Hacker News Reader

Comment by i18nagentai | Hacker News Reader

[flagged]

Doesn't it also make sense in the context of modern networking assumptions?

I've never had to connect to PostGres in an adversarial environment. I've been at work or at home and I connected to PostGres instances owned by me or my employer. If I tried to connect to my work instance from a coffee shop, the first thing I'd do would be to log in to a VPN. That's your multiplexed protocol layer right there: the security happens at the network layer and your cancel happens at the application layer.

This is a different situation from websites. I connect to websites owned by third parties all the time, and I want my communication there to be encrypted at the application layer.

Zero trust security which is becoming increasingly common is based on removing the internal / external network dichotomy entirely. Everything should be assumed to be reachable from the open internet (so SSO, OIDC everywhere.)

It makes me think of ipsec, ipsec was originally intended to be used sort of the the same as we use tls today, but application independent. when making a connection to a random remote machine the os would see if it could spool up a ipsec sa. No changes to a user program would be needed. But while they were faffing about trying to overcomplicate ipsec ssl came along and stole it's lunch money.

This application of ipsec was never used and barely implemented. Today getting it to make ad-hoc connections is a tricky untested edge case and ipsec was regulated to dedicated tunnels. Where everyone hates it because it is too tricky to get the parameters aligned.

There is definitely a case to be made that it is right and proper that secure connections are handled in the application(tls), But sometimes I like to think of how it could have been. where all applications get a secure connection whether they want one or not.

As a useless dangling side thought, an additional piece would be needed for ad-hoc ipsec that as far as I know was never implemented, a way to notify the OS that this connection must be encrypted(a socket option? SO_ENC?). This is most of the case for encrypted connections being the duty of the application.

>I've never had to connect to PostGres in an adversarial environment.

heroku's postgres database service still exposes itself on the public internet.

cancel key is arbitrary sized

https://www.postgresql.org/docs/current/protocol-message-for... / BackendKeyData

I'm fairly certain that this cancellation approach has nothing to do with UNIX networking assumptions, and everything to do with the connection/process model of PostgreSQL.

Creating a connection => starting a process and passing the accepted socket to it (so in-band cancel would have to go directy to the backend executing the query) + single-threaded backend process not reading from socket when executing a query, so it would get the cancellation request only after the query finishes (or even after all pipelined queries before it finish, which is even worse).

This is new in postgres 18/protocol 3.2. libpq still defaults to protocol 3.0 and many client drivers don't have support for protocol 3.2

is sed s/—/--/ the new meta

offtopic, but it's interesting how large of a discrepancy there is between the length of your comment and how much time i'd have to spend explaining background info to a non-programmer to get them to understand why this is funny

why is it funny? it seems like a sincere question

The way it's written is funny, I find. But I'm a programmer...

And as GP wrote, it would take a substantial amount of time to explain to a normie (infinite I'd say, but let's not despair).

I have used "--" as a lazy-man's emdash for decades at this point. Once I heard that people started assuming text that uses emdashes was written by an LLM I got worried that people were going to think that I'm an LLM, but then I realized the LLMs use the real unicode emdash character, while I just use two regular ASCII-zone hyphens. Whew.

(Also I just learned that ASCII 0x2d/unicode U+002D is more properly called a "hyphen" [well, "HYPHEN-MINUS"], not a "dash".)

well, that was my point, that people have seemingly begun replacing — with -- or --- in llm-generated comments recently

this is maybe the fifth time i've seen this happen on hn in the last few weeks

hardly new, I've used it before advent of llm popularity, and I wasn't alone

It should be THREE hyphens for an em-dash!

In theory, yes, endash would be "--" and emdash would be "---", but oof, the three hyphens looks like way too much in normal text. So I've always used "--".

I've always used it.

My keyboard has -.

Reply on news.ycombinator.com