HNHacker News
TopNewBestAskShowJobs

calrain

536 karma · joined July 19, 2017

I work in Identity and Access Management, Cyber Security, Infrastructure, and software development.

My key focus is helping organizations do security better, make it simpler, and get alerted when things get messy.

submissionscomments
calrain··on How long it takes to know if a job is right for you or not
I find that I pick companies to work with when my goals and their goals align.

I visualize this alignment like two boats travelling on the ocean together, with a rope that runs between them, connecting them.

When the alignment is strong, the tension on the rope is low, and it's a great place to work at.

But over time, the direction of either party can change, and it results in a better alignment, or a drift from each other that starts to put the rope under increasing tension.

It's possible that the tension on the rope is good, and your trajectory will adjust. But due to the size of the company it's unlikely your small boat can adjust the heading of the company, but you might succeed, if you try.

The key is to know when the rope is about to break, and then disconnect from that company and start the process again with another company, aligned in your direction.

calrain··on Apple Developer Video: Meet Liquid Glass
It's important to justify the hardware upgrades of each generation of iPhone.
calrain··on Poison everywhere: No output from your MCP server is safe
Yes, this is just 'your code' if you're writing your own MCP code, but it's also 'Googles' code if you're using their MCP service in front of GMail.

As with all code reviews, supply chain validation, CVE scanning, SNYK, whatever, definitely keep doing that for your home brew MCP implementation.

For the commercial stuff, then that falls under the terms of service umbrella that covers all the stuff your company is still using from them.

This article from CyberArk seemed to be fear mongering, not really educating people on writing better code.

Not sure what their angle is, unless they are about to deliver a MCP Server service.

calrain··on Poison everywhere: No output from your MCP server is safe
This is true for any code you install from a third party.

Control your own MCP Server, your own supply chain, and this isn't an issue.

Ensure it's mapped into your risk matrix when evaluating MCP services before implementing them in your organisation.

calrain··on Vibe Coding Is Driving
I like the analogy, but I'd adjust it a bit.

Vibe Coding is you teaching a learner how to drive a car. You are in the passenger seat, and your job is to get the learner to drive the car to where you want to go.

The learner has a lot of book knowledge, knows the traffic rules, knows the car, but doesn't have much experience driving for you and needs help driving in a way that is suitable for the roads you have to travel over.

calrain··on I built my first website
I am not sure what the site offers on landing, why would i invest the time to register?

maybe provide an animated slide deck of the problem you are facing, or the challenge you are posing, and how does your site help with that.

It mentions history, but I'm not sure of what that is. The history of Pokemon characters, a brief history of time? or something to do with ruins?

calrain··on How to Store Data on Paper?
First, encode data as an image. Second, work out the best image for printing/scanning purposes.

I saw some work a while ago of storing SQL extracted table data as an image, and always thought that with good compression and a good printer, you could make paper copies.

calrain··on Poison Pill: Is the killer behind 1982 Tylenol poisonings still on the loose?
I would expect a broad spectrum quality test, of which cyanide would be one of the components tested for.
calrain··on Show HN: Kan.bn – An open-source alterative to Trello
Without making generalisations, I'm trying to leverage LLM as much as possible to see how they can help.

I know there is a lot of hype about LLM's and I'm genuinely interested in the niches that they can fill, and where they definitely shouldn't be involved in the software development process.

I would say I'm an expert level programmer in the small field that I work in, and have set up development teams in the past.

I think that is an advantage to working with integrating LLMs into a dev cycle as I have experience in providing structure with developers, something that LLMs 100% require, without a shred of doubt.

As the capability of LLMs continues to grow, having some framework around where they are 'almost good enough' will help re-evalutate them as they improve.

I'm not trying to prove anything to anyone else, just build a reference point for where we are now.

calrain··on Show HN: Kan.bn – An open-source alterative to Trello
Will try, thanks!
calrain··on Show HN: Kan.bn – An open-source alterative to Trello
AI is just a tool, it's no more useful than a non-complaining junior dev that constantly needs direction, but it sure can cut out a lot of repetitive work.

I am more productive using it, but that is just me.

calrain··on Moats in the Age of AI
I'm taking a nuanced approach to make it more difficult to 'me too' my idea, even though I am heavily leveraging AI development.

My test is to build a layered business model where the initial development is a unique solution to an old problem, but that isn't what I will sell.

The goal is to build 2 or more layers of innovation on top of each other, so that a direct attack on the product you are selling is more difficult.

In order to sell what I will sell, you will need to implement the multiple layers that sit under that service.

If AI is your end state product, I think you will find it difficult to build a moat.

calrain··on Show HN: Kan.bn – An open-source alterative to Trello
I've been testing using AI coding agents by asking an AI acting as a software designer to build a set of kanban style cards as .md files in a directory, designing the work we talked about into cards for AI developers.

It works quite well, and then you can review the cards (as files) and then ask another AI agent running as whatever role is suitable for that card, to pick up the card by name and do the work.

But there is no kanban board, it's just .md files in a folder.

I am continuing to test this, as transfer of context between AI sessions is an interesting challenge, and leveraging md files as if they are kanban / agile style cards, is interesting.

calrain··on If you are useful, it doesn't mean you are valued
Do your job and you will always be useful, rarely valued.
calrain··on Theory of Stupidity [pdf]
> A stupid person is a person who causes losses to another person, or to a group of persons, while deriving no gain for himself, and possibly incurring losses.

This is a good definition, one we need to talk about more and not associate it with IQ or other social indicators.

calrain··on Highlights from the Claude 4 system prompt
Everything!
calrain··on Ask HN: Anyone struggling to get value out of coding LLMs?

  It's easy to get good productivity out of LLMs in complex apps, here are my tips:

  Create a directory in the root of your project called /specs

  Chat with a LLM to drill into ideas having it play the role of a Startup Advisor, work through problem definitions, what your approach is, and build a high level plan.

  If you are happy with the state of your direction, ask the LLM to build a product-strategy.md file with the sole purpose of describing to an AI Agent what the goal of the project is.

  Discuss with an LLM all sorts of issues like:

    Components of the site

    Mono Repo vs targeted repos  

    Security issues and your approach to them

    High level map of technologies you will use

    Strong references to KISS rules and don't over complicate

    A key rule is do not build features for future use


  Wrap that up in a spec md file

  Continue this process until you have a detailed spec, with smaller .md files indexed from your main README.md spec file

  Continue promoting the role of AI Developer, AI Consumer, AI Advisor, End User

  Break all work into Phase 1 (MVP), Phase 2, and future phases, don't get more granular (only do Phase 2 if needed)

  Ask LLM to document best practice development standards and document in your CLAUDE.md or whatever you use. Discuss the standards, err to industry standard if you are lost

  Challenge the LLM while building standards, keep looping back and adjusting earlier assumptions

  Instruct AI Agents like Claude Code to target on specific spec files and implement only Phase 1. If you get stuck on how to do that, ask an LLM on how to prompt your coding agent to focus, you will learn how they operate.

  Always ask the coding agent to review any markdown files used to document your solution and update with current features, progress, and next issues.

  Paste all .md files back into other AI's e.g. high models of ChatGPT and ask it to review and identify missing areas / issues

  Don't believe everything the agents say, challenge them and refuse to let them make you happy or confirm your actions, that is not their job.

  Always provide context around errors that you want to solve, read the error, read the line number, paste in the whole function or focus your Cursor.ai prompt to that file.

  Work with all the AI's, each has their strength.

  Don't use the free models, pay, it's like running a business with borrowed tools, don't.

  Learn like crazy, there are so many tips I'm nowhere near learning.

  Be kind to your agent
(Edited: formatting)
calrain··on Pro-doping Enhanced Games to debut in Las Vegas in 2026
This is one of those idiotic ideas I had about 30 years ago.

Clearly the bar for 'idiotic ideas' has moved.

calrain··on Getting a paper accepted
...and that is how you start a career in Marketing...
calrain··on “Streaming vs. Batch” Is a Wrong Dichotomy, and I Think It's Confusing
For me, a key difference is:

- 'Streaming' means the consumer determines server utilization rates

- 'Batch' means the server determines server utilization rates

I much prefer Batch as the processing can be performed when the server has appropriate resources, helping products run on lower spec servers.

calrain··on What were the MS-DOS programs that the moricons.dll icons were intended for?
I used these all the time when rolling out Windows 3.1 and 3.11 for thousands of computers back in the early 90's.

You would just pick any icon that seemed relevant, with a focus on not choosing the same icon for two different applications.

Computer GUI's were so new then that people didn't really care if the icon was 100% correct or not.

Sometimes for big applications I would draw up an icon and then use it, but mainly try to stay on moricons.dll or any dll's that came with the application that might contain icons.

calrain··on Material 3 Expressive
If that page is an example of Material 3 Expressive then it's a hard no.

It is nauseating how text blocks keep moving after a scroll, and the animations are a solid 15 year step back in time.

I won't be using it on any projects, and I will spend much less time on any site that uses it.

calrain··on The cryptography behind passkeys
There was an interesting Kickstarter a while ago called DiceKeys https://www.crowdsupply.com/dicekeys/dicekeys that provided a physical mechanism to store the seed of a passkey.

If you then purchased passkeys that supported a custom seed, you could then replicate this seed to as many keys as you needed.

There are always security tradeoffs, but this was a mechanism to store something in the real world that had about 115 bits of entropy, as 'Something you know'

calrain··on "World's First" 500Hz Gaming Monitor
Is there any evidence that people can notice improvements above about 220Hz?

There seems to be a worthless arms race on high monitor refresh rates and there are heavily diminishing returns past 220Hz.

calrain··on Ask HN: Are LLMs useful or harmful when learning to program?
I think they are useful as long as you use them the right way.

Dig into problems, try to understand why it was solved a specific way, ask what are the con's of doing it another way, and let it know you are a learning and want to understand more of the fundamentals.

LLMs are just a tool, so try and use them to help you learn the fundamentals of the language.

It could also be argued that using StackOverflow to solve a problem doesn't help you understand a problem, and equally, just asking an LLM for answers doesn't help you understand the language.

calrain··on Microsoft Teams will soon block screen capture during meetings
Just take a picture with your smartphone and email it to whomever you want.

Blocking screen captures is an example of 'Security Theatre'

calrain··on Ask HN: How to incentivize my Eng team to update tasks after daily standups?
Focus more on what is important to them.

They are delivering the work, you need to understand why they don't have time to update tasks and why they don't see it as a priority.

Your goal should be to understand their position, not force them to do something that they see as low priority.

Successful projects don't come from engineers being forced to do Agile ceremonies.

calrain··on Unmarked Vans. Secret Lists. Public Denunciations. Our Police State Has Arrived
The people have all the power, but only if they Vote
calrain··on Tesla's all-time net income is still below Elon Musk's $55B compensation package
For the wealthiest, there's no such thing as 'enough.' The game isn't about money anymore - it's about keeping score.

When a company's lifetime profits still don't match a single executive's payout, it's clear the system has no upper bound.

calrain··on 300-year-old Polish beech voted Tree of the Year
That Scottish tree is amazing
← PreviousPage 3 of 8Next →