Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

871–880 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#871
post #134

Earlier quoted context omitted.

You'll never win this battle, so why waste feelings and energy on it? That's where the internet is headed. There's no magical human verification technology coming to save us.

> You'll never win this battle, so why waste feelings and energy on it? Cool. The attitude of a bully. Thanks for the contribution!

[dead]

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#872
post #684

Earlier quoted context omitted.

I can prove all contributions to stagex are by humans because we all belong to a 25 year old web of trust with 5444 endorser keys including most redhat, debian, ubuntu, and fedora maintainers, with all of our own maintainer keys in smartcards we tap to sign every review and commit, and we do background checks on every new maintainer. I am completely serious. We have always had a working proof of human system called W…

nothing about this proves anything except that someone or something had access to the key.

Do you think it is likely that the majority of the people that spent decades building this trust graph and gaining the trust needed to be release engineers on the packages that power the whole internet are just going to hand off control of that key to a bot?

Anyone doing so would be setting their professional reputations completely on fire, and burning your in-person-built web of trust is a once in a lifetime thing.

Basically, we trust the keys belong to humans and are controlled by humans because to do otherwise would be a violation of the universally understood trust contract and would thus be reputational bankruptcy that would take years to overcome, if ever.

Even so, we assume at least one maintainer is dishonest at all times, which is why every action needs signatures from two or more maintainers.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#873
post #869

Earlier quoted context omitted.

With 5400+ people I am betting that you have at least one person in your 'web of trust' that no longer deserves that trust. That's one of the intrinsic problems with webs of trust (and with democracy...), you extend your trust but it does not automatically revoke when the person can no longer be trusted.

Of course! There are always edge cases, but I would suspect the number of bots signed by reputable keys to be near 0%, and the honest human score in this trust graph to be well over 90%. Compare to how much we should trust any random unsigned key signing commits, or unsigned commits, in which the trust should be 0% unless you have reviewed the code yourself.

The problem is all it really takes is one edge case to successfully break a web of trust to the point that the web of trust becomes a blind spot. Instead of distrusting everybody (which should be the default) the web of trust attempts to create a 'walled garden of trust' and behind that wall everybody can be friendly. That gives a successful attacker a massive advantage.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#874
post #214

Finally all spinner verbs revealed: https://github.com/instructkr/claude-code/blob/main/src/cons...

I'm glad "reticulating" is in there. Just need to make sure "splines" is in the nouns list!

[dead]

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#875
post #249
post #7

The big loss for Anthropic here is how it reveals their product roadmap via feature flags. A big one is their unreleased "assistant mode" with code name kairos. Just point your agent at this codebase and ask it to find things and you'll find a whole treasure trove of info. Edit: some other interesting unreleased/hidden features - The Buddy System: Tamagotchi-style companion creature system with ASCII art sprites - Un…

If this true. My old personal agent Claude Code setup I open sourced last month will finally be obsolete (1 month lol): https://clappie.ai - Telegram Integration => CC Dispatch - Crons => CC Tasks - Animated ASCII Dog => CC Buddy

I didn't know this existed. I had claude put this together for me from scratch a week ago. Tmux and claude and telegram is a really powerful combo!

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#876
post #684

Earlier quoted context omitted.

I can prove all contributions to stagex are by humans because we all belong to a 25 year old web of trust with 5444 endorser keys including most redhat, debian, ubuntu, and fedora maintainers, with all of our own maintainer keys in smartcards we tap to sign every review and commit, and we do background checks on every new maintainer. I am completely serious. We have always had a working proof of human system called W…

You can prove the commits were signed by a key you once verified. It is your trust in those people which allows you to extend that to “no LLM” usage, but that’s reframing the conversation as one of trust, not human / machine. Which is (charitably) GPs point: stop framing this as machine vs human — assume (“accept”) that all text can be produced by machines and go from there: what now? That’s where your proposal is on…

I can prove that code was signed by a key that was verified to belong to a single human body by lots of in-person high reputation humans.

How the code was authored, who cares, but I can prove it had multiple explicit cryptographic human signoffs before merge, and that is what matters in terms of quality control and supply chain attack resistance.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#877

Earlier quoted context omitted.

I guess I could just curl up into fetal position and watch the world go by. But that's no fun. Why not dream big and shoot for the moon with kooky goals like, say, having an underground, community-supported internet where things are falling less to shit? Belief in inevitability is a choice (except for maybe dying, I guess).

Why stop at one? Make more such underground community supported internets. The more the merrier. Monoculture ends with death. The only question is how long it will take.

https://hashbang.sh - "underground" for over 20 years and still running strong.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#878

Earlier quoted context omitted.

This is the only relevant question. And it leads right to the next one which is “what is a good life?” But humans have a huge bias for action. I think generally doing less is better.

On the other hand, if a dead person can do it better than you can, it's not that much of an accomplishment.

I didn’t mean that you should strive to do as little as possible; rather that if you have 2 choices, do more or do less - then I would be biased towards doing less. Of course not always a realistic option

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#879
post #870
post #744

Earlier quoted context omitted.

You can only prove that all contributions are pushed by those humans, and you can quite explicitly/clearly not prove that those humans didn't use any AI prior to pushing.

I absolutely do not care what autocomplete tools someone used. Only that they as humans own and sign what is submitted so it is attached to their very expensive reputations they do not want to lose.

That’s great, and I also don’t care. But I think all people are saying is that by most definitions you cannot “prove all contributions to stagex are by humans”.

Or are you saying you can prove that aliens and cats didn’t make them? Because I’m not sure that’s true either.

And once you find out someone has trained their dog to commit something, how exactly do you revoke your trust?

I think if you answer these questions you’ll see pretty quickly why this solution isn’t the silver bullet you think it is.

Edit: stagex looks really, really good

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#880

Earlier quoted context omitted.

This is the only relevant question. And it leads right to the next one which is “what is a good life?” But humans have a huge bias for action. I think generally doing less is better.

> I think generally doing less is better. My sedentary lifestyle is responsible for my recurrent cellulitis infections. Just saying.

You can probably find a million situations where doing less is terrible.

I think first step would be to define for yourself what doing less actually means - it could mean taking a walk instead of chasing dopamine -> doing less but you move more.

But whatever it’s a philosophical question and there aren’t any right or true answers

Post reply on HN