HNHacker News
TopNewBestAskShowJobs

__david__

6,528 karma · joined March 11, 2009

submissionscomments
__david__··on Gravity seems holographic. What does that mean for reality?
Does that mean that all the black holes of a particular volume have the same interior? Or does it mean that the black hole state is the case where you can’t tell what the interior is?
__david__··on UTF-8000: Unlimited UTF-8
I don’t think there’s harm is speccing out the arbitrary encoding and then having a different spec that references that spec but puts hard limits on it. Many rfcs are like that.
__david__··on English: A vs. An
I do too, but with an exception—if I’m going to emphasize the word “actual” I’ll say “thuh ACTual” but with a full stop after the “the” so that I can really chew on that first syllable for the emphasis.
__david__··on English: A vs. An
I would transcribe the first sound of “unicorn” as “yoo“. It’s almost ee oo but the ee isn’t voiced—it starts right at the transition between those which is what the Y sound is.
__david__··on Introducing Ad Blocker for Firefox on iOS
I just tried AdGuard with safari and got YouTube ads. Do you have to configure something special?
__david__··on Please stop flooding our projects with AI slop to furnish your CV
I never suggested that you shouldn’t check the commit before merging!
__david__··on Please stop flooding our projects with AI slop to furnish your CV
Or just pull the pr into your local git, git amend --reset-author, and then push it to master yourself.
__david__··on Malicious Rust crate Arrayref runs a build-time payload
Perhaps, but I think it depends on where the Go devs are coming from. In my experience the lack of proper dependency management in older versions of Go didn't really lessen dependencies, it just made teams have to deal with annoying $GOSRC issues. But then I worked at a place where the devs used PHP (w/composer) and node before Go was introduced.

Personally I came from a C background so I tended to use deps more sparingly.

In the end it's a bit of a balancing act—lots of dependencies is a larger opportunity for these kind of supply chain attacks to affect you. Copying stuff into your repo protects you from that, but it also makes it way more likely that you'll miss security fixes, unless you're actively looking for them. Re-implementing what you need is also viable but it slows down the dev process.

__david__··on Malicious Rust crate Arrayref runs a build-time payload
I also wish that it would be the default. Integration tests are fine, but they aren't compile time. Elevating them to compile time and using an LSP enabled editor makes it just underline SQL errors before I've even had a chance to run a manual compile let alone a test...
__david__··on Malicious Rust crate Arrayref runs a build-time payload
sqlx at least has the (optional) offline mode, where you "cargo sqlx prepare" once (which wants access to a db) and then you can build in offline mode which typechecks your queries against local files.

Although I suppose that's still doing a lot of shenanigans at compile time. It could be sandboxed pretty well (theoretically). I'd hate to give it up completely though, getting a compile time error when SELECT query params or return values have type mismatches is extremely nice.

__david__··on Malicious Rust crate Arrayref runs a build-time payload
I think Go ends up with fewer dependencies mostly because there is more friction in finding them. With rust (and npm) you just "cargo search xxx", then "cargo add xxx". Go makes you web search and poke around github looking for something. It's not onerous or anything, but just that extra step slows things down just a bit. C projects tend to have the least because it's even more annoying to add them and you have to create build commands that deal with slightly different distributions (and learn makefile+pkg-config or cmake, or autoconf).

Certainly having a larger stdlib helps Go projects keep their deps down, but I don't think it's the real reason.

__david__··on Deus Ex creator Warren Spector is retiring from game development
I liked it, but it felt like 1/10th of a game. On the other hand they only charged about 1/10th of a game ($5). I played it for about 10 hours so I feel like I easily got my monies worth.
__david__··on 2027 memory capacity is reportedly sold out
They obviously did not mean not literal USB, just a standardized connector across DRAM versions/speeds.
__david__··on MiMo-v2.5-Pro-UltraSpeed: 1T model with 1000 tokens per second
Only if your personal projects make you money. I have a million hobby projects but none generate income.
__david__··on Moving beyond fork() + exec()
Having fd 4 mean something specific is no weirder than having fds 0,1, and 2 mean something specific, which is probably never going to change. At some point you just gotta embrace the Unix.
__david__··on Moving beyond fork() + exec()
I agree. I think the current way is very nice to use (in c). I think the best way would be to have something similar to vfork() but not bound by posix rules. Then make the normal posix apis (close, setuid, etc.) act like the Rust “builder” pattern. Possibly giving them a prefix for explicitness. That way the “fill out a giant structure” people could have their wish and the people that just want a faster posix experience don’t have to learn an entirely new concept and api surface. It would be future extensible that way, too (just add more prefixed calls to the builder).
__david__··on Squillions: How money laundering won
That’s only fairly recently at my Costco. For years and years it was only American Express and debit.
__david__··on I'm Tired of Talking to AI
No one is saying to pretend you memorized everything. They’re saying they’d rather have an “I don’t know” than a half-assed ai response (or stack overflow cut and paste).

Or, if you get nerd-sniped by the question and spend some time figuring it out, that’s fine too.

But if you want to be helpful but don’t want to take the time to figure it out yourself, don’t just forward the question to AI or send me a link to the first result in Google because I could have done that myself(and may have done it already). Just say you don’t know, which is a paradoxically more useful response.

__david__··on Big tech's anti-labor playbook has come for Wikipedia
From his 2006 speech/routine at the White House Correspondents' Dinner, speaking to then president George Bush:

> Now, I know there are some polls out there saying this man has a 32 percent approval rating. But guys like us, we don't pay attention to the polls. We know that polls are just a collection of statistics that reflect what people are thinking in reality. And reality has a well-known liberal bias...

His whole thing was phenomenal: https://www.youtube.com/watch?v=IJ-a2KeyCAY

__david__··on That Methyl Methacrylate Tank
On the plus side, it's a chemical that was discovered more than a century ago so scientists have accumulated a lot of knowledge about it. So far no studies were able to link it to cancer. It also doesn't significantly build up in the body over time (like heavy metals do). It's 3x heavier than air so it shouldn't spread too far away. The main issue is they want to try to keep it from getting into storm drains or into the ground water.

I've heard from others that it's readily absorbed by water. That's bad in the ground water case, but it seems it might be a positive when trying to clean up a (contained) spill.

It appears to me to have a relatively high lethal dosage (my back of the napkin calculations are saying a 200 pound human would have to orally ingest almost a liter of it to reach the LD50 dosage--but again don't quote me on that number because I am not an expert and could have very easily messed up the math or the concept of a lethal dose).

So, while I agree there might be unknown long term issues, it does appear to be a relatively low probability of that since it seems to be on the less pernicious side.

__david__··on That Methyl Methacrylate Tank
> What a disaster and complete failure on the local government in the way they handled this situation.

Can you expand on that? It seems like there wasn't a lot they could do once the tank started leaking.

__david__··on FBI director's Based Apparel site has been spotted hosting a 'ClickFix' attack
I understand what you’re saying but in this case notice they don’t even mention terminal or command lines. You have to already understand enough context to know what they mean and at that point you should be able to interpret the command itself.
__david__··on Toxic chemical leak at a manufacturing facility in Orange County
In addition to possible ignition through the sparks, it's apparently stored under high pressure, so you can't make a hole without completely compromising the structural integrity which is pretty much guaranteed to kill the driller.
__david__··on Postmortem: TanStack npm supply-chain compromise
is not bad for that. Not precise, but in the ballpark.
__david__··on Running out of disk space in production
That’s also not great if you’re trying to make a 10 gigabyte file. In that case, use bs=1M and count=SizeInMB.
__david__··on Music for Programming
I discovered long ago that psytrance/goa was perfect for me. It works almost as well as caffeine and I can work for hours and hours as long as it’s blaring.
__david__··on Subscription bombing and how to mitigate it
> But from a UX standpoint its a nonstarter

Disagree. The UX would be pretty similar. Click a mailto link which opens the email client with to, subject and body precomposed. Click send. Server receives mail and the web page continues/finishes the sign up process. No need for an email reply. It’s different, but it’s not crazy.

__david__··on Subscription bombing and how to mitigate it
> how do you "be careful" with spoofed email?

You actually verify DKIM and SPF—you know, that “dmarc stuff”. That’s enough to tell you the mail is not spoofed.

__david__··on EmDash – A spiritual successor to WordPress that solves plugin security
Isn’t that just the way old school Perl/ruby/php web apps from 20 years ago did things but with a fancy name?
__david__··on Desk for people who work at home with a cat
My cats actually love their cat tree. I’ve had to replace it because they clawed through the scratching post legs (all the way through the cardboard underneath the sisal rope).

Knowing that they love rectangles explains a lot too. They love every Amazon box that arrives, the folded hand towel in the bathroom, the top of my pc mini tower (rectangular and warm). Though they get off the tower when I’m playing a game since the gpu heats up so much and the exhaust fans blow out the top—it just gets too hot for them. I made a “cat catcher for my bed—a single hand towel folded in half lying on the otherwise featureless comforter. There’s almost always a cat there when I wake up in the morning.

This desk might actually work for me since one of my cats loves to sleep right under my office chair, dangerously close to the wheels. He’s got real long hair and I find tufts of fur around the chair and feel absolutely horrible. Crazily I almost never notice when it happens, he doesn’t yelp! I finally ended up buying a small scratching post with a bed on top and set it under my desk. He instantly took to it, so no more running over the poor cat. As a bonus he’s now in petting reach so I can get my cat fix whenever I need (petting is a two way street).

Page 1 of 34Next →