Hacker News: eranation

New comment by eranation in "When I reject AI code even if it works"

eranation — Sun, 21 Jun 2026 03:08:15 +0000

LLMs diverge, not converge. They slightly increase entropy if not controlled. While you can have DRY skills and use AI to organize AI (in loops(tm) like Boris does) but eventually if you don’t understand the code, you are taking yourself out of the loop. And not just the job security that’s on the line, it’s the increasing cost for AI to babysit AI. If you or your “loops” (or paperclip, Hermes, gastown, or next in class agents of agents that runs your entire company) let it gradually sneak in slop-debt, the cost to fix it later will become prohibitive. (You can always just rewrite it, but as the race for “feature complete” and “zero backlog” continues, rewriting an ever growing set of new daily table stakes will become an economical moat)

TLDR: Keeping your codebase human readable and reason-about-able is not just helping humans to stay relevant. It will save costs for LLMs to maintain it.

New comment by eranation in "Leaked financial docs show OpenAI is losing billions of dollars a year"

eranation — Wed, 17 Jun 2026 23:43:42 +0000

Copying my other reply.

> Interesting. I'm mostly using Claude, so perhaps I'm not nearing the limits, but I do use Codex (for coding and reviews occasionally) and use chatgpt for second opinion many times, including "pro" research. Never got to my limits. But again, not my main go to tool.

New comment by eranation in "Leaked financial docs show OpenAI is losing billions of dollars a year"

eranation — Wed, 17 Jun 2026 23:43:07 +0000

Interesting. I'm mostly using Claude, so perhaps I'm not nearing the limits, but I do use Codex (for coding and reviews occasionally) and use chatgpt for second opinion many times, including "pro" research. Never got to my limits. But again, not my main go to tool.

New comment by eranation in "OpenAI Losses Increased Nearly 8X in 2025, with Spending Hitting $34B"

eranation — Wed, 17 Jun 2026 23:16:05 +0000

Is this surprising to anyone? I thought that was a given. I'm getting de-facto unlimited use of a model more expensive than Opus 4.8 for $20 a month.

New comment by eranation in "Stop Using JWTs"

eranation — Wed, 17 Jun 2026 00:12:06 +0000

Been in this rabbit hole since JWT shipped. As others have mentioned, cookies have their own risks, you're now juggling both XSS and CSRF, and the CSRF defenses (SameSite, tokens) do nothing against XSS since that's a same-origin attacker.

Just to clarify, httpOnly/sameSite isn't useless under XSS the way localStorage is. XSS can't read a httpOnly cookie, so it can't exfiltrate the credential, it can only perform the attack during the session from the victim's browser. A JWT in localStorage can be reused offline for its entire lifetime. Also worth separating: localStorage is the exposure, not JWT. Just please for the love of all that's good and pretty, don't store a JWT in a httpOnly cookie.

New comment by eranation in "Show HN: VoiceDraw – Talk system design out loud, the diagrams draw themselves"

eranation — Tue, 16 Jun 2026 22:23:20 +0000

Great idea! Just quick feedback. Asked it to “Draw a pelican riding a bicycle.”

On mobile the response (not a technical diagram) wasn’t visible, initially thought it just didn’t work).

Asked it then to draw a diagram for an X replacement, it nailed it.

New comment by eranation in "SpaceX to buy Cursor for $60B"

eranation — Tue, 16 Jun 2026 14:48:49 +0000

Still do. Composer 2.5 is a beast. But even with Opus (and Fable for a few days) their harness is many times faster. The main reason for me to use CC is the $200 subsidized pro max plan.

Also their computer use in the cloud agents (when it works) is a game changer. No need to keep your laptop open / get a Mac mini if it runs in the cloud.

New comment by eranation in "Show HN: DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs"

eranation — Tue, 16 Jun 2026 02:16:04 +0000

Should be fixed now, thanks again!

New comment by eranation in "The Birth and Death of JavaScript (2014)"

eranation — Sun, 14 Jun 2026 23:42:43 +0000

Good catch. I'm sure there could be more technical inaccuracies in the talk, but again, this is for entertainment purposes I assume, not education.

New comment by eranation in "The Birth and Death of JavaScript (2014)"

eranation — Sun, 14 Jun 2026 14:58:33 +0000

Surprised no one mentioned this is the guy who brought us this masterpiece. If you haven’t seen it, drop everything and watch it, best 5 minutes of your day guaranteed.

https://www.destroyallsoftware.com/talks/wat

New comment by eranation in "Amazon CEO's talks with U.S. officials triggered crackdown on Anthropic models"

eranation — Sat, 13 Jun 2026 19:54:01 +0000

Interesting point. Just a small correction, the Anthropic stake is higher. ($13B + another $20B option if they hit certain milestones, which I believe is almost guaranteed)

So it's closer to $33B

In any case, there is no reason for them to purposefully hurt Anthropic.

I would say that this government "takedown" of Mythos is great free advertising. I mean, if you look at this, they said it's too risky to launch, we all said it's pure marketing, and now when it's actually "banned" for being too risky, we laugh at the "Karma", where in fact, the majority of people who are not in our circles, see it as "wow, they were not kidding".

The overall result is net gain in brand awareness to Anthropic, before an IPO, I think if we had 2 parallel universes with or without this ban, the one with is a much higher IPO outcome for Anthropic than the other.

And again, I think this all needs to be taken with Occam's razor and bit of Hanlon's razor (without going into politics, the technical savviness of this administration is not the thing it's most famous for)

New comment by eranation in "Amazon CEO's talks with U.S. officials triggered crackdown on Anthropic models"

eranation — Sat, 13 Jun 2026 18:56:35 +0000

Just a small correction, Bezos is not Amazon CEO anymore. They meant Andy Jassy.

New comment by eranation in "Amazon CEO's talks with U.S. officials triggered crackdown on Anthropic models"

eranation — Sat, 13 Jun 2026 18:52:16 +0000

Just to put things in the right perspective to those who are not aware, Amazon heavily invests in Anthropic [0] and AWS is a partner on project Glasswing (Select companies that used Mythos to find critical vulnerabilities in major open source and critical infrastructure) [1]

So I don't think there is anything sinister here, I would use Hanlon's razor [2] here...

[0] https://www.anthropic.com/news/anthropic-amazon-compute

[1] https://aws.amazon.com/blogs/security/building-ai-defenses-a...

[2] https://en.wikipedia.org/wiki/Hanlon%27s_razor

New comment by eranation in "Amazon CEO's talks with U.S. officials triggered crackdown on Anthropic models"

eranation — Sat, 13 Jun 2026 18:43:42 +0000

Amazon invests in Anthropic, and has partnership with them on AWS Bedrock.

https://www.anthropic.com/news/anthropic-amazon-compute

New comment by eranation in "Show HN: Paca – Lightweight Jira alternative for human-AI collaboration"

eranation — Sat, 13 Jun 2026 18:10:52 +0000

Thanks for having a security policy

https://github.com/Paca-AI/paca/security

However I'm getting a 404

https://github.com/Paca-AI/paca/security/advisories/new

(You need to enable private security advisories: https://docs.github.com/en/code-security/how-tos/report-and-..., really not sure why GitHub made it opt-in only)

New comment by eranation in "US Government directive to suspend access to Fable 5 and Mythos 5"

eranation — Sat, 13 Jun 2026 01:16:15 +0000

Still works for me but I don't know if it's gaslighting me or not... fool me once situation here...

New comment by eranation in "I Am Not a Reverse Centaur"

eranation — Sat, 13 Jun 2026 00:51:24 +0000

Asking contributors to first make sure there is an approved requirement before creating a PR sounds like a great idea regardless of the use of LLM.

But another issue is - AI disclosure (agent, model etc). I'm sure others tried similar approaches, but in case this is not common knowledge - I tried to see what happens if you ask agents to disclose themselves in the PR description / comments in a rule file.

It seems to work pretty well as most AI "assisted" PRs will be opened by agents using the gh cli or MCP on behalf of the user. (Of course this can be bypassed, but for someone who doesn't mind disclosing or doesn't care, this is a good step forward)

Example: https://github.com/arnica/depsguard/blob/main/AGENTS.md#ai-d...

(so far worked on PRs from both Claude Code and Codex - both got a footer disclosure of the agent name and model)

New comment by eranation in "Claude Fable is relentlessly proactive"

eranation — Fri, 12 Jun 2026 23:21:25 +0000

wow, this is a life goal.

New comment by eranation in "Claude Fable is relentlessly proactive"

eranation — Fri, 12 Jun 2026 05:36:43 +0000

Ha, thanks for the reply!

New comment by eranation in "Claude Fable is relentlessly proactive"

eranation — Fri, 12 Jun 2026 04:23:18 +0000

Am I the only one who slightly miss the pelican on a bike? It was a nice novelty... of course I could make one myself, but I became conditioned to expect one for every new model. Other than his great writing on AI, it became part of the package. Some small fun quirk to distract us from the non stop ping pong between the extremes of "omh are you still writing prompts you should use loops / 200k github stars, for a markdown file / someone just open sourced _ and it changes everything!" vs "haha the AI told me to walk to the car wash / it can't recognize and upside down cup"