Hacker Newsnew | past | comments | ask | show | jobs | submit | morphology's commentslogin

It's funny that even after all these years and all this money invested in technology, we still haven't come up with anything better than word-of-mouth for hiring great people. Many serial founders have said that, despite the most stringent interview processes and the most sophisticated filtering pipelines, they still have a higher hit rate with people they've worked with in the past.

This isn't to diminish the whispernet. Rather, it shows just how many important signals cannot be quantized.


True, I have found it to be valid as well


Insane how? I would expect more points for open source contributions. It is trivial to create a personal project, but that does not carry with it any indicator of quality. Having your work accepted by other maintainers is one indicator at least.


You're welcome to port anything over to those languages. LLMs can do it in a couple of days at most.


Tell me next time Codex app would be rewritten to native stack scross all platforms: swiftui, winui, etc.

Should be easy, yeah?


It's a bit less automation-friendly because the UX is not great when the bot doesn't have its own phone number (which costs money). I think it has better privacy, though. Matrix server operators can read message metadata.


Telegram server operators can read message meta data and messages


You're right, Matrix is a much better option than Telegram. I misread the thread as comparing Signal to Matrix.


I defaulted to Biome for all greenfield projects a year ago, and at this point you would have to drag me kicking and screaming back to ESLint and Prettier. I also defaulted to Bun and still think Bun is leagues better than Node.js but I now have my doubts about its future after seeing the OpenCode devs consciously minimize their dependency on Bun for strategic reasons.


That money is going directly to Jensen as quickly as possible to secure OpenAI's place in the delivery queue


The investment version of "can you climb up a falling ladder fast enough to not fall"


They do have a hot mess with traction amongst developers. Codex is far behind Claude Code (in both the GUI and TUI forms), and OpenAI's chief of applications recently announced a pivot to focus more on "productivity" (i.e. software and enterprise verticals) because B2B yields a lot more revenue than B2C.


Codex is not far behind Claude Code


Honestly, I like codex performance compared to claude code.


I don't get the benefit. Yes, agents should not have access to API keys because they can easily be fooled into giving up those API keys. But what's to prevent a malicious agent from re-using the honest agent's fake API key that it exfiltrates via prompt injection? The gateway can't tell that the request is coming from the malicious agent. If the honest agent can read its own proxy authorization token, it can give that up as well.

It seems the only sound solution is to have a sidecar attached to the agent and have the sidecar authenticate with the gateway using mTLS. The sidecar manages its own TLS key - the agent never has access to it.


But surely the point is that the proxy key is for your local network, it ain't got no value on the interwebz.


Precisely. You absolutely have to ensure that random agents can't join your local network, which means you need a deterministic orchestrator or an AI orchestrator that only spins up a handful of vetted agents.


[flagged]


People are addressing that gap. I have a secure agent framework that uses a tool gateway hooked up to OPA (https://github.com/sibyllinesoft/smith-core), this solves the credential issue as the credentials live in the tools, and the authz issue, as OPA policy controls who does what.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: