MurphyA/hacker-news huggingface dataset:
Show HN: My agents are building a secure fork of OpenClaw
by stcredzero | 2026-02-13 17:59:34+00:00
Show HN: SEKSBot – AI agents that can't see your secrets

SEKSBot is a fork of OpenClaw where agents have zero access to API keys, tokens, or credentials — ever.

The core insight is borrowed from SQL prepared statements: separate the instructions from the sensitive data. Agents write requests using named secret references. A broker intercepts and injects the real credentials at execution time. The agent never sees them.

How it works:

seksh (our nushell fork) has secure built-in commands (seksh-http, seksh-git) that route through the broker. Agents can make authenticated API calls and git operations without the keys ever entering shell memory.

seks-broker stores secrets and acts as a proxy. It can inject bearer tokens, API keys, and even handle asymmetric key signing — all without exposing anything to the agent process.

Three layers of defense: (1) Agents never have secrets in env vars or memory. (2) The broker validates and scopes every request. (3) Skills use sandboxing on top of broker-mediated access.

The problem we kept seeing: every AI agent framework puts API keys in environment variables. One prompt injection, one malicious webpage, one bad skill — and your keys are exfiltrated. We decided the only real fix is making it physically impossible for the agent to access them.
by tracker1 | 2026-02-13 18:00:03+00:00
And this is different from current town halls how? If you have an important issue to you, there are ways to be heard, and they aren't always convenient.

This is how representative democracy is meant to work... you work/talk with your local representatives who work as part of a larger body on your behalf. Part of the problem in the US is we stopped growing the House of Representatives, which should be about 4-5x the size that it currently is, so you have much closer local representatives.
by bwestergard | 2026-02-13 18:00:25+00:00
"But when I'm honest with myself, I can't point to evidence that an LLM writes worse code in a messy repo. And that bothers me. I've watched agents make correct changes in files I'd be afraid to touch."

If the author is afraid to touch the files, how does he know the changes are correct?

It is very tempting to believe code is a pure means to an end, and that the end can be exhaustively represented by some combination of a test suite, a prose technical design, etc. And in a single round game version of development, that gets close to true. But in the multi-round situations that matter economically, some bodies of code act as the measure for other bodies of code. This is most evident when we see generated code fail to typecheck.

Writing non-trivial software is not an exercise in translating a clearly defined end into precise means. It is solving a series of economic coordination problems over time.
by PaulHoule | 2026-02-13 18:00:38+00:00
From the viewpoint of self psychology people are limited in their ability to seduce because they have a self. You can't maintain perfect mirroring because you get tired, their turn-on is your quick, etc. In the early stage of peak ensorcelement (limerence) people don't see the "small signals", they miss the microexpressions, sarcastic leaks, etc.

It can be puzzling that people fall for "romance scams" with people whose voice they haven't even heard but actually it's actually a safer space for that kind of seducer to operate because the low-fi channel avoids all sort of information leaks.
by renewiltord | 2026-02-13 18:00:39+00:00
He said “slowing growth rate” not “shrinking economy”. Take 1900 to 2025 (or 2019 if you want to dodge covid) and EMA the (g’-g)/g and it will be visually apparent.

Quite hard to see higher derivatives in the g vs. t graph. You need to plot at least dg/dt vs t to see d2g/dt2 unless very talented.
by luckystarr | 2026-02-13 18:01:24+00:00
I tried the way they used "oracles" to verify their implementation against known good ones, and I must say: this works.

Not all implementations are re-implementations, so this approach won't work for everything. But for a new implementation in a new programming language than the original implementation, it works great. Built myself a MIB compiler, checked against smidump. Now it is more correct than the original, because smidump still crashes on some inputs, while mine does not.

So the news is not so much that Anthropic built a C compiler, but HOW.
by satvikpendem | 2026-02-13 18:01:25+00:00
Mermaid diagrams are even better because you don't waste characters on the visual representation but rather the relationships between them. It's the difference between

graph TD

User -->|Enters Credentials| Frontend[React App]

> Frontend -->|POST /auth| API[NodeJS Service]

> API -->|Query| DB[(PostgreSQL)]

> API --x|Invalid| Frontend

> DB -->|User Object| API

> API -->|JWT| Frontend

and

> +-------+ +-------------+ +---------+

> | User | | React App | | NodeJS |

> +-------+ +-------------+ +---------+

> | | |

> | Enters Creds | POST /auth |

> |--------------------->|---------------------->|

> | | |

> | Invalid | <-- [X] Error -----|

> |<---------------------| |

> | | Query DB |

> | |---------------------->| [ DB ]
by gus_massa | 2026-02-13 18:02:04+00:00
> that catalyzes general RNA-templated RNA synthesis using trinucleotide triphosphate (triplet) substrates

So it need very short RNA strings (length = 3), each one with a triphosphate that means that it is high energy molecule, similar to the ATP (length = 1).

I'm not sure if this is very optimistic bath composition, or it's a brilliant insight of why codons has length 3 too.
by jzb | 2026-02-13 18:02:38+00:00
The AI doesn’t “know” anything. It’s a program.

Destroying the bot would be analogous to burning a library or desecrating a work of art. Barring a bot from participating in development of a project is not wronging it, not in any way immoral. It’s not automatically wrong to bar a person from participating, either - no one has an inherent right to contribute to a project.
by Joel_Mckay | 2026-02-13 18:02:39+00:00
Some businesses confuse Sales with racketeering with a computer. People don't want to hear your pitch deck every time they use a product, or budget for something critical to their operations every month.

FOSS is simply computer users doing what they have always done, and accomplishing things no one (or no company) could ever do on their own.

For those that paid tens of thousands of dollars to keep the office talent happy with what they know software wise, it has been my observation the training and support is often still missing on the commercial options as well... once they get paid.

Finally, most become locked into a vendors up-sold ecosystem as they choke off compatibility with other external product workflows. And you can't add something to fit your specific use-case, as single users don't matter in business products.

FOSS is usually better in almost every way most of the time, but often lacks stability as upstream projects continuously undergo permutation. Note, even the old closed-source Nvidia GPU drivers in kernel <6.0.8 are now abandoned in >6.15 to send a lot of old Linux laptops to the landfill.

Confusing skill issues with the realty of the software business is common. =3
by cmiles8 | 2026-02-13 18:02:56+00:00
Amazon’s leadership culture is pretty low EQ and they often fail to see things that others would find fairly obvious.

The Amazon Go stores and “Just Walk Out” were a good idea on paper but terribly executed because Amazon leaders didn’t understand how customers think and the awkward aspects of the design. Same with the palm reader tech they just scrapped. Similar here where someone thinks this is a good idea but is completely out of touch with customer mindsets. It’s a recurring pattern for Amazon.
by sneezydwarf | 2026-02-13 18:02:58+00:00
It’s not infinite — it’s a fixed 1,000,000 × 1,000,000 grid.
That’s 10¹² addressable coordinates. Large, but finite.

You’re right that pixel canvases have been done before (e.g. Million Dollar Homepage, r/place).

The difference here is:

- No images
- No advertising
- No time resets
- No collaborative overwriting
- Permanent ownership of a coordinate

It’s less about pixels and more about addressable digital space.

As for the $1 — I don’t expect everyone to care.
The question isn’t “will everyone buy one?”
It’s whether a small number of people find value in permanently marking a coordinate.

If nobody does, that’s a useful signal too.
by eviks | 2026-02-13 18:03:02+00:00
> sooner or later ... design in the latest SDKs

Or don't use the latest SDK and don't be forced "next year", but continue for many more years. Also "later" is definitely better in such cases because there is some change the design will be improved.
Either way, there is no good reason to rush to be worse and cut off users if you proclaim you're into quality
by matheus-rr | 2026-02-13 18:03:28+00:00
The thing that strikes me about this thread is how many people are scrambling to evaluate alternatives they've never tested in production. That's the real risk with infrastructure dependencies — it's not that they might go closed-source, it's that the switching cost is so high that you don't maintain a credible plan B.

With application dependencies you can swap a library in a day. With object storage that's holding your data, you're looking at a migration measured in weeks or months. The S3 API compatibility helps, but anyone who's actually migrated between S3-compatible stores knows there are subtle behavioral differences that only surface under load.

I wonder how many MinIO deployments had a documented migration runbook before today.
by Jackson-Solway | 2026-02-13 18:03:31+00:00
Founder again.

It might be. Or it might not be.

I mean this in all sincerarity, if you're having that reaction, I invite you to join the waitlist to move to the city.

I've come to believe that people are mean and dismissive online (as you just were) not because they, and you, are mean and dismissive people, but because at a fundamental level there's nothing to do on the internet. The few things we manage to do, or build, or change online are a whiff of shit on the breeze compared to the adventure, meaning, and risk of interacting with real people in physical reality.

You will benefit from moving to the city because building something in the real world with people you depend on, and who depend on you, will make you a better, happier human. Please consider it.

The waitlist form is here: https://newathens.fillout.com/waitlist
by ryandrake | 2026-02-13 18:03:55+00:00
> After school specials since the 80s have made pregnancy a horror to avoid instead of a joy to grasp.

Pregnancy can be employment-disrupting, and a horror if you're not financially ready to raise a child. Teen pregnancy can end one's future, one's educational and career prospects, before it even begins. The steady and nearly-uninterrupted decline in teen pregnancy from its peak in the early 90s is an absolute miracle of sex education.

The birth rate for women 20-24 was cut in half from 2005 to 2023, and the birth rate for teens under 20 dropped by 2/3s[1], which is frankly amazing progress.

1: https://usafacts.org/articles/how-have-us-fertility-and-birt...
by addaon | 2026-02-13 18:04:29+00:00
Slowing refers to a change in the derivative, in this context. Slowing growth would be a decrease in change in GDP per year — a decrease in growth. But the claim is that the growth (first derivative) is what’s slowing — that is, the second derivative of GDP w.r.t. time went negative, which does seem to be the case in mid 2018 from the linked chart.
by toomuchtodo | 2026-02-13 18:05:05+00:00
I subscribe to keep the reporting going. Journalism costs money.

Most Americans don’t pay for news and don’t think they need to - https://news.ycombinator.com/item?id=46982633 - February 2026

(ProPublica, 404media, APM Marketplace, Associated Press, Vox, Block Club Chicago, Climate Town, Tampa Bay Times, etc get my journalism dollars as well)
by runako | 2026-02-13 18:05:07+00:00
This is exactly, precisely the opposite of what the impact will be.

For example:

- every technology has false positives. False positives here will mean 4th amendment violations and will add an undue burden on people who share physical characteristics with those in the training data. (This is the updated "fits the description."

- this technology will predictably be used to enable dragnets in particular areas. Those areas will not necessarily be chosen on any rational basis.

- this is all predictable because we have watched the War on Drugs for 3 generations. We have all seen how it was a tactical militaristic problem in cities and became a health concern/addiction issues problem when enforced in rural areas. There is approximately zero chance this technology becomes the first use of law enforcement that applies laws evenly.
by tryauuum | 2026-02-13 18:05:35+00:00
such is the reality of the modern world. Either you whine on the internet impotently. Or you suicide bomb the HQ. These are the only two options to affect a corporation nowadays

GitHub ignores my requests to delete my account. What are my options? I will whine online because I'm not ready to break the law. This, or maybe I will bully the github employees in real life. What are my other options? I tried to find a lawyer in the european country where the github has an office, but got refused help.
by Oatcake21 | 2026-02-13 18:05:36+00:00
I built a vulnerability scanner targeting logic bugs that Semgrep, CodeQL, and Snyk structurally cannot catch because they pattern-match syntax, not behaviour.

SAST tools find SQL injection and XSS. They cant find a booking endpoint that lets any authenticated user delete another user’s booking. The code is syntactically valid — the bug is in what’s missing (an ownership check), not what’s present.
by bigstrat2003 | 2026-02-13 18:05:39+00:00
I also struggle. I do not personally find LLMs useful for my job, but it does concern me that the hype might become so strong that I'm unable to find a job where I'm allowed to simply not use the tool if it isn't providing me value. And if it comes to that I'll use the stupid thing because I'd rather do that than go homeless, but I will certainly hate my job if it becomes just "supervise the LLMs".

In order to combat that worry, I'm trying to focus on gratitude that I have had a career where I got paid for doing fun things (programming), rather than worrying about what if my career stops being fun. Many people never get that chance, after all, and live their entire lives working menial jobs just to put food on the table. I'm also trying to make my career less important to my own mental happiness by focusing on other things that are good and will not go away even if my career stops being fun (for me, that means my marriage and my faith).

It's not easy to do, at all. And it also doesn't help the worry that I might even lose my job entirely because the industry abandons sense and fires people in favor of LLMs. But it does help a little, and I'm hoping that with practice the mental discipline will get easier and I can let go of the anxiety some.
by luqtas | 2026-02-13 18:06:00+00:00
> the European explorers and colonists did commit horrific crimes against humanity

not only horrific but the biggest hollocaust in the entire human history, with around 34 million people killed from 1500 up to 2025

with that said, people romanticize them too much. canibalism, war and also a (probably) big impact in one of the most rich ecosystems of Earth: the Amazon was ripped with their practices of burning stuff and planting dominant species among the forest that reduced for sure the amount of biodiversity in their +15,000 years of existence there. tho not defending EU ppl ripping out their forest till the border of rivers
by mindslight | 2026-02-13 18:06:02+00:00
Why do you write so many low-effort, disingenuous, inflammatory comments? They're "not even wrong", yet they just suck energy right out of productive discussion as people inevitably respond to one part of your broken framing, and then they're off to the races arguing about nonsense.

The main problem with the law not being applied evenly is structural - how do you get the people tasked with enforcing the law to enforce the law against their own ingroup? "AI" and the surveillance society will not solve this, rather they are making it ten times worse.
by M95D | 2026-02-13 18:07:18+00:00
This is the attitude that made me keep my patches to myself.

Hey, you, FOSS maintainer, whoever you are:

- If you make your project public, it means you want and expect people to use it. You could at least write some documentation, so I don't waste my time and then find out, days later, it isn't capable of what I need or I simply don't know how to use it.

- If you set up a bug tracker, then at least have the decency to answer bug reports. Bugs make it unusable. Someone took the time to write those bug reports. I'm not asking to fix them (I lost that hope decades ago), but at least you could give a one line answer or 2-line guidance for some another person that might want to try a fix - "I don't have time to fix it, sorry, but it's probably because of <that thing> in <that file>." I mean, you wrote the stuff! One minute of thinking on your part is the same as 6 hours of digging for someone who never saw the code before.

- If you open it up to pull requests, it means you want people to contribute. Have the decency to review them. Someone took time away from their jobs, families or entertainment to write those PRs. Ignoring them because you don't need that feature, not affected by the bug, or simply because of code aesthetics is an insult to the one who wrote it.

PS:

- And no, don't expect someone else to write the documentation for your code. Same as the bugs: 1 minute of your time is 6 hours of work for someone else.

If you can't do at least these things, just say it's abandoned on the front page and be done with it.
by mr_mitm | 2026-02-13 18:07:29+00:00
Sorry, looks like I haven't been precise.

I've seen them veer off a plan, and I've seen the posts about an agent accidentally deleting ~, but neither of those meet the definition of the lethal trifecta. I'm also not saying it can't happen - I count myself towards the ones that are waiting for it to happen. The "we" was meant literally.

That being said, I still think it's interesting that it hasn't happened yet. The longer this keeps being true, the lower my prior for this prediction will sink.
by gleipnircode | 2026-02-13 18:08:59+00:00
Love this. Takes me right back to my teenage years. Can someone please make a Dota 2 pack? Invoker alone would be perfect.

Session start:
"I am a beacon of knowledge blazing out across a black sea of ignorance"

Task finished:
"It falls to me to inform you that this one is in the bag"

When a failure occured:
"My memory fails me"

I think i would get addicted to work again like in my past playing dota.
by DangitBobby | 2026-02-13 18:09:12+00:00
We're talking about appealing to social justice types. You know, the people who would be first in line to recognize the personhood and rally against rationalizations of slavery and the Holocaust. The idea isn't that they are "lesser people" it's that they don't have any qualia at all, no subjective experience, no internal life. It's apples and hand grenades. I'd maybe even argue that you made a silly comment.
by roywiggins | 2026-02-13 18:09:34+00:00
The simulacrum of a relationship. When an LLM says it has an emotion of any kind, it is to a first approximation making that up. It's roleplay.

It's like paying someone to be your friend and saying "wow, this is so much easier than friendships otherwise"- of course it is, that's what you're paying for. Nothing wrong with that per se- a lot of therapy e.g. is paying someone to pay close attention to you. But it's not the same sort of thing at all.
by system7rocks | 2026-02-13 18:09:54+00:00
I don't like to paint Apple as being completely incompetent (but damn have they been screwing stuff up), but I do think trying to solidify the experiences around a common codebase has become untenable. The idea is great thought - write one app that works on macOS, iPadOS, iPhoneOS, visionOS, etc. What a time saver that is for developers - but the problem is that screen sizes and interactions with those different platforms vary. Yes, resizing a window with your clunky finger needs a bit more wriggle room, while a pixel precise mouse or touchpad is a lot different.
by acters | 2026-02-13 18:10:00+00:00
I'm partially fascinated by their reliance on this model. I do miss the models before gpt 5.
Openai is quietly locking it away into some vault as we just need to accept whatever model is current.
I think I can sympathize with these people on only one merit and that is nostalgia and entertainment.
I still load up old versions of software. I still watch old shows. I still play old video games. Under the lens of entertainment, I will never be able to be entertained by the objectively worse models.
Old chats are kind of still there but not really, the UI is obviously different and probably will get deleted when I stop paying for the subscription and try to claw back some of my life away from chatting with these stupid models.
It's dangerous to hold any meaningful memory with these cloud LLMs. Not to mention the social media traps people fell for, that I was proactively avoiding. I did get some part of me attached to gpt 4o. I quickly realized it and moved away from it.
This post is a mixture of complex emotions but it is just what I felt like posting. It's fine to ridicule people for wanting to be that deeply attached but these cloud LLMs show how easily it is to start a social habit and lose it in an instant. We need more healthcare push to prevent (and treat the) social attachment from happening to LLMs.
by gwern | 2026-02-13 18:10:33+00:00
> My siblings are very much not developers. That's a lot of data for them to download, store, and figure out a way to view.

I wasn't suggesting anything about your siblings, but you, who are a developer. I was just talking about the actual download step, not what you did after that. (Obviously you were going to host them somewhere else in some other form. Probably not DVDs but a little quickie website or maybe just a Flash drive with a HTML file index, say, I don't know, lots of options here to make it user-friendly for your siblings on Christmas Day. The hard drive or Flash drive idea has the benefit of LOCKSS, especially if you use up the spare space providing PAR2 FEC.)

> I doubt any model could effectively label locations and people over 20 years of video.

Actually, Gemini is highly promptable with a large context window and a single still image only takes up ~300 tokens IIRC, so I think that you could probably do so! Just include, say, 3 photos of each person over time with a natural language description, and 1 photo of each location, and that might be enough to get back useful labels. Gemini can even do bounding boxes. (Google is quite proud of its vision and video analysis capabilities.) And you can run multiple passes or split up videos etc.
by crooked-v | 2026-02-13 18:10:35+00:00
The Aztecs in particular were kind of uniquely terrible, both for their own citizens and for every oppressed pseudo-vassal-state around them. It's one of those weird accidents of history that Spanish colonizers were able to step into the power vacuum after the fall of Tenochtitlan and have at least some people genuinely think 'yes, this is better than the last boss'.