Hacker Newsnew | past | comments | ask | show | jobs | submit | Lx1oG-AWb6h_ZG0's commentslogin

patio11 wrote a great article and podcast about debanking and anti-money laundering processes last year, it was eye opening how kafkaesque these things are: https://www.bitsaboutmoney.com/archive/debanking-and-debunki...


I thought skills were supposed to help with “giving claude access to tools it can call”. When would one use MCP over skills?


skills are basically markdown files that teach claude how to do something. they live in your repo and load on demand.

MCP is for when you need claude to actually interact with external systems like querying a database, hitting an API, etc...


I've not explicitly used skills or MCP, but have had zero issues with Claude calling apis via curl as an example. I'm not sure what the MCP server or skill is actually enabling at this point. If I wanted CC to talk to SQL Server, I'd have it open a nix-env with the tools needed to talk to the database. One of my primary initial claude.md entries has to do with us running on NixOS and that temporarily installing tools is trivial and it should do things in the NixOS way whenever possible. Since then it has just worked with practically everything I've thrown at it. Very rarely do I see it trying to use a tool that isn't installed anymore. CC even uses my local vaultwarden where I have a collection of credentials shared with it. All driven through claude.md.


From TFA:

> However, the Internet Archive expanded its library project during the covid-19 pandemic. It launched the National Emergency Library, allowing an unlimited number of people to access the same copies of ebooks. That’s when the publishers banded together to file the lawsuit, targeting both online libraries.

The digital copy could be checked out by many people at the same time.


NEL was a brief deviation from the usual CDL one-borrower-at-a-time system. Parent asked how CDL, not NEL, hurt authors.


The pandemic lending is a different thing, it's not "CDL".


One other reason is that the quality of Amazon listings has really nosedived over the last decade. There are too many spammy merchants in the marketplace now. You cannot just trust the name or description - you need to look at the reviews (or other websites) these days before you feel confident about your purchase.

It’s a classic case of mismatched incentives - the Retail org is just focused on increasing sellers and listings because they have reviews to bail them out, but Devices really need quality results which Retail is not motivated to provide. Their recent focus on mimicking Temu and Shein is only going to make things worse.


>> One other reason is that the quality of Amazon listings has really nosedived over the last decade.

I stopped using Amazon years ago when I had four purchases of completely different and random items all turned up to be counterfeit. One was a Microsoft ergonomic keyboard, the other was a pair of Lucky brand jeans, the other was a pair of Ski goggles and the last thing was a Topo Designs backpack.

I've also noticed that when I came back looking for something simple like a charging block for a new phone, I had pages and pages of Chinese merchants who all had similar looking products but just different brand names stamped on them.

But I agree with everything you're saying, its not just logging on, finding what you need and ordering something. It takes ungodly amounts of due diligence to make sure what you're buying is a) a legit product and b) its not some suspect seller that's paying people to write fake reviews.


The reviews can be bogus too. I've just stopped shopping on Amazon. Their business model isn't trustworthy.


There's a video on YouTube of some guy gathering pee bottles discarded by Amazon drivers/contractors, created a fake drink, and got it listed on Amazon to the top spot.


Wouldn't this be an attack vector? Use some low-hanging bug to bring down an entire security module, allowing you to escalate?


It's currently a DOS by the crashing component, so it's already broken the Availability part of Confidentiality/Integrity/Availability that defines the goals of security.


But a loss of availability is so much more palatable than the others, plus the others often result in manually restricting availability anyway when discovered.


I think the wider societal impact from the loss of availability today - particularly for those in healthcare settings - might suggest this isn't always the case


Availability of a system that can’t ensure data integrity seems equally bad though.


Tell that to the millions of people whose flights were canceled, the surgeries not performed, etc etc.


What is the importance of data integrity? If important pre-op data/instructions are missing or gets saved on the wrong patient record which causes botched surgeries, if there are misprescribed post-op medications, if there is huge confusion and delays in critical follow-up surgeries because of a 100% available system that messed up patient data across hospitals nationwide, if there are malpractice lawsuits putting entire hospitals out of business etc etc, then is that fallout clearly worth having an available system in the first place?


How does crowdstrike protect against instructions being saved on the wrong patient’s record?


Huh? We're talking about hypotheticals here. You're saying availability is clearly more important than data integrity. I'm saying that if a buggy kernel loadable module allowed systems to keep on running as if nothing was wrong, but actually caused data integrity problems while the system is running, that's just as bad or worse.


Or anyone who owns CrowdStrike shares.


They’d surely have used some kind of Unix if uptime mattered.


before you get all smug recognize that linux has the exact same architecture, just because it wasn't impacted - this time.


Too late, I was born smug.

If Linux and Windows have similar architectural flaws, Microsoft must have some massive execution problems. They are getting embarrassed in QA by a bunch of hobbyists, lol.


I'm sure the people who missed their flights because of this disagree.


Or families of those who die.


If you're planning around bugs in security modules, you're better off disabling them - malware routinely use bugs in drivers to escalate, so the bug you're allowing can make the escalation vector even more powerful as now it gets to Ring 0 early loading.


> Wouldn't this be an attack vector?

Isn't DoSing your own OS an attack vector? and a worse one when it's used in critical infrastructure where lives are at stake.

There is a reasonable balance to strike, sometimes it's not a good idea to go to extreme measures to prevent unlikely intrusion vectors due to the non-monetary costs.

See: The optimal amount of fraud is non-zero.


In the absence of a Crowdstrike bug, if an attacker is able to cause Crowdstrike to trigger a bluescreen, I assume the attacker would be able to trigger a bluescreen in some other way. So I don't think this is a good argument for removing the check.


That assumes it's more likely than crowdstrike mass bricking all of these computers... this is the balance, it's not about possibility, it's about probability.


I think we're in agreement. I now realize my previous comment replied to the wrong comment. I meant to reply to Lx1oG-AWb6h_ZG0. Sorry.


Requires state level social engineering.

Might by why north Koreans are trying to get work from home jobs.

https://www.businessinsider.com/woman-helped-north-korea-fin...


Apparently Crowdstrike also brought down Linux hosts in the same way in April but it didn’t get widely reported: https://news.ycombinator.com/item?id=41005936


iOS already supports OTP, it’s just buried in Settings > Passwords > Set up verification code. Once you do that, it’s seamless - it autofills in all my site and works beautifully in chrome/edge/firefox even in my PCs


There are plenty of reports about how Tesla has made this difficult. Tesla parts are difficult to obtain even for Tesla’s own service centers: there are frequent months-long waits. “Certified” non-Tesla shops get parts at a lower priority, non-certified shops simply cannot order most parts (just basic stuff like bumpers)

0: https://www.reddit.com/r/Insurance/s/fkcTScUDpL


Maybe someone needs to found the Framework Computer, Inc, of electric cars.


Seriously, this should happen sooner than later.

We're quickly entering a world where car manufacturers are trying to extract profit from subscriptions (see: BMW heated seats, Toyota remote start, Ford BlueCruise, etc). On top of that, most cars are now shipping with an encrypted CAN bus, which lands us right back in the same "trusted computing" quagmire as every other consumer electronic device.


I have the skillset and network to design, prototype and source just about any part or assembly. If anyone wants to do this, seriously, reach out.


Framework is great, but their existence doesn't change the harmful antirepair practice of other companies. Similarly, the ratio of servicable cars on the road won't change the fact that offering less service is cheaper, and forcing first-party repair can even be profitable.


> their existence doesn't change the harmful antirepair practice of other companies

Their existence doesn't but their success does. If and when Framework becomes large enough to steal a significant portion of marketshare from less repair friendly companies, they will adapt or die.


I wish you were right, but historically I don't think anything suggests a change. There has always been a market for repairable and rugged laptops, but their market share loses out to expensive and easily replaceable machines. Skimping on repairability lets you focus on some other feature that you can market instead, which will almost always seem sexier than "the topcase costs less than $500 to replace".

There are success stories here; IBM and Panasonic didn't struggle to find customers for the Thinkpad and Toughbook respectively. But the market was never forced to "adapt or die" as you put it; in fact, the rugged and repairable machines were now the ones that had to adapt. How can you compete against a monopoly on repair pricing?


What if you had 30k or 10k teslas hanging around for parts though?


Software lock ala apple?


Interesting, I've seen people using tesla drive motors in electric conversions, so maybe that's easier if they're controlled by some 3rd party hardware, because you're just fighting the motor not the whole car as a system.


Definitely, and even with some legitimate reasons. The inverter and the motor are linked by a calibration.


> Privacy taken too far, however, can lead to bad outcomes. To mitigate the potential of Code being used for nefarious activity, Code users are limited to $250 USD per payment, up to $1000 USD per day.

This is a joke. Everything seems to be designed around their proprietary app, so why bother with a blockchain and custom currency at all?


The substance is causing the anti-social behavior though, it’s putting people in a state where they’re not able to control their behavior or reason rationally about how it affects them and the people around them. In such a situation, you cannot just focus on the outcomes, you need to control the inputs as well.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: