TekMol

You don't use public networks?

And when you connect to a non-public WiFi for the first time - how do you make sure it is the WiFi you think it is and not some dude who spun up a hotspot on their laptop?

My question was about known networks.

As far as I know, access points only identify via their SSID. Which is a string like "Starbucks". So there is no way to tell if it is the real Starbucks WiFi or a hotspot some dude started on their laptop.

    vulnerable to remote code execution from
    systems on the same network segment

Isn't almost every laptop these days autoconnecting to known network names like "Starbucks" etc, because the user used it once in the past?

That would mean that every FreeBSD laptop in proximity of an attacker is vulnerable, right? Since the attacker could just create a hotspot with the SSID "Starbucks" on their laptop and the victim's laptop will connect to it automatically.

In the rare case (maybe once per month or so) where that happens, I start a script on my laptop that starts a webapp both the phone and the laptop can open in their browser and send text to each other.

The overhead of starting it and typing "laptop.tekmol" into the browser on both machines is only a few seconds.

That seems mich saner to me than to constantly have some interaction between the two devices going on.

What works better as a native application?

Strange, I don't need any of that.

And when I hang out with people who ARE in Apple's ecosystem, to me it seems they struggle more to get things done than me.

Why would I want a shared clipboard across multiple devices?

As someone using Linux to build web applications, I wonder what about the Apple ecosystem could make it worth to have such a Damocles’ sword hanging over me my whole life.

Am I missing something? My current perspective is that not only am I free of all the hassle that comes with building for a closed ecosystem, such as managing a developer account and using proprietary tools, it also comes with much harder distribution. I can put up a website with no wait time and everybody on planet earth can use it right away. So much nicer than having to go through all the hoops and limitations of an app store.

Honest question: Am I missing something? What would I get in return if I invested all the work to build for iOS or Mac?

Everyone could offer a cloud-hosted saas product that involves bun, right?

Why invest into a company that has the additional burden of developing bun, why not in a company that does only the hosting?

What is the business model behind open source projects like bun? How can a company "aquire" it and why does it do that?

In the article they write about the early days

    We raised a $7 million seed round

Why do investors invest into people who build something that they give away for free?

The hole was of simple enough shape that I could just design it manually. I used SCAD, which is kind of a programming language supported by some tools that can convert it to STL.

    you accidentally knock a hole in your wall,
    it’s probably cheaper to buy a flatscreen TV
    and stick it in front of the hole

What I recently did is that I 3D-printed an object with PLA that exactly fit the whole and just glued that in with assembly glue.

What does the HN panel say? Is it a solution? Or does it have any downside?

Every instance would only get the messages that its members have subscribed to. How can any system be more efficient than this?

A $5/month VM could ingest millions of messages per day. What's the problem?

Why is this so complicated?

Can't we build a social network with a simple protocol:

1: Each user has a private key that they use to sign their messages.

2: Each user keeps a list of instances who announced that one of their members follows them. When the user posts something, they broadcast the post to those instances.

Shouldn't this be enough?

It could all be url based. One user, one url.

When Sue wants to read Joes latest posts, she sends this request:

someserver.com/joedoe?action=latest_posts

When Sue wants to follow Joe, she sends this request:

someserver.com/joedoe?action=follow&from=otherserver.com/suelue&sig=f819h...

I am using Git submodules for dependencies. My approach to a situation like this:

    1: Clone gh.com/someone/LibBar to gh.com/me/LibBar
    2: Fix the bug
    3: Send pull request to someone
    5: git submodule set-url lib/LibBar https://gh.com/me/LibBar.git
       git submodule sync lib/LibBar
       git submodule update --init --remote --recursive lib/LibBar
       cd lib/LibBar/; git checkout main; cd ../..
       git add .; git commit -m "Use my own version of lib/LibBar"

And keep using my fork until upstream accepted my pull request. Then I switch the url of the dependency back.

How about adding some image with a public http logger url like

https://ih879.requestcatcher.com/test

to each of the nonsense pages, so we can see an endless flood of funny requests at

https://ih879.requestcatcher.com

?

I'm not sure requestcatcher is a good one, it's just the first one that came up when I googled. But I guess there are many such services, or one could also use some link shortener service with public logs.

My takeaway:

Do not install apps. Use websites.

Apps have way too much permissions, even when they have "no permissions".

I'm using Debian with the Plasma desktop, so I have a taskbar.

Will this impact me?

    I guess for most people the standard is to install things from NPM

"things" that run in the browser?

    replace 'lit' with something like this:
    https://unpkg.com/lit@3.3.1/index.js?module

Thanks, that works:

https://plnkr.co/edit/2y9JEOgSZLpO4bE7

The example does not use an importmap attribute.

Overall, the example does not seem like something that is supposed to run directly in the browser without some kind of intermediate step.

That is why I asked what the minimal number of steps would be to download the example and have it work locally.

Not with paths like 'lit' that is used here.

I'm all for a lightweight approach to software development. But I don't understand the concept here.

Looking at the first example:

First I had to switch it from TS to JS. As I don't consider something that needs compilation before it runs to be lightweight.

Then, the first line is:

    import {html, css, LitElement} from 'lit';

What is this? This is not a valid import. At least not in the browser. Is the example something that you have to compile on the server to make it run in the browser?

And when I use the "download" button on the playground version of the first example, I get a "package.json" which defines dependencies. That is also certainly not something a browser can handle.

So do I assume correctly that I need to set up a webserver, a dependency manager, and a serverside runtime to use these "light weight" components?

Or am I missing something? What would be the minimal amount of steps to save the example and actually have it run in the browser?

Votes are crucial. HN goes to great lengths to prevent votes that do not stem from real user intent.

See this post for example:

https://news.ycombinator.com/item?id=22761897

Quotes:

"Voting ring detection has been one of HN's priorities for over 12 years"

"I've personally spent hundreds of hours working on this"

Nope, it would not have been prevented by CORS.

CORS prevents reading from a resource, not from sending the request.

If you find that surprising, think about that the JS could also have for example created a form with the vote page as the target and clicked on the submit button. All completely unrelated to CORS.

The same would have worked with a POST endpoint.

The story url only would have to point to a web page that creates the upvote post request via JS.

So why is there no problem with vote/flag/vouche on HN being GET endpoints?

If you rely on the HTTP method to authenticate users to mutate data, you are completely lost. Bots and humans can send any method they like. It's just a string in the request.

Use cookies and auth params like HN does for the upvote link. Not HTTP methods.

What's your problem with it?

Can you give an example of an endpoint where you would prefer a "RESTful API endpoint"?

You know what type of API I like best?

    /draw_point?x=7&y=20&r=255&g=0&b=0
    /get_point?x=7&y=20
    /delete_point?x=7&y=20

Because that is the easiest to implement, the easiest to write, the easiest to manually test and tinker with (by writing it directly into the url bar), the easiest to automate (curl .../draw_point?x=7&y=20). It also makes it possible to put it into a link and into a bookmark.

This is also how HN does it:

    /vote?id=44507373&how=up&auth=...

No matter if the LLM is on the same machine or elsewhere, why would you need WASM to talk to it and not just JS?