Shish2k

> That $0.10 you paid for the paper only really covered the cost of printing and distribution, if that.

AFAIK for most newspapers and magazines, the cost on the label was mostly there so that readers would feel like the publication was serious - differentiating them from the free papers which were clearly spam and / or propaganda

My interested-lay-person understanding: Previously it would read a chunk of file, then decode it, then apply filters, then run multi-threaded encoding, then write a chunk of file.

Now it can read the next chunk of file while decoding a chunk while applying filters while running multi-threaded encoding while writing the previous chunk.

I expect this will be a big help for complicated setups (applying multiple filters, rendering to multiple outputs with different codecs), but probably not much change for a simple 1-input 1-output transcode.

Javascript was designed to be secure-by-default, and it takes a vast amount of effort to keep it that way

Native apps were designed to be powerful-by-default, and the amount of effort to bolt security on after the fact is orders of magnitude more

The Raphael boss fight music is quite possibly my favourite audio moment in 30 years of gaming ;) (Alas I’m not sure how to describe it without spoiling the surprise, since it is quite different to the rest of the soundtrack)

I’m curious if anybody else sees tailscale / headscale in the same way that I do — I was avoiding signing up to tailscale because I didn’t want to be locked into a proprietary platform, but since learning that headscale exists and is “good enough”, I’m now happy to be a tailscale customer safe in the knowledge that I can fall back to self-hosting when needed.

(Yes the company _could_ do a sudden 180 and start intentionally breaking compatibility and forbidding that their clients be used with third-party servers - but the risk of that doesn’t seem much different than the risk of an open-source alternative being abandoned)

If E2EE is “the bare minimum”, how are there so many successful and thriving companies who don’t do it? And why are you even on HN, which doesn’t do it?

> Why would you want to restart a service frequently?

As mentioned in the original comment - I haven’t found a web framework which supports timeouts for idle TCP connections (they all seem to be built on top of Hyper, which doesn’t support them). And so even tweaking kernel parameters to bump up the connection limit to a few hundred thousand (any higher than that and I start hitting a different set of problems), and only having a few thousand actually active connections, my app still runs out of sockets and hangs after a few hours.

I have tried (specifically nginx, haproxy, varnish, squid, traefik, and a few others) - alas every setup had problems, but “expose my app to the internet, and have a cronjob to kill and restart it every 3 hours” has had the fewest problems ;(

Looking at stats on crates.io for a few frameworks

- axum: 100k installs/day

- warp: 25k installs/day

- actix: 15k installs/day

- rocket: 7k installs/day

- tide: 1k installs/day

(For comparison, hyper - the HTTP library that most web frameworks use under the hood - is at 200k/day, many of which are using it for client rather than server functions. So unless there is another not-hyper-based framework out there, then I’d be moderately confident guessing that axum has >50% of the server market)

Is it safe to expose to the internet[0]? I’m still looking for a Rust web framework that supports eg timeouts for idle connections so that it doesn’t crash and burn when it runs out of sockets after a few hours of serving production traffic (let alone being able to survive an intentional slowloris attack) :(

[0] I’m ideally hoping for a framework which ticks the same boxes that Go’s `net/http` was ticking in 2016: https://blog.cloudflare.com/exposing-go-on-the-internet/

> It wasn't a "sinking-ship podcast platform”

I think you may have missed the context for this thread :) You’re talking about reality - I’m talking about the hypothesis that Spotify chained Joe Rogan to their platform because they wanted him to drown, which implies not only that the platform is sinking, but that it’s doing so deliberately.

And when they paid an additional several hundred million buying up tens of random science and tech news and D&D podcasts - was that to intentionally kill those podcasts too? Or were they just a necessary sacrifice in order to create a more believable “we want our product to succeed” fascade, so that Joe didn’t realise he was getting tricked?

Spotify paid $200 million… to tie a podcaster to their sinking-ship podcast platform (and this plan only works if they know and intend for their platform to sink)… just to get him from a big spotlight to a small spotlight?

Are “it was a stupid decision to buy him” and “I don't get why people listen to him” supposed to be related statements? The business decision isn’t about your personal feelings, it’s about his objectively measurably enormous audience

Corporate developers are typically paid to solve corporate problems. Sometimes a company will hire a big-name OSS developer and tell them “continue maintaining your project in whatever way you think best”, but that’s by far the exception rather than the norm.

I wonder which will happen first - AI evolves to work well at the high-end, or high-end humans retire and there’s nobody left in the low-to-mid end to fill their shoes…

I am curious why vouch for provenance rather than vouching for quality. In “mass-produced AI garbage” is the “AI” part a bigger problem than the “garbage” part?

> We’ve never had a period in time where massive corporations owned basically every part of everything

We have had royal families who owned basically every part of everything though, which isn’t the same but seems to have quite a lot in common...

If you have a sufficiently large amount of hype, day 1 sales can give you enough runway for a redemption arc. NMS and CP2077 were two of the most hyped games in history and they barely managed it though, so I’m not sure it applies to the general case.

> the tech industry refuses to build anything decent that "just works” locally

If a significant number of users were willing to pay for this, I’d gladly build it… evidence would suggest that very few people actually care strongly enough to open their wallets though :(

On the one hand, yes, there should be tests. On the other, `goto fail;` :P

Also, adding braces from the start means that adding one new line of code is a one-line patch, instead of a four-line one - I do that for the same reason that I always put trailing commas on my array definitions

Am I reading correctly that non-destructive editing, advanced colourspace support, and reliable hidpi display support are all unlikey to make it into 3.0…? Does anybody know what is expected to make it into 3.0? (IIRC the switch to gtk3 is happening at last, which is nice… even though gtk4 was released in 2020)

Remove HTML/CSS rendering and the other 10% of the challenges go away too. Skip the whole “browser" thing and just use `curl`. Zero harmful technologies, maximum user control - I’m sure all of the users will be flocking to this new approach in no time :D

> Haskell, Scala, F#, OCaml, etc.

Rust is the first not-weirdass-academic-wtf language to have these features ;)

(I love functional programming and apply the functional approach no matter what language I’m using - but why is it that functional languages are always so deeply down the academic rabbithole that they think eg “car” and "cdr” are intuitive names for “retrieve the first element of a list” and “retrieve the rest of the list” functions??)

Interesting~ Last time I spoke to somebody from CF we were too big for the regular plans and too small for the “call us on the phone and we’ll discuss a custom contract” plan, but it has been a couple of years so maybe worth looking at the newer services :)

As a point of reference, Go was considered “safe to expose to the internet” in 2016, and I’d really like Rust to be in the same position: https://blog.cloudflare.com/exposing-go-on-the-internet/

> How do you handle https if you don't?

All of the code is here: https://github.com/shish/shm-cached/blob/main/src/tcp.rs

Two async functions - one listens on port 80, and forwards requests into the business logic; one listens on port 443 (grabbing a certificate from Let’s Encrypt if it doesn’t have an up-to-date one in the cache), decrypts the SSL, and forwards requests into the business logic.

Before I gave up and wrote my own software I tried various combinations of nginx, varnish, hitch, haproxy, squid, traefik, and I’m sure more that I’m forgetting. Most of them worked ok in most cases (and I’m still happily using `varnish -> nginx -> app server` for other parts of the site) -- but for one reason or another they each had issues handling tens of thousands of requests per second on a tiny potato of a server D: (If any of them worked then yes I would go ahead and use them - but it wouldn’t stop me feeling bad about needing to have a whole extra reverse-proxy layer just because my web framework doesn’t know how to close idle TCP connections :P)

(Incidentally if somebody knows of a CDN or cloud service that’ll serve ~3Gbps of NSFW content for <$800/mo, I would be more than happy to quit writing my own software to run on hand-managed bare-metal servers :P)

From a quick glance it seems still vulnerable to trivial slowloris’ing D:

Is anybody actually exposing their rust-based websites to the internet? I want to, but it seems that for some reason every rust web framework keeps TCP connections open _forever_, meaning that even with file descriptors bumped to 64000, my web server runs out of FDs and needs to be killed and restarted every 3 hours or so. The standard advice seems to be “don’t do that, put your rust app behind a reverse-proxy written in C or Go, and let the proxy handle the complexities of TCP”, but it seems so sad to add an extra layer of latency and complexity just to close idle connections ;(

I’ve been using the sapling CLI as my frontend with github as my backend and finding it quite delightful - all the UX niceness from mercurial (and then some), while still being totally compatible with the rest of my team :)

> this the price was $680 per person

What in tarnation is up with American rail?? Picking random routes spanning the EU, I’m seeing things like a 15 hour sleeper journey costing €100 for a private sleeper cabin (or €16 for one bed in a shared 6-person cabin)