Article URL: https://blue-continuum.com/verne-paris Comments URL: https://news.ycombinator.com/item?id=50309314 Points: 5 # Comments: 0
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Naser Sadrmanesh, an AI product engineer and store founder, has released four small open-source projects, all under the MIT license. The tools were built from utilities he repeatedly needed for client online stores. One is llm-search-eval, which compares search system changes using a shared label pool, LLM judges, and statistical tests. Another is woocommerce-mcp, which gives AI agents access to WooCommerce stores with read-only defaults, preview-and-confirm writes, and audit logging. A third, commerce-agent-skills, is a library of 29 Markdown skills that guide coding agents toward correct e-commerce implementation details.
A developer using Docker Compose found that a Django container kept exiting shortly after launch, showing exit code 127 in the docker ps output. To investigate, they committed the failed container to a new image so its state could be preserved. They then started that image with the entrypoint overridden to launch an interactive shell, using /bin/bash or /bin/sh if bash is unavailable. This gives access to run diagnostic commands inside the container's environment, with the specific checks depending on the problem.
Microsoft's Protected Users group applies fixed protections against credential theft, such as blocking credential caching, NTLM and Digest delegation, and limiting Kerberos to newer encryption. Because these restrictions cannot be toggled per account, adding a user is a compatibility decision as well as a security one. The article recommends first inventorying authentication dependencies through logs, then running a small pilot that tests interactive sign-in, administration, Kerberos tickets and delegation. Organizations should keep a tested break-glass account, record approvals and rollback steps, and review membership regularly so the group stays small and current. Protection only applies on supported hosts and domain controllers, so the platform should be verified before reporting an account as protected.
A developer's first production AI agent issued the same refund three times after a payment API returned a 502 error and the model retried the call. The root cause was a missing idempotency key, a bug familiar from standard HTTP client code rather than a language model problem. The article argues that the model should be treated as an unpredictable API caller, so tools need the same safeguards as public APIs, including versioning, timeouts, idempotency, scoped credentials, and rate limits. It recommends classifying every tool as read, write, or destructive, with that classification enforced in code rather than documentation. The author also advises generating idempotency keys in the application, since models will retry calls for many reasons.
Discussion (0)
Log in to join the discussion and vote.
Log in