Hacker News: clemlesne

New comment by clemlesne in "Text AI watermarks will always be trivial to remove"

clemlesne — Thu, 13 Aug 2026 16:12:26 +0000

I done a C2PA implementation for raw text, if that can ease someone’s life: https://github.com/dualeai/c2patxt

New comment by clemlesne in "Python implementation of C2PA text marking (C2PA 2.4 Annex A.8)"

clemlesne — Thu, 06 Aug 2026 17:37:10 +0000

If that can help anyone to comply with the AI Act!

Python implementation of C2PA text marking (C2PA 2.4 Annex A.8)

clemlesne — Thu, 06 Aug 2026 17:37:10 +0000

Article URL: https://github.com/dualeai/c2patxt

Comments URL: https://news.ycombinator.com/item?id=49199815

Points: 1

# Comments: 1

New comment by clemlesne in "Hpke-HTTP – End-to-end encrypt HTTP API bodies, even behind Cloudflare"

clemlesne — Tue, 17 Feb 2026 13:50:49 +0000

TLS terminates at your CDN, load balancer, or WAF. After that point, request and response bodies are plaintexts. Cloudflare, AWS ALB, GCP -- they can all read your API payloads. For most production APIs, this is the reality.

hpke-http adds RFC 9180 HPKE encryption on top of TLS. It's a drop-in middleware for FastAPI (server) and aiohttp/httpx (client). Zero application code changes:

  app.add_middleware(HPKEMiddleware, private_keys={...}, psk_resolver=resolve_psk)

That's it. Your existing routes, request.json(), return values -- all unchanged. Bodies are encrypted end-to-end between client and origin server.

What it does: encrypts/decrypts request and response bodies using X25519 + HKDF-SHA256 + ChaCha20-Poly1305. PSK mode binds each request to an API key. Counter-based nonces prevent replay attacks. SSE streaming and file uploads work with O(chunk_size) memory. Optional zstd compression before encryption.

What it does NOT do: encrypt URLs, headers, query params, or status codes. Those remain visible to intermediaries. This is not a replacement for TLS -- it's a layer on top.

Cipher suite is a single opinionated choice (no algorithm negotiation), validated against official CFRG test vectors and Wycheproof. 10K lines of library, 14K lines of tests including property-based fuzzing and statistical randomness verification.

We looked for an open-source, standards-based HTTP body encryption middleware and couldn't find one, so we built it. Apache-2.0.

https://github.com/dualeai/hpke-http

Hpke-HTTP – End-to-end encrypt HTTP API bodies, even behind Cloudflare

clemlesne — Tue, 17 Feb 2026 13:50:49 +0000

Article URL: https://github.com/dualeai/hpke-http

Comments URL: https://news.ycombinator.com/item?id=47047461

Points: 1

# Comments: 1

New comment by clemlesne in "Zvec: A lightweight, fast, in-process vector database"

clemlesne — Sat, 14 Feb 2026 22:11:54 +0000

Did someone compared with uSearch (https://github.com/unum-cloud/USearch)?

New comment by clemlesne in "Run untrusted code in VMs on Mac/Linux – 1-2ms warm start, domain filtering"

clemlesne — Tue, 20 Jan 2026 12:24:18 +0000

I built exec-sandbox because I wanted VM-level isolation for AI-generated code on my Mac without running Linux in a VM first.

Most sandboxes (E2B, Hopx) use https://firecracker-microvm.github.io/, on macOS, you need nested virtualization. exec-sandbox uses QEMU with Apple's Hypervisor.framework (HVF) and runs natively on macOS, including Apple Silicon.

What makes it different:

- Native macOS + Linux, no Docker, no nested VMs, just brew install qemu

- 1-2ms warm start, pre-started VM pool beats E2B's 150ms cold start

- Port forwarding without network, expose localhost:8080 while blocking all outbound (DNS + IP)

- Domain allowlisting, allowed_domains=["api.github.com"] for granular control

- CLI for automation, sbx run *.py -j 10 --json with concurrency control

- Package validation, blocks typosquatting against PyPI/npm top 10k

- Self-hosted, no session limits, unlike E2B's 24-hour cap

7-layer security: hardware virtualization, unprivileged QEMU, seccomp, cgroups v2, namespaces, AppArmor/SELinux, socket authentication.

https://github.com/dualeai/exec-sandbox

Run untrusted code in VMs on Mac/Linux – 1-2ms warm start, domain filtering

clemlesne — Tue, 20 Jan 2026 12:24:18 +0000

Article URL: https://github.com/dualeai/exec-sandbox

Comments URL: https://news.ycombinator.com/item?id=46691071

Points: 3

# Comments: 1

New comment by clemlesne in "Jepsen: NATS 2.12.1"

clemlesne — Mon, 08 Dec 2025 19:41:26 +0000

NATS is a fantastic piece of software. But doc’s unpractical and half backed. That’s a shame to be required to retro engineer the software from GitHub to know the auth schemes.

New comment by clemlesne in "Microsoft Releases AI Call Center Stack with Voice, SMS, and Memory"

clemlesne — Tue, 28 Oct 2025 10:34:11 +0000

Project creator there. The biggest challenge in marketing this project to potential customers is not the fact that it does not work well, but the unions and human problems. It really marked me.

New comment by clemlesne in "Microsoft Releases AI Call Center Stack with Voice, SMS, and Memory"

clemlesne — Tue, 28 Oct 2025 10:27:33 +0000

Funny because I written them myself at the time. Last year they were no really useful AI like CC!

New comment by clemlesne in "Microsoft Releases AI Call Center Stack with Voice, SMS, and Memory"

clemlesne — Tue, 28 Oct 2025 10:25:51 +0000

Indeed. I’m the project creator. That’s standard legal notice we must add to these kind of “large” repos. If not a dev team should maintain it full time with security incidents response managed within a SLA, which is not the case there. The same project is working in production for a few customers.

New comment by clemlesne in "[dead]"

clemlesne — Mon, 20 Oct 2025 09:48:04 +0000

Probably related to AWS outage. Are they infra not reliable enough? Do you think this kind of critical communication service should be deployed cross-provider?

New comment by clemlesne in "AI Conversation Context Extractor – Resume ChatGPT/Claude Chats Seamlessly"

clemlesne — Tue, 12 Aug 2025 15:00:37 +0000

I built this after getting frustrated switching between AI platforms and losing conversation context. It analyzes your ChatGPT/Claude exports and creates markdown files with comprehensive context that you can paste into any AI to continue exactly where you left off.

Key features: - Extracts your actual implementation status vs what was just discussed - Tracks decision journeys and what you've already ruled out - Groups ChatGPT Project conversations into organized folders - Smart caching saves API calls on re-runs (100% cache hit rate after first run) - Works with any AI - paste the context into ChatGPT, Claude, Gemini, etc.

The context extraction goes way beyond simple summaries. It identifies critical unknowns, user expertise level, what's blocking you, and provides specific continuation advice for the next AI.

Perfect for when you want to switch from ChatGPT to Claude mid-project, or resume an old conversation months later with full context intact.

Built with Python + Claude API, requires your conversation exports from ChatGPT/Claude settings.