Hacker Newsnew | past | comments | ask | show | jobs | submit | politelemon's commentslogin

They're friendly for the user audience that doesn't care about these things. The location is a minor issue compared to many of the capabilities they come with. For the slightly more tech savvy, they should really be running these harnesses in a contained environment with net cap dropped, for instance.

How is anthropic enforcing the ban, are there identifiers sent from harnesses?

From the Claude Code codemap leak, it seems like Claude Code is sending metadata about the binary that is sending HTTP requests

It's got a little zig mystery blob that does the hashing. Messing with that would run afoul of DMCA anticircumvention right?

they but "minimal dump DRM" into their client (supposedly, from people which leaked the linked source code, no me)

easy to circumvent

but would fall under "circumventing security protections"/"hacking their API"/etc. And due to the sometimes very unreasonable laws the US has in that area they can use that to go after anyone providing a workaround.

Through that maybe won't work well for the EU, I'm not sure how much the laws have been undermined in recent years but we had laws which made it explicitly legal to circumvent DRM iff it's for the sake of producing compatibility (with some caveats).


I think the law just says that it's legal to circumvent DRM for compatibility - they don't define DRM or compatibility. It's one of those vague laws that you only know if it matters when it gets tested in court.

I think if you were going to send the same harness/prompt traffic as Claude Code, then you’d just use Claude Code. Alternatives generally are trying to do something different, thus are going to be easy to detect.

I wouldn’t imagine that fingerprinting them based on request patterns is very difficult.

until your account gets banned.

you can figure out the fingerprinting today, but if they change it tomorrow and wait 5 months to force update everyone, they will catch you and ban


They can just look at the system prompt or tool definitions.

This is a concern and risk that has realised itself multiple times over the past decades. There have been multiple stories linked to multiple developers in the past.

If you publish to any closed platform including ios, mac, win, android, this is the risk you run and a condition of operating you will need to accept.


What is openai's involvement here, as I am out of the loop.

Claude: Autonomous weapons and domestic surveillance are our red line

Pentagon: No

OpenAI: We are okay if the line is merely a suggestion and we encourage you not to cross it!

Pentagon: Yes we pick that option


I assume it's anthropic rejecting the US Government's use of their software for domestic mass surveillance or fully autonomous weapons, and openai happily agreeing to it.

That has led to a significant number of people switching over from openai, or at least stating they were going to do so.


They made a $25 million donation to Trump, which was repaid in kind by designating Anthropic a supply chain risk. Unfortunately, they weren’t nearly subtle enough about this, and went “sure, we’ll take over the contract with no limits on killbots or domestic surveillance, no problem!” on the same day as Anthropic got in trouble, and people put two and two together.

Neither developers nor consumers should be comfortable with this, as this breaks the trust model and is extremely worrying. The site is of course downplaying it given its name, which is a huge shame.

What trust model are you thinking of though? Because another way to look at it is that Apple has pushed an update to ensure these apps keep working and remain secure.

And this is part of the agreement between an app developer and Apple; for a long time now, a developer doesn't upload a full compiled app to Apple, but a package containing partially compiled (itermediary language) code and assets for many different platforms and resolutions, leaving it up to Apple to do the final assembly based on what device it downloads. This allows them to (re)compile for newer hardware, 32 vs 64 bit CPUs, save bandwidth and storage space by only having the device download the assets for its device (and for e.g. games the assets for the level they are playing at that time), etc.

So again, what trust model are you thinking of? Apple is a trusted party when it comes to this, I'd even argue they're more trustworthy than the app developers themselves.


What trust model? Is there anyway to verify that an app from the app store is the same as the one the developer uploaded?

Different people have completely different experiences as they perform different tasks, that shouldn't be difficult to understand. It's a bit like the purported degradation of quality of Google search. It is still excellent for me but I don't doubt that others are experiencing it.

If different people are allowed to have different experiences why are you only getting one set of experiences be controlling?

This is a problem with all the OSes.

I disagree. KDE and Gnome both have pretty consistent UI strategies. You may or may not like them but they have clear identities and design guidelines and follow them.

GTK1, GTK2, GTK3, GTK4, GTK5. Qt1, Qt2, Qt3, Qt4, Qt5.

Yes, those are all different versions of the underlying widget frameworks. I don't understand your point. My current GUI is KDE Plasma 6.6. The only libraries I have installed are Qt 6 (which I am not sure why you didn't list). I have no need for version 5 or 4, or any other. The GUI is consistent.

When I last used Windows, on a fresh install, I saw a mixture of different frameworks used for core OS components from the same vendor.

When I last used OS X, it was pretty consistent but I hear complaints from friends that its no longer the case.


Amusingly, talk like caveman being discussed here: https://news.ycombinator.com/item?id=47647455

It was still likely possible to have retained the originality and novelty of the first site without succumbing to the plague of our contemporary blandness.

You're not wrong. The 2011 version had character. Google+ icons, chat per city, a people search engine. It felt like a place, not a tool.

The tradeoff was deliberate though. Serving 261 countries in 4 languages with an API and MCP Server pushes you toward structure over personality. But I do miss some of that original energy.


I wonder if we ought to be flagging it then? There's already so much uninteresting AI slop observations.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: