On the other hand I wonder why aren't they run in such a sandbox where the most destructive action they can do is to wipe the sheets.
Very.
Although I don't believe it's being used for greenfield hacks as much now, the world largely still runs on workbooks & apps built in Excel + VBA years and years ago. There are entire supply chains that likely run on this built by some analyst a decade or more ago. It remains by far the largest source of Shadow IT there is, and there isn't enough dev time or appetite to untangle these monstrosities into actual apps.
They aren't sandboxed because that would remove the usefulness. The reason VBA+Excel got its tentacles into everything is precisely because its not sandboxed. Anything the user can access is fair game, including network shares, SQL, and Win32 calls.
> they run in such a sandbox
What makes them interesting is that they can talk with the outside world: API calls, databases, the terminal named after a former Democratic primary candidate...
You need a genuine licensed excel to run the file and prepare returns. Thankfully you can file same returns online on the portal for free so they get a safe pass that way.
Edit: it's actually 50klocs since the pyOpenVBA dependency is from the same author and has been made the week-end before.
https://news.ycombinator.com/newsguidelines.html
Claude ain't “other people” so I don't think this applies.
By the way, the guidelines proscribe AI-generated comments, so I don't see why AI-generated posts should be treated differently.
Claude didn't make the post or come up with the idea or execute it independently, so not sure how that applies.
If you want to comment on the code quality or the engineering itself, that would be a good critical comment that teaches us something.
> By the way, the guidelines proscribe AI-generated comments, so I don't see why AI-generated posts should be treated differently.
That's your opinion and not the guideline, so again not sure how it applies.
You're free to e-mail hn@ycombinator.com and suggest, but I'm sure it crossed their mind when they wrote about AI comments so I don't think it's been decided that AI-aided projects are somehow automatically invalidated.
It applies when you're talking about someone else's work. Not every repo is slop. If you want to make a claim that this code is bad, then claim that rather than saying "they used AI therefore it's bad" which is, as the rule says, a shallow dismissal that teaches us nothing.
Ultimately this project's success will be determined by its test suite... it's tough to get quality tests by vibe coding.