lucasluitjes

Nice, though I think I'd rather do:

  def a *args
    if args.empty? 
      @setting
    else
      @setting = args.first
    end
  end

Confusing title, both the original and the one here on HN.

Three french supermarket chains had their refrigeration systems hacked.

Separately, a super market chain serving Belgium and the Netherlands shut down a large chunk of their IT systems due to a "cybersecurity incident", primarily affecting distribution centers and grocery delivery services. But the supermarkets are currently open, and do not have refrigeration issues.

Suspicious timing and these incident could well be related, but that has not been reported so far.

It could well be one ransomware attack on Ahold Delhaize, and an unrelated attack on a refrigeration supplier. Note that a similar refrigeration attack happened happened to a number of US military installations a few weeks ago.

The ones mentioned in this thread all use Kiwix for off-line wikipedia, OSM for maps, Khan for educational videos. It looks like internet-in-a-box is aimed at working well on low-powered devices, whereas nomad expects beefy hardware and includes local AI. Not sure how WROLPi differs from internet-in-a-box.

Maybe it's like linux distros: all based on the same software, but optimized for different use-cases or preferences.

The full report can be found here: https://services.google.com/fh/files/misc/2025_state_of_ai_a...

That 17% increase is in self-reported effectiveness. The software delivery throughput only went up 3%, at a cost of that 9% extra instability. So you can build 3% faster with 9% more bugs, if I'm reading those numbers right.

I've been annoyed with Google search quality lately and was wondering how the others fared on this specific issue. Turns out, mostly not much better.

Bing, DuckDuckGo, Qwant, Ecosia, Brave all had the github repo and nanoclaw.net (the fake homepage) in the first or second place. Marginalia had fascinating results about biology but only tangentially related Nanoclaw results, not the github repo or either the fake or real homepage.

Mojeek was the exception, sort of. It had some random news sites up top, but the github repo in 2nd place and nanoclaw.dev (the real homepage) in the 4th place. The fake nanoclaw.net did not show.

Kagi is the only one I couldn't try because apparently I used up my free credits a year back. Can anyone see how they compare?

Agree with all of that, especially modern supply chain risk (imho the more important reason to opt for VM isolation rather than containerization). But the original article specifically talks Vagrant as an isolation solution, and describes it as not protecting against VM escape, but also that guest-to-host 0day is rare.

Hence pointing out that VM escape is a lot easier than that if your VM management tool syncs folders the way that Vagrant does by default.

It's the default behaviour for Vagrant. You put a Vagrantfile in your repo, run `vagrant up` and it creates a VM with the repo folder shared r+w to `/vagrant` in the VM.

> What you’re NOT protecting against:

> a malicious AI trying to escape the VM (VM escape vulnerabilities exist, but they’re rare and require deliberate exploitation)

No VM escape vulns necessary. A malicious AI could just add arbitrary code to your Vagrantfile and get host access the first time you run a vagrant command.

If you're only worried about mistakes, Claude could decide to fix/improve something by adding a commit hook. If that contains a mistake, the mistake gets executed on your host the first time you git commit/push.

(Yes, it's unpleasantly difficult to truly isolate dev environments without inconveniencing yourself.)

  Location: The Netherlands. I'm flexible with working hours, I usually work with clients from either Western Europe or the USA.
  Remote: Yes
  Willing to relocate: No, but willing to travel/visit
  Technologies: especially Ruby (including Ruby on Rails, Sinatra, and standalone applications), PostgreSQL, Ansible, Linux. Lots of others at the end of my comment.
  Résumé/CV: https://www.luitjes.it
  Email: lucas@luitjes.it 

I do dev/devops/security, usually for startups or scale-ups or other small orgs with limited resources, and I've been doing that for 15+ years. So, if you:

* Have a slow web application that’s often down?

* Want to improve security and don’t know where to start?

* Have a legacy system that needs to be replaced?

* Are considering an acquisition but not sure about the technical side?

I can help with that. For example, in the past I have:

* Massively improved performance and reliability for a data visualization platform.

* Led a large effort to improve security for a cybersecurity SaaS.

* Built a micropayments system for a prominent media startup.

* Rebuilt an aging e-learning platform from scratch for a GDPR compliance SaaS.

* Conducted technical due diligence for acquisitions.

For more information: https://www.luitjes.it

Other tech I've worked with: Elixir, C#, Java (Spring/Hibernate), JavaScript, HTML/CSS/XSLT/XPATH/XSLFO, Elasticsearch, MongoDB, MySQL, Redis, Solr/Lucene, Graphite, Kibana, Grafana, Logstash, Icinga, Jenkins, Varnish, HAProxy, Pound, Nginx, Apache, Passenger, Vagrant, Docker, DCOS, Kubernetes, SSH, OpenVPN, TCP/IP, tcpdump/strace/lsof/etc, AWS (EC2, ELB/ALB, S3, CloudFront, Lambda, Batch, VPC, etc.

This.

If you were writing a script to mass-scan the web for vulnerabilities, you would want to collect as many http endpoints as possible. JS files, regardless of whether they're commented out or not, are a great way to find endpoints in modern web applications.

If you were writing a scraper to collect source code to train LLMs on, I doubt you would care as much about a commented-out JS file. I'm not sure you'd even want to train on random low-quality JS served by websites. Anyone familiar with LLM training data collection who can comment on this?

GrapheneOS is basically the Android equivalent of iOS Lockdown mode. Considering how the threat landscape has changed, it would be nice if Google offered this itself. Or became a long-term sponsor of GrapheneOS, seeing how great a job they've been doing.

SEEKING WORK | REMOTE | Dev, DevOps, Security | Location: The Netherlands

Willing to relocate: no, but willing to travel/visit. I'm flexible with working hours, I usually work with clients from either Western Europe or the USA.

I do dev/devops/security, usually for startups or scale-ups or other small orgs with limited resources, and I've been doing that for 15+ years. So, if you:

* Have a slow web application that’s often down?

* Want to improve security and don’t know where to start?

* Have a legacy system that needs to be replaced?

* Are considering an acquisition but not sure about the technical side?

I can help with that. For example, in the past I have:

* Massively improved performance and reliability for a data visualization platform.

* Led a large effort to improve security for a cybersecurity SaaS.

* Built a micropayments system for a prominent media startup.

* Rebuilt an aging e-learning platform from scratch for a GDPR compliance SaaS.

* Conducted technical due diligence for acquisitions.

For more information: https://www.luitjes.it

Favorite buzzwords: Ruby (including Ruby on Rails, Sinatra, and standalone applications), PostgreSQL, Ansible, Linux.

Other buzzwords: Elixir, C#, Java (Spring/Hibernate), JavaScript, HTML/CSS/XSLT/XPATH/XSLFO, Elasticsearch, MongoDB, MySQL, Redis, Solr/Lucene, Graphite, Kibana, Grafana, Logstash, Icinga, Jenkins, Varnish, HAProxy, Pound, Nginx, Apache, Passenger, Vagrant, Docker, DCOS, Kubernetes, SSH, OpenVPN, TCP/IP, tcpdump/strace/lsof/etc, AWS (EC2, ELB/ALB, S3, CloudFront, Lambda, Batch, VPC, etc.

TLDR: they wrapped prompts with concepts from Buddhism and got better performance on alignment tests. Actual prompts are in appendix D in this PDF: https://osf.io/az59t

I'm curious what effects you would see with secular moral philosophy, other religions, etc. Is Buddhism special, as the paper seems to argue?

SEEKING WORK | REMOTE | Dev, DevOps, Security | Location: The Netherlands

Willing to relocate: no, but willing to travel/visit. I'm flexible with working hours, I usually work with clients from either Western Europe or the USA.

I do dev/devops/security, usually for startups or scale-ups or other small orgs with limited resources, and I've been doing that for 15+ years. So, if you:

* Have a slow web application that’s often down?

* Want to improve security and don’t know where to start?

* Have a legacy system that needs to be replaced?

* Are considering an acquisition but not sure about the technical side?

I can help with that. For example, in the past I have:

* Massively improved performance and reliability for a data visualization platform.

* Led a large effort to improve security for a cybersecurity SaaS.

* Built a micropayments system for a prominent media startup.

* Rebuilt an aging e-learning platform from scratch for a GDPR compliance SaaS.

* Conducted technical due diligence for acquisitions.

For more information: https://www.luitjes.it

Favorite buzzwords: Ruby (including Ruby on Rails, Sinatra, and standalone applications), PostgreSQL, Ansible, Linux.

Other buzzwords: Elixir, C#, Java (Spring/Hibernate), JavaScript, HTML/CSS/XSLT/XPATH/XSLFO, Elasticsearch, MongoDB, MySQL, Redis, Solr/Lucene, Graphite, Kibana, Grafana, Logstash, Icinga, Jenkins, Varnish, HAProxy, Pound, Nginx, Apache, Passenger, Vagrant, Docker, DCOS, Kubernetes, SSH, OpenVPN, TCP/IP, tcpdump/strace/lsof/etc, AWS (EC2, ELB/ALB, S3, CloudFront, Lambda, Batch, VPC, etc.

> I have recently written security-sensitive code using Opus 4. I of course reviewed every line and made lots of both manual and prompt-based revisions.

> Cloudflare apparently did something similar recently.

Sure, LLMs don't magically remove your ability to audit code. But the way they're currently being used, do they make the average dev more or less likely to introduce vulnerabilities?

By the way, a cursory look [0] revealed a number of security issues with that Cloudflare OAuth library. None directly exploitable, but not something you want in your most security-critical code either.

[0] https://neilmadden.blog/2025/06/06/a-look-at-cloudflares-ai-...

I've seen LLMs generate plenty of wildly insecure code, but the percentage of insecure solutions out of the solutions that are functional, is even higher than I expected.

Also, I'm curious how the average coder would fare on this benchmark.

Hardcoded API keys and poorly secured backend endpoints are surprisingly common in mobile apps. Sort of like how common XSS/SQLi used to be in webapps. Decompiling an APK seems to be a slightly higher barrier than opening up devtools, so they get less attention.

Since debugging hardware is an even higher threshold, I would expect hardware devices this to be wildly insecure unless there are strong incentive for investing in security. Same as the "security" of the average IoT device.

Ironically if you wanted to build that accurately and quickly, you would probably end up having an LLM classify content as being LLM-related or not. Keyword-based filtering would have many false positives, and training a model takes more time to build.

SEEKING WORK | REMOTE | Dev, DevOps, Security | Location: The Netherlands

Willing to relocate: no, but willing to travel/visit. I'm flexible with working hours, I usually work with clients from either Western Europe or the USA.

I do dev/devops/security, usually for startups or scale-ups or other small orgs with limited resources, and I've been doing that for 15+ years. So, if you:

* Have a slow web application that’s often down?

* Want to improve security and don’t know where to start?

* Have a legacy system that needs to be replaced?

* Are considering an acquisition but not sure about the technical side?

I can help with that. For example, in the past I have:

* Massively improved performance and reliability for a data visualization platform.

* Led a large effort to improve security for a cybersecurity SaaS.

* Built a micropayments system for a prominent media startup.

* Rebuilt an aging e-learning platform from scratch for a GDPR compliance SaaS.

* Conducted technical due diligence for acquisitions.

For more information: https://www.luitjes.it

Favorite buzzwords: Ruby (including Ruby on Rails, Sinatra, and standalone applications), PostgreSQL, Ansible, Linux.

Other buzzwords: Elixir, C#, Java (Spring/Hibernate), JavaScript, HTML/CSS/XSLT/XPATH/XSLFO, Elasticsearch, MongoDB, MySQL, Redis, Solr/Lucene, Graphite, Kibana, Grafana, Logstash, Icinga, Jenkins, Varnish, HAProxy, Pound, Nginx, Apache, Passenger, Vagrant, Docker, DCOS, Kubernetes, SSH, OpenVPN, TCP/IP, tcpdump/strace/lsof/etc, AWS (EC2, ELB/ALB, S3, CloudFront, Lambda, Batch, VPC, etc.

Here you go: javascript:(function(){window.scrollTo({top:0,behavior:'smooth'});})();

That is amazing research! Reminds me a bit of the 2017 research of RCE on a DNA sequencing machine by synthesizing shellcode in actual DNA/RNA molecules [0]. I was gonna say "next up: OSC" but I guess MIDI is still dominant.

[0] https://www.usenix.org/conference/usenixsecurity17/technical...

SEEKING WORK | REMOTE | Dev, DevOps, Security | Location: The Netherlands

Willing to relocate: no, but willing to travel/visit. I'm flexible with working hours, I usually work with clients from either Western Europe or the USA.

I do dev/devops/security, usually for startups or scale-ups or other small orgs with limited resources, and I've been doing that for 15+ years. So, if you:

* Have a slow web application that’s often down?

* Want to improve security and don’t know where to start?

* Have a legacy system that needs to be replaced?

* Are considering an acquisition but not sure about the technical side?

I can help with that. For example, in the past I have:

* Massively improved performance and reliability for a data visualization platform.

* Led a large effort to improve security for a cybersecurity SaaS.

* Built a micropayments system for a prominent media startup.

* Rebuilt an aging e-learning platform from scratch for a GDPR compliance SaaS.

* Conducted technical due diligence for acquisitions.

For more information: https://www.luitjes.it

Favorite buzzwords: Ruby (including Ruby on Rails, Sinatra, and standalone applications), PostgreSQL, Ansible, Linux.

Other buzzwords: Elixir, C#, Java (Spring/Hibernate), JavaScript, HTML/CSS/XSLT/XPATH/XSLFO, Elasticsearch, MongoDB, MySQL, Redis, Solr/Lucene, Graphite, Kibana, Grafana, Logstash, Icinga, Jenkins, Varnish, HAProxy, Pound, Nginx, Apache, Passenger, Vagrant, Docker, DCOS, Kubernetes, SSH, OpenVPN, TCP/IP, tcpdump/strace/lsof/etc, AWS (EC2, ELB/ALB, S3, CloudFront, Lambda, Batch, VPC, etc.

I wonder: do mail servers determine the received timestamp based on when the connection was opened or when the last character was received? I guess OP could send them an unrelated question using this technique, and check in the reply what timestamp they have.

If you want to beat other romantically inclined geeks running scripts, you could make sure your script is running somewhere with low latency to that static IP. Use traceroute, looking glass, tools to ping from multiple regions to find the perfect place to run your script.

A VPS in the same region with good peering would be a start. Could see what else is running on IP addresses in the same range, maybe find someone who runs infra on a nearby IP who is willing to run your script.

Cool! Skip to 2m18s in the video if you're just curious about what the AI summarization looks like, and how it handles comment threading. Any plans for a firefox version?

But finally there is dark-mode! I'll take any number of blue round buttons if I don't have to stare at a white background anymore.

My comment history is short if you're curious about the comment itself. But in general for writing sales copy, I found The Copywriter's Handbook by Robert Bly very helpful, especially the first five chapters. Some of it can seem a bit sleazy to IT folks (the book is primarily written for people who write ads for a living) but there's great advice in there.

> How do you sell yourself if you're more of a generalist like me?

I focus on small firms. They don't have the resources or amount of work to hire a full-time (or multiple full-time) person for each role. If you can do many roles well, they don't have to source/vet a super-part-time person for each role.

> leaving me time and flexibility to work on my own project.

I think there's a bit of give-and-take there. Early on I try to look extra hard for any opportunity to show I can be flexible if they need something, and give them no reason to doubt my ability to deliver. Pretty soon trust is established, and I have all the time and flexibility I need to work on other projects alongside.

> The key is that I can keep getting the work with consistency.

My experience is my clients often don't know beforehand how long-term/consistent the work will be. But if I'm reliable and helpful, it usually turns into a long-term relationship.

> How are you finding part-time work?

HN seeking freelancer thread (https://news.ycombinator.com/user?id=whoishiring) got me a particularly nice gig, also meetups, and most of all staying in touch with people I've worked with before. For the latter two, I try to focus on quality over quantity. The handful of people who know me well, tend put me in touch with better matching gigs than the large group of superficial contacts.

Cold-emailing/cold-calling companies that look like they may be a good fit, also worked. Personally I find it a bit draining so I avoid cold-anything if I can.

Interesting. Are there similar products targetting bootstrapped founders that have reached a certain milestone? Reported MRR, DAU, etc?

SEEKING WORK | REMOTE | Dev, DevOps, Security | Location: The Netherlands

Willing to relocate: no, but willing to travel/visit. I'm flexible with working hours, I usually work with clients from either Western Europe or the USA.

I do dev/devops/security, usually for startups or scale-ups or other small orgs with limited resources, and I've been doing that for 15+ years. So, if you:

* Have a slow web application that’s often down?

* Want to improve security and don’t know where to start?

* Have a legacy system that needs to be replaced?

* Are considering an acquisition but not sure about the technical side?

I can help with that. For example, in the past I have:

* Massively improved performance and reliability for a data visualization platform.

* Led a large effort to improve security for a cybersecurity SaaS.

* Built a micropayments system for a prominent media startup.

* Rebuilt an aging e-learning platform from scratch for a GDPR compliance SaaS.

* Conducted technical due diligence for acquisitions.

For more information: https://www.luitjes.it

Favorite buzzwords: Ruby (including Ruby on Rails, Sinatra, and standalone applications), PostgreSQL, Ansible, Linux.

Other buzzwords: Elixir, C#, Java (Spring/Hibernate), JavaScript, HTML/CSS/XSLT/XPATH/XSLFO, Elasticsearch, MongoDB, MySQL, Redis, Solr/Lucene, Graphite, Kibana, Grafana, Logstash, Icinga, Jenkins, Varnish, HAProxy, Pound, Nginx, Apache, Passenger, Vagrant, Docker, DCOS, Kubernetes, SSH, OpenVPN, TCP/IP, tcpdump/strace/lsof/etc, AWS (EC2, ELB/ALB, S3, CloudFront, Lambda, Batch, VPC, etc.