Hacker News Reader

foobiekron I'm not a fan of strlcpy(3)

For most strings, it seems to be that using a varint would solve the overhead problem. For short strings the overhead would be no longer than the null byte (which you could discard, except when interacting with existing APIs).

But as with _all_ string solutions, it's the POSIX interface, standard library, and other libraries that screw you. If you're programming in C today, it's because you're integrating with a ton of C code, and thus it's impossible to make progress since the scope of improvement is so small.

It's always struck me as weird that Rust treats strings the way it does - the capacity value is not useful for many cases of strings, and it would have cost them one bit to special case the handling constant strings without the cap measure, which would be better. Most strings are _short_ which makes the overhead worse, proportionally.

foobiekron I'm not a fan of strlcpy(3)

This. I don't understand the objection and I spent 20 years writing C code. The reason to use strlcpy is not to _fix the bug_ but rather _to prevent the bug from turning into a crash, memory corruption, or exploit_. It also forces discipline by carrying around the length. As you say, it's also a drop-in.

A truncation bug is a hell of a lot easier to debug than memory corruption.

foobiekron At the Mountains of Madness

Never use a string. What if the string is wrong? Use hashes.

foobiekron At the Mountains of Madness

A lot of things work that way because it’s obvious to everyone except the container runtimes on Linux.

foobiekron At the Mountains of Madness

As an aside, a lot of people don't know about ldd, and introducing it to them is very cool, but it should almost always come with a warning - maybe add a note that people should be careful with ldd - ldd _may_ execute arbitrary code. This is in the ldd man page, but most people never read documentation. It is unsafe to use on any binary you're not otherwise believed safe.

foobiekron At the Mountains of Madness

It's a shame that DLL hell was never resolved in the obvious way: deduplication of identical libraries through cryptographic hashes. Containers basically threw away any hope of sharing the bytes on disk - and more importantly _in ram_. Disk bytes are cheap, ram bytes are not, let alone TLB space, branch predictor context, and so on.

There was a middle ground possible at one point where containers actually were packaged with all of their dependencies, but a container installer would fragment this assembly into cryptographically verifiable share dependencies, but we lost that because it was hard.

foobiekron ChatGPT is hallucinating fake links to its news partners' biggest investigations

The tech industry has long, long, long been a rapacious pump and dump scheme where the tech is barely relevant and most of the industry has been harvesting violations of social norms and regulations (tracking and ad tech, Uber, etc.).

The only reason any of us defend it is that's how we make money. Honestly a lot of people in tech should be a little ashamed.

foobiekron CriticGPT: Finding GPT-4's mistakes with GPT-4

The lazy version of that, which I recommend, is always deny the first answer. Usually I deny for some obvious reason, but sometimes I just say "isn't that wrong?"

foobiekron My spiciest take on tech hiring

I don't know your life circumstances, but as I am slightly beyond 25 YOE, it has been over two decades since I found myself job shopping, just job choosing. There's no way I'd be working my current job and also doing whatever weird contract-to-hire gig some company that can't vet employees would ask.

For most senior people, a new job is leaving an existing cushy job. We're not going to do that for some nonsense like this.

foobiekron My spiciest take on tech hiring

What senior person wants to do this?

foobiekron Ask HN: Midlife crisis, which direction to go with?

ML is swarmed with people and security mostly doesn’t pay

Here’s an alternate piece of advice: find a new job and take the job that pays the most money. Repeat.

True joy is getting to where you don’t need to work. The moment you are there your entire outlook changes.

foobiekron Safe Superintelligence Inc.

It's no mystery, AI has attracted tons of grifters trying to cash out before the bubble pops, and investors aren't really good at filtering.

foobiekron Off-path TCP hijacking in NAT-enabled Wi-Fi networks

https://www.usenix.org/system/files/login/articles/105484-Gu...

Abstract: No.

foobiekron The upcoming iterator design for Go 1.23

"Lowercase symbols are private to the package they are declared at"

This isn't magic, it's just a clever convention.

foobiekron The 'Compact' Version of Stable Diffusion 3 Is Generating Monstrous Human Bodies

https://medium.com/incerto/the-most-intolerant-wins-the-dict...

it's interesting to consider the implications of Taleb's essay in light of the companies trying to make globally inoffensive LLMs.

foobiekron Demystifying NPUs: Questions and Answers

Different optimization choices.

foobiekron Leafy vegetables found to contain tire additives

Do your bike tires wear out?

Where does the material go?

foobiekron Make your program slower with threads (2014)

Sadly, this no longer really applies. Programmers today do absolutely grotesque things unimaginable to Knuth of that era. One look at any modern pipeline that converts to and from JSON a dozen times, sometimes even inside the same process between modules, would make Knuth recall all of that.

Programmers now have done the impossible: written code so consistently bad that there are no hotspots, because the whole codebase is non-performant trash.

foobiekron GOG will delete cloud saves bigger than 200MB after August 31st

Honestly, that's absolutely crazy.

foobiekron Simple tasks showing reasoning breakdown in state-of-the-art LLMs

Exactly right and well said.

foobiekron Space secrets leak disclosure

Nobody expects a model file to be code thrat executes whatever.

foobiekron Hacker confirms access through infostealer infection [withdrawn]

"Snowflake internal staff do not have access to read customer data"

Do engineers in Snowflake have access to production systems?

foobiekron Hacker confirms access through infostealer infection [withdrawn]

Exactly, how is an SE privileged enough to cause a problem? Or for the activities to go unnoticed?

Like I would be very humiliated to have a system under my care that had this problem.

foobiekron Is regulated BGP security coming?

The average user does not have JavaScript turned off. Plain http sites are a risk to their users.

foobiekron Codestral: Mistral's Code Model

There's some irony in the fact that people will ignore this license in exactly the same way Mistral and all the other LLM guys ignore the copyright and licensing on the works they ingest.

foobiekron AI headphones let wearer listen to a single person in a crowd by looking at them

There's also a pretty useful criminal application of listening in on people without them knowing.

foobiekron API Shouldn't Redirect HTTP to HTTPS

The bigger issue is that a malicious interceptor could inject javascript. The site may not use javascript, but the users almost certainly have it turned on, and accessing a non-https site means that any man in the middle can inject malicious javascript.

HTTPS is about protecting the client.

foobiekron Possible association between tattoos and lymphoma

How do you know they are inert? The ingredients are mostly unstudied and unregulated.

foobiekron Is regulated BGP security coming?

That issue isn’t a dnssec problem, it’s that Let’s Encrypt was not familiar with the route hijacking threat model. It was pointed out early to them and they ignored it.

foobiekron Is regulated BGP security coming?

The threat model of plain http is about the user (and injected content) and not the server. Plain http is a threat to users.

Has it really been so many years since people used to do tcp injections and walk around coffee shops or whatever returning results faster than the internet server and injecting goatse?

You guys have forgotten who tls protects.