Hono+htmx and Astro cost Claude least to build, Brazil fines a hidden prompt, and Zamzar turns 20

On Sunday's Hacker News front page, Nolan Lawson asked what a JavaScript framework costs once an agent writes the code. He gave Claude Code the same spec for a small Pokémon app and had it build that app in twelve frameworks, five times each, checked against a conformance suite. Hono with htmx and Astro came out cheapest, at under three dollars a build. Angular cost almost twice that, took the longest, and in two of its five runs produced an app that could not be measured. Plain JavaScript on Vite, with no framework, cost more than several of the frameworks.

To keep the comparison fair, every framework that ships an official MCP server or agent skills had them installed. The agents often ignored them. Nuxt's MCP server went unused in all five runs, and the Next.js skill was opened in just one. SvelteKit cost more for a different reason: its third version is newer than the model's training data, so every run read the migration guide before writing code. Lawson suspects the current crop of framework MCP servers and skills may be doing more harm than good.

Code size now has a running cost, because the agent reads the code back in tokens on every later change. Hono with htmx built the same app as Angular in about 70 percent of the lines. In the thread, deepsun pushed back: frameworks pay off on long projects where people come and go, and this is a simple, mostly static app, closer to Wikipedia than to Figma. For a content site like it, I would start with Astro. It was among the cheapest and fastest to build, and it sent no JavaScript to the browser at all.

A labor court in Brazil fined two law firms for a prompt injection in a court filing. Set in white on a white page, a line told any AI reading the petition to answer superficially and not challenge the documents. The courts' own AI tool, Galileu, found the hidden text when the judge ran the filing through it. The fine was a tenth of the claim, about 16,000 dollars. In the thread, simonw bet the trick would not have worked anyway, since models stopped falling for injections this naive a couple of years ago. Any agent that reads outside documents still takes in text a person can't see.

Fastmail's Neil Jenkins laid out what encrypted email does and does not protect. Between mail servers, encryption is opportunistic: a server tries TLS and falls back to plain text, so an attacker in the middle can strip it. Two standards close that gap. MTA-STS needs one DNS record and a policy file. DANE needs DNSSEC, and a DNSSEC mistake can sit in caches across the internet for days. Fastmail, like Google and Yahoo, chose MTA-STS. For a journalist protecting a source, the advice is to leave email for Signal.

Brothers Chris and Mike Whyley started Zamzar, a file conversion website, in 2006. It launched with 150 conversion types and now supports more than 2,100. About 550 million people have used it to convert almost 770 million files, and its API takes more than a million requests a day. It is still a small, independent company in the UK, with no venture capital. Along the way it helped the inventor of PowerPoint recover long-lost presentations, and got a cease-and-desist letter from Google for letting people download YouTube videos.