yakkomajuri

Finnish libraries are fantastic. Many had free-to-use 3D printers as far back as 2012!

Libraries are a place of possibilities and fun, and it makes people want to be there. You can imagine the long-term positive impact this has.

I love this. My very own static site generator, Teeny [1], is going on five years now. It's 350 lines of hand-written JS and has powered all my blogs and personal websites for years. It currently powers https://yakko.dev.

I added plugins this year which made it really powerful and allows me to keep the core small.

[1] https://github.com/yakkomajuri/teeny

A platform that offers a simple deploy path for internal tools in your own infra.

Basically, build anything using your agent of choice (Claude Code, Codex, etc) and get it live in your company's infra without having to provision anything yourself / loop in a DevOps person.

App goes behind company auth (e.g. SSO), and everything's handled for you: custom domains, governed storage APIs, observability, analytics, role-based access control, etc.

Private Alpha atm.

https://railcode.dev/

OP here. So I've also been running a survey about how developers are feeling about AI (added a link to the post) and 60% of respondents said that using AI actively makes them more tired. Most also report being more productive with AI. One would think these two things combined make up for initiatives for shorter work weeks and the like, but from what I've seen, at least for now, the opposite seems to be happening.

P.S. Sample size is currently small but I've also gathered a fair amount of qualitative data to indicate both of these things. Of course measuring productivity is also far from a science.

Congrats on the launch!

Tiny bit of feedback on the demo video: the beginning makes me dizzy and I'm not sure what's going on (was watching on my phone).

I believe attacks like this often include copying data and then deleting it from the victim's servers.

Although of course returning is a weird term in the sense that the attackers will almost certainly keep the data as well.

DuckDuckGo browser helped mask some stuff, but definitely a fair amount still goes through.

Annoyingly the web is becoming a bit more annoying to browse as a DuckDuckGo (mobile) and Brave (desktop) user. With a VPN on top it gets even worse.

TIL that there are fees for Pix under certain circumstances (e.g. as a business receiving payments). I mostly use Pix for person-to-person transactions, and those are free (and instantaneous).

I don't even remember how we used to split bills back in the day anymore.

I can definitely relate. What's funny is I've always been really social and open to talking to strangers, plus I come from a culture where this is accepted and encouraged (Brazil).

However, I've been working remotely for 7 years now and recently became a solo founder, and I realized I'm having a fair amount of social anxiety. At the previous two companies, I was working remotely but still had people online to chat to, and would meet in person once in a while. Now as a solo founder I've just been working from home and I noticed that when I was leaving the house to buy groceries or work out that was my "break time" and I somehow just wanted to be more alone so I always had my headphones on.

That meant that I became someone who's running away from social interaction the more I actually needed it. And that when placed in a social situation I'm suddenly anxious whereas before this all came very naturally to me (I've also spoken in public very often etc).

How I'm coping:

- Got a WeWork membership

- Leaving the house without headphones

- Striking up conversation with uber drivers, cashiers, etc

- Making an effort to go to events (even flying somewhere at my own expense to speak at a small event for the first time in years)

Unfortunately the article doesn't tell us much. I'd have hoped for some footage beyond what was released by the artist.

It doesn't need to be super layered to be impactful?

Plus the execution is also part of the art.

"Prompts an LLM" -> which LLM?

I saw you're using Gemini for the sentiment rating (which I guess you picked because it's not often mentioned and thus "neutral"? lol)

But would be interesting to get more details overall

Cool project and great domain!

Great question. I assume you mean tools like Composio right?

So the difference here is the granular permissioning layer. In practice it means AgentPort is basically an open source Composio with granular permissions today. But whereas their focus is on just connecting you to everything my focus here is security. And that leads to pretty different products down the line in my opinion.

As for connecting your own tools, I have a feature basically ready to let you create your own integrations. Should launch soon!

OP here. Happy to answer any questions. Security for autonomous agents/claws is a deep rabbit hole that I've jumped into and I'm really interested in having open discussions about how people are approaching it.

Yeah so this is the part where it needs to be tested actively by more people in order to design the best experience.

So today there are two modes:

1. The agent halts and waits for you to approve

2. The agent can fire the tool calls and keep working on other things and only at the end ask for the approvals it needs

It's not perfect, but it does work well in a lot of cases. Retrying is pretty simple because you can just tell the agent to re-run the same tool call and approve it then. As of right now approvals expire within 15min but I'm actually putting a PR up today to make this configurable.

Adding a human in the loop technically does limit how much can be done fully autonomously (e.g. via scheduled agents) but: a) I think the tradeoff is worth it b) it gives me peace of mind to let agents run unsupervised on a schedule for tasks that shouldn't require approval because I know they won't do something they weren't instructed to do when left unsupervised.

Nevertheless, it's a tricky design problem. I prefer the current approach to having to log into AgentPort and approve things from a "pending approvals list" there, but what do you think? What would make most sense to you?

I've been thinking a lot about securing autonomous agents recently and the rabbithole goes deep as you might expect.

One of the principles I believe you should follow is: if there's enough access for an action to be taken, then you must assume that action can be taken at any point.

Basically, if it has access to delere prod data, you should assume it might do it and plan accordingly.

I also believe the actions of your agent are entirely your responsibility.

As part of my digging into securing these systems I've baked some of these principles into AgentPort, a gateway for connecting agents to third-party services with granular permissions.

If anyone's interested in this space:

https://github.com/yakkomajuri/agentport

I do think this is likely to make things more secure but it's also dangerous by potentially giving users a false sense of complete security when the security layer is probabilistic rather than deterministic.

EDIT: it does seem to have a deterministic layer too and I think that's great

Really cool! I'm also building something in this space but taking a slightly different approach. I'm glad to see more focus on security for production agentic workflows though, as I think we don't talk about it enough when it comes to claws and other autonomous agents.

I think you're spot on with the fact that it's so far it's been either all or nothing. You either give an agent a lot of access and it's really powerful but proportionally dangerous or you lock it down so much that it's no longer useful.

I like a lot of the ideas you show here, but I also worry that LLM-as-a-judge is fundamentally a probabilistic guardrail that is inherently limited. How do you see this? It feels dangerous to rely on a security system that's not based on hard limitations but rather probabilities?

I did something very similar recently, just made it open source but haven't posted anywhere.

https://github.com/yakkomajuri/seams

Run `seams .` in any dir and get a rich markdown editor with image uploads, block editing, tables, etc etc

Congrats on launching!

I've been trying out Hermes this week. OpenClaw felt like too much.

It was really easy to setup and I've been getting some value out of it but hasn't been the craziest thing in the world. I'm using it for:

- Unstructured note-taking: I suck at notes and todos and used to have a WhatsApp chat with myself (this is really common in Brazil) where I dump stuff. Now I dump into Hermes and it sorts whatever I put in there into one of various lists like to-do, to-read, to-try, to-buy, and so on.

- Briefings on a cron: I get reminded of my todos every morning and at the end of the day so I can cross stuff off. Later in the day I get reminded of my to-read list. I also get a summary of what went on from my coding orchestrator.

- Some coding: I built my own remote orchestrator and have been using Hermes to manage tasks, review code, and trigger tasks when on the move. Hermes has been a nice interface to allow me to use the orchestrator on my phone.

Haven't connected email or anything else yet. I feel like the security story here is lacking.

Overall it's been interesting but not mind-blowing. Plus setting up was easy but it's a bit buggy at times, messing up where files were and not being able to configure itself according to its own docs.

EDIT: Ah yes and voice notes via WhatsApp out-of-the-box is really nice

I'm inclined to believe this one given the people involved.

Congrats, and I'm rooting for this to work.

I think the comment was out of legitimate interest rather than weighing one against the other

I mean I'm as annoyed as the next person about the outages but I'm not sure correlating with the Microsoft acquisition tells the whole story? GitHub usage has been growing massively I'd imagine?

The abrupt ending was funny and then I realized the author is Finnish and it all made sense.

Nice post.

(P.S. I'm also Finnish)

As others have pointed out this would likely not save you in this case, but there are some phones which do support this, and I know people in Brazil that use these features in order to be able to comply when getting mugged without giving away access to your bank etc.

The most phonetically consistent language I know is Finnish. I believe there is exactly one way to pronounce every word and it's clear to all speakers.

And the least phonetically consistent is English.

This is not new, but it's certainly getting worse and will get even worse. Some large companies used to do bot interviews for low-level positions even pre-AI where the bot would ask a recorded question and you'd have a certain amount of time to answer.

It reminds me of a funny story. I did a Business Management degree at university and during my first year was already freelancing as a dev. But basically everyone around me wanted to work in either consultancy or investment banking (this was in London) so the path was to get accepted for a "spring week" during your first year, internship the second, and then get an offer to work there at the end of your third year.

With all everyone could talk about being applying for spring weeks, I gave in and decided I was going to prove to myself and others that I could do this if I wanted to but I just wanted to be a dev. Applied to JPMorgan and got through to this first bot interview stage. I thought I was knocking it out of the park and then the last question was "Why do you want to work at JP Morgan?". The answer time was something like 30s. I froze for what felt like 15 then blurted out some BS.

That told me all I needed to know. I never again thought about working in this industry and soon after was hired as a developer full-time while taking my studies lightly.

2 years ago I built something I called "social media for blogs" that had some similar ideas. Nothing around encryption though, all on public data.

I'd be keen to revisit those ideas and see if they can take shape in another form.

MIT licensed if anyone's interested: https://github.com/yakkomajuri/recess

For all people have to say about Pete the openclaw guy he's been perhaps one of the most vocal voices about CLIs > MCPs (or maybe his is just the loudest?) and he also built a GSuite CLI that probably inspired this project.

I mean it's great that we get this, hopefully it can continue to be maintained and I'd love to see a push for similar stuff for other products and at other companies.