HN user

mmaunder

17,333 karma

I'm the founder/CTO of Defiant Inc. We make Wordfence, the most widely used WordPress firewall and malware scanner. We protect over 5 million websites.

https://www.wordfence.com/

We are usually hiring so please check:

https://www.defiant.com/

Email me at:

mark at defiant·com

Posts292
Comments2,189
View on HN
markmaunder.com 6mo ago

The Idiocy of Equating AI with the Dot Com Bubble

mmaunder
2pts3
markmaunder.com 7mo ago

Nature Is Laughing at the AI Build Out

mmaunder
24pts1
simonwillison.net 7mo ago

What happens when the coding becomes the least interesting part of the work

mmaunder
6pts4
news.ycombinator.com 7mo ago

Is Gemini 3 with Gemini CLI having issues?

mmaunder
1pts7
news.ycombinator.com 8mo ago

Tell HN: Gemini 3 with Gemini CLI Is a Game Changer. Impressions with Rust/CUDA

mmaunder
1pts1
old.reddit.com 8mo ago

Codex Degradation Update on Reddit from OpenAI Employee with Full Report

mmaunder
1pts1
markmaunder.com 10mo ago

The Rise of the Operator

mmaunder
3pts0
www.wordfence.com 11mo ago

Pushing Boundaries with Claude Code

mmaunder
2pts0
markmaunder.com 1y ago

RAG Enabled WordPress in Core Could Transform WordPress from CMS to Aims

mmaunder
2pts0
en.wikipedia.org 1y ago

2025 Potomac River mid-air collision

mmaunder
5pts1
markmaunder.com 1y ago

The Nanny Scale

mmaunder
2pts0
markmaunder.com 1y ago

Amidst the noise and haste, Google has successfully pulled a SpaceX

mmaunder
69pts63
markmaunder.com 1y ago

My 2025 AI Predictions

mmaunder
1pts0
news.ycombinator.com 1y ago

Wanted: Great guide on benchmarking LLMs using standard benchmarks

mmaunder
1pts0
markmaunder.com 1y ago

Colorado Mountain Wave in a Cessna 206 Turbo

mmaunder
11pts0
www.wsj.com 1y ago

Porch pirates stealing AT&T phones seconds after delivery

mmaunder
3pts3
markmaunder.com 1y ago

Briefing Something Mission Critical When Failure Is Not an Option

mmaunder
1pts0
spy.org 2y ago

Spy.org has been a blank website for about 30 years. That is all

mmaunder
1pts1
news.ycombinator.com 2y ago

Ask HN: Books on Brand Turnarounds

mmaunder
2pts0
www.wordfence.com 2y ago

Wordfence is paying up to $10k for WordPress vulnerabilities

mmaunder
1pts0
www.wordfence.com 2y ago

Fostering Innovation in Web Security

mmaunder
1pts0
news.ycombinator.com 2y ago

Ask HN: Does Nvidia have any credible competition in the AI/DL space?

mmaunder
22pts15
www.wordfence.com 3y ago

What to Do About AI

mmaunder
1pts0
en.wikipedia.org 3y ago

Googie (Not Google) Architecture

mmaunder
2pts0
en.wikipedia.org 3y ago

The Everything Bubble

mmaunder
1pts0
www.nytimes.com 3y ago

It’s Public Land. But the Public Can’t Reach It

mmaunder
2pts4
www.wordfence.com 4y ago

Securing Port 443: The Gateway to a New Universe

mmaunder
1pts0
www.youtube.com 4y ago

First to market is awkward. Your early adopters will carry you if you find them

mmaunder
3pts0
en.wikipedia.org 4y ago

Bayraktar

mmaunder
4pts0
www.youtube.com 4y ago

Bike Math. Happy Saturday Night HN

mmaunder
2pts0

Seems that “oracle routing” is a term the authors invented. Also sounds like they’re sending requests to all routes but assuming the readers request will route to the “best” model. The closest thing to what they’re describing is semantic routing using a NN search in a vector DB to make a routing decision, but the efficacy of this approach isn’t a slam dunk.

Re local LLMs: “You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions.”

Making the authors stance on LLMs clear.

GPT-5.6 13 days ago

Or an allegedly even more dangerous model that they refuse to release. What a joke Anthropic has become.

The new normal for the next decade: You must protect the public from us and all others, and we are your closest ally so we make your rules for us and our competition. This wasn’t a lucky outcome. They laid the groundwork years ago with the AI “ethics” movement and this was the play all along.

F3 29 days ago

Not quite vaporware, but few commits, PRs, history, actual examples etc. It's pretty thin.

F3 29 days ago

A Wasm decoder takes encoded bytes and returns an iterator of Arrow Buffers. In case you were wondering.

Amazing how the dev community is suffering from a similar inability to approach the subject of real world AI efficiencies and business benefits. I don’t think it’s helpful to accuse the other side of psychosis. It disqualifies any data or experience they bring to the conversation.

Metrics would help others who may want to rescue the project consider the options. Eg user base would make it clear if there’s an immediate opportunity to work with the author to launch a paid backup service around the project, funding continued work on it.

The generous take is that this is someone's pet project that marketing got too excited about, and that the leadership haven't applied their minds to. GPL provides a moat for the community, who are contributing their time and energy into a project. It ensures that, even if a commercial company grabs your software, extends it, and commercializes it, that you can fold those improvements back into your original distribution. While the commercial entity benefits from your free labor, you benefit back from theirs.

Re-implementing WordPress (their words, not mine) as MIT licensed, while legally questionable, breaks that virtuous cycle and removes the community's moat. They've taken WordPress's roles and menus and borrowed its Gutenberg code (which is GPL), and launched it as an MIT licensed product, which breaks that virtuous cycle. It means e.g. a hosting company can take the product closed source if they want to, and never have to contribute any of what they build on top of the community's work, back to the community.

https://github.com/emdash-cms/emdash/tree/main/packages/core... says "The core EmDash CMS package - an Astro-native, agent-portable reimplementation of WordPress."

Emdash uses WP's RBAC roles. Also uses their menus. Also depends on @wordpress/block-serialization-default-parser which I think might (??) be able to be used by an MIT project even though WordPress is GPL.

They used Claude Code it seems because the first commit has a CLAUDE.md file which became an AGENTS.md.

In the source there is an outbound-only Remote Control session that can forward recent transcript history and ongoing user/assistant/local-command events to a claude.ai session, likely for cross-device/session sync, remote viewing, internal dogfooding, or telemetry/ops experiments. It’s separate from the normal explicit /remote-control flow. But in the actual production binary I checked, the mirror helpers are compiled down to hard false, so it does not appear enabled in the shipped distribution build.

Same story for the anti_distillation: ['fake_tools'] path: I could find it in source, but the prod binary I checked does not contain the anti_distillation / fake_tools strings at all.

Claude Code has a server-side anti-distillation opt-in called fake_tools, but the local code does not show the actual mechanism.

The client sometimes sends anti_distillation: ['fake_tools'] in the request body at services/api/claude.ts:301

The client still sends its normal real tools: allTools at services/api/claude.ts:1711

If the model emits a tool name the client does not actually have, the client turns that into No such tool available errors at services/tools/StreamingToolExecutor.ts:77 and services/tools/toolExecution.ts:369

If Anthropic were literally appending extra normal tool definitions to the live tool set, and Claude used them, that would be user-visible breakage.

That leaves a few more plausible possibilities:

Fake_tools is just the name of the server-side experiment, but the implementation is subtler than “append fake tools to the real tool list.”

or

The server may inject tool-looking text into hidden prompt context, with separate hidden instructions not to call it.

or

The server may use decoys only in an internal representation that is useful for poisoning traces/training data but not exposed as real executable tools.