HNHacker News
TopNewBestAskShowJobs

buro9

24,701 karma · joined January 8, 2008

barely active on here now, VP Eng @ Grafana Labs
submissionscomments
buro9··on The Race to Seal Helium HDDs (2021)
I received a HDD only last year where the SMART status immediately reported a failure for status 22, and it led me to https://www.backblaze.com/blog/smart-22-is-a-gas-gas-gas/

It's an immediate "return the drive" scenario, as something happened between factory and the SMART test and the drive is no longer within spec.

Thankfully an easy returns and replacement process, but an eye opener too, I hadn't heard of SMART 22 prior to this.

buro9··on Geomys, a blueprint for a sustainable open-source maintenance firm
I'm really glad to see `bluemonday` in such company, but I'm also really happy to hand over the reigns to a group of engineers that can focus on OSS.

I am the author of https://github.com/microcosm-cc/bluemonday but being a maintainer is a journey, you make a tool for yourself, you realise others will benefit and open it up to others... time passes... and then you realise you are that tiny pillar in the XKCD comic about dependencies, and that when you make a casual update to the project that multiple security companies ping you to ask the impact and scope of the change, implications, and of course others ping you to say that it breaks their individual workflow.

I've known Filippo for almost as long as that library has existed, and I know it's in a safe pair of hands, and that Geomys is going to be a good home to all of the OSS projects that they have in their portfolio.

It's definitely a journey, how should these foundational elements be supported and funded? This is one answer to that question, and I'm glad it exists as my spare cycles were very few, I'm also really glad for Filippo being so key to it, if anyone will make this work and do a good thing it will be him and those who he surrounds himself with.

buro9··on Cities need more trees
There are a lot of species that may be misinterpreted as a shrub, i.e. a Hazel tree https://www.woodlandtrust.org.uk/trees-woods-and-wildlife/br... is dense, and forms many smaller straighter branches shooting up in parallel... could easily be mistaken as a shrub as this next pic shows https://cotswoldtrees.com/hazel-corylus-avellana/ .

Still a tree though, and all trees are good trees.

buro9··on Microsoft Account to local account conversion guide erased from Windows 11 guide
I wouldn't mind if Microsoft didn't keep breaking Windows PIN and Windows Hello.

Enabled it on a private PC but a different account (a work one) owns the Office license, and now Windows knows that there is an account that owns the Windows license and a different account that owns the Office license.

Result? All kinds of fun that looks like this https://answers.microsoft.com/en-us/windows/forum/all/window... and has many many recommended answers, of which none worked.

What did work, was removing the work account via Accounts > Work or School, and falling back to a local account and password for Windows. At least I can sign in to the machine again.

buro9··on US EPA Enforcement and Compliance on Apple Fabrication
> and I would very strongly doubt any new claims made

And I would very strongly doubt the word of a People Team member as the conclusive evidence of any lying.

People Team are there to reduce the liability for the company, the company in this case are the very company in question for alleged environmental issues.

What actually happens vs what a trained People Team member knows to document are seldom the same thing, and people on the receiving end of the consequences of this seldom have their full wits about them at the time and are almost never lawyered up at that time.

If you had other receipts I'm sure people might consider them, but if your main gripe is based on what a People Team / HR person says... yeah, that's not conclusive either.

The one party I would trust most here are the EPA, and the author didn't fabricate (pun intended) the reports made by them.

buro9··on Ask HN: Advice for leading a software migration?
Is it a web service? Can you put a proxy in front of the old, to allow you to observe, and potentially duplicate (to the new, whilst testing) all requests that go to the old system?

If you're migrating data, can you take counts of things, so you can get quickly verify, i.e. we have 2.32M records before, and we have a way to prove we have 2.32M records after.

Mostly though, all migrations take longer than you think.

buro9··on “Attention assault” on Fandom
The problem with wikis is similar to the problem with forums... it's not that they do not work really well, they do, but it's that the cost of running a single wiki or forum in terms of operational overhead and hosting costs is significant.

Dynamic user generated content is going to do two things:

1) it's going to result in you needing a database and a web server, capable of a few concurrent users (in addition to bots and guests) but likely sized to handle your spikes in traffic... i.e. over-sized, let's ballpark at $50 per month (people will argue some specifics, but in general this is indicative)

2) it's going to result in you needing to stay up to date, moderate new users, and manage spam... i.e. it requires a disproportionate time investment

and the content is likely crappy, you were just having shits and giggles and nerding out on some small thing that you got excited about... not quite worth those costs.

the solution then is a multi-tenant platform that distributes the ops, cost and moderation problem evenly across many sites, so perhaps the $ cost to you is $1 per month, and time is hardly anything.

but now you've got a different problem, now there's a central entity that "owns" the platform and likely helped itself to a license allowing it to use all of the content, monetise away and profit of the fandom of others.

there are anarchic platforms to counter this, but they're small and cannot be the destination for people to migrate to, and so we're stuck with either the high overhead, costs, and burnout of individual sites, or these crappy platforms taking their users for granted.

though now I wonder... what license is fandom content under? can an independent entity scrape it and start over?

buro9··on Perplexity AI is lying about their user agent
The companies will scrape and internalise the "customer asked for this" requests... and slowly turn the latter into the former, or just their own tool as the scraper.

No, easier to just ask a simple question: Does the company respect the access rules communicated via a web standard? No? In that case hard deny access to that company.

These companies don't need to be given an inch.

buro9··on Google to shut down Google One VPN on June 20
> it's really stunning just how few things actually make it

which echoes my experience in the music industry, and what I've seen of VCs in tech, and small businesses in my town.

very, very, few things are successful, and even fewer of those are successful at the kind of scale that Google needs to ensure that they don't become a sprawling mess of millions of employees. they need very high margin high value products at high scale, supported by the fewest possible engineers (even if that number is still thousands or tens of thousands of engineers)... and the truth is, for that business model, very few things are possible, and that the understanding of what those things are is going to be the result of trial and error.

I'm almost completely de-Googled now, so these announcements affect me less and less as time passes, but I do understand why they do this, and it does make business sense

buro9··on Recall: Stealing everything you've ever typed or viewed on your own Windows PC
https://learn.microsoft.com/en-us/defender-endpoint/enable-c... this works surprisingly well to prevent an app from going too far into folders it should not access.

It's a bit opaque though, not as simple as *nix owner/group/everyone permissions.

buro9··on Google Meet rolls out multi-device adaptive audio merging
Well I'd hope that's a property of a specific meeting and not all meetings, but team weeklies where those not present want to catch up, and the recording is only going to those regular attendees (members of a specific Google Group)... sure, that's a thing we would like to have.
buro9··on Google Meet rolls out multi-device adaptive audio merging
If Meet did "autorecord" combined with "autoshare recording with recipients" (specifically including Google Group recipients)... then it would be perfect.

As it is, we're gradually shifting more things to Zoom where that's either part basic functionality, or part easy to automate as things like Zapier are well integrated into the API.

We only use Meet for team meetings now, and we did use Gong.io to solve the above... but Gong is pretty expensive just to allow those who were out that week to catch up on a recording when they're back and if they care to.

buro9··on ReMarkable
I'd seen these online and thought they were neat, but today I got to witness someone using one and it blew my mind how comprehensively they were taking notes, acting on them, editing, and keeping their thinking organised. I've owned an iPad and it failed to shine here, but as the person told me about the reMarkable it became more obvious that by removing all other distractions and focusing on the best single experience possible, and coupled with a battery life of weeks and the ability to use it in bright sunlight and low light so easily, that a device so dedicated to a single purpose will outperform the arguably better and more capable device.

I needed that reminder, and have now ordered a reMarkable for myself and one for my partner (an academic).

I'm sharing just in case someone else also needed the reminder that a tool like this exists and quietly makes people happy and more effective with note taking and capturing thoughts.

buro9··on Apple apologizes for iPad 'Crush' ad that 'missed the mark'
> How do those of you who feel so strongly about this ad get through daily life?

Whilst I didn't feel a great deal watching the video, this statement is very presumptive.

Reversed: How does one get through daily life _not_ feeling so strongly about things?

Should perhaps we, those who didn't feel a great deal here, not reflect on whether we might be feeling as much of life as we could, empathise more deeply, care about broader things, consider life as more than ration or reason?

It didn't bother me one way or another, but I also didn't assume anything. I can imagine a life far more rich just by feeling more, seeing more colours in the same palette, tasting more when eating food, and feeling so much more when just experiencing life... perhaps for all the benefit of feeling more, there's just the sharper edge that sometimes you feel more about something like an Apple advert.

buro9··on The business of wallets
I mean, you can just read up on Gov information on it: https://www.consumerfinance.gov/data-research/research-repor... (similar reports are published by the EU, UK, and other governments)

"Apple is reportedly using consumer data, such as spending history and which devices a user owns"

"Specifically, Google collects an immense amount of consumer data when consumers use the product. Google appears to use this data to develop new services and also in its advertisement business, among other thin"

Payments made by Apple Pay and Google Pay/Wallet both include a lot of data, and the use of that data by Apple, Google, Samsung, et al is "opted-in" when you chose to use the service and were presented with the very long ToS to agree to.

I bet most people didn't realise that Google may share all of that data (you can see your activity here https://payments.google.com/gp/w/home/activity ) with their affiliates and partners, the opt-out is hard to find and most people are unlikely to be aware of it, it's on this page: https://payments.google.com/gp/w/home/settings

Note: Stripe Link also collects a lot of data https://link.com/gb/privacy-center

Contactless card payments are naturally limited in the amount of data collected and very tight regulation about how it's used.

From a privacy standpoint cash wins, but realistically cards will be used offline and online... so cards which are not loyalty / points cards, and not used via Apple Pay, etc, and which you can use in person, or enter each time into a payment provider and not store are the best choice.

buro9··on The business of wallets
I liked Google pay, until I found myself randomly in some experiment group and it just didn't work one day. I discovered this in the shop, and of course I wasn't carrying physical cards because I'd been duped into thinking the digital type would never fail.

I started carrying my physical cards after that, and started using them more for quick transactions, as I'd rather risk dropping a piece of plastic rather than my phone.

I've entirely switched back to physical cards now, after exclusively using digital wallets for years.

One thing that helped is learning how much data is stored by the wallet providers. I fear data being used against me, in the future, in ways I cannot imagine today.

So imagine my surprise when a Stripe payment, for an online service to provide hormones for transitioning, which is legal where I live... Triggers Stripe to send an email phrased like it was necessary for order confirmation, and then to create a Link account presumably with the transaction details... Opt-in via dark patterns.

One thing not covered is the safety of wallets and the metadata around transactions, safety for individuals from the politics of the United States.

buro9··on Many FBI agents are struggling to make ends meet. Housing costs are to blame
It's also caused by the idea that housing should be an asset to make someone else money, rather than solely a place in which a person/family can live. This leads to the AirBnB culture, the landlord culture, and compounds inequality whilst driving unaffordability.

I'm sure the idea is abhorrent to the USA, but perhaps removing incentives to be a landlord at every step should be considered... mortgages should be punitive on second properties, taxes exorbitant for rented properties, insurance should be unavailable, etc. Housing should experience disintermediation, those in the housing should be the ones owning the housing.

On this site my karma will suffer for saying this out loud, but a persons fundamental right to shelter, food, health... are just not valued in the US above someone else's right to profit from depriving some of shelter, food and health... at every level it's wrong, but yet capitalism seems to demand it.

buro9··on Spotify launches personalized AI playlists that you can build using prompts
Had it in Plex for a while, it does demand a huge library to be really useful though.

Also this announcement really buries the big Spotify change https://djmag.com/news/spotify-officially-demonetises-all-tr... in which they demonetize (keep the money for themselves) nearly all indie and small artists.

buro9··on A podcast about the xz backdoor with the guy who found it
who says that person exists? could well be a persona created for this purpose, with a team behind the persona
buro9··on A deep dive into email deliverability in 2024
I can only share my own numbers: 90K sent, 97.12% delivered, 103.11% clicked (presumably some clicked more than once? or some older emails still being clicked?)

I do not track "opened" / "viewed" as that is not important to me, these are transactional emails, logins or "someone has replied to your conversation".

buro9··on Headline Driven Development
Well this is, at least, better than Gartner Driven Development which has been observed at several startups. Whereby a startup begins to care about their placement on the Magic Quadrant, and start adding very poor imitations of features merely to get a check on a form and move their company more towards the top-right "Leaders" category.
buro9··on A deep dive into email deliverability in 2024
When you use services like Sendgrid, having a spam report will automatically prevent future emails being deliverable, third parties and intermediaries do this precisely to protect their email reputation.

Marking spam may not be immediately be a death knell within Gmail, Hotmail, etc, but because of the potential impact from being marked as spam, virtually everything treats it like a death knell.

This is fine for me, my service is entirely opt-in, and if someone hits the spam button it risks impacting other users who _want_ the email, so I am not bothered that this person effectively unsubbed themselves and killed their account.

buro9··on A deep dive into email deliverability in 2024
I run webforums, and this is enforced trivially.

I don't send marketing, I only send transactional emails. Notifications are opt-in, and transactional. Logins / signups are done via sending a TOTP to the email, these too are transactional.

If someone marks notifications of new posts in a subscribed thread as spam... fine, but this is self-solving, as this person will trigger no more email ever reaching them for that email address, meaning they also cannot now sign in to the website, and therefore cannot subscribe to more email updates, or visit things to refresh "last viewed", and so would never be notified again.

Emailing a TOTP as a login has increased deliverability by self-selecting the removal of those who hit the spam button. Deliverability of email from the webforums is over 99%.

Reporting email as spam, effectively bans oneself from the website. I didn't even need to do anything.

buro9··on Someone has been attempting to DDoS us for weeks and we do nothing
Decent Wordpress hosters always had this, but the majority of Wordpress sites were (and probably still are) just droplets, Linode, Hetzner, etc.
buro9··on Someone has been attempting to DDoS us for weeks and we do nothing
Given that the vast majority of the web are Wordpress sites (or Drupal if you're a larger Org) that are on $5-20 per month multi-tenant hosts, have not installed caches, and speak directly to the database... the vast majority of sites on the internet can be knocked offline by merely doing 4 requests per second.

That sounds crazy, right? But yet that's where we are.

Context: I used to manage the DDoS protection at Cloudflare, and also the WAF, Firewall and some customer facing security projects, and we frequently either saw that web scraping took customers offline, or trivial and very low volume HTTP request rates took customers offline. In the early days we considered anything to be a DoS when it threatened our infra, but the threshold for customers is barely higher than a few concurrent and active users.

The big numbers always make headlines, but it's the small numbers which most people feel.

buro9··on Google I/O 2024
They'll also be announcing some new thing that is average, but as it overlaps with an existing thing that is awesome and barely related, they're of course shutting that down.
buro9··on Gigantic Aluminium Spiders
> The self-erecting crane has no weight or height limitations and can be used in very windy locations

We have our space elevator!

buro9··on Ask HN: Who's getting their job applications rejected?
I work at Grafana, and we be hiring, I posted on the Who's Hiring in January and that was a big mistake. I've posted before (probably 6 times a year as I miss the 1st sometimes) and had few to no responses, but in January I had over 50 responses in the first few hours, and it continued to elicit responses for the next week.

Employers are swamped right now, there are a lot of people seeking few positions. I've gone from giving personal replies and spending time on most applicants, from spending time sourcing, to just trying to keep up with the inbound applications.

It's obviously a very hard market right now, and I feel for those who are searching in this climate.

buro9··on Grafana Labs Observability Survey 2024
I work at Grafana, and just attended KubeCon, even when not near the booth but just in Grafana t-shirts I was stopped frequently by individuals saying how much they love Grafana, how it just works, how we should just keep doing what we're doing... there's strong signal there (though this is KubeCon, and K8s isn't the whole industry by a long shot).

But even I would rationally question the survey results, as like all surveys it would only represent those surveyed.

If you scroll to the bottom of the article there is a section "About the respondents and methodology" and to quote, "This year, 306 people participated in the Grafana Labs Observability Survey. We did not contract an outside agency to solicit responses. Instead, we reached out to our community to participate, through our website, social media, and at various Grafana Labs and OSS events".

So let's be upfront here, it's a biased and small sample, but the consistent methodology with prior years means that the directional trends can be identified, even if you cannot extrapolate any specific number to the whole industry.

The indicative signals in there for trends and direction... but it's not quite a 100K audience from all industries and representative of wider engineering.

The number is high due to who was asked to respond.

buro9··on Ibis, a federated Wikipedia alternative
How does moderation work in this system, and if it results in multiple diverging pages on the same topic, how is any of it trusted?

As much as it's a complicated mess, a centralised system with a broad army of moderators operating to similar standards, is the feature of Wikipedia. They may be wrong at times, but they're accountable somewhat collectively for that and so hold each other to account.

← PreviousPage 3 of 34Next →