HNHacker News
TopNewBestAskShowJobs

mmaunder

17,967 karma · joined July 18, 2007

I'm the founder/CTO of Defiant Inc. We make Wordfence, the most widely used WordPress firewall and malware scanner. We protect over 5 million websites.

https://www.wordfence.com/

We are usually hiring so please check:

https://www.defiant.com/

Email me at:

mark at defiant·com

submissionscomments
mmaunder··on QuadRF can spot drones and see WiFi through my wall
Historically these have been quickly shut down without much of an explanation.
mmaunder··on GPT-5.6
Or an allegedly even more dangerous model that they refuse to release. What a joke Anthropic has become.
mmaunder··on The Free Market Lie: Why Switzerland Has 25 Gbit Internet and America Doesn't
25 gig is still expensive for consumers to configure end to end.
mmaunder··on U.S. government will decide who gets to use GPT-5.6
The new normal for the next decade: You must protect the public from us and all others, and we are your closest ally so we make your rules for us and our competition. This wasn’t a lucky outcome. They laid the groundwork years ago with the AI “ethics” movement and this was the play all along.
mmaunder··on F3
Not quite vaporware, but few commits, PRs, history, actual examples etc. It's pretty thin.
mmaunder··on F3
A Wasm decoder takes encoded bytes and returns an iterator of Arrow Buffers. In case you were wondering.
mmaunder··on AI OSS tool repo goes archived over night after raising $7.3M Seed
And poached eggs.
mmaunder··on MAI-Code-1-Flash
You lost me at forced scrolling. Ugh!
mmaunder··on The seed oil panic is hurting my cardiac patients
You’re under 50 and haven’t seen the results of a stroke. There are states worse than death.
mmaunder··on The seed oil panic is hurting my cardiac patients
Fish, tree nuts, avocados and olive oil. Avoid butter, red meat and cheese. It’ll save your life.
mmaunder··on DeepSeek reasonix, DeepSeek native coding agent with high caching and low cost
Unusable thanks to the top animation pushing the rest of the site down repeatedly as you’re trying to read.
mmaunder··on Read the DNC's 2024 autopsy obtained by CNN
Political content on HN? That’s a first. Please flag this. Let’s keep HN free of rage bait and focused on innovation.
mmaunder··on I believe there are entire companies right now under AI psychosis
Amazing how the dev community is suffering from a similar inability to approach the subject of real world AI efficiencies and business benefits. I don’t think it’s helpful to accuse the other side of psychosis. It disqualifies any data or experience they bring to the conversation.
mmaunder··on Pgbackrest is no longer being maintained
Metrics would help others who may want to rescue the project consider the options. Eg user base would make it clear if there’s an immediate opportunity to work with the author to launch a paid backup service around the project, funding continued work on it.
mmaunder··on DaVinci Resolve – Photo
BM stills camera coming soon. It would replicate their video model with their software driving their hardware sales.
mmaunder··on Google releases Gemma 4 open models
This comment deserves it's own HN post. Thanks!
mmaunder··on Live: Artemis II Launch Day Updates
24/7 coverage here: https://www.youtube.com/watch?v=m3kR2KK8TEs
mmaunder··on EmDash – A spiritual successor to WordPress that solves plugin security
If creating OSS is this low effort, the right question is: What high effort assets, that are valuable to other builders, should open communities be working on? And I think the answer is open source models with open training and open training data.
mmaunder··on EmDash – A spiritual successor to WordPress that solves plugin security
The generous take is that this is someone's pet project that marketing got too excited about, and that the leadership haven't applied their minds to. GPL provides a moat for the community, who are contributing their time and energy into a project. It ensures that, even if a commercial company grabs your software, extends it, and commercializes it, that you can fold those improvements back into your original distribution. While the commercial entity benefits from your free labor, you benefit back from theirs.

Re-implementing WordPress (their words, not mine) as MIT licensed, while legally questionable, breaks that virtuous cycle and removes the community's moat. They've taken WordPress's roles and menus and borrowed its Gutenberg code (which is GPL), and launched it as an MIT licensed product, which breaks that virtuous cycle. It means e.g. a hosting company can take the product closed source if they want to, and never have to contribute any of what they build on top of the community's work, back to the community.

https://github.com/emdash-cms/emdash/tree/main/packages/core... says "The core EmDash CMS package - an Astro-native, agent-portable reimplementation of WordPress."

Emdash uses WP's RBAC roles. Also uses their menus. Also depends on @wordpress/block-serialization-default-parser which I think might (??) be able to be used by an MIT project even though WordPress is GPL.

They used Claude Code it seems because the first commit has a CLAUDE.md file which became an AGENTS.md.

mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
Who's we, and how do you know this?
mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
In the source there is an outbound-only Remote Control session that can forward recent transcript history and ongoing user/assistant/local-command events to a claude.ai session, likely for cross-device/session sync, remote viewing, internal dogfooding, or telemetry/ops experiments. It’s separate from the normal explicit /remote-control flow. But in the actual production binary I checked, the mirror helpers are compiled down to hard false, so it does not appear enabled in the shipped distribution build.

Same story for the anti_distillation: ['fake_tools'] path: I could find it in source, but the prod binary I checked does not contain the anti_distillation / fake_tools strings at all.

mmaunder··on The Claude Code Source Leak: fake tools, frustration regexes, undercover mode
Come on guys. Yet another article distilling the HN discussion in the original post, in the same order the comments appear in that discussion? Here's another since y'all love this stuff: https://venturebeat.com/technology/claude-codes-source-code-...
mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
Claude Code has a server-side anti-distillation opt-in called fake_tools, but the local code does not show the actual mechanism.

The client sometimes sends anti_distillation: ['fake_tools'] in the request body at services/api/claude.ts:301

The client still sends its normal real tools: allTools at services/api/claude.ts:1711

If the model emits a tool name the client does not actually have, the client turns that into No such tool available errors at services/tools/StreamingToolExecutor.ts:77 and services/tools/toolExecution.ts:369

If Anthropic were literally appending extra normal tool definitions to the live tool set, and Claude used them, that would be user-visible breakage.

That leaves a few more plausible possibilities:

Fake_tools is just the name of the server-side experiment, but the implementation is subtler than “append fake tools to the real tool list.”

or

The server may inject tool-looking text into hidden prompt context, with separate hidden instructions not to call it.

or

The server may use decoys only in an internal representation that is useful for poisoning traces/training data but not exposed as real executable tools.

mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
Great theory. I'll dig deeper.
mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
The only sensible response is to immediately open source it.
mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
Agreed. This is a big deal.
mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
Bet you’re pissed.
mmaunder··on Claude Code's source code has been leaked via a map file in their NPM registry
Haven’t looked at the code, but is the server providing the client with a system prompt that it can use, which would contain fake tool definitions when this is enabled? What enables it? And why is the client still functional when it’s giving the server back a system prompt with fake tool definitions? Is the LLM trained to ignore those definitions?

Wonder if they’re also poisoning Sonnet or Opus directly generating simulated agentic conversations.

mmaunder··on Claude Code runs Git reset –hard origin/main against project repo every 10 mins
Can we immunize HN against being yet another AI drama site? Obviously this isn’t a fundamental issue with agents or AI or Anthropic but a misconfiguration edge case.
mmaunder··on The Cognitive Dark Forest
The only barrier to a flourishing truly open source AI model ecosystem is the cost of training a highly capable model. This will get as cheap as it is to buy a computer and contribute to Linux. OSSAI movements will replace traditional OSS. And as with software, the early Slackware-like versions will be poor substitutes, but it will get better and then dominate.
← PreviousPage 3 of 34Next →