Hacker News Reader

adontzon Every invoice in Brazil's economy runs on SOAP 1.2

Similar in Georgia https://eservices.rs.ge/app/Downloads

XML/SOAP based protocol was created with modern at the time .Net technologies, but nobody really cared about interoperability, so it screams "old .Net" now.

adontzon TLS certificates for internal services done right

Moreover you can delegate domain to improve security.

https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

adontzon Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

It's not a good analogy. Something is still on in suspend. Good you can control Linux kernel, but what about all other chips which may be an attack vector?

adontzon DialUp95 – A 90s inspired nostalgia hit

Very similar, thank you so much

adontzon DialUp95 – A 90s inspired nostalgia hit

Oh, nostalgia. I had a US Robotics 56K modem, which produced two bell-alike sounds during handshake. It was cool. I search for that specific sounds for years and cannot find.

adontzon htmx: Server Sent Event (SSE) Extension

HTMX can do much more than just innerHTML swap.

https://htmx.org/attributes/hx-swap/ https://htmx.org/attributes/hx-swap-oob/ https://htmx.org/attributes/hx-target/

adontzon I dumped Windows 11 for Linux, and you should too

I'm currently developing ASP.Net Core services and modern .Net is quite nice. Everyone around me uses absolutely free Visual Studio Community edition, so it would be weird to not use it.

adontzon I dumped Windows 11 for Linux, and you should too

These articles... I'm not sure who are the target audience, because I am definitely not and I don't know anyone who is. Specific OS is not the important, anything with modern KDE is good enough to replace Windows 10/11.

But do I (and all my colleagues) need Microsoft Office (Word, Excel at least) and/or Drawing software (Adobe or something) and/or god forbid Visual Studio 2026, and some other corporate software to make a living? Inevitably yes.

adontzon Google is down in Eastern Europe

https://news.ycombinator.com/item?id=45124458

adontzon Is Google Down? - EU networking issue

In particular the following are not accessible ajax.googleapis.com fonts.gstatic.com gmail.com google.com www.googletagmanager.com www.youtube.com

adontzon Is Google Down? - EU networking issue

Same in Georgia

adontzon Nginx introduces native support for ACME protocol

It's a Python package you can install with pip, never ever installed it with Snap

adontzon Nginx introduces native support for ACME protocol

certbot has an plugin for nginx, so I'm not sure why people think is was hard to use LetsEncrypt with nginx.

adontzon SQL Injection as a Feature

What people often don't realize is that in a big business system a user may have no permission to raw data of some table, but may have permission to report which includes aggregated data of the same table, so report permissions cannot be deducted from base CRUD permissions.

If such SIAAS

    - Checks that query is SELECT query (can be tricky with CTE, requires proper SQL parser)
    - Allows editing said query by superuser only
    - Can be parametrized, including implicit $current_user_id$ parameter
    - Has it's own permissions and users can run the query if they have permissions

It's safe enough. I've seen and applied such "Edit raw SQL in HTML form" many times. It's super flexible, especially combined with some CSV-to-HTML, CSV-to-PDF, or CSV-to-XLS rendering engine.

adontzon Plain – a web framework for building products with Python

I've successfully replaced django.contrib.auth multiple times. It it not easy, but it is not too hard either. Honestly, everything else they do could be a regular Django app. Looks to me like forking a big project became a marketing move rather than technology necessity.

adontzon I built a website where you can pop confettis for no reason

Thank you. I really needed that in my life today.

adontzon Ask HN: Who wants to be hired? (December 2024)

Location: Georgia

Remote: Yes

Willing to Relocate: Yes

Technologies: .Net, Ansible, AWS (DynamoDB, EC2, ElasiCache, Lambda, Organizations, RDS, etc.), Azure, C, C++ (Qt), C# (WPF), Jira, Go, Linux, Python (Django), TailwindCSS, Terraform, reverse engineering formats and protocols, cryptocurrencies

LinkedIn: https://www.linkedin.com/in/adontz/

Email: roman@adontz.com

I am an Engineer with experience in backend software development, desktop software development, embedded development, electronics, and infrastructure management. I like to know things.

In recent years I was head of DevOps department in a bank and CTO is an early stage startup. Love open source.

adontzon [dead]

A bit of a first-hand witness context

The Georgian Dream party rigged the elections, stole at least 20% of the votes, securing a constitutional majority.

During the election campaign, the Georgian Dream party promised its voters EU membership.

The party approved the composition of the parliament and government with a gross violation of the law.

The party presented an average football player without a higher education as a candidate for the country's president. This same person could not become the president of the football federation due to the lack of a higher education.

The self-appointed prime minister announced that the question of EU membership will not be considered until 2028.

Unorganized protests began simultaneously in five cities. Police dispersed people with a mixture of cold water and pepper spray. Dozens of protesters were hospitalized with chemical burns to their skin.

adontzon Hyrum’s Law in Golang

Nobody teaches people to use them. There is no analog to "catch most specific exceptions" culture in other languages.

adontzon Hyrum's Law in Golang

Nope, exceptions in Python are not the same. There are a lot of standard exceptions

https://docs.python.org/3/library/exceptions.html#concrete-e...

and standard about exception type hierarchy

https://github.com/psycopg/psycopg/blob/d38cf7798b0c602ff43d...

https://peps.python.org/pep-0249/#exceptions

Also in most languages "catch Exception:" (or similar expression) is considered a bad style. People are taught to catch specific exceptions. Nothing like that happens in Go.

adontzon Hyrum's Law in Golang

Honestly, this is so much worse than "catch". It's what a "catch" would look like in "C".

adontzon Hyrum's Law in Golang

This is a good example of "stringly typed" software. Golang designers did not want exceptions (still have them with panic/recover), but untyped errors are evil. On the other hand, how would one process typed errors without pattern matching? Because "catch" in most languages is a [rudimentary] pattern matching.

https://learn.microsoft.com/en-us/dotnet/csharp/language-ref...

adontzon Hyrum’s Law in Golang

https://www.joelonsoftware.com/2000/05/24/strategy-letter-ii...

Jon Ross, who wrote the original version of SimCity for Windows 3.x, told me that he accidentally left a bug in SimCity where he read memory that he had just freed. Yep. It worked fine on Windows 3.x, because the memory never went anywhere. Here’s the amazing part: On beta versions of Windows 95, SimCity wasn’t working in testing. Microsoft tracked down the bug and added specific code to Windows 95 that looks for SimCity. If it finds SimCity running, it runs the memory allocator in a special mode that doesn’t free memory right away. That’s the kind of obsession with backward compatibility that made people willing to upgrade to Windows 95.

adontzon SQLite vs. PostgreSQL Performance [video]

Great video.

I suspect CPU spikes are caused by Go's GC, not some Postgres client issue. Anton got similar latency spikes in nginx vs Caddy test, explained them by GC then.

While settings in the video make sense for production, worth noting that SQLite WAL settings can affect performance by an order of magnitude, so YMMV. Also, SQLite may be completely in memory.

adontzon OpenFeature – a vendor-agnostic, community-driven API for feature flagging

Yes, it's not a good solution. Targeting was missing, good catch. I've just shared an unusual experience to inspire further experimenting.

adontzon OpenFeature – a vendor-agnostic, community-driven API for feature flagging

Yeah, naming was bad. Courage 0 is maximum courage.

>> How did you measure "experiment tolerance"?

Feedback from CS mostly. No formal method. We tried to survey clients to calculate courage metric, but failed to come up with anything useful.

adontzon OpenFeature – a vendor-agnostic, community-driven API for feature flagging

Mostly functional changes. Like deploying a new parser, which may not support all the old files. There were users which will contact customer support in panic stating that their life is ruined by this change and there were users who's like that fixed by next quarter.

adontzon OpenFeature – a vendor-agnostic, community-driven API for feature flagging

I respectfully disagree. Depends on number and severity of experiments. Comparing two decimals is really not harder than checking a boolean, still a single "if". I do not see much over-engineering here.

adontzon OpenFeature – a vendor-agnostic, community-driven API for feature flagging

>> How do you deal with the bias from your 'more courageous' people?

That's a great question. We had no general solution for that. We tried to survey people, but results were inconclusive, not statistically significant.

adontzon OpenFeature – a vendor-agnostic, community-driven API for feature flagging

A little story from personal experience.

Most people think of feature flags as boolean on/off switches, maybe per user on/off switches.

If one is testing shades of colors for a "But Now!" button that may be OK. Regarding more complex tests my experience is that there are not a lot of users who tolerate experiments. Our solution was to represent feature flags as thresholds. We assigned a decimal number [0.0, 1.0) to each user (we called it courage) and a decimal number [0.0, 1.0] to a feature flags (we called it threshold). That way not only we enabled more experimental features for most experiment tolerant users, but these were the same users, so we could observe interaction between experimental features too. Also deploying a feature was as simple as rising it's threshold up to 1.0. User courage was 0.95 initially and could be updated manually. We tried to regenerate it daily based on surveys, but without much success.