HNHacker News
TopNewBestAskShowJobs

dantiberian

4,623 karma · joined June 22, 2011

@danielwithmusic on Twitter. Clojurists Together co-founder. Working at Whimsical. Working on deps.co for private Maven repositories.

[ my public key: https://keybase.io/danielcompton; my proof: https://keybase.io/danielcompton/sigs/HVrj42Dnw9wOvE9nvNSySMmkoacaCW11OZr0ead1iJQ ]

submissionscomments
dantiberian··on Railway Blocked by Google Cloud
I wrote about the UniSuper issue at the time: https://danielcompton.net/google-cloud-unisuper. It was a pretty nasty bug where their VMWare environment was created with a one-year expiry date, but was one "resource" from the perspective of Google Cloud.
dantiberian··on CISA Admin Leaked AWS GovCloud Keys on GitHub
GitHub has automatic secret scanning on all public repositories which notifies AWS if access keys are pushed. I would have expected these tokens to be immediately revoked by AWS. Is there something different about GovCloud access keys so they weren't detected?
dantiberian··on The Codex App
Could you please pass on feedback to the team that the git diff view is very hard to read for red/green colourblind users like myself? Colour scheme like GitUp.co is very readable for me.
dantiberian··on People who know the formula for WD-40
I'd be very interested to know how they produce it if the formula is so tightly held. At some point people need to be purchasing the ingredients and mixing them together.
dantiberian··on OrioleDB Patent: now freely available to the Postgres community
From the article:

The intention of OrioleDB is not to compete with Postgres, but to make Postgres better. We believe the right long-term home for OrioleDB is inside Postgres itself. Our north star is to upstream what’s necessary so that OrioleDB can eventually be part of the Postgres source tree, developed and maintained in the open alongside the rest of Postgres.

dantiberian··on Happy 10k Day
Looks like it, based on this video driving on the left side of the road in what looks to be Australia: https://www.youtube.com/watch?v=Fkh3s6WHJz8
dantiberian··on Electric (Postgres sync engine) beta release
I listened to https://www.localfirst.fm/18 recently from Electric-SQL. One of the things James mentioned was that Electric lets you use commodity CDNs for distributing sync data, which takes the load off your main Postgres and servers.

This seems like a good pattern, but of lower value for a SaaS app with many customers storing private data in your service. This is because the cache hit-rate for any particular company's data would be low. Is this an accurate assessment, or did I misunderstand something?

dantiberian··on Model Context Protocol
Will this be partially available from the Claude website for connections to other web services? E.g. could the GitHub server be called from https://claude.ai?
dantiberian··on Zero-latency SQLite storage in every Durable Object
https://where.durableobjects.live is a good website that shows you where they live. Only about 10-11% of Cloudflare PoPs host durable objects. Requests to another PoP to create a DO will get forward to one of the nearby PoPs which do host them.
dantiberian··on 1 bug, $50k in bounties, a Zendesk backdoor
The issue here is that if company.com does not use Google Workspace and hasn't claimed company.com, then any employee can sign up for a "consumer" Google account using user@company.com.

There are legitimate reasons for this, e.g. imagine an employee at a company that uses Office365 needing to set up an account for Google Adwords.

dantiberian··on Starbase: SQLite on the Edge
I don't really understand what this is offering beyond Cloudflare's recent release of running SQLite in durable objects: https://blog.cloudflare.com/sqlite-in-durable-objects/. Is it about providing an external interface to Cloudflare's SQLite databases?
dantiberian··on We survived 10k requests/second: Switching to signed asset URLs in an emergency
Could you explain more why you were you not able to sign the URLs at request time? Creating an HMAC is very fast.
dantiberian··on All of Microsoft's MacBook Air-beating benchmarks
The Surface Laptop scored 1,745 on the Procyon AI Score, while the MacBook Air managed 889. Qualcomm’s Snapdragon X Elite has 45 TOPS of AI acceleration performance, much more than the 18 TOPS found on the M3.

TOPS (Trillion Operations Per Second) is a meaningless score without including the precision. Are they INT4, INT8, INT16 or FP16? Microsoft's qualifications for a Copilot+ laptop require 40 TOPS at INT8: https://www.theregister.com/2024/05/21/qualcomm_windows_micr.... The new Snapdragon X Elite can do 45 TOPS at INT8.

Apple's M3 has 18 TOPS, and their M4 has 38 TOPS, but the M3 was measured at INT16 and the M4 at INT8: https://www.anandtech.com/show/21387/apple-announces-m4-soc-.... Cutting the precision in half lets you do ~twice the amount of work.

The Snapdragon is very impressive, but it's silly to see TOPS claims from companies repeated by journalists without adding some context.

dantiberian··on What went wrong with UniSuper and Google Cloud?
Thanks for pointing that out. I had a look at the Terraform provider but missed that delayHours was hardcoded to 0. I’ll update the article.
dantiberian··on Australia to ban engineered stone
From the report (page 56):

Exposure to RCS from engineered stone causes silicosis typified by a faster onset and more rapid progression than that caused by RCS [Respirable crystalline silica] from other sources, including natural stone.

When engineered stone is processed, the dust generated contains higher levels of RCS, and that RCS has different physical and chemical properties that likely contribute to the more rapid and severe disease. There is also evidence to suggest that other components of engineered stone may contribute to the toxic effects of engineered stone dust, either alone or by exacerbating the effects of RCS.

...

The increased risks posed by RCS from engineered stone, increased rate of silicosis diagnosis amongst engineered stone workers, and the faster and more severe disease progression amongst this group, combined with a multi-faceted failure of this industry to comply with the model WHS laws means that continued work with engineered stone poses an unacceptable risk to workers. The use of all engineered stone should be prohibited.

https://www.safeworkaustralia.gov.au/sites/default/files/202...

dantiberian··on Australia to ban engineered stone
From the report:

> A total of 12 successful prosecutions have been reported since 2021, with many related to the uncontrolled processing (dry cutting) of engineered stone materials

https://www.safeworkaustralia.gov.au/sites/default/files/202...

dantiberian··on How Bear does analytics with CSS
You should add this as a reply to the top comment as well.
dantiberian··on I think GCP is better than AWS (2020)
A general issue I have with GCP docs is that they are overly implicit. Often the interaction of two features is implied but not specified. Another issue I have is when implementation details are waved away rather than explained. It adds up to an experience where I am trying to read between the lines of the GCP docs for a feature to understand what is really happening.

AWS docs are the opposite. They are often very long and verbose, but once you read the whole manual, you can be guaranteed to have a good understanding of the service.

My advice for the Google team would be that if you are ever writing documentation and ask yourself “does the customer really need to know about this?”, the answer should always be yes.

dantiberian··on Infrastructure Manager: Provision Google Cloud Resources with Terraform
Presumably GitHub/GitLab support is coming, but this is quite a limited product at the moment. It doesn’t even support their own Cloud Source Repositories.

You can version the Terraform configuration, either in a public Git repository or in a Cloud Storage bucket. Use Object Versioning to version configurations in a storage bucket.

https://cloud.google.com/infrastructure-manager/docs/overvie...

dantiberian··on Clojurists Together – Firefox 116 release
Co-founder of Clojurists Together here, I’m really proud of what the Clojure community was able to fund here.

Now, all Firefox users will be able to use custom formatters. They’re a very useful tool, I’d love to see more JavaScript projects adopt them.

dantiberian··on New York City may be sinking under the weight of its skyscrapers
This is all based on the authors' estimations, not actual measurements or observations.

The scholars first estimated the cumulative weight of New York’s buildings to be 1.68 trillion pounds, and then calculated the downward pressure these buildings exert on the mixture of clay, sand, and slit that make up most of the ground beneath the city’s streets.

Based on their model, New York experiences a “subsidence rate” (the technical term for sinking) of about one to two millimeters per year on average, though Lower Manhattan, as well as particular areas of Brooklyn and Queens, show a propensity for greater subsidence risk.

dantiberian··on How Discord Stores Trillions of Messages
How much of the latency reduction was due to the data services layer with request coalescing and how much was from ScyllaDB? Did the schema and other factors stay the same when migrating to ScyllaDB?
dantiberian··on Toyota suffered a data breach by accidentally exposing a secret key on GitHub
The GitHub public events API is delayed by 5 minutes, presumably to give secret scanning partners time to react before commits are made public.

https://github.blog/changelog/2018-08-01-new-delay-public-ev...

Disclosure: I'm an ex-GitHub employee but was not involved in the secret scanning API.

dantiberian··on Pipefail: A missing shell option slowed Cloudflare down
One other thing which could have prevented the shell failure is checking shell scripts with https://www.shellcheck.net/. It helps catch common errors and places where shell errors can fail either silently (like here), or catastrophically (`rm -rf $abc/` where $abc is undefined)

Perhaps that was also part of Cloudflare’s mitigations here too but not mentioned.

dantiberian··on Their secret for workplace Zen: Landlines and ethernet cords
Google doesn't use shared building wifi in their corporate campuses

> For both wired and wireless access, Google uses RADIUS servers to assign devices to an appropriate network, based on 802.1x authentication. We use dynamic, rather than static, VLAN assignment. This approach means that rather than relying on the switch/port static configuration, we use the RADIUS servers to inform the switch of the appropriate VLAN assignment for the authenticated device. Managed devices provide their certificate as part of this 802.1x handshake and are assigned to the unprivileged network, while unrecognized and unmanaged devices on the corporate network are assigned to a remediation or guest network. - https://static.googleusercontent.com/media/research.google.c...

Yes BeyondCorp does allow access to corporate resources outside of the intranet, but as part of a managed device + identity + network evaluation.

dantiberian··on How our free plan stays free
BastionZero is a similar product which gives you multiple roots of trust, one to BastionZero, and one to your identity provider (Google, Okta, etc.) https://www.bastionzero.com/security-model
dantiberian··on Pull Through Cache Repositories for Amazon Elastic Container Registry
> You pay for all bandwidth into and out of Amazon S3, except for the following:

> Data transferred from an Amazon S3 bucket to any AWS service(s) within the same AWS Region as the S3 bucket (including to a different account in the same AWS Region).

https://aws.amazon.com/s3/pricing/

dantiberian··on Why is Control Center on Monterey listening on ports?
Only .localhost, .example, .test, and .invalid are reserved for those purposes: https://datatracker.ietf.org/doc/html/rfc2606. .local is reserved, but for mDNS usage.
dantiberian··on Microsoft warns thousands of cloud customers of exposed databases
https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-a... is from the researchers and has more details.
dantiberian··on Bitcoin’s reliance on stablecoins harks back to the Wild West of finance
I just listened to a podcast about this and the guest Bennett Tomlin said these are things that may happen if Tether was shut down by the US government:

https://anchor.fm/aviv-milner/episodes/The-Tether-Situation-... at 30:57

* Price of BTC/USDT ETH/USDT explodes as people try to exchange Tether to another liquid asset

* BTC and ETH start to drop on non-Tether exchanges as people sell and try to get out to fiat currency

* Tether collateralises futures contracts, when BTC/USDT spikes, some strange behaviour may happen in derivatives based on Tether.

* Tether allegedly is a meaningful percentage of the commercial paper market, if those assets are seized, it may affect that market.

* Some S&P500 companies have a lot of Tesla on their books. As BTC/USD drops, that would impact their stock price, and potentially the index overall.

* Some shadier crypto exchanges may go under or abscond with client funds in the confusion.

A lot of this could happen in a matter of minutes.

You could imagine a similar flight to safety happen if Tether was revealed to not have the reserves they claimed to and were unable to redeem client funds.

Fun times!

Page 1 of 16Next →