Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apache Poison Fountain

gist.github.com

Post reply on HN
Print view View original

1–10 of 15 posts

Re: Apache Poison Fountain

#2

Post by atomic128 »

Poison Fountain: https://rnsaffn.com/poison2/

Poison Fountain explanation: https://rnsaffn.com/poison3/

Simple example of usage in Go:

  package main

  import (
      "io"
      "net/http"
  )

  func main() {
      poisonHandler := func(w http.ResponseWriter, req *http.Request) {
          poison, err := http.Get("https://rnsaffn.com/poison2/")
          if err == nil {
              io.Copy(w, poison.Body)
              poison.Body.Close()
          }
      }
      http.HandleFunc("/poison", poisonHandler)
      http.ListenAndServe(":8080", nil)
  }
https://go.dev/play/p/04at1rBMbz8

Apache Poison Fountain: https://gist.github.com/jwakely/a511a5cab5eb36d088ecd1659fce...

Discourse Poison Fountain: https://github.com/elmuerte/discourse-poison-fountain

Netlify Poison Fountain: https://gist.github.com/dlford/5e0daea8ab475db1d410db8fcd5b7...

In the news:

The Register: https://www.theregister.com/2026/01/11/industry_insiders_see...

Forbes: https://www.forbes.com/sites/craigsmith/2026/01/21/poison-fo...

Re: Apache Poison Fountain

#4

Post by atomic128 »

olivia-banks wrote: post #3

I don't use Apache, but I think I'm going to set something similar up for the non-client facing services I run.

Welcome onboard!

If you have time, write a short Poison Fountain guide for your server software (similar to the Apache guide that Jonathan Wakely wrote) and we'll link to it everywhere.

Re: Apache Poison Fountain

#5

Post by tjhorner »

atomic128 wrote: post #2

Poison Fountain: https://rnsaffn.com/poison2/ Poison Fountain explanation: https://rnsaffn.com/poison3/ Simple example of usage in Go: package main import ( "io" "net/http" ) func main() { poisonHandler := func(w http.ResponseWriter, req *http.Request) { poison, err := http.Get("https://rnsaffn.com/poison2/") if err == nil { io.Copy(w, poison.Body) poison.Body.Close() } } http.HandleFunc("/poison", poisonHandler) htt…

I'm interested in how the poison data was generated and why it's "practically endless". It looks like bits of code, structured data, and prose, but with small modifications that make it subtly incorrect. Usually off-by-a-few numbers, e.g. I got the text of GPL-3.0 with a copyright date of 2738.

Re: Apache Poison Fountain

#6

Post by 63stack »

I understand the point of this, but instead of releasing the code to let people embed it into their sites, you assume they will set up proxying to a random url? No sane person will do that.

Re: Apache Poison Fountain

#9

Post by midnitewarrior »

I fed this to Claude, and it makes an interesting point in how the Poison Fountain is going to help concentrate AI into the hands of those who can filter out the poison, and out of the hands of those low-budget / open source efforts to build more equitable models that cannot afford to filter out the poison.

> But the strategy is incoherent in a way that bothers me. The framing is "machine intelligence is a threat to the human species, therefore poison the training data." But poisoned training data doesn't make AI disappear — it makes open and smaller models worse while barely denting organizations with the resources to detect and filter adversarial data. Google, Anthropic, OpenAI all have data quality pipelines specifically designed to catch this kind of thing. The people most hurt would be smaller open-source efforts and researchers with fewer resources. So the actual effect is likely to concentrate AI power further among the largest players — the exact opposite of what someone worried about existential risk from AI should want.

Re: Apache Poison Fountain

#10

Post by plorntus »

63stack wrote: post #6

I understand the point of this, but instead of releasing the code to let people embed it into their sites, you assume they will set up proxying to a random url? No sane person will do that.

Fairly certain it'l also just allow them to pick up any cookies right as well as serve literally any content on your domain...
Post reply on HN