chowells

That person is a problem because low-trust environments are inherently low-privacy and low-efficiency environments. Allowing a small portion of the population to destroy trust and then justifying it with "well there was no explicit rule against it" is parasitic on the whole society. It's better to stand up and say "this is unacceptable and clearly not what was asked for".

If the Internet goes away, Bitcoin goes away. That's a real threat in a bunch of conceivable societal failure scenarios. If you want something real, you want something that will survive the loss of the internet. Admittedly, what you probably want most in those scenarios is diesel, vehicles that run on diesel, and salt. But a pile of gold still could be traded for some of those.

If you're replacing a chain of filters and maps with a nested loop, you're far past "a simple loop" and well into the realm of an unintelligible for loop. The chain of maps and filters tends to make that far easier to read by decomposing it into separately-comprehensible pieces.

Reduce cannot calculate literally anything, in the sense you mean. It corresponds in computational power with primitive recursion. And quite famously, there are problems primitive recursion cannot solve that general recursion can.

On the other hand, I don't think I've ever seen something as recursive as Ackermann's function in real life. So it can probably solve any problem you actually mean to solve.

It isn't just an RPC spec, it's a use case. Specs never exist without a reason. I can assure you, a spec is a lot of work to write. You don't do it unless there is a purpose.

And with MCP, that purpose is fundamentally unsafe. It cannot be done safely without a different underlying technology. So yeah, it's pretty fair to say MCP is unsafe by design. It wouldn't exist except for that desire to create systems which cannot be secure.

Not supported means they're not debugging your broken system. It doesn't mean the game doesn't work when your system isn't broken.

Now, consider that that the program might be rejected for being incorrect, without being run. Wouldn't that be even better?

Turing completeness is irrelevant, as it only addresses computation. Security has to do with system access, not computational capacity. Brainfuck is Turing complete, but lacks any primitives to do more than read from a single input stream and write to a single output stream. Unless someone hooks those streams up to critical files, you can't use it to attack a system.

Language design actually has a lot of impact on security, because it defines what primitives you have available for interacting with the system. Do you have an arbitrary syscall primitive? Then the language is not going to help you write secure software. Is your only ability to interact with the system via capability objects that must be provided externally to authorize your access? Then you're probably using a language that put a lot of thought into security and will help out quite a lot.

I mean, it's my #1 experience using npm. I never once have used `npm install` and had a result other than it changing the lockfile. Maybe you want to blame this on the tools I used, but I followed the exact installation instructions of the project I was working on. If it's that common to get it "wrong", it's the tool that is wrong.

This is a functor, not a monad. Also, it's implemented really poorly. If only more languages actually implemented monads well. You wouldn't need special case junk like this.

Have you ever tried to self-host a font from Google fonts? I have. It's actually quite a lot of work. It doesn't just give you a blob of CSS that links to a font file. It dynamically populates the contents based on what Google thinks of your request. You can't just examine your browser network logs to get the content you need. You have to synthesize the contents of a lot of different requests to fully populate the CSS, and get a bunch of different font files. And it's not just combining things blindly, you have to work around all the weird splitting it does to attempt to optimize common cases.

Writing a tool to do all that work for you is the hacker spirit. Mocking the work is not.

No, really. I asked a specific question. What would a vulnerability that's not propaganda look like? Please explain how to distinguish between propaganda and non-popaganda vulnerabilities. I need to be able to distinguish between them for myself.

The... propaganda? PoC exploits demonstrating full device takeover by sending an image file are propaganda? What would a real security vulnerability that's not propaganda look like?

https://nvd.nist.gov/vuln/detail/CVE-2023-4863

Ok, I see where the "actually 2000" misconception would come from. A mile is 2000 steps, and "mile" comes from "mille".

But "mille" means 1000. Specifically, it was the distance covered by 1000 paces from a marching Roman soldier. It's more consistent to measure paces than steps in the face of left/right asymmetries, so it's the unit implied when you just say you're marching 1000.

Funding cuts. Like from the state and federal levels. This resulted in costs to students increasing while also forcing researchers to generate income. This is the natural result of treating college like a business. They raise costs on every side.

You know, my first job during college involved updating construction documents based on changes that were approved by both the contractors and the owners. Penmanship was critical when updating blueprints by hand - which was always a lot cheaper than getting the source documents, revising them, and reprinting them.

In my very limited experience, I learned the importance of penmanship in that profession.

In my much larger experience since, I've learned the irrelevance of penmanship to writing code. I don't practice my blueprint handwriting anymore. It would be wholly unfit-for-purpose without a bunch of practice. But I understand its value in that context.

If I understand the thrust of your comment correctly, you're pointing towards removing formatting as a channel being a net positive, despite the loss of all these indicators. I might almost agree with that, except for my point 4. Sometimes it's better, on the whole, to break conventions. Mechanical formatting systems cannot make these judgement calls.

I think the minor friction of explicit formatting is a net positive. I think the communication channel it adds carries more value than the friction it imposes hurts. (And I'm calling it explicit formatting because it doesn't have to be manual - it just has to be done with intention, judgement, and approval.)

I don't think the massive friction imposed by submitting code as ink on paper provides enough value to be worth its costs, by contrast.

You've jumped to a fascinatingly false conclusion here. Is this the so-called death of media literacy? I replied to the ideas underlying the post rather than the words in it, and you think that means I didn't read it?

To go through the details: The post explicitly complained about a linter enforcing style rules. It did not object to the presence of mechanically-enforced style rules. In fact, it glorified them implicitly by saying how great it would be if everything was formatted at presentation-time. This glorification is the exact thing I was criticizing.

I think machine-enforced rules are bad because they destroy a communication channel that importantly has point 4 that I listed - when well-formatted code breaks its conventions, there must be a reason for it. That is important information that enforced presentation rules force to be put into another channel.

And it's certainly true that other channels do convey this other information, but I find more value in having it conveyed in the presentation channel than I do in having that channel replaced by mechanistic formatting.

This is the premise underlying the article that I object to. It is present so heavily in the subtext that if you pretend it's not, the post becomes incoherent.

And FWIW, HN rules say not to accuse people of not having read the article. I think that rule is mostly there because someone can read the article and notice something you missed, and it's wiser to not post than it is to assume you absorbed 100% of the context of the post.

I have to disagree with the premise. Formatting code is a critical communication channel. Well-formatted code should tell you:

1. The developer has enough experience to understand that formatting matters.

2. The developer has enough discipline to stick with their chosen formatting rules.

3. The developer has the taste necessary to choose good formatting rules.

4. The developer has the judgement necessary to identify when other concerns justify one-off violations of the rules.

These are really important attributes for a developer to have. They affect every aspect of the code, not just formatting. Formatting is just a very quick proxy to measure those by.

Unfortunately, things like autoformatting and linter rules are destroying the signal. Goodheart's law strikes again.

Why do you think buying recreational narcotics isn't desperation to live?

This is a very business-centric viewpoint. I publish a small number of open-source libraries. They are not a business. I have no interest in making them a business. In fact, the idea of making them a business is repellent. They're just code for doing some tasks more easily than starting from scratch.

I made some of them because I needed them, and had no reason to own them. I made some because I thought another library was poorly designed and I could demonstrate a better way. I didn't make any because I wanted money or recognition. I don't care who uses them, or how. It is literally impossible for a user to do anything with any of them that harms me.

I am deeply suspicious of any world view that declares it bad when people use code I have released for free. I released it so people would use it. Good for them!

In line printers, a line feed moves the paper forward one line. A carriage return moves the print head back to the start of a line. You can do interesting things by making them separate commands, like bold text (overstrike) or underlining, so they were independent commands for talking to a line printer.

ASCII standardized on a character set containing control codes for line printers, so it included CR and LF separately. It's a bit weird that some terminals changed the semantics of those control codes, but I guess things never stay static in time.

I think it comes mostly from CI environments that start entirely clean before every run. 10 minutes every time a commit is pushed is not pleasant. That's not how I'd like CI to work, but sadly it seems to be the current state of things.

The law is not computer code, and this is a feature. Playing word games does not get you out of your legal responsibilities. Was it a text communication in the specified time frame? Then it really doesn't matter what protocol and encodings were used.

Fighting games do not use server-mediated simulation, in general. Cheating is actually a huge problem in popular games. And in fact, even running a server-mediated simulation wouldn't help with any of the common cheating in fighting games.

For instance, a common cheat in Street Fighter 6 is to trigger a drive impact in response to the startup of a move that is unsafe to a drive impact. That is recognizing the opponent's animation and triggering an input. There's no part of that which cares where the game simulation is being done. In fact, this kind of cheating can only be detected statistically. And the cheats have tools to combat that by adding random triggering chances and delays. It's pretty easy to tune a cheat to be approximately as effective as a high-level player.

Kernel-level anticheat isn't a perfect solution, but there are people asking for it. It would make cheating a lot harder, at least.

Yes. It's using a global variable to canonicalize instances so that reference equality is value equality. An LRU cache will evict things that are still in use, so that the canonicalization process returns a different instance for the same value. (If it doesn't evict anything still in use, it's strictly inferior to just tying to the garbage collector anyway.) This will break the assumption that reference equality is the same as value equality that the rest of the code depends on.

People are too addicted to automatic stack traces for mainstream languages to optimize away stack frames.

I'm slightly horrified by the memory leak that's casually introduced without even a remark as to the potential to cause a problem. I can't tell if I'm more horrified by the cavalier attitude or the fact that JavaScript makes having a global registry the only easy way to use an object of an arbitrary type as a key to Map.

But at the very least, if you're going to memoize immutable values, please do it in a way that allows garbage collection. JavaScript has WeakRef and FinalizationRegistry. (Why it doesn't provide the obvious WeakCache built on those is a mystery, though.)

The issues won't be visible on a toy example like making mazes a few hundred elements across, but if you use these techniques on real problems, you absolutely need to cooperate with the garbage collector.

Autocomplete-oriented programming optimizes for writing code. I don't think that's a good route to go down. Autocomplete is good for spewing out a large volume of code, but is that what we want to encourage?

I'd much rather optimize for understanding code. Give me the freedom to order such that the most important ideas are up front, whatever the important details are. I'd much rather spend 3x the time writing code of it means I spend half the time understanding it every time I return to it in the future.

Um... This conversation is about OpenBSD, making that objection incredibly funny. OpenBSD has a mostly-deserved reputation for doing the correct security thing first, in all cases.

But that's also why the rng stuff was so much faster. There was a long period of time where the Linux dev in charge of randomness believed a lot of voodoo instead of actual security practices, and chose nonsense slow systems instead of well-researched fast ones. Linux has finally moved into the modern era, but there was a long period where the randomness features were far inferior to systems built by people with a security background.

Why would I care? I write libraries to help humans write code. If an LLM was actually good at writing code, it would engage with the library in the same way as a human. If it can't, that's not a problem with the library. I don't lose anything if an LLM doesn't use a library I've written.