Hacker News Reader

EGregon Tokenmaxxing is dead, long live tokenmaxxing

I don’t think people who write these headlines understand that “long live the king” used to refer to the next king. Where is the next tokenmaxxing?

EGregon The KIDS Act would require age checks to get online

Oh for goodness’ sake, can’t the government (federal or states) create a service that will simply give out a token when someone has passed the age they want (eg 18), and provably goes through a multipart mixer, or just give you a zero-knowledge proof on the device of your choice, anytime you need?

On a related note, if they will require a specific kind of ID to vote, can’t they just make sure everyone can receive that ID?

Of course they can. They don’t want to. And they pretend like they don’t know how to. What this government is lacking, is a distribution system.

To be fair, they will need digital IDs or NFC chips in IDs since deepfakes can now fake the physical IDs next to your face in real time.

EGregon RubyLLM: A Ruby framework for all major AI providers

In case you're using PHP or Node.js, we've made a similar toolkit free and open source on github: https://github.com/Qbix/AI/tree/main/classes/AI

EGregon Q.js: modern front-end framework for 2026. No build scripts unlike React et al.

It's kind of like if jQuery continued developing until 2026, and competed with Vue, Angular, React, etc.

This is my first release, distilled from our battle-tested open source Qbix Platform, to just be a minimal, unified set of front-end functionality people would need.

You can include it on any website:

  <script type="module" src="https://unpkg.com/@qbix/q.js@1.0.2/dist/Q.minimal.min.js">

Or if you're brave (or on a webpage you don't care about) you can paste this into the console:

  var s = document.createElement('script');
  s.src = 'https://unpkg.com/@qbix/q.js@1.0.1/dist/Q.min.js';
  s.type = 'module'
  document.head.appendChild(s);

Documentation is here:

  https://github.com/Qbix/Q.js

If you want, copypaste the docs into an LLM-powered chatbot and ask it any questions ;-)

What else would you want to see? A playground for developers, with code snippets etc.?

EGregon WhatsApp's "End-to-End Encryption" Is the Biggest Lie in Tech History

I mean attestation of what’s running on the server. Did you click and read?

As for the client — the app store on iOS doesn’t allow reproducible builds.

Telegram tried something close for years, which is how I know they care: https://core.telegram.org/reproducible-builds

But it doesn’t matter because the metadata is equally important and useful to get you. And anyway, end-to-end encryption can be banned, or compromised by a new app update, or secretly removed via a backdoor for some, if you pressure one guy (eg @durov in France, or his team every time they pass through an airport). Read this article — it was my response to Moxie Marlinspike (of Signal fame) years ago when he was skeptical of decentralization:

https://community.intercoin.app/t/web3-moxie-signal-telegram...

EGregon WhatsApp's "End-to-End Encryption" Is the Biggest Lie in Tech History

I’ve been saying this for years — when people derided me on HN — that we need decentralization and open-source backends, because we are relying on pinky-promises. We need attestation that we can trust.

I have been building it, piece by piece. Some pieces have been recently featured (last week) in trusted security publications:

Safecloud: https://www.helpnetsecurity.com/2026/06/19/safecloud-browser...

Safebox and Safebots are coming too: https://safebots.ai/about

You won’t need to take anyone’s word for it. And in fact, end-to-end encryption will become unnecessary.

EGregon Ask for no, don't ask for yes (2022)

Does this also work when asking someone out? Or raising capital?

Answer: no, because you need the other person to actually do something.

These kinds of things work when you’re already in a relationship.

EGregon Who owns your ATProto identity?

I am familiar with it. But even then it applies only “if a person is under an imminent threat of serious physical harm or danger by a guest (or an intruder) in their home, they do not have to attempt to safely escape the situation prior to using physical force; the homeowner may immediately use force to eliminate the threat in their home.”

For example shooting a 5 year old kid who trespassed on your property isnt covered

EGregon Who owns your ATProto identity?

Right, but neither do these problems apply to domains, as much as they apply to ATProto accounts.

You don't even have the frameworks that are available to protect domains. (Domain lock, transfer, etc.) And registrars are regulated by laws and frameworks in ways ATProto hosts aren't. Don't get me wrong, if a registrar transfers your domain due to a social engineering attack on the registrar, then you might lose it (an attacker almost did this to me once via a SIM swap, and I had to call GoDaddy to prevent the transfers). But that's not the same as, say, hacking the web hosting server.

In any case, tptacek, Safebox is supposed to solve these actual problems, by making sure no one can actually get into the box (no ssh, etc) so it's a "neutral ground" that no one can really "own", "redirect", steal keys or impersonate you. If you read https://safebots.ai/about you'll see what I'm talking about. If you do, I'd love to read any feedback you might have, given your background in security!

EGregon Who owns your ATProto identity?

Let's compare apples to apples, shall we.

How many houses were actually seized, repossessed, commandeered with "eminent domain", slowly taken over via "adverse possession", encroached on with easements and air rights, and whatever else? Versus how many domains?

There is no violence on the internet. You can't shoot intruders. And that's a great thing.

Put in legal terms, you do NOT have this level of ownership to your house... and you certainly do not have sovereign immunity on your land: https://en.wikipedia.org/wiki/Allodial_title

Usually the best you can get is this: https://en.wikipedia.org/wiki/Fee_simple

You probably have something more like this: https://en.wikipedia.org/wiki/Freehold_(law)

What you are describing is more like the king of England being able to shoot people on his own property, and have full sovereign immunity (in theory, I mean recently a British prince was arrested on allegations of far less).

EGregon Who owns your ATProto identity?

Yes you do own your domain, as much as you can own your house. Your hosting provider can only take down your hosting, not your domain. Seizing domain names isn't very common. And by the way, with Web3 domains, you have full ownership via your own private key, with no need to pay rent. Is it possible to lose your house that you own? Yes. It's far more rare to lose a domain you own, by it being seized.

DNSSec is used to prevent unauthorized stealing of domains. Furthermore, if someone does steal one domain you own, they don't steal all your accounts across all domains. If they take over your hosting, that's a fixable problem -- you just repoint the domain.

Now, having said that, I designed the Safebox exactly to prevent these scenarios from happening, and create an actually solid foundation for decentralized social networking, AI workloads, etc. If anyone is interested, probably the best link to begin reading about it is: https://safebots.ai/about (If you do, I'd love to hear your thoughts)

EGregon What was nice about the UI of Windows 2000

It started with iOS 7 and Jony Ive

Steve Jobs was right. Then when he died (after removing Scott Forstall), Jony Ive got to do his hardware minimalism in software too. And everything Steve Jobs favored was suddenly derided as “skeumorphism”. It’s like what USSR did with Stalin under Khrustchev. I still remember when Chrome app just had a big white area where you’re supposed to enter the url and you had no idea unless you randomly happened to click there. And if the website background was white, too? Oh too bad LMAO. Minimalistic! Chrome had no… chrome.

EGregon Emacs 31 is around the corner: The changes I'm daily driving

Investing your time how exactly

EGregon Stop Using JWTs

Over the past 15 years of developing secure web apps for various organizations, I ended up architecting solutions which had to deal correctly with ITP, webauthn, CHIPS, iframes and more.

This year, I ended up publishing an open protocol that can be used for everything from secure authentication to API requests to micropayments, and it works with the existing Web stack and P256 curve with JSON serialization curves as well as EVM blockchains via K256 curve and EIP712 serialization.

I encourage everyone to take a look at it and consider using it, so we can stop reinventing the wheel. Everything has already been deployed, it’s an extremely simple protocol, much simpler than JWT and requires no global registry.

https://openclaiming.org

https://github.com/OpenClaiming

It is also used in stuff like https://safebots.github.io/Safecloud/

EGregon 'Ghost jobs' could soon be illegal in New York

As a libertarian, I am okay with laws that allow people to sue for fraudulent or intentionally very misleading statements, especially ones made publicly and impose compounding costs on a lot of people. This is public harm. The laws are protections for regular people, in this case people who are looking for jobs. I'm also okay with Pigovian Taxes for the same reason: forcing actors who externalize costs to the public, to internalize those costs.

Laws are frameworks. My brand of libertarianism is "decentralizing concentrations of power" and "giving people the software tools to self-organize". But in the meantime, yeah, if there would be laws for anything, it would be this kind of stuff. It is why I can get behind Intellectual Property for Trademarks, before I get behind Copyrights and Patents. Trademarks are about making sure actors don't misrepresent who they are and appropriate the brand of other actors. I think many libertarians would come to support Trademark enforcement laws if they were presented that way.

EGregon What is it like to be a bat? (1974) [pdf]

Oh, I’d say they had some good clues.

EGregon AI agent runs amok in Fedora and elsewhere

Literally on the front page of https://safebots.ai … “Don’t let your AI Agents run amok”. Sadly we will see a proliferation of not just agents, but swarms

EGregon Building an HTML-first site doubled our users overnight

I think Facebook with their money and Vercel with their VC funding tried hard to push the React and then the Next.js everywhere. So it arrived in time for AIs to all train on it. And now it’s the one true way :)

But do we really need all that stuff? Build steps, bundling, tree shaking, all for what? And is it really simpler… hmm

EGregon Hermes Agent – Open-source AI agent with persistent memory

What's wrong with having a website where you scan a QR code, and have your own private chat, and it sends notifications using, say, Web Push?

EGregon The 29th International Obfuscated C Code Contest (IOCCC) 2025 Winners

Wait, I kind of don't get it.

So Obfuscated C Code Contest works but Capture the Flag doesn't? Because of AI?

https://twit.tv/posts/tech/ai-disrupts-capture-flag-what-mea...

EGregon LLMs are eroding my software engineering career and I don't know what to do

Think of it like this

You’ve already faced this the entire time with… libraries on github.

If employers knew how much you can just use a new standard library, or ask you to “use React”, that’s a lot like asking you to use an LLM to speed things up. You also benefit from the collective wisdom of a lot of people. Do you write assembly or pixel shaders by hand?

EGregon When AI Builds Itself: Our progress toward recursive self-improvement

RSI is dangerous. That is why we designed CDE:

https://safebots.ai/declarative.html

EGregon How we index images for RAG

We have it in our open-source framework, in case anyone wants to deploy it:

https://github.com/Qbix/AI/blob/6753f6e453908682401f49760002...

https://github.com/Qbix/AI/blob/main/config/observations.jso...

wrote it up here a few months ago: https://community.safebots.ai/t/building-cultural-infrastruc...

EGregon Malicious npm packages detected across Red Hat Cloud Services

https://qbix.com/blog/2026/04/01/no-way-to-prevent-this-says...

EGregon SQLite is all you need for durable workflows

Files is all you need.

https://xkcd.com/378/

EGregon I think Anthropic and OpenAI have found product-market fit

And how exactly does the agent harness surface ALL the right places that need to be updated, and reason about functions and APIs?

EGregon I think Anthropic and OpenAI have found product-market fit

Here is a serious question.. Can we sell into the hype cycle and on the way down with this: https://safebots.ai/costs.html

EGregon I think Anthropic and OpenAI have found product-market fit

Most work is not coding.

And also, people have it wrong… their models are not the main problem anymore. It’s the RAG

EGregon Why AI Agents Cannot Change Software Systems

"But agentic work is global and transformative: the LLM must change the system itself, which requires understanding dependencies, invariants, interactions, and downstream consequences.

This is causal reasoning, not pattern extension. LLMs predict tokens, not consequences — and that is why the leap from writing code to producing a safe, system‑aware PR‑ready diff is not incremental but a shift into a fundamentally different problem space."

This is well said. We need a new paradigm. I could go into the shortcomings of the current agent-oriented approaches but it would turn into a huge post. If you want to read it, I wrote it up here: http://safebots.ai/agents.html

EGregon Claude Code as a Daily Driver: Claude.md, Skills, Subagents, Plugins, and MCPs

Best Claude Code daily-driver guide I’ve read. Though I’ve only read two. The “let Claude write rules for itself” CLAUDE.md pattern is the highest-ROI habit in there. Buth here’s the thing. The assumption underneath: this works when Claude mostly follows CLAUDE.md. Anthropic’s own engineering post from May 25 (https://www.anthropic.com/engineering/how-we-contain-claude) reports their telemetry shows ~93% of permission prompts get clicked through and ~17% of dangerous actions slip past the auto-mode filter.

Their conclusion: environment-layer containment first, then model-layer steering. CLAUDE.md is the right configuration layer but it is not a containment layer. Worth thinking about whether your worst case is a lost afternoon or a lost database and all backups deleted, too: https://safebots.ai/compromise.html

But the more important point are the costs. People are starting to realize just how costly it can be to run agents without precomputing and caching: https://safebots.ai/costs.html and self-orchestrating agents can go up to 1000x: https://safebots.ai/kimi.html