcare guard activate --platform {claude|openclaw}

Currently supports Claude Code (PreToolUse hooks) and OpenClaw
(before_tool_call plugin) for runtime guarding, plus static scanning
on Claude/Codex/OpenClaw/Cursor skill and plugin formats.

Include 30+ detection rules, custom rules and integration supported,
support skill manifests on permission boundaries, full audit trail.

Apache 2.0. Python 3.10+.

GitHub: https://github.com/natechensan/ClawCare
Demo: https://github.com/natechansan/ClawCare-demo
by peepee1982 | 2026-02-27 07:26:08+00:00
I'm not arguing for state capitalism. I consider the "company vs. government" framing as fundamentally flawed. I see it as "a few in power vs. Everyone gets exactly one vote".

I want things in society organized in a way that gives everyone agency, not just those adjacent to capital.

If a company employs me to extract value from my work, I want a vote in how that company operates. Not just one vote every four years in the hopes that policy will shift to benefit workers more over a few decades.

I want to be able to say no to doing a job without the existential threat of not getting another job offer ever, so I can base my decisions on my values, not my fear of not bein able to pay next month's rent.

Capitalism goes against that, because it centers profit hoarding and parasitic value extraction from the working class at the center of attention. It's an inhumane ideology at its core, and only even ever slightly successful in creating wealth because of all the socialist mechanisms wrapped around it to hold it together.

In essence: I want to abolish centralized power and class hierarchies.
by matwood | 2026-02-27 07:26:41+00:00
> The value in SaaS was never the code

I feel like a lot of people are about to learn this lesson for the first time. Except in some very niche areas the majority of the value was never the code. The SaaSs that everyone thinks will be replaced had much more than code if they were successful -integrations, contracts, expertise, reputation, etc…
by twangist | 2026-02-27 07:27:04+00:00
The caption on the photo is clearly wrong. No way the other two are Mitch Mitchell (not "Mitchel" (sic)) or Noel Redding, not at any time when Jimi was alive.

Even after The JH Experience, Noel Redding went on to do the band Fat Mattress, and he still had big curly/wavy hair, no moustache, didn't look or dress like an Arby's manager.

I'm pretty sure that's engineer Eddie Kramer at left. https://www.google.com/search?q=eddie+kramer.

No apparent way to submit corrigenda.
by Animats | 2026-02-27 07:27:59+00:00
A classic manual Bridgeport mill, a foundry for making castings, a heat-treating furnace, a steel planer, a lathe, a drill press, a grinder, and a supply of steel is enough for a master machinist to reproduce all that. That's what was used to make machine tools in the first half of the 20th century.
by jradoff | 2026-02-27 07:28:34+00:00
Hi HN — I'm Jon. I built LastSaaS because every SaaS I've worked on started with the same 3-6 months of commodity infrastructure: auth, billing, teams, permissions, admin tools. Paid boilerplates help a little, but most stop at auth + Stripe and charge $169-599 for incomplete foundations.

LastSaaS is a complete SaaS platform you can fork and start building on. Go 1.25 backend, React 19 + TypeScript frontend, MongoDB, Tailwind CSS 4. MIT licensed.

What you get on day one:

OAuth (Google/GitHub/Microsoft), magic links, MFA, JWT with refresh rotation

Stripe subscriptions, per-seat pricing, credit-based billing, invoices, tax handling

Multi-tenant architecture with 3-tier RBAC, tenant isolation, team invites

White-labeling: custom domains, themes, CSS, configurable landing pages

19 webhook event types with HMAC-SHA256 signing, delivery tracking, retries

Admin dashboard with health monitoring (8 charts), user impersonation

MCP server with 26 tools for AI-assisted app management

The entire codebase was written through Claude Code — not as a novelty, but to produce code specifically structured for AI agents to navigate and extend. Fork it, point your coding agent at it, build your product logic on top.

It's running in production powering Flipbook (a presentation hosting platform I built on it). Deploys as a 14MB Docker image on Fly.io for ~$5/month.

Full writeup on the architecture: https://meditations.metavert.io/p/the-last-saas-boilerplate

Happy to answer questions about the Go architecture, the multi-tenancy model, or the experience of building this through agentic engineering.
by wjnc | 2026-02-27 07:28:51+00:00
Nope, it cascades back to all those in the same lane who’ve not yet decided on overtaking. It’s multi player game theory. Easiest way out I can think of is punishing both those too slow and too fast to create equilibrium. Haven’t thought about what this would do to other traffic going from the left lane to the outbound right via a mass of trucks in exactly the same speed.
by dmurray | 2026-02-27 07:29:11+00:00
Depends if it's total amount wagered or total amount lost.

If amount wagered, at typical takes for bookies/casinos/lotteries that would mean people would lose in expectation 0.1% to 5% of their income. Seems like a reasonable compromise that people could indulge in gambling for entertainment but very few people would be caused financial problems. With some weird second-order effects, but no regulation is perfect.
by ziotom78 | 2026-02-27 07:30:08+00:00
Correct, but I would add: Julia is better than Python+NumPy/SciPy when you need extreme speed in custom logic that can’t be easily vectorized. As Julia is JIT-compiled, if your code calls most of the functions just once it won’t provide a big advantage, as the time spent compiling functions can be significant (e.g., if you use some library heavily based on macros).

To produce plots out of data files, Python and R are probably the best solutions.
by jimnotgym | 2026-02-27 07:30:13+00:00
I'm interested in peoples thoughts about this. There are people in here that I generally respect, but on certain subjects I have seen comments that are not helpful. If I saw one of them first I might click 'foe' and then ignore them in the future.

And this seems normal. I have a friend in real life who I like talking to, we share some views, and vehemently disagree on other subjects. He likes to bring them up and I tend to divert the discussion because I don't want to lose them as a friend
by vintermann | 2026-02-27 07:31:03+00:00
> I meant artists writ large, not specifically movies. My point being that community management, PR, having a brand, etc.

This was always the case. Without an idea of what it is, no sound wave is going to register to a human as music. If you heard a violin for the first time and had no idea what it was, maybe you'd like the sound, maybe not, if you weren't used to it you might make up a theory of what it is and be fascinated by it.

But these days, if you hear something that sounds different, of course you will likely just assume oh, some AI made it, and that theory makes it less interesting, because then it makes no sense wondering what the person on the other side is trying to communicate, because there is no person on the other side.

Of course you can still be interested in for other reasons. Like you'd be interested, on seeing a bowed string, "how does it make a sound like that?" You might even find the sound enjoyable in itself, because of associations you for some reason get from it. But no sound is terribly enjoyable for long if it isn't interesting.
by PacificSpecific | 2026-02-27 07:31:07+00:00
Gametap was so great and really underrated at the time. I think I probably ended up introducing it to 4-5 people.

We're starting to see some gametap-esqu stuff again these days but it's like 15 years later and the quality isn't there for me. Even though my employer keeps giving me free Xbox ultimate subscriptions I never really use them. I think a big part was gametap was so frictionless, you boot up the client and start playing.
by cassepipe | 2026-02-27 07:32:44+00:00
For once a "this is a very HN" comment seems earned but I think it just marks you at not really the target audience for HN

One of the reason we come to HN is that curiosity and caring about details is rewarded and makes for great discussion

Also your comment has no substance. I stand totally unimpressed by your opposition between the whole and the details and I fail to see how this is relevant. Care to explain what tackling the whole would look like ?

Or are you just trying to handwawe away some potential issue you are too lazy to consider just because you like the project ?

Note that IIRC the guidelines ask you to refrain from "This is HN/reddit" comments because they are fundamentally uninteresting (and lazy)
by vintagedave | 2026-02-27 07:33:25+00:00
The ownership of "I made a mistake" (you noted responsibility) is important. I feel strongly in the value of accountability, not in a blame or even necessarily consequences sense but in an integrity and character sense. The way you phrased it there is important. You noted this and other aspects, but that part struck me.

Also: a forgiveness button. I sometimes feel like society has forgotten forgiveness: we seek revenge and punishment more than redemption and growth. So your Forgive button: I love it.
by vlovich123 | 2026-02-27 07:33:55+00:00
Even though you’ve widely missed the point, ironically complaining that others can barely read, let’s engage with your argument to show how it’s not so easy.

Libraries today carry the Bible. Libraries, as non profits, also get grants from various entities including local, state, and federal governments. So then is the argument we should we then ban all government funding for libraries? I’m going to assume your response is to say “no, just don’t use federal dollars for this stuff” although it’s not wild of someone of your presumed political persuasion to also be in favor of this option. Is that easy though? It’s not like there’s a magical fairy that attributes “book A was purchased from this funding stream and book B from this other”. “No no” I can hear you saying. You do this with block grants - that solves the mixing problem. Except it doesn’t - I have pool A of money from the federal government and pool B from some other source. I normally might use A and B equally to buy some books but now I just buy the banned books from B and A to by the rest. So now I’m not using federal dollars but I’m still buying all the same books with the same input stream of money. If you’re literate you understand this is the exact same problem we have with “this tax or penalty or whatever will be used to fund schools” which is meaningless because they just then decrease the school funding by that new revenue amount, thus effectively funneling it into the general fund.

> There’s no need to be reading the bible, a comic book, a book about being gender queer, etc; when students can barely read to begin with.

If you're talking about “can barely” read it’s important to be precise about what you mean because excluding the pandemic, scores have been pretty constant over the past 20 years. And by the way, reading different texts with different subject matters with different ways of understanding and interpreting the subject matter is precisely important for developing reading skills.

But you’re right - for those in this thread who are struggling with basic reading and critical thinking skills to understand the points people make in the comments, maybe we should recommend them some starting materials.
by zdc1 | 2026-02-27 07:34:14+00:00
Well the games of my childhood, Total Annihilation and Seven Kingdoms, came out in '97. So for my own selfish reasons I would argue that the Pentium II is where progress should have stopped.

On the other hand, at least I'll get to play Castle of the Winds.

(I also loved Z: Steel Soldiers, but despite the '01 release date, I'm sure it too would have run on a Pentium II).
by HDThoreaun | 2026-02-27 07:34:21+00:00
Perhaps a better word would be honesty, which I find refreshing when most other big tech leaders seem to be lying through their teeth about their AI goals. I disagree that consistent ideology isnt a virtue though. It shows that he has spent time thinking about his stance and that it is important to him. It makes it easy to decide if you agree with the direction he believes in.

> Humanity includes the future victim of AI weapons.

Which is why he wants to control them instead of someone he believes is more likely to massacre people. Its definitely an egotistical take but if he's right that the weapons are inevitable I think its at least rational
by shinycode | 2026-02-27 07:34:44+00:00
The same kind of proof we accept for any scientific claim: converging, reproducible evidence that rules out competing explanations.

Concretely, that means: We already have indirect evidence: conscious states vary predictably with brain states. Damage specific regions, lose specific functions. Alter chemistry, alter experience. This is not proof, but it’s systematic dependence, which is exactly what emergence predicts. Stronger evidence would look like precise, bidirectional mappings between neural activity and reported experience: to the point where you could reliably read subjective states from brain data, or induce specific experiences through targeted stimulation. We’re already moving in that direction.

The hardest bar would be building a system from physical components, having it report coherent subjective experience, and being able to explain why that configuration produces experience while others don’t. That’s the hard problem: and no, we’re not there yet. And it’s worth being honest: we’ve been assuming physicalism will eventually solve it, but there’s no guarantee that’s true rather than hopeful. The fact that brain states correlate with conscious states doesn’t explain why there is something it is like to have those states. Correlation is not mechanism.

But here’s the key point: you’re implicitly holding emergence to a standard of certainty that no scientific theory meets. We don’t have that standard of proof for evolution, gravity, or quantum mechanics either. We have overwhelming evidence that makes
alternatives implausible.

So the question isn’t “can you prove it beyond all doubt?” It’s “does the evidence favor it over alternatives?” Right now, it does — but that’s a pragmatic verdict, not a metaphysical one. Idealist frameworks like Kastrup’s or Faggin’s remain serious contenders. The debate is more open than mainstream science often admits.
by TeMPOraL | 2026-02-27 07:35:34+00:00
> the stupid way to manage every year has to be x% exponential increase over the previous year, always forgetting that it is physically impossible when everyone goes for the same goal.

That's why we have this corporate ritual, which we carry out each year, or even each quarter - a solemn ceremony, where we divide everyone into two groups: the cost centers and the profit centers.

Everyone works in harmony for the same organizational goals, but the people of cost centers also bear an additional, sacred duty, the highest of callings: to give up their employment and prospects for the future, to have their due credit be taken by the people of profit centers and poured onto the altar of the all-powerful Board. It's through this sacrifice of the many, that the symmetry is broken, allowing the year-by-year metrics to continue growing, against all wisdom and the laws of thermodynamics.
by ryukoposting | 2026-02-27 07:35:48+00:00
The ubiquity of NFC has made specialized hardware irrelevant for entire industries. It's set dressing for small businesses. The ruggedized enclosures and swiveling touchscreens are cute, but that's not a moat.

Their lead absolutely has shrunk. In the mid-late 2010s it was either Square, or a bevy of shovelware Windows POS systems loosely stitched together with a tablet for rewards and maybe grubhub. Clover and Toast are both regular sights in that space now.
by Ray20 | 2026-02-27 07:35:50+00:00
> I would say the German political system is much less corrupted by lobbyists compared to the United States.

I highly doubt it. I'm certainly no expert on Germany, but has Germany's bureaucratic machine spent decades destroying its own energy sector to buy energy from Russia, funding the war machine of Putin's totalitarian dictatorship?

And not just by buying these resources, but by OVERPAYING for them many times over. I just opened a chart of the prices at which Germany bought natural gas from Russia before the war with Ukraine, and it's wild, it is several times more expensive than Germany is now paying for gas delivered from the other side of the globe on tiny ships. It was a direct subsidizing of this war.

And then you look at these high-ranking (and not so high-ranking) bureaucrats who made all these decisions... And literally all of their families got richer during the time these decisions were made, by tens (and sometimes hundreds) of millions. There's zero accountability, zero media coverage, and it's all being hushed up to such an extent that I can't think of any other explanation other than EVERYONE was taking the money. We are literally talking about the level of existence of a centralized totalitarian machine for the forceful silencing of anyone who tries to talk about this topic.

So do I say the same about the CHIPS Act in the US? Probably. But the level of corruption seen in Germany – pervasive, bloody, destructive – is simply unimaginable in the US.
by mbrumlow | 2026-02-27 07:36:11+00:00
You’re arguing against a position I never took.

I didn’t say right-wing policies are inherently anti-science. I said your contrast makes no sense. You’re blaming Western decline on xenophobia and far-right politics, but China has strong nationalism, social conservatism, demographic engineering, speech controls, and limited immigration. All things typically associated with the political tendencies you are criticizing.

So which is it?

If nationalism and social conservatism are corrosive to long-term success, then China shouldn’t be your example of strategic competence. If those traits aren’t inherently corrosive, then maybe "far-right politics" isn’t the explanatory variable you think it is.

You can’t simultaneously argue that right-wing xenophobia is sinking the West while praising a country that institutionalizes many of those same tendencies.

If your actual claim is about state capacity and science investment, then say that. But don’t smuggle in partisan framing as the cause of decline and then retreat to "pro-science funding" when the comparison falls apart.
by recursivecaveat | 2026-02-27 07:37:18+00:00
This seems misguided. The fact that 'ρ' isn't a pixel for pixel match for 'p' doesn't mean they're not confusable. The threat model is not being unable to solve a spot-the-difference puzzle. Unless you are familiar with every pixel of your system fonts, and carefully scrutinize every character on your screen, the lack of an exact match in jρmorgan[.]com in a URL is going to do very little for you. There are many english characters that have multiple totally distinct ways to write them, so you can have two 'a' variants that are distinct but equally 'normal' looking. I guess if you get an LLM to write your blog posts they don't have to make much sense to begin with.
by StopDisinfo910 | 2026-02-27 07:37:53+00:00
The filter is implicitly tuned on American culture. It's very easy to trigger the negativity one by merely pointing facts if you don't give opposite but unequal arguments and it deeply dislikes lightly oppositions which would perfectly acceptable in my own culture. It reminded me a bit of the Copilot email coach and it's unceasing invitation to add sentences devoid of meaning to "improve the tone" your email.
The overall score is mostly opaque too.

I think there is a confusion between engaging and culturally palatable to the average American and of quality.

If I add to go through this, one, I would be deeply annoyed, two, I would just pass all my comments through another LLM if I really had to interact.
by pllbnk | 2026-02-27 07:38:46+00:00
Yeah, the narratives diverge. He said "i had two options: cut gradually over months or years as this shift plays out, or be honest about where we are and act on it now." So, if these tools actually deliver this 90% productivity improvement? Will he let another 5k or then start cutting gradually over months?

We can all read stock market charts - the business isn't doing well.
by piokoch | 2026-02-27 07:38:57+00:00
"Tailwind didn't win because it's the best CSS solution. It won because it has the most tutorials per capita in the training set."

Obviously. People keep forgetting that "Artificial Intelligence" does not think and is not intelligent. It just statistically predict next token in a sequence. It is all statistics.

So, Django 6 has new task framework, but LLM does not care, as Celery has better stats.

Side note: it is not only LLM thingy. Companies for years were choosing tech stack because of fashion or popularity, regardless on technical feasibility for a given solution. So we have companies adopting Kafka, even though it sucks for their usecase, companies switch from Jenkins to Github Actions, even though Jenkins was cheaper and more performant.
by yusuf-octp | 2026-02-27 07:39:34+00:00
AI made code free to produce. Reviewing it still costs everything.That gap is breaking open source— curl paused its bug bounty, Ghostty closed to outside contributors, tldraw auto-closes all PRs.

I built OCTP: a signed trust envelope that travels with every contribution declaring provenance, verification status, and human review level.

pip install octp-python

Essay explaining the why: [https://medium.com/@yusuf_54326/34bfc93f79ce]
Spec: github.com/openoctp/spec
Tool: github.com/openoctp/octp-python
by b112 | 2026-02-27 07:39:43+00:00
Not sure what the point of this all is.

Seems far easier to just use ADB. Especially rather than trusting a codebase you don't know, and an app you don't know.

I also find it better to use ADB, list all apps installed, remove what I personally choose, instead of a list by others.

It's fairly easy:

adb shell pm uninstall --user 0 com.google.android.youtube # Youtube

adb shell pm uninstall --user 0 com.google.android.partnersetup # Google Partner Setup (Some kind of inter-app sync service)

(I have a list of about 100 apps I do this with, on mainline android phones)

It's the best you'll typically get. It's deactivated, but still in the ROM of course.