Hacker News: radku

New comment by radku in "AWS: Inaccurate Estimated Billing Data – $1.7 billion"

radku — Fri, 17 Jul 2026 17:43:59 +0000

I almost got a heart attack seeing a bill for 48B USD!

New comment by radku in "Ask HN: What Are You Working On? (July 2026)"

radku — Mon, 13 Jul 2026 09:24:24 +0000

I've built a voice app for controlling Claude code / Codex sessions and having a lot of fun with it.

I can start a remote tmux session from my laptop, close the lid, grab my airpods and continue on the same sessions while in a gym or a bicycle.

Planning to open source it soon.

New comment by radku in "GLM-5.2 – How to Run Locally"

radku — Tue, 23 Jun 2026 09:30:18 +0000

I have pretty much almost this exact setup with 2x3090s and with slightly faster DDR4 512GB and 64 core Epyc! [0] I've been enjoying it a lot. Can't wait to give this model a try.

Apart of running local models I use this rig as my main remote development platform. All Claude Code sessions are running there in tmux now. And my fingers can't be happier not having to deal with constantly hot laptop. Not to mention that Claude Code is such a battery hog.

[0] https://medium.com/@rathko/i-built-an-epyc-64-core-512gb-ram...

New comment by radku in "Launch HN: TesterArmy (YC P26) – Agents that test web and mobile apps"

radku — Fri, 19 Jun 2026 13:19:25 +0000

Congrats on the launch!

Will this solution work with services protected by cloudflare turnstile or captchas? Does this involve human in a loop?

New comment by radku in "Show HN: Are You in the Weights?"

radku — Thu, 18 Jun 2026 22:52:17 +0000

No privacy policy whatsoever?

New comment by radku in "Ask HN: What are you working on? (June 2026)"

radku — Sun, 14 Jun 2026 19:53:18 +0000

I'm working on OSS security tool that can protect you form credential stealers (think Shai-hulud and similar) or prompt-injected agent leaking your secrets.

agent-vault-proxy is a local proxy that injects real secrets into requests in-flight, so a compromised or prompt-injected agent has nothing to steal, feedback welcome: https://github.com/inflightsec/agent-vault-proxy

Show HN: AVP – an agent can't leak a secret it never had

radku — Thu, 11 Jun 2026 19:10:08 +0000

A process can't leak a secret it never had.

Shai-hulud, prompt-injection - you name it. They cannot steal what your agent (or an process) don't have.

I run coding agents (Claude Code, Codex) on my own machines most of the day. Every one of them wants real API keys in env and I was scratching my head for the last few months how to contain it.

The usual answer to this is a firewall. I don't buy it. A firewall tries to contain a secret the process is still holding, and the rules are painful to maintain.

AVP gives the agent a placeholder and injects the real value at the last moment, on the wire: ``` # the agent's env holds only a placeholder STRIPE_API_KEY=avp-placeholder # agent sends: Authorization: Bearer avp-placeholder # AVP forwards upstream: Authorization: Bearer sk_live_...real... ```

Keep your passwords in your vault where they belong. AVP initially relies on Bitwarden as a secret manager. It's MIT licensed.

Appreciate any feedback.

Comments URL: https://news.ycombinator.com/item?id=48495018

Points: 3

# Comments: 1

New comment by radku in "Show HN: Claw Patrol, a security firewall for agents"

radku — Thu, 11 Jun 2026 18:15:59 +0000

Nice work shipping this.

Disclosure: author of a related tool here. I have create agent-vault-proxy for a very similar reason. It also can help keep credentials out of the agent process. The agent gets a placeholder, the proxy swaps in the real secret in transit.

I read them as complementary: action firewall in front, credential broker behind. https://github.com/inflightsec/agent-vault-proxy

New comment by radku in "Grafana Labs internal source code accessed"

radku — Sun, 17 May 2026 19:23:27 +0000

AI is actually pretty good at finding vulnerabilities in the codebase.

Critical vulnerability in that source code could enable further access to other production systems or databases.

Edit: typo

New comment by radku in "Node.js Security Bug Bounty Program Paused"

radku — Fri, 03 Apr 2026 14:26:22 +0000

This could significantly impact security of large parts of web ecosystem.

Perhaps Node.js can switch to a VDP, no-bounty program. From Hacker One: "VDP is designed solely for receiving, validating, and addressing security reports without a paid bounty element"

New comment by radku in "Subscription bombing and how to mitigate it"

radku — Thu, 02 Apr 2026 07:31:42 +0000

Agreed. Personally I think about it as massaging a text with LLM is like applying filters to your pictures.

The text probably have been based entirely on the internal notes and investigations and is very informative. Would it be better if the OP wrote it entirely by themselves? Not necessarily.

New comment by radku in "Hammerspoon"

radku — Sat, 14 Mar 2026 14:14:35 +0000

Hammerspoon helped me have a F12 shortcut for Ghostty (the only feature I missed from guake on mac)! I love it

New comment by radku in "Bootkitty: Analyzing the first UEFI bootkit for Linux"

radku — Fri, 29 Nov 2024 10:06:43 +0000

I keep my fingers crossed for Arch and Valve cooperation: https://lists.archlinux.org/archives/list/arch-dev-public@li...

LLMs Orchestrating Structured Reasoning Achieve Kaggle Grandmaster Level

radku — Fri, 15 Nov 2024 15:50:01 +0000

Article URL: https://arxiv.org/abs/2411.03562

Comments URL: https://news.ycombinator.com/item?id=42147944

Points: 2

# Comments: 0

New comment by radku in "Law Enforcement Undermines Tor"

radku — Fri, 25 Oct 2024 13:03:46 +0000

Would using VPN prevent prying eyes from detecting the IP address? This issue seems to be related only to Tor users who do not use VPN?

New comment by radku in "Science Fiction Books About Aliens"

radku — Sun, 14 May 2023 08:43:54 +0000

Legendary Iain M. Banks is a true classic now.

For some hard sci-fi I do highly recommend Neal Asher, which reminds me of Banks universe.

And a classic "We are Bob" by Dennis Taylor, which is a very easy way to introduce anyone to sci-fi.

New comment by radku in "‘They killed everyone.’ Fury in Ukraine at Russian troops’ barbarity"

radku — Sun, 10 Apr 2022 15:21:44 +0000

It's a troll who ignores the mass graves, the rapes, the killing of civilians. How sick do you have to be to look for "winks" here.

New comment by radku in "‘They killed everyone.’ Fury in Ukraine at Russian troops’ barbarity"

radku — Sun, 10 Apr 2022 15:04:08 +0000

You are right. Clearly Russians are enemies here.