News for hackers. Stuff that matters.

noperator

Re:OpenAI agent hacked Australian government website, PM says on Thursday September 24, 2026 @11:57AM (#49832540)
I discussed this here: "Who bankrolls the AI agent swarm?"

> A highly capable agent swarm requires an absurd amount of resources. Either the swarm steals tons of compute from a company that has a lot of money to burn and doesn't address a massive spike in its cloud bill, or a company intentionally commits those resources but is negligent about monitoring the workload.

https://noperator.dev/posts/who-bankrolls-the-ai-agent-swarm...

Re:Leanstral 1.5: Proof Abundance for All on Friday July 03, 2026 @09:39PM (#48781899)
Leanstral 1.5 has 6B active parameters. How many parameters does GPT-5.5 have?
Yes, I did end up figuring out a clean way to allow normal reasoning inside <think> and then force JSON _after_ the closing </think>. Example here: https://gist.github.com/noperator/6c711ab19027ea8056442df839...
Having some success while testing this model out as a replacement for GPT-5 nano in source code security review. Running on RTX 3090 (24 GB VRAM) via vLLM. It's not great on structured output (as noted in the model card) but I'm working around that in my harness.
Re:Let's discuss sandbox isolation on Friday February 27, 2026 @04:54PM (#47186196)
> compute isolation means nothing if the sandbox can freely phone home.

Here's a project I've been working on to address the network risk. Uses nftables firewall allowing outbound traffic only to an explicit pinned domain allowlist (continuously refreshes DNS resolutions in the background).

https://github.com/noperator/cagent

Re:Computing, Convivially on Saturday January 10, 2026 @09:00PM (#46572029)
Digital technologies can be terribly destructive, but they can also be gloriously empowering. How do we shape them into tools for conviviality rather than means of domination?
Re:Jqfmt like gofmt, but for jq on Monday July 21, 2025 @05:15PM (#44640503)
My prototype one-liners usually turn into Go programs :)
Re:Jqfmt like gofmt, but for jq on Monday July 21, 2025 @05:14PM (#44640492)
if you like fx, then you'll love https://jless.io/
Re:Jqfmt like gofmt, but for jq on Monday July 21, 2025 @03:38PM (#44639501)
Hey, author here. see also, sol: a de-minifier (formatter, exploder, beautifier) for shell one-liners

https://github.com/noperator/sol

I actually wrote jqfmt because I needed it for sol :)

kind of meta, but one of my most-used commands is sol: a de-minifier (formatter, exploder, beautifier) for shell one-liners

https://github.com/noperator/sol

Re:I used o3 to profile myself from my saved Pocket links on Tuesday July 08, 2025 @09:47AM (#44499938)
Awesome! I found this section interesting: https://blog.kelvin.ma/posts/an-ode-to-pocket-analysis-of-ex...

I don't think of HN as a source itself but rather a way to discover sources. So I think my Pocket data reflects sources that I've discovered, but to your point, doesn't represent everything I've read from those sources.

Re:I used o3 to profile myself from my saved Pocket links on Tuesday July 08, 2025 @09:39AM (#44499858)
Moved to Wallabag, but note that I don't read anything via Wallabag (or Pocket) UI. I export saved items as an RSS feed which I consume in an RSS reader like Inoreader or FreshRSS.
Re:I used o3 to profile myself from my saved Pocket links on Tuesday July 08, 2025 @09:34AM (#44499830)
Hugo lives on GitHub which autodeploys to Cloudflare Pages. https://developers.cloudflare.com/pages/framework-guides/dep...
Re:Remotely Wipe a Server (2011) on Monday July 07, 2025 @08:32PM (#44495884)
> This is a relatively simple request when the server is under your desk: boot a rescue disk, use a tool like shred to wipe the data on all the hard drives, then press the power button. When the server is in a remote data center, it's a little more challenging: use a remote console to reboot into a rescue disk, wipe the server, then remotely pull the power using some networked PDU. When, like me, you have to wipe a server thousands of miles away with no remote console, no remote power, no remote help and only an SSH connection, you start scratching your head.
o3 spent that time "thinking" and built the profile using only the URLs/titles, no content fetching.
Thanks all for your feedback. Adjusted the title to clearly reflect that I'm the agent here.
Recalling Simon Willison’s recent geoguessing challenge for o3, I considered, “What might o3 be able to tell me about myself, simply based on a list of URLs I’ve chosen to save?”

Show HN: curlmin – Curl Request Minimizer

https://github.com/noperator/curlmin

curlmin is a CLI tool that minimizes curl commands by removing unnecessary headers, cookies, and query parameters while ensuring the response remains the same. This is especially handy when copying a network request "as cURL" in Chrome DevTools' Network panel (Right-click page &gt; Inspect &gt; Network &gt; Right-click request &gt; Copy &gt; Copy as cURL).I use Chrome's "Copy as cURL" _a lot_...

( Read More... | no comments | 2 points | on HN )
Re:Tldx – CLI tool for fast domain name discovery on Sunday June 01, 2025 @09:18AM (#44150660)
You can also use https://github.com/noperator/raink to brainstorm TLDs that are relevant to some topic you care about. For example:

    curl -s https://data.iana.org/TLD/tlds-alpha-by-domain.txt |
        raink -f /dev/stdin -p 'which of these TLDs is most related to the concept of "hacking"?' |
        jq -r 'map(.value)[:10]'
    
    [
      "BLACK",
      "COMSEC",
      "TOOLS",
      "SECURITY",
      "ZERO",
      "EXPOSED",
      "FORUM",
      "SHELL",
      "BOT",
      "SOFTWARE"
    ]
Those are all in the IANA list but not all can be registered—just showing as PoC. See https://bishopfox.com/blog/raink-llms-document-ranking for more background.
Re:Hard problems that reduce to document ranking on Tuesday February 25, 2025 @03:11PM (#43176712)
Agree. I think LLMs are usually not "harnessed" correctly for complex, multi-step problems—hence the `raink` CLI tool: https://github.com/noperator/raink

Older »