clemlesne
Joined 3 years ago
Karma
57
Submissions
39
Member since
Apr 3
[ my public key: https://keybase.io/clemlesne; my proof: https://keybase.io/clemlesne/sigs/qbp4ZD7ke-HwUVimaBE4Y2_AyY02VA8h24oSDX9CF0g ]
View on Hacker NewsRecent submissions
Comment · 2 months ago
I done a C2PA implementation for raw text, if that can ease someone’s life: https://github.com/dualeai/c2patxt
Comment · 3 months ago
If that can help anyone to comply with the AI Act!
Comment · 8 months ago
TLS terminates at your CDN, load balancer, or WAF. After that point, request and response bodies are plaintexts. Cloudflare, AWS ALB, GCP -- they can all read your API payloads. For most production APIs, this is the reality.
hpke-http adds RFC 9180 HPKE encryption on top of TLS. It's a drop-in middleware for FastAPI (server) and aiohttp/httpx (client). Zero application code changes:
app.add_middleware(HPKEMiddleware, private_keys={...}, psk_resolver=resolve_psk)
What it does: encrypts/decrypts request and response bodies using X25519 + HKDF-SHA256 + ChaCha20-Poly1305. PSK mode binds each request to an API key. Counter-based nonces prevent replay attacks. SSE streaming and file uploads work with O(chunk_size) memory. Optional zstd compression before encryption.
What it does NOT do: encrypt URLs, headers, query params, or status codes. Those remain visible to intermediaries. This is not a replacement for TLS -- it's a layer on top.
Cipher suite is a single opinionated choice (no algorithm negotiation), validated against official CFRG test vectors and Wycheproof. 10K lines of library, 14K lines of tests including property-based fuzzing and statistical randomness verification.
We looked for an open-source, standards-based HTTP body encryption middleware and couldn't find one, so we built it. Apache-2.0.
Comment · 8 months ago
Did someone compared with uSearch (https://github.com/unum-cloud/USearch)?
Comment · 9 months ago
I built exec-sandbox because I wanted VM-level isolation for AI-generated code on my Mac without running Linux in a VM first.
Most sandboxes (E2B, Hopx) use https://firecracker-microvm.github.io/, on macOS, you need nested virtualization. exec-sandbox uses QEMU with Apple's Hypervisor.framework (HVF) and runs natively on macOS, including Apple Silicon.
What makes it different:
- Native macOS + Linux, no Docker, no nested VMs, just brew install qemu
- 1-2ms warm start, pre-started VM pool beats E2B's 150ms cold start
- Port forwarding without network, expose localhost:8080 while blocking all outbound (DNS + IP)
- Domain allowlisting, allowed_domains=["api.github.com"] for granular control
- CLI for automation, sbx run *.py -j 10 --json with concurrency control
- Package validation, blocks typosquatting against PyPI/npm top 10k
- Self-hosted, no session limits, unlike E2B's 24-hour cap
7-layer security: hardware virtualization, unprivileged QEMU, seccomp, cgroups v2, namespaces, AppArmor/SELinux, socket authentication.
Comment · 11 months ago
NATS is a fantastic piece of software. But doc’s unpractical and half backed. That’s a shame to be required to retro engineer the software from GitHub to know the auth schemes.
Comment · 1 year ago
Project creator there. The biggest challenge in marketing this project to potential customers is not the fact that it does not work well, but the unions and human problems. It really marked me.
Comment · 1 year ago
Funny because I written them myself at the time. Last year they were no really useful AI like CC!
Comment · 1 year ago
Indeed. I’m the project creator. That’s standard legal notice we must add to these kind of “large” repos. If not a dev team should maintain it full time with security incidents response managed within a SLA, which is not the case there. The same project is working in production for a few customers.
Comment · 1 year ago
Probably related to AWS outage. Are they infra not reliable enough? Do you think this kind of critical communication service should be deployed cross-provider?
Comment · 1 year ago
I built this after getting frustrated switching between AI platforms and losing
conversation context. It analyzes your ChatGPT/Claude exports and creates
markdown files with comprehensive context that you can paste into any AI to
continue exactly where you left off.
Key features: - Extracts your actual implementation status vs what was just discussed - Tracks decision journeys and what you've already ruled out - Groups ChatGPT Project conversations into organized folders - Smart caching saves API calls on re-runs (100% cache hit rate after first run) - Works with any AI - paste the context into ChatGPT, Claude, Gemini, etc.
The context extraction goes way beyond simple summaries. It identifies critical unknowns, user expertise level, what's blocking you, and provides specific continuation advice for the next AI.
Perfect for when you want to switch from ChatGPT to Claude mid-project, or resume an old conversation months later with full context intact.
Built with Python + Claude API, requires your conversation exports from ChatGPT/Claude settings.