Hacker Newsnew | past | comments | ask | show | jobs | submit | ascorbic's commentslogin

A great read. Sylvie's writeup is good too: https://sylvie.fyi/posts/react2shell/


The mother and baby are more likely to die. I don't think wanting to prevent that is a value judgement.

No of course it isn't nobody suggested it was.

The value judgement is saying the changes you want are worth doing because they might reduce it. Social and personal choices are weighed all the time that include risks to lives, suggesting something that might reduce risk does not end the debate.

We would generally want to prevent people dying in horrible aviation disasters too, we could do that by ceasing non essential air travel.


> We would generally want to prevent people dying in horrible aviation disasters too, we could do that by ceasing non essential air travel.

Equating educating girls to an aviation disaster has to be a new low.

This inflammatory comparison does nothing to improve the level of civil dialog on HN.


Argument by absurdity is a well known and to some well regarded rhetorical technique.

It makes you at least agree that there is a line somewhere, and then you can go on to decide where to draw it.


> Equating educating girls to an aviation disaster

To be clear, that is an unfounded accusation that you just now fabricated.

> This inflammatory comparison does nothing to improve the level of civil dialog on HN.

Your disgusting lies and fake pearl clutching are the problem here.


Death being bad is a value judgement.

That was an even more ridiculous post. It wasn't spyware, it was a messaging bridge being installed for exactly the purpose it was intended. It was Claude Desktop installing a bridge that would allow Claude browser plugins to communicate with it. It was only used if the user had installed the browser plugin, and all it did was grant that plugin access to the app that had installed it!

So it's a backdoor to bypass the browser sandbox. Spyware is an apt label for that.

It's not a backdoor: it's using a feature for the purpose for which it was designed. It's not granting plugins access to anything except itself

It's the sheer gall of doing shit like that on my system without asking me. Creating a shitload of files to modify the settings of OTHER apps, wtaf?

I asked Codex to look into it: https://i.imgur.com/lvOjR0x.png


Auto-updating browsers is one of the best advances in the web dev space in the past decade. I find it hard to believe that anyone who did web development before evergreen browsers became a thing would ever disagree.

I think automatic updates that offer no easy way to refuse are completely unreasonable.

Can you imagine going to see a doctor, and in the middle of your appointment, the doctor drags you into the operating room to automatically update your body?

That's roughly how I feel about automatic updates. If you apply the concept of automatic updates to any industry outside of software, it would very easily be illegal. But strangely, this concept is considered legal when it comes to software.


Best advances for whom? Lazy web developers?

Considering that most websites are optimized to just barely run on what the developers are targeting, letting them target the "state of the art" instead of what came installed on grandmas machine is been a huge negative for website efficiency and thus average user experience, not to mention global resource waste.


Web developers, users who want don't want security issues in their browser, and anyone who wants consistent rendering of sites

> and anyone who wants consistent rendering of sites

Yeah, that's where you lose me. The people who want to guarantee pixel-perfect rendering of web sites tend to be the same people who feel entitled to run their code on my machine as part of delivering their site, who prioritize their brand identity over my accessibility settings, who want to build their complex web app UI with no respect for the conventions of my chosen operating system. My browser should not be an ally to them; it should be taking my side in those conflicts.


Not via the API, previously.

It's not as simple as being pro- or anti-bot. It's about giving site owners the tools to decide whether or not they want to allow them. Seems pretty consistent to me. If they don't want bots, they can use tools to identify and block them. If they do, they can do things like automatically deliver markdown versions to them, or use x402 to charge micropayments.

Disclaimer: I work at Cloudflare, but not on these


People use agents to deploy sites all the time. Buying a domain is part of that if you want to build a site that's beyond a toy. Allowing agents to do a task isn't just for things you do every day – it's also for things you do rarely and need agents' help. It's not just devs using agents to perform these sort of tasks anymore.

Stripe Atlas makes it massively easier for startups to incorporate in Delaware. This is particularly hard for non-US founders. It solves a real problem. I don't think this part will be done by agents though!

Disclaimer: I work at Cloudflare but not on this


Wouldn't it be critical if the agent botched the domain purchase in weird ways ?

Short of throwaway sites (spam etc) it's hard to imagine skimping time on this specific, mostly painless part.


People are skimping time in every part.

I am watching people who can't code build and deploy dashboards and sites with Claude Code (desktop app - they don't use the CLI), then go cap in hand to developer friends to get it hosted on a domain (rather than some Vercel or whatever URL).

Those people absolutely want to risk letting an agent buy and set up the domain.

This is not necessarily as blindly stupid as you might think. Many of these people know that this workflow is no good for writing code that does anything serious (i.e. storing data for people, taking payments, etc.) but there are a huge number of projects that are just websites, dashboard, data visualisations, etc. with static content and public APIs (Twitter is awash with them) and domains are cheap.

A decent minority of these are even quite cool or interesting.

So a lot of people want to put their vibe-coded weekend project behind a nice domain. Why not?


> why not?

Let's say they buy a first time discounted $5 domain with a $9000 renewal (could the first renewals be made contractually mandatory?), potentially some other weird terms that the agent agreed to for them.

If I was ill spirited I'd go look at how the agents try to buy and setup juicy traps to milk it as much as I can for the first wave.


I would expect the value of a domain purchase + setup handled by an agent is the highest for people that are not very technical. I'd say that a well-engineered agent will do a better job avoiding botching it than your average non-dev.

If the rest of your deployment flow is via the agent, needing to switch over to a different context and open up a browser and login (or create an account) and buy the domain absolutely is a bump in the road.

Lets remind the purpose of incorporating in Delaware is legal tax evasion, so that we don't not have pensions, health insurance or anything nice, really.

Rename to Greedware.


Are you sure you know what you're talking about here?

In the US, regulations on pensions, health insurance etc. are governed by the state that employees physically work in, not by the laws of the state of incorporation.


Please explain. Your comment reveals your lack of understanding of corporate law and the benefits of one state versus the other. And smart companies are going to incorporate in Texas anyway and it has nothing to do with taxes. More to do with corporate governance.

Investors usually expect that non-US founders incorporate in the US, and usually expect Delaware. There are other states that are more friendly to tax avoidance. Delaware is mostly preferred because it's a known quantity with mature regulation. Investors don't want to deal with dozens of different legal regimes, they want the one that they know about.

do you work on a cloudflare delaware-awareness project? Delawareness?

Nope, nothing like it. I'm an Astro maintainer and I work on web frameworks.

The primary purpose of incorporating in Delaware is less about taxes and more that Delaware is the "Silicon Valley" of corporate law - incredible concentration of professionals, infrastructure, and intangibles. Any dispute you have will generally be handled better, faster, and cheaper by Delaware courts than they would be anywhere else. I'll quote my good friend who is a startup M&A lawyer: "I'd go so far as to say that it would be managerial malpractice to incorporate anywhere other than Delaware."

Nevada makes it much harder to sue corporate officers when they do malfeasance. Wyoming has tons of privacy perks for the officers (similar to cayman island accounts). “Perks” though also convert into signaling for the intent of the founders.

No, it’s not. Companies have to pay taxes where they operate regardless of what state they incorporated in.

Stop spreading populist internet bullshit.

Incorporating in Delaware is like 95% about being in a predictable legal framework for any business related dispute imaginable.


Uhuh. And in other places, companies are incorporating in Ireland or Luxembourg or other similar tax evasion heavens because of the "predictable legal framework" too. Lol.

Right, and in other countries they have different laws. In the USA they also pay taxes where they operate. That's how it works.

> it's also for things you do rarely and need agents' help

I recently set up DNSSEC for the first time.

It really was just a bunch of copy-paste from one provider to another.

I like to understand what I'm doing, and LLMs helped greatly with that.

But it was copy-pasting screenshots into chat, so not really agentic.


Last time (after years of doing it manually every once in a while) I just gave codex an ephemeral restricted Cloudflare API Token / key / whatever, the screenshot, and it set up all the records on its own.

I'm not sure the fact that somebody is already rich rich would make them less likely to perform ethically dubious practices to juice their own compensation. In fact I'd say the opposite is more likely.

It's possible for both to be bad and yet one to be worse

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: