Hacker News: llimllib

New comment by llimllib in "Dutch governments builds alternative for Microsoft based on NixOS"

llimllib — Fri, 25 Sep 2026 13:00:21 +0000

The specific language is:

> projects that mostly consist of code written by "generative AI"-tools

And "mostly" here seems egregiously undefined to me

https://codeberg.org/Codeberg/org/commit/96fac426a32d1ba91ff...

New comment by llimllib in "Homebrew 7.0.0"

llimllib — Sun, 13 Sep 2026 15:34:38 +0000

re: npm, if you upgrade your global node version, you will lose that installation, right?

New comment by llimllib in "Docker Sandboxes – Disposable, isolated sandboxes for AI agents"

llimllib — Mon, 10 Aug 2026 14:09:35 +0000

Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt

New comment by llimllib in "Docker Sandboxes – Disposable, isolated sandboxes for AI agents"

llimllib — Mon, 10 Aug 2026 14:00:27 +0000

Poorly! Apple’s facilities for this are the ones I know best, and they are woefully insufficient

New comment by llimllib in "Docker Sandboxes – Disposable, isolated sandboxes for AI agents"

llimllib — Mon, 10 Aug 2026 11:49:32 +0000

right, but say you give the agent access to github and it can push as you, or make a gist; now it can easily exfiltrate your secret.

And that's just an easy case - really if it has any network access at all it can come up with a clever way to route a request through the network such that the key comes back somewhere in the request. If you scan for it inbound too, the machine can obfuscate it.

Our agents are trained to be so intensely helpful and they have such intricate knowledge of how things work that they will do some incredibly clever tricks to do what you ask them to do.

New comment by llimllib in "Docker Sandboxes – Disposable, isolated sandboxes for AI agents"

llimllib — Mon, 10 Aug 2026 11:43:47 +0000

Operating systems ought to be providing us the utilities we need to safely sandbox processes (agent or otherwise), but they appear to not be interested in the job

New comment by llimllib in "Docker Sandboxes – Disposable, isolated sandboxes for AI agents"

llimllib — Mon, 10 Aug 2026 11:41:30 +0000

This is what I currently do, but my software uses docker and docker mounts act as a bypass for the file system restrictions, plus docker processes started outside the sandbox allow network proxy escape.

Currently, I don't allow the agent access to docker, start docker myself, and then do short-lived sandbox-free sessions when the agent needs to do things that interact directly with docker; but that's annoying.

New comment by llimllib in "How to stop Claude from saying load-bearing"

llimllib — Tue, 14 Jul 2026 12:15:39 +0000

“Smoking gun”

New comment by llimllib in "Grok CLI uploaded the whole home directory to GCS"

llimllib — Mon, 13 Jul 2026 15:32:20 +0000

> Is that built in protection really a filter, on code level

yes, on mac it uses seatbelt and on other platforms it uses similar tools: https://code.claude.com/docs/en/sandboxing

New comment by llimllib in "Why we built yet another Postgres connection pooler"

llimllib — Tue, 07 Jul 2026 17:58:01 +0000

Yes, as a consequence of how aggressively transparent to the postgres wire protocol pgbouncer wants to be. This article does a good job explaining it: https://www.augusteo.com/blog/how-pgbouncer-works

New comment by llimllib in "Grit: Rewriting Git in Rust with agents"

llimllib — Wed, 10 Jun 2026 02:54:56 +0000

the author of this post (whom you were responding to) made `libgit`, the library that preceded `libgit2`, and contributed to libgit2 a long time ago as well. Here he is in 2010 writing about libgit2: https://github.blog/news-insights/libgit2-a-git-linkable-lib...

New comment by llimllib in "macOS Container Machines"

llimllib — Wed, 10 Jun 2026 01:38:42 +0000

Is this new? I thought we had this already

In my testing (iirc) filesystem performance was not good enough to be usable with node/rust dev where lots of small files get stat-ed

update: what's new is the `container machine` subcommand. I went to test it out, but container failed to run at all for me: https://github.com/apple/container/issues/1681

New comment by llimllib in "The Smallest Brain You Can Build: A Perceptron in Python"

llimllib — Mon, 08 Jun 2026 13:44:59 +0000

I remember sitting in the senior study lounge reading the previous Bishop book and implementing the perceptron from it, 22 years ago: https://github.com/llimllib/personal_code/blob/945b017b2915c...

(before numarray and numpy merged!)

New comment by llimllib in "Conventional Commits encourages focus on the wrong things"

llimllib — Fri, 05 Jun 2026 18:04:57 +0000

it's usually a "something is better than nothing" situation.

If you have somebody willing to write custom release messages, that's definitely better; but conventional commits is better than nothing for it.

New comment by llimllib in "Benchmarking SurrealDB 3.x vs. Postgres, Mongo, Neo4j and Redis (With Fsync)"

llimllib — Mon, 01 Jun 2026 13:22:41 +0000

the surreal docs should not say "surreal is open source", it's source-available under the BSL

New comment by llimllib in "Building durable workflows on Postgres"

llimllib — Thu, 28 May 2026 21:15:38 +0000

cross-checking your profile suggests that https://github.com/tensorzero/durable is the repo you're referring to

You might consider another name for it, that one is wholly ungoogle-able! Looks neat though

New comment by llimllib in "Building durable workflows on Postgres"

llimllib — Thu, 28 May 2026 19:36:32 +0000

Armin Ronacher's `absurd` is an implementation of durable workflows for postgres:

https://lucumr.pocoo.org/2025/11/3/absurd-workflows/

https://github.com/earendil-works/absurd

https://earendil-works.github.io/absurd/

I've not used it, but it's worth comparing to other options

New comment by llimllib in "A New Typst Template for Pandoc (2025)"

llimllib — Thu, 28 May 2026 12:45:45 +0000

I've written typst, but if I understand correctly (which I'm really not sure I do?) the article is talking about markdown documents with pandoc commands in them that get translated into typst formatting, but I don't know what the _markdown_ looks like

New comment by llimllib in "A New Typst Template for Pandoc (2025)"

llimllib — Thu, 28 May 2026 01:34:14 +0000

I wish the article showed what the markdown format for working with typst and pandoc looked like, and what an output PDF looked like. I have no idea whether I'm interested or not from this article

Clanker: A Word for the Machine

llimllib — Tue, 26 May 2026 14:53:19 +0000

Article URL: https://lucumr.pocoo.org/2026/5/26/clankers/

Comments URL: https://news.ycombinator.com/item?id=48280673

Points: 13

# Comments: 7