nucleardog

I posted mine in a sibling comment before seeing yours--

I had a static code analysis tool (written in PHP for analyzing PHP code) crash on our codebase. Crash in this cause not being "seg faulted the interpreter" or something concerning, it just hit an invalid state internally, identified it, and cleanly exited with an error to let me know something was wrong. Got Claude to track down what was wrong and how our codebase was triggering it. I asked it to create a minimal reproduction I could include on my bug report, and the guard rails triggered and refused to answer. Asking Claude why that would happen, it suggested because what I was doing looked like exploit development.

"vaguely security related tasks" is right.

Found a bug in a PHP code analysis tool a while back. Not like "crash the interpreter" or anything, just the application ending up in a weird state and crashing. Couldn't exactly share our entire codebase to report the bug, so after Claude chased down _what_ the issue was, I asked it to make me a minimal reproduction so I could report the bug.

Blocked. Guessing it looked like I was trying to develop an exploit or something. By driving a static code analysis tool to an invalid state where it handled the state by cleanly reporting the issue and stopping. In an interpreted language. With the context full of Claude's own efforts to track down why and how this was happening.

Theoretically? Sure, theoretically I'm sure practically anything could be used for nefarious purposes.

Practically? Not useful in the slightest.

Funny part was--Claude was more than happy to talk with me about why it was potentially blocked and suggest ways to try and work around the guard rails. Suggested I include context like the exact bug tracker I'm reporting to, etc to try and put more weight behind the "good actor reporting a bug" aspect, etc.

> Why? To increase chances of crashes that produces more views?

Why not allow traction control? To increase crashes?

Why not allow "lane keep assist"? To increase drivers crashing into walls?

Why not allow "automatic braking"? To increase drivers slamming into walls and other drivers?

Why do we still have the human in the car when a brick on the accelerator could do the same job? So when the cars crash people feel there are real stakes?

(Presumably they've decided they want the sport to be about the drivers to some extent.)

Heard similar stories from many people. I have my own--

I was at a range shooting this old revolver with worn seals. Every shot, unburnt (or sometimes burning) powder was flying backward onto my face and arms. I basically took a gunpowder shower.

Got up like 6 hours later and went to the airport to get on a plane. Got swabbed. Came back negative. Got on the plane.

So... yeah, not really sure what the swabs are doing. I have to assume it's more an issue of "they're not intending to detect that" than "failures to detect" because otherwise the repeated misses here are just a little too big to believe.

Every day we stray further from god, etc, etc.

Yes this is and has always been an option. Find any real vape shop at any point in the past... _checks calendar_ 15 years at least, and they will sell you nearly any of their "e-juice" products with no nicotine.

Trick is, the companies making disposables vapes/pods/etc generally don't offer them because those are generally large tobacco and other companies and ... well, why would they manufacturer and sell a non-addictive cigarette when an addictive version exists.

0% nicotine was an option almost 20 years ago when I started vaping and is still available. The tobacco companies getting involved and polluting the streets with single use lithium ion batteries and shit have done nothing but made everything worse.

Got it installed, been playing with it for a bit.

Had a bit of jankiness during setup as I fought with llama.cpp bugs. There are a few issues around models reported by the provider changing, refreshing as they change, had a few instances of "New Chat" showing one model then hitting llama.cpp with another, etc. Sorry, been traveling for a bit and didn't have the energy to properly recreate and put together a real bug report. Just a heads up that the onboarding there is a bit rough, though anyone running their own local models is probably more than able to get it figured out.

I'm really liking it. I wish I had something more substantial to say than "it's easy and clean" but... it's easy and clean. And as far as "AI tooling" goes, the setup was an absolute breeze even with the issues. The fact that I can just install a single app and go rather than spending hours and hours on setup, configuration, etc makes me way more likely to use this going forward... it's a lot easier to rely on a tool when I know it will be quick to fix if it breaks.

One note and one feature request, if you want 'em:

Though now that I understand the concepts better it's obvious, it _wasn't_ immediately obvious why the MCP server I added wasn't working. Tools are called via "tasks", and "tasks" are defined based on the skills. I had to create a skill. I'm sure it's somewhere in the documentation but I (and most people) don't read that kind of stuff, so would be good to surface somewhere obvious in the UI maybe?

And I would absolutely _love_ if you could override the provider and model per task. I run a small model locally as it's good enough for most of what I want to do (and cheap! and private!), but it would be great if I could define a "write-code" skill that was run via Claude instead or something so I could delegate tasks that aren't really suitable for a tiny local model out to something more capable.

Anyway... Cool tool. Hope to see it continue to grow and evolve! Thank you for releasing this!

Nope, no disagreement. I just see your take as very optimistic.

There is no court at the border. If the agent decides you're going to jail, you're going to jail. The decision may be reversed/corrected after, but it's still going to be a big, expensive problem for you and you _are_ going to be detained for a time.

Not to mention walking up with an empty phone and telling the agent to "fuck off" when they ask about it sure sounds eerily similar to the facts of the case in the linked article. I'd wager that's a good way to land an obstruction charge.

This is not... advice. But if anyone's actually going to do this, the method that's worked for me...

A couple weeks before your trip, factory reset whatever burner phone you're planning on using and swap your SIM card over. Install a few basic apps you wouldn't mind them looking through. Enable hotspot/tethering, and connect your other phone via Wi-Fi.

For a couple of weeks, use the burner as much as you can with what is available on it. When you're driving, us the maps app for GPS. Make and receive some calls, ignore some spam calls. Read the news. Get a few inane text messages conversations going, etc.

When you travel, leave your regular phone at home and take the burner. When it's searched at the border, it has enough activity to pass most initial smell tests. If asked, you dropped your other phone and didn't have time to get it fixed before your trip, this is one a friend lent you.

This has worked for me. Never _actually_ into anything illegal, but just apparently had a suspicious vibe about me or something because every time I crossed the border into or out of the country I was spending 4-5 hours getting searched. Didn't need someone going through my entire life going back decades every time--once was enough.

They have to let you in. Doesn't mean they have to let you roam the country freely. They can just send you to some form of detention.

My personal experience would strongly disagree with "usually" here. While I can't really be sure I've never seen one, none come to mind on my travels across US/Canada/Mexico/East Asia (though I've really only been within Canada the last couple of years).

I also go through the trusted traveler line, and the rules there are _usually_ different (but not always!) and I definitely don't recall seeing any sign specifically addressing the rules for that line at any point. Except maybe one at the start clarifying _who_ can use the line (though on that one I've also had the TSA agents go ahead and explain the rules entirely different than the sign they were standing in front of so...).

I've often thought that having a standardized checklist on a big board in the security line would be a big help.

    Laptops: In/Out
    Liquids: In/Out
    Shoes: On/Off
    Etc

Because yeah, it's really annoying getting treated like I'm the dummy by some agent that's only ever known this airport's rules... because this airport has rules entirely different than every other one I've flown through in this decade.

Recently had to fly with some splints and crutches and stuff and that was a whole extra set of fun difference in airport rules. First one really wanted to rub their explosives swab on my finger that was held together by exposed metal pins and had exposed subcutaneous tissue. They were a bit put off when I asked for alternate options.

Because your entire premise here sort of betrays a fundamental misunderstanding of the concept?

So we stop vaccinating people here, and require everyone that enters be vaccinated. Problem solved!

Except not really, because people here travel to foreign places. So also everyone that _leaves_ here needs to be vaccinated as well. But that's do-able.

Except, and here's the part where "herd immunity" is important: Being vaccinated doesn't prevent contracting the disease 100% of the time. The reason vaccines are effective isn't "you can never get the disease", it's because "if you get it, it can't spread to enough people to sustain itself into an outbreak".

If you require people traveling into or out of the country to be vaccinated and stop vaccinating at home, you're going to have someone bring polio back fairly quickly. The vaccine is not 100% effective, and polio is asymptomatic in about 75% of cases so many carriers wouldn't even know they have it.

In a vaccinated population, that's not a problem. The effective reproduction rate is <1. For every person infected, less than one other will contract it. It does out quickly.

In your unvaccinated population, the R0 is 5-7. For every person infected, five to seven others will be infected. The growth will explode quickly and given the rate of asymptomatic carriers there's no chance you're going to contain it.

(Also have you ever watched any zombie virus/fungus/etc show? Even if the vaccine is 100% effective, do you really want to hang the health of the whole country on nobody ever messing up vaccine administration, nobody lying, nobody faking paperwork, etc?)

So everyone has to be vaccinated anyway, and if they're all vaccinated anyway the risk of letting a potential carrier in is... pretty near nil in the grand scheme of things.

Your options are:

* Never let anyone in or out. (But honestly, it'll still probably get in. See: lying.)

* Eradicated the disease globally. We can do it, but less likely to happen now with USAID shut down.

* Vaccinate at home so when the disease gets in the country it doesn't spread.

As a kid I have memories of driving a bit out the edge of town to a big steel plant for almost exactly this reason, it's not totally insane.

There's plenty of free parking, free admission, giant pool with some small waterslides and stuff, a bunch of picnic tables and public barbecues, generally some nice greenery and trees for shade, ponds and fountains and stuff, a bandstand, etc.

It's not somewhere you'd pop over to for a "quick swim", but especially for lower income people it's a great place to have around as a "grab a pack of hotdogs and your swim trunks and make a day of it" sort of thing. As a kid we couldn't afford to, say, go to the actual waterslide park or anything so I have a lot of fond memories of visiting the steel plant.

I'm sure the construction and upkeep was less than a rounding error in terms of construction and upkeep costs for the plant itself.

In the first case, I've connected to someone else's server and actively done the damage of deleting their data.

In the second case, I've provided instructions on how to destroy the data, said "don't do this", and then someone has done it anyway. _They_ have destroyed their data, and it's now up to them to justify why that's my fault.

If we want to get into legal territory about it, which I'm sure we're both woefully underqualified to comment on... the CFAA is all worded around "intentionally accesses a protected computer...". How exactly do you show intent to access a protected computer here? The developer never took any sort of positive step to access _any_ specific computer. The best I could see would be negligence where a reasonable person would have to have known someone would run this on a protected computer, but that still feels like something a good lawyer would find a way out of.