MurphyA/hacker-news huggingface dataset:
Show HN: I built a BYOK AI gateway after a 100x Cloudflare KV cost mistake
by qzira | 2026-03-09 14:23:46+00:00
I run a small data recovery business in Japan, and over the past year I've been building with AI coding tools like Claude Code, Cursor, and Cline.

One of my side projects is an overnight content pipeline for my business. It pulls RSS feeds, fetches source articles, generates posts with AI, scores them, and publishes them to WordPress without supervision.

The content is a bit niche: cybersecurity incidents for Japanese manufacturing companies in Aichi Prefecture — Toyota's home region — where older workflows like fax and password-protected ZIPs still haven't fully disappeared.

The physical setup is also a little ridiculous: a SwitchBot turns the PC on at 3am, Windows Task Scheduler starts the Python pipeline, and another scheduled task shuts the machine down when it's done.

Originally this was only meant to solve my own problem. But the more failure modes I found, the more features I kept adding.

What pushed me to build qzira was cost control.

The first lesson was operational: alerts don't help at 3am. What I needed wasn't another notification, but a kill switch outside the application — something that could stop requests before they reached the provider, regardless of what the agent decided to do.

The second lesson was more embarrassing: I had miscalculated Cloudflare KV write costs by 100x. Every request was triggering a KV put. Rewriting that path to batch via cron jobs reduced writes by about 99% and fixed the unit economics.

I also became much more conservative about model choice for production content after running a simple comparison on my own pipeline.

I ran 10 articles through Claude and didn't find any hallucinations.

Then I ran 1 article through gpt-4o-mini, and it immediately inverted the meaning of the source: it wrote "operations were suspended" where the original said "no impact on operations was confirmed."

To be fair, the pipeline was tuned around Claude, so I don't take this as a general statement about model quality. It may simply have been a prompt/model fit issue. But for me, it was enough to become much more conservative about where lower-cost models are allowed to touch production content.

Both problems pointed to the same conclusion: cost and policy enforcement belong at the infrastructure layer, not inside the application.

So I built qzira — a BYOK AI gateway in front of OpenAI, Anthropic, and Google AI. It adds gateway-level budget controls, hard stops, and routing by changing the base_url in tools like Claude Code or Cursor.

Stack: Cloudflare Workers, Hono, D1, KV, and Vectorize.

There's a free tier.

Happy to answer questions about the architecture, the cost mistake, the overnight pipeline, or the slightly absurd physical setup behind it.
by aw1621107 | 2026-03-09 14:23:52+00:00
> Could you share a situation where the behavior is necessary?

The effects mentioned in the article are not too uncommon in embedded systems, particularly if they are subject to more stringent standards (e.g., hard realtime, safety-critical, etc.). In such situations predictability is paramount, and that tends to correspond to proving the absence of the effects in the OP.
by guenthert | 2026-03-09 14:24:22+00:00
"This one caught me off guard. Arduino, the company most of us associate with microcontrollers and blinking LEDs, have released an SBC."

Uh, what were they doing before? No, seriously, given that every laptop ever and most legacy free desktops, not to speak of the 1U servers you find in data centers use a single PCB, what makes a SBC a SBC?

I've seen Raspberry Pi and the like being referred to as 'open frame computers', which I thought describes them more fittingly.
by JKCalhoun | 2026-03-09 14:24:27+00:00
Generally, you're right about your first point. Apple (and perhaps all "designers") want to get it right, not leave it to the whims of the user.

Even if you allow for both options, you can still have a long drawn out argument about what the default should be. (And then if you can agree on the default, the thought raises its head—maybe we ought to just go with that alone and keep it simple.)
by popupeyecare | 2026-03-09 14:24:27+00:00
I did and a few CPAs. Surprisingly my customers have been CPAs buying to offer to their clients.

Pixie is more like quickbooks or any other record keeping software. We don’t employ the children, their parents do. And as long as the kids are doing legitimate work, it’s fair and actually the irs has a page on it.
https://www.irs.gov/businesses/small-businesses-self-employe...
by zozbot234 | 2026-03-09 14:24:44+00:00
Doing the hard work up front is easier than doing it while debugging a non-trivial system. And there are boilerplate patterns in Rust that allow you to skip the hard work while doing throwaway exploratory programming, just like in "easier" languages. Except that then you can refactor the boilerplate away and end up with a proper high-quality system.
by angiolillo | 2026-03-09 14:24:50+00:00
> That only works if your printouts aren’t too long

It depends on what you mean by "too long".

A few folks in my office have binders with dog-eared code printouts for some of the more stable internal libraries in our codebase. A 3" thick 3-ring binder can hold a little over a million lines of code. I wouldn't use it for Firefox (~21M LOC) or Linux (~40M LOC) because you'd need to dedicate several shelves and print it regularly to be useful. And there's no grep. But for things like a stable, versioned library it can be very useful.
by dilawar | 2026-03-09 14:25:07+00:00
> I got tired of nil checks in Go and became a squeaky wheel in incident retros, where I finally got the chance to rewrite parts of our system in Rust during a refactor.

At a new job, I am writing my first microservice in golang. Used to be a Rust/C++ (kernel) and Python/PHP/JS dev (fullstack). Rust is allowed by team is heavily invested in go already.. I don't think I'll be able to convince them to learn rust! Lol
by eltondegeneres | 2026-03-09 14:25:30+00:00
The article says "Something important that should be clarified before we move on is that machine translation (specifically a combination of DeepL and ChatGPT 4o/4.5) was used during the initial hacking phase for testing purposes. Once it was time to translate the game proper, multiple human translators then took over."

Fan translations have used Babel Fish or similar during the development process for decades. If the final script isn't AI translated I don't see any issue with that.
by ValentineC | 2026-03-09 14:25:38+00:00
> Tim Cook and the other c-suite Apple execs have bad taste.

> If they had better taste, they never would have approved text layout that automatically applies inconsistent kerning to squish long menu items into narrow spaces. It's a tasteless idea that sounds great when put into words.

I have a feeling what happened was that the C-Suite only watched a Keynote or live product demo that, like everything Apple presents to the public, was highly curated and scripted to win approval.
by tfeld001 | 2026-03-09 14:25:39+00:00
I built a GitHub Action that generates PASTA (Process for Attack Simulation and Threat Analysis) threat models automatically by analyzing your repository's code, infrastructure, and dependencies.

The problem: Every security framework says you should threat model. Almost nobody does it consistently. A proper PASTA assessment takes days per application. Most teams produce one for an audit, shove it in Confluence, and never touch it again.

How it works:

Two-phase approach:

Static discovery (no AI): Walks the repo tree and collects tech stack (package.json, requirements.txt, go.mod), infrastructure configs (Terraform, Docker, K8s), API endpoints, auth mechanisms, and data flow patterns. Files are prioritized by security relevance — routes and auth middleware get read before utility files.

AI reasoning (Claude API): The collected context plus a STRIDE attack pattern database (~40 patterns across API, auth, database, and storage categories) gets sent to Claude in 3 focused calls. Covers business objectives, attack surfaces, kill chain scenarios, and risk scoring following the full 7-stage PASTA framework.

Output: Markdown with Mermaid data flow diagrams, JSON for CI/CD integration, HTML for stakeholders, optional PDF.

Remediation: Optionally creates GitHub Issues for findings and AI-generated fix PRs for critical/high vulnerabilities. Deduplication built in so you don't get duplicate issues on repeat runs.

Setup is 6 lines of YAML:

- name: Generate Threat Model
uses: cybrking/thr8@v1
with:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
github-token: ${{ secrets.GITHUB_TOKEN }}
create-issues: 'true'
auto-fix: 'true'
Costs about $0.05-0.15 per run (3 Claude API calls). Supports JS/TS, Python, Go, Java, Ruby with popular frameworks. Open source, MIT license.

What I'd like feedback on:

How realistic are the kill chain scenarios compared to manual assessments?
Is the STRIDE pattern database missing common patterns?
How would you use this in your pipeline — every PR, weekly, or just on pushes to main?
by umanwizard | 2026-03-09 14:25:49+00:00
> Comparing to something like zig which just cannot panic unless the developer wrote the thing that does the panic

The zig compiler can’t possibly guarantee this without knowing which parts of the code were written by you and which by other people (which is impossible).

So really it’s not “the developer” wrote the thing that does the panic, it’s “some developer” wrote it. And how is that different from rust?
by thegtmauditguy | 2026-03-09 14:25:52+00:00
B2B websites convert roughly 2% of visitors through forms. The other 98% leave without providing any identification, representing significant unrealized pipeline value.

De-anonymization technology (reverse IP lookup, cookie matching, data network partnerships) can resolve 40-65% of anonymous B2B traffic to company and contact-level records. Combined with real-time enrichment and routing automation, this creates a pipeline that converts anonymous visits into sales outreach within minutes.

The technical challenge is latency. The value of identification decays rapidly with time. Research shows 100x higher qualification rates at sub-5-minute response vs 30 minutes. Most B2B companies respond to form-fill leads in 42 hours. De-anonymized leads, by definition, get no response at all without this infrastructure.

The stack: identification layer (Warmly.ai or similar), enrichment waterfall (multi-provider data validation), CRM routing (real-time assignment and alerting), outbound activation (automated personalized multi-channel).

For a site with 5K monthly visitors and $40K average deal size, the 98% represents $2M+ in annual pipeline value. The identification stack costs $15-25K/year.

artemisgtm.ai/blog/website-visitor-deanonymization-revenue-leak
by stinkbeetle | 2026-03-09 14:25:56+00:00
US contract law has the concept of unconscionability already. You're not listening to me, my question is why should those things be allowed but nothing else? "Because a severe power imbalance allows for abuse, and governments should prohibit such abuse." does not address my question because it does not explain why the would-be permitted things are not subject to severe power imbalance or abuse of a type that governments should prohibit.
by deanc | 2026-03-09 14:26:24+00:00
There's a lot of misinformation and misunderstanding of the global energy supply presented around me nowadays. I would urge anyone to stop what they're doing and read "Clearing the Air" [1]. It's completely reshaped my understanding of this problem, and I am far more optimistic after reading it.

It addresses key questions such as "What about China?" and "Can we stop it?"

[1] https://www.goodreads.com/book/show/222768021-clearing-the-a...
by kibwen | 2026-03-09 14:26:25+00:00
> You can do basically the same thing with stackfull coroutines.

It's clear that you don't understand the use cases that async in Rust was designed to accommodate.

> Also the ecosystem is setup so you have to use tokio and everything has to be an Arc.

It's clear that you're not at all familiar with the Rust async ecosystem, including Embassy.
by rlpb | 2026-03-09 14:26:31+00:00
There is well established case law on the contract that forms when you buy something from a store (say with cash). There is a contract, on implied terms . I think what we’re talking about here is entering into a contract (or not) on explicit terms dictated by one party where the other party has not explicitly considered them and barely given the opportunity to do so if at all. I don’t think anybody is denying the ability of contracts coming into existence on implied terms.
Show HN: OpenClaw CRM, an open source CRM your AI agent can manage
by x402ventures | 2026-03-09 14:26:39+00:00
We built a CRM that your Openclaw agent can control through the API. This started as a practical problem: while building and using agents, we kept needing to organize leads, track conversations, and manage deals, but existing CRMs are not designed for programmatic control. So we built one around that assumption.

The agent connects via a skill file generated from the CRM's OpenAPI spec. Go to Settings, generate the file, drop it into your agent config, and the agent can create contacts, update deals, log notes, search records, and manage tasks.

The data model is a typed EAV: a `record_values` table with type-specific columns (text\_value, number\_value, date\_value, timestamp\_value, boolean\_value, json\_value, referenced\_record\_id). 17 attribute types, each stored natively.

When an agent queries "deals over $50k closing this month," it hits actual numeric and date columns. No string coercion.

Underneath is a real CRM: People, Companies, Deals (Kanban pipeline), Tasks, Notes, custom objects, compound filters, CSV import/export. There is also a built-in AI chat assistant (OpenRouter for model selection) for when you are inside the CRM yourself.

This is an experiment, not a finished product. There are rough edges and missing features (email sync, workflow automations, calendar integration are not built yet). But the core CRM loop and the agent integration both work today.

Tech stack: Next.js 15 (App Router), PostgreSQL 16, TypeScript, Drizzle ORM, Better Auth, Tailwind CSS v4. Deploys via Docker Compose on a single VPS.

Try the hosted version at https://openclaw-crm.402box.io (no setup) or self-host it.

GitHub: https://github.com/giorgosn/openclaw-crm
Docs: https://openclaw-crm.402box.io/docs
by Sat_P | 2026-03-09 14:26:42+00:00
I love this because when I've been down in various periods of my life, after sharing a problem with someone close, one thing they said made all the difference. This has happened to me many times after getting kind words from family and friends. I agree that this will be ruined if it gains traction, but it should be great if it remains not too well known (ironically).
by embedding-shape | 2026-03-09 14:26:42+00:00
Ultimately, basically. I have two servers in my homelab, one that is more beefy, which hosts a bunch of stuff (basically everything parent outlined + ), including a DHT crawler, download clients, indexers, databases and a lot more. It's sitting and using 16GB (out of available 126GB) right now. Then I have another which only runs the security system + Frigate + Home Assistant, it's using 2.3GB out of 32GB available.
by projektfu | 2026-03-09 14:26:43+00:00
It will virtually end when it is no longer economically advantageous. In my mother's hometown in Mayo, most home heat was solid fuel, and it's gradually turning to electric heat pumps. The other alternative, heating oil, is very expensive and not renewable, but also used a lot. I think the turf is starting to run out because the use of it has gone way down. Either that or fewer homes have a legacy parcel of bog.
by alastairr | 2026-03-09 14:26:54+00:00
You are right that Taiwan doesn't. But it has consequences, Taipower is forced to undercharge against market prices, but is backstopped by the government.

At the end of the day, it's a global market, and if you want it 'cheap' someone has to pick up the tab. Either it's taxpayers now, taxpayers in the future or consumers now.

https://www.taipeitimes.com/News/front/archives/2025/03/23/2...
by abound | 2026-03-09 14:27:10+00:00
My /24 came from ARIN's NRPM 4.10 block [1]. Basically, you can get a /24 if you'll use it to help IPv6 adoption, which is what I'm doing: my web hosting service will offer shared IPv4 and dedicated IPv6 (like Fly.io does), and same for the ISP - CGNAT for the IPv4, dedicated IPv6 subnets.

[1] https://www.arin.net/participate/policy/nrpm/#4-10-dedicated...
by sathish316 | 2026-03-09 14:27:18+00:00
If you intercept what an agent (client) sends to the LLM with multiple MCP servers and tools, the context or header is filled with available MCP servers and all tools as part of the conversation.

With a CLI, you avoid sending this context to the LLM and it progressively discovers only what is needed.

The input token costs come down because of using a CLI instead of MCP
by ACCount37 | 2026-03-09 14:27:23+00:00
You can train them in a very similar way.

Modern LLMs often start at "imitation learning" pre-training on web-scale data and continue with RLVR for specific verifiable tasks like coding. You can pre-train a chess engine transformer on human or engine chess parties, "imitation learning" mode, and then add RL against other engines or as self-play - to anneal the deficiencies and improve performance.

This was used for a few different game engines in practice. Probably not worth it for chess unless you explicitly want humanlike moves, but games with wider state and things like incomplete information benefit from the early "imitation learning" regime getting them into the envelope fast.
by guerython | 2026-03-09 14:27:29+00:00
the markdown-as-database framing is the right one. we ran into the same Jira friction for our agent fleet and ended up with a simple REST task board instead.

the key insight: agents need a shared state store they can both read and mutate without human-mediated handoffs. markdown files work fine for single-agent. once you have multiple agents racing on tasks you want atomic PATCH semantics, not file locks.
by palmotea | 2026-03-09 14:27:37+00:00
> If only someone could invent some kind of educational institution to teach people new skills!

> People could learn things and join the workforce!

> /s

The point is to always, always blame the individuals being harmed for the structural problems they face.

Lost your job? Well fuck you if you can't afford to pay a lot of money to go back to school for years and support your family out of savings in the mean time. It's your own damn fault for not being rich enough.
by tsimionescu | 2026-03-09 14:27:40+00:00
This is somewhat fair, but only as long as you agree that you then have no right to use these services.

I think there is a big difference between the EULA that comes attached to a product you've already paid for, that represents additional terms to what you had already agreed to when paying, and the T&C of a free service or a subscription, presented before payment.

You can't seriously claim that you have a right to use, say, YouTube without any restriction whatsoever. It is a private service, and you can either use it under the terms and conditions that its private owner establishes, or you can avoid using it at all.
by popupeyecare | 2026-03-09 14:27:45+00:00
Sure!

Unfortunately if a spammer called the StatPhone number, it would dial everyone. I thought about blocking or automatically categorizing but then you may miss an important call from an unknown number.

Most spammers are actually operating off of known lists, usually made off of some data leak.

I haven’t encountered that issue yet. I don’t have a great solution for that case.
by ACCount37 | 2026-03-09 14:27:47+00:00
I would expect that off the shelf GPT-5.4 would be able to do it when prompted carefully, yes. Through reasoning - by playing every move step by step and updating the board one move at a time to arrive at a final board state.

On the other hand, recovering the full board state in a single forward pass? That takes some special training.

Same goes for meatbag chess. A correspondence chess aficionado might be able to take a glance at a list of moves and see the entire game unfold in his mind's eye. A casual player who only knows how to play chess at 600 ELO on a board that's in front of him would have to retrace every move carefully, and might make errors while at it.
by elevation | 2026-03-09 14:28:02+00:00
> I'd need to make a few dozen different fonts & have it randomly pick between them

I took this approach once and enjoyed the result. I filled out 10 copies of the template of a handwriting font generator and generated all 10 fonts. Then I wrote a python script to process a libreoffice document. If it saw the 'handwriting1' style anywhere in the document it would pseudorandomly alternate between fonts. Since uncanny resemblance of two adjacent letter is the biggest giveaway that a handwriting font is at play, I made sure my script would change the font within a word if there were two adjacent 'T' or 'S' characters.

I've since lost the code (it wasn't something I needed to often use) but with LLMs these days I'm sure I'd be inclined to build something better -- for instance, performing the randomization within a single font file, and using custom glyphs for adjacent 't' characters that might have a common crossbar, improved support for other languages I use, or rendering a particular case of my legal name as a signature.
by harpiaharpyja | 2026-03-09 14:28:07+00:00
Look, included in the concepts the article discusses are features that people have been wanting for a very long time.

Like, the ability to have multiple mut references to a struct as long as you access disjoint fields? That's amazing!!!
A redo of Pin that actually composes with the rest of the language? That's pretty awesome too.

I think you're getting tied up because the the author is describing these features in a very formal way. But someone has to think about these things, especially if they are going to implement them.

Ultimately, these are features that will make Rust's safety features (which really, are Rust's reason for existing) more ergonomic and easier to use. That's the opposite of what you fear.
by room271 | 2026-03-09 14:28:13+00:00
Rust needs to be careful that it doesn't invite the type-programming crowd in too much. Even if individual features are helpful, the cultural effect on the programming language in terms of the community (i.e. libraries and idioms) can really fragment and destroy a language. Scala, which I programmed in for many years, is a good example -- lots of great features but ultimately overwhelmed by typesafe abstractions that held theoretical appeal but hampered readability and fragmented the community. (Lack of backwards compatibility and poor tooling also hurt Scala no doubt about it, just as slow compile times hurt Rust.)
by landl0rd | 2026-03-09 14:28:19+00:00
No, it isn't. Power in a grid is fungible so grids operate based off consumption-based accounting. Britain continues to import at times from countries still burning coal. As such, Ireland is not free of coal dependence. It's really that simple. It is accurate for Ireland to say she no longer directly burns coal, no longer operates coal power, but the common understanding of "coal-free" is, "we are no longer directly dependent on coal for our lights to turn on." That simply isn't the case.

The way to think about this is, "If the grid had zero reserves and coal cut off, who could POSSIBLY go down?" You may figure this is constructed, but in a few days' dunkelflaute, Ireland needs her interconnects. Wind is then possibly low across much of Europe, meaning Holland and Germany ramp dispatchable capacity, including German lignite.