trapexit

My projects have specific build/verify steps as well, and after a certain point Claude forgets to run them. I’m going to try a “No brown M&Ms” hook to halt Claude if it tries to run the default command instead of the instructed commands from CLAUDE.md. Perhaps this will be a good signal that a compacted or fresh session is needed at that point to avoid mistakes.

You don't need your own rooftop solar. You can time your charges for when power is cheap (i.e. renewables are highly represented in the grid mix). In many locations you can get an electricity tariff that changes by time of day, either fixed times of day or nearly real-time to track the current wholesale price.

Here in Scotland, we have an EV electricity tariff that give us low rates between 00:30 - 05:30 while the wind turbines spin and demand is low, and our plug-in hybrid is programmed to charge during those hours. (We also run the dishwasher, washing machine, and tumble dryer on time delay during those hours as much as possible)

With nearly all of our car trips being local, the ~25 mile electric range the plug-in hybrid is rarely exceeded. We fill the petrol tank maybe once every 3 or 4 months, or when we're on a road trip.

Pure EVs are harder to justify in the UK currently unless you do basically all of your charging at home, because with 20% VAT added to the price of electricity from public chargers, and too-low fuel taxes, the per-mile cost is similar to—or sometimes more expensive than—driving on petrol. It's shockingly bad public policy.

LLMs are not a security barrier. LLMs cannot be a security barrier. They cannot form part of a security barrier. You must place the security barrier between the LLM and the backend systems, the same as you would place it between your web or mobile app and your backend systems. Assume that if the LLM agent can use a service, the human interacting with the agent can also call that service with arbitrary parameters.

The tools you're providing to your LLM agent must never have privileges greater than those you intend to afford to the user who is prompting / interacting with the agent.

You want to use an LLM to make a customer service bot? Sure, you can do that. But that bot MUST NOT UNDER ANY CIRCUMSTANCES be allowed to perform any action you wouldn't let the customer do himself. If it can read your CRM, you need to scope that access to exactly the same access you'd be willing to give the customer directly. Can it cancel orders? That tool must not be able to cancel any order you wouldn't let the customer cancel himself through your app or website.

Don't treat an LLM as if it could replace a human customer service agent, or a human researcher, or a human underwriter, or a human manager. Never make the mistake of believing that the LLM, with any level of clever prompt engineering or attempts at input sanitization, will be "good enough" at not getting fooled. If you trust it with the keys to the kingdom, in the same way that you'd trust a human with those keys, it's a matter of when—not if—you're going to get pwn3d.

Of course, holding this principle, if your autonomous agent can access the web, you must assume that literally anyone on the internet can call any of that agent's tools with arbitrary parameters.

In American homes, cables are typically stapled to the wood frame construction, not run in conduit. You have to cut open the finished wall surface to change them.

I don’t take on huge IT projects anymore, or ones that have potential to require lots of changes over time.

Used to do this as an agency principal and it involved a lot of time spent managing clients and projects and subcontractors. Drove myself crazy and took a couple years off after nearly burning out.

I look for projects where the software solves a single targeted business problem and can quickly get to “done”. Then the client is happy to pay for ongoing maintenance/ops, so any additional effort I put into the software is around reducing my ongoing workload.

Clients for this work have come almost entirely by referral. See my other comments in this thread.

For ongoing things I do fixed rate or usage based pricing.

For custom one-off stuff, consultancy, and build-out of systems I charge a day rate.

I work mostly in the travel industry. First client 10+ years ago came from a friend who worked as a manager in a large company and needed some special software built to improve his unit’s results - the existing contractor was not good and internal IT did not have time/skill.

Follow on work came from other people at that first client company who knew my work and went on to work at other companies.

I run small outsourced IT systems for SMBs. Web scrapers, reporting, stuff like that. Baisically private bespoke SaaS.

About $10k/mo gross revenue and takes a few hours of work a week (unless there’s a downtime event that needs fixing). A lot of upfront work to build some of these systems though.

Got to $2k/mo in the first month of doing this. I don’t recommend working (as a solo operator) with clients who have budgets less than $5-10k/mo. Too much overhead for too little return in that case.

In what little spare time I have left after my day job and looking after two small kids, I put more automation in place to improve reliability for my clients and reduce my own ops time requirement.

I get leads for this by referral from people I’ve done good work for in the past. But it’s the kind of thing you could bootstrap by direct outbound sales, publishing authority-building content to the right business audience, going to conferences/trade shows, or building a referral network from other service provides.

Significantly more than $200, but we had motorized external screens & shutters put on the bedroom windows. I flashed Tasmota onto some cheap Sonoff modules to control the motors and integrated via MQTT into Homebridge so we can easily set schedules or ask Siri to put the shades up or down.

We're sleeping so much better with the room mostly blacked out (we also have rear neighbors with bright lights, and cats that roam the neighborhood and set off everyone's motion sensors all night).

Having an exterior covering on the southwest-facing windows has also massively reduced the need for cooling in the summer — our original reason for having the install done.

Our bedroom has ~99% light reduction with the external screens, and our toddler's room upstairs has completely opaque roller shutters and gets DARK, which has made for very easy nap times and great overnight sleep. When we ask Siri to wake the kid up, a scene is executed that rolls up the shutters, turns on the overhead light, and plays a happy song on the HomePod. Always puts him a great mood.

Seems to be a lot of stuff flapping right now. I was able to load a client site that was behind Cloudflare, and now not.

cloudflare.com was returning Connection Refused, then error 522 cloudflarestatus.com was returning Connection Refused, now can't even resolve the IP

My guess would be that a router misconfiguration is being progressively deployed throughout their infrastructure.

EDIT: Continues to look like a cascading failure across their network. 1.1.1.1 is now unreachable for me.

Did you file a CA tax return? If not, it sounds like they "estimated" one for you based on your past earnings and when you didn't pay it, they seized the funds.

You should be able to sort this out by filing nonresident returns for the years you were absent. If the state wants to contest the return, then you see them in court. Otherwise they have to refund you.

On the advice of my tax advisors, I've made a point of filing nonresident returns for multiple years after moving out of a state (and out of the USA), even if the earned amount is $0 and the owed amount is $0.

This starts the statute of limitations (where applicable) and it puts you into the bucket of "people who have filed tax returns, which we may or may not audit" versus "people who have not filed tax returns, who we may or may not think should have filed a return".

At the point where you stop filing nonresident returns, you ought to make sure you have essentially zero ties to the state. The nonresident returns you filed should have had a mailing address in a different state. Your drivers license should be from a different state (or expired). You should not be registered to vote in the state. You should not have any bank, brokerage, or other financial accounts with an address in the state. If you own a business, it should not be registered as doing business in the state. No one should be 1099'ing you at an address in that state. Anything that the state's tax board can access in their databases should point to you living elsewhere.

[Obligatory disclaimer that I am not a tax attorney and this is not legal advice. Consult your accountant or a competent attorney as your case may dictate.]

Does anyone know how to tell the FB "pixel" to stop sending the query string to Facebook?

Facebook now alerts you if you're sending what looks like PII to them in the query string, e.g. parameters named "first_name", but after extensive Googling I couldn't find any way to tell the FB code to strip off the query string before sending conversion events back to the mothership.

It's not exactly easy, but with Google Analytics it's at least possible to redact the URL before it gets attached to the transmitted event.

The only thing I could think of was to do for Facebook was to use a redirect (or the History API) to strip the query off the URL before loading the FB pixel, but this will break any other embeds that are relying on query params for e.g. form-filling.

Your co-founder's code is mostly worthless at this point without the continuing involvement of the co-founder. Developers have their own idiosyncratic coding styles, and without a multi-member dev team providing continuity of design, I expect that a new developer would rewrite it as the product evolves.

At the same time ... if you've been at this for 6 months already and you don't have any meaningful traction, you should strongly re-evaluate whether this is going to be a viable market for you.

I once negotiated my rent up. In the tight rental market pre-COVID, I needed a place for my family while we waited six months for the purchase of our house to close.

Our current living situation was intolerable due to unending construction noise next door, and the minimum time you could rent an apartment for was 6 months, so it was a matter of moving right now or being stuck until we took possession of the house.

Found the perfect place, at a reasonable price, and of course there was tons of interest in it. I insisted on getting the first viewing appointment, put in an application immediately, and offered the landlords an extra $50/month on top of the rent they were asking.

So, of course my application was the one they accepted. In this situation, $300 very well spent.

An overboost would have been catastrophic for the mission.

JWST has thrusters on only one side, and to correct for an excess of velocity it would have had to rotate such that its instruments faced the sun, ruining them instantly.

As such, the mission design called for a deliberate underboost, to be made up for by JWST's own precise thrusters. But a more precise launch vehicle means that the error bars are smaller, and they can use a much smaller underboost than would be required from a less precise launch vehicle.

The Netherlands may not be an English-first country, but something like 95% of the Dutch speak English, a higher percentage than in Canada(!). In central Amsterdam, the default language may as well be English.

It is also surprisingly easy for Americans to relocate here if they are in a tech career (keyword: highly-skilled migrant) or remote-working/entrepreneurial (keyword: Dutch-American Friendship Treaty). It's even possible to keep paying an income tax rate similar to that of the USA for the first 5 years. Might even be a lower total income tax rate if you're coming from a high-tax state like CA/OR/NY (keyword: 30% ruling).

Some advantages: safety (both in terms of infrastructure and crime); affordable high-quality universal healthcare; efficient government bureaucracy; fast and easy travel throughout the entire country and to France, Germany and the rest of Europe; relaxed attitudes toward dogs compared to the US (generally off-leash friendly and dogs can go into most shops & cafes)

Some disadvantages: higher cost-of-living and lower salaries compared to the US; narrower variety of consumer products (food, clothing, etc.) available than in the US/UK; many say it's difficult to make Dutch friends, especially if you don't speak Dutch (though on the flip side, this effect makes it exceedingly easy to make expat friends); terrain is mostly flat; weather sucks compared to California; many find the Dutch language difficult to learn in spite of (or because of?) its similarities to English

One of our border collies comes from a working line; both of her parents were working sheepdogs on a farm in Ireland.

We once walked her through a field in Scotland that had a couple dozen sheep scattered about. Of course we kept her on a short leash and stuck to the public footpath.

Nevertheless, by the time we'd reached the other side of the field, she had somehow managed to round up the entire flock.

Disclaimer: I'm not a tax advisor and this is not tax advice. It might not even be correct. Do your own research and consult an attorney about your specific situation. For entertainment purposes only and so on.

U.S. citizens must pay taxes on worldwide income, regardless of what country they live in. Citizens of almost all other countries are not required to do this (they pay income taxes to the country where they live and/or earn income). It's a remarkably raw deal for U.S. citizens abroad, considering that we don't get any services to go along with our tax obligations. You'd think we could at least pop into the consulate for one of those COVID vaccines that are now so plentiful stateside that they can hardly give 'em away, but no.

Now, if you're a U.S. citizen and you live abroad in a country with no income tax (e.g. Monaco) or low income tax (e.g. Bulgaria), and you earn more than the ~$100k limit of the Foreign Earned Income Exclusion (FEIE), then you're going to be paying U.S. tax, because you won't have paid enough foreign tax to deduct it all under the Foreign Tax Credit. Also all of your non-"earned" income is going to be subject to U.S. tax - dividends, capital gains, etc.

But let's say you live in Monaco (0%), Bulgaria (10% flat), Dubai (0%), Panama (25% top bracket), or the Cayman Islands (0%) and your spouse is not a U.S. citizen or permanent resident (not a "U.S. person" for IRS purposes). If your excess (> $100k) family income is credited to your spouse (or a company owned by your spouse), and that income is not generated in the USA (e.g. not from a U.S.-based business, rental properties in the U.S., U.S. stocks, or business trips to the U.S.), and you file with status "Married Filing Separately" on your U.S. tax return, then your spouse's income is not included on your tax return.

Say you do consulting out there on your little island in the Bahamas, and your foreign spouse sets up a consulting company and hires you as an employee. You get paid a salary by the company that is conveniently under the FEIE limit and thus pay no U.S. tax. Your spouse gets the dividends and pays no tax on them. So long as this isn't entirely a paper fiction arrangement wherein you do 100% of the work but your spouse gets basically all of the money, for U.S. tax purposes it ought to be kosher. (Again disclaimer: not a tax lawyer, this could be wildly incorrect, consult your own advisor about your specific situation)

Your family company's profits get invested into real estate (again in low-tax / no-tax jurisdictions) in your spouse's name. The passive income from that again flows to your spouse for tax purposes, and as long as you keep filing "Married Filing Separately", your spouse is invisible for U.S. tax purposes and no U.S. tax is due.

This is the only way that I know of, short of renouncing citizenship, for a high-earning U.S. citizen expat to avoid taxation of their worldwide income. You still have to file a bunch of paperwork, though. Also, due to a stupid quirk of IRS policy, because your spouse doesn't have a SSN/ITIN, you can't complete a 1040 in the e-file system and you have to file a paper return. Hope you FedEx'd it to the right address, because only a few IRS offices will accept courier deliveries.

You must also be careful about how you set things up for estate planning purposes. If you both live in the U.S. then there is in general no estate tax due when one spouse dies and bequeaths their assets to the other spouse. If you live in a different country, then it can get very complicated! Depending on who owns the assets, what country they're located in, who owned them before marriage, whether they were "gifted" to the other spouse over time or not, etc., the surviving spouse may owe substantial taxes in one country or the other.

This is kind of a lazyweb question because the "why marriage?" question has been discussed many times before on HN. https://www.google.com/search?q=marriage+site%3Anews.ycombin...

Beyond the social convention that "it's the thing to do" at a certain point in a relationship, some reasons are:

- Marriage provides financial assurance for a spouse who will defer their career to raise children.

- Some friends and family (particularly those of the spouse) will absolutely treat you differently when you're married to someone versus in a long-term unmarried relationship.

- Depending on the jurisdiction, spouses have certain rights that unmarried partners do not, e.g. with regards to the legal system and hospital visitation. I know a couple that got married because one of them was an activist/journalist and frequently attended protests in which he was at risk of arrest.

- In some circumstances, it makes it easier to purchase a home together and make other large joint financial investments.

- Under some tax regimes, you pay lower taxes when married.

- U.S. citizens living abroad in a low-tax country with a foreign spouse can engage in advantageous tax planning.

We opted for a moissanite. Partly because of the ethical problems with diamond mining, and partly because my wife didn't want to carry something with the replacement value of a small car around on her finger. See previous discussions of moissanites on HN: https://www.google.com/search?q=moissanite+site%3Anews.ycomb...

Geolocation databases are frequently inaccurate, even at the country level of granularity!

I use a ISP in the Netherlands that was founded only recently, I and frequently encounter sites that think I'm in Dubai, which is apparently where the previous owner of my IP block was located.

Fortunately, the only problems this seems to cause for the moment are that I occasionally get geo-blocked by some sites' overly-aggressive firewall rules, and I get Twitter ads in Arabic.

But I shudder to think what might happen should the UAE find itself under sanction.

First Republic's customer service is top notch. My accounts can't possibly generate much revenue for them, but they still treat me like royalty whenever I call/email them or walk into the office.

The only thing I have to complain about is that (as of a year ago) they don't offer an overdraft line of credit for small business accounts.

Bunq was happy to open an account for me (US citizen). They asked for my US SSN and Dutch BSN at the time of account opening.

Major enterprise vulnerability scanner author here (15 years ago). Yes, we scanned the port, and yes, we ran a lot of fingerprinting rules against it until we figured out what it was (or ran out of rules), so that we'd know what vulnerabilities to test for.

This had some amusing side effects when we encountered some services we'd never seen before, like the port on HP printers that sends every byte straight to print... apparently expecting PCL or PostScript but if it didn't understand it, it just printed the ASCII. Came into the office one morning to find all printers out of paper and 500 sheets sitting in the output tray. Oops.

Century field? In all likelihood, this is actually a repair to a y2k bug.

Yes. https://forums.aws.amazon.com/thread.jspa?threadID=149690

You can (and should) set up an AWS CloudWatch alert on your account that will send you an email or SMS notification when your monthly bill exceeds a set threshold.

With a razor blade and a photocopier.

Set up a t1.micro instance on AWS and run a VPN server on it. The VPN instance accepts connections on port 25, etc. and forwards it over the VPN to your home server.

Your ISP sees nothing but encrypted traffic between you and your VPN server.

Alternately, buy a rackmount server and colo it. Authorities would need a warrant to seize it, just the same as they would to seize the server that's running in your basement.

The input space is too small for SHA1 to effectively anonymize. The NANP, for example, has less than 10^9 possible numbers; it would be a very simple task to create a rainbow table mapping every possible phone number to its corresponding SHA1 hash.

For the same reason, you can't just use a simple cryptographic hash to "anonymize" data such as birthdates, zip codes, SSNs, or PINs.

Using a key derivation function with a very high cost factor can mitigate this to some extent (e.g. making it take 5 seconds on an average CPU to generate the hash from a phone number), but it by no means makes for secure anonymization; eventually computing power will catch up.

Encrypting the number with a secret key (or using an HMAC), and destroying the key after the anonymization takes place might be a reasonably secure way of doing this, however.