HNHacker News
TopNewBestAskShowJobs

gred

1,409 karma · joined October 3, 2013

submissionscomments
gred··on CS240 AI Cheating Retrospective
I'm a fan of zero tolerance policies for academic dishonesty. The dean getting involved and mitigating consequences for the ~~customers~~ students is classic.
gred··on Rock band Muse lose social media handles to Meta’s new AI tool
I'm sure somehow it's George W. Bush's fault.
gred··on Oracle bans AI-generated code from OpenJDK
Not too different from the recently-announced Rust guidelines at https://blog.rust-lang.org/inside-rust/2026/08/05/rust-langr...
gred··on PyPI Blog: Releases now reject new files after 14 days
There is indeed a "draft" release (I think they call it a "deployment"), but AFAIK your choice is then to either publish it or delete it. If you review it and it looks good, you publish it and can't change it thereafter (no changes to files, no adding new files, no removing existing files). If, however, you need to change something in the deployment before publishing it, you have to delete the deployment and create + upload a new "draft" release / deployment (can be same version number, since the previous "draft" wasn't published). AFAIK these "draft" releases are visible only to the author.
gred··on PyPI Blog: Releases now reject new files after 14 days
Yeah, I think that's the difference. In Maven, the entire set of files which compose a release is immutable. You can't add to or remove from the set of files once you've published. You have to release a new version if you want to add anything.
gred··on PyPI Blog: Releases now reject new files after 14 days
In the Java world, Maven has a "publish" step. Published artifacts (groups of files) are immutable, so publish == finalize.
gred··on Microsoft has released software updates to plug at least 570 security holes
Emergent product roadmap in action.
gred··on This blog is written in en-GB
Do you mean A&E the television channel?
gred··on Supreme Court upholds broad conception of birthright citizenship
> Conservative bias in the media.

Depending on how you count, something like 96%, 94%, 65% or 87% of mainstream media employees lean left. Of course this matters less and less as customers tune out and their influence wanes.

https://ballotpedia.org/Fact_check/Do_97_percent_of_journali...

gred··on Malicious npm packages detected across Red Hat Cloud Services
Thanks for the link. However, a 7x size differential does not fully explain a 100x security incident differential -- although I'm sure it's part of it. Some of the root causes are very hard to address (e.g. a very limited standard library which encourages dependency explosions), some are just hard (e.g. established cultural norms around version pinning and upgrades, well-established reliance on install scripts) and some are easier (e.g. small tool improvements like min-release-age). I'm personally not going to touch npm with a ten foot pole in the next year or two, but I'd love to see significant improvement, so that I have that option again in 2 or 3 years. Stay safe!
gred··on Malicious npm packages detected across Red Hat Cloud Services
Days since last malicious packages in NPM: 0 (evergreen)

Days since last malicious packages in PyPI: 30

Days since last malicious packages in Maven: 120

I'm sure this isn't 100% accurate, and there are probably better metrics (average number of malicious packages per year, average number of developers affected per year, etc) but they aren't as easy as a quick Google News search.

gred··on Incident with Pull Requests, Issues, Git Operations and API Requests
We're halfway there!
gred··on Incident with Pull Requests, Issues, Git Operations and API Requests
New PR: revert GitHub software and infrastructure to version of June 1st, 2018.

New PR: disable new user signups for 6 months

HR initiative: all future KPIs automatically require three-nines availability; all bonuses are forfeited, regardless of accomplishments, if annual availability falls below target

HR initiative: fire CEO and CTO

gred··on Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
> The thing keeping maven safe for now is that most people pin [...] versions

Yes, and also the signing of JARs that are uploaded to the repository, and the fact that most release processes are not fully automated, and the batteries-included standard library which reduces the total number of dependencies, and the fact that a run-of-the-mill third-party library can't execute code at build time, and the very small number of people with credentials to publish new versions of major Maven plugins, etc.

gred··on Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository?

Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade.

gred··on Postmortem: TanStack npm supply-chain compromise
There are npm supply chain exploits in the news every other day. I'm honestly surprised that something as decentralized as Go Modules is more reliable, but here we are. The fact that we're not seeing these stories about e.g. Maven is not at all surprising, given the limited need for third party libraries and the culture of careful upgrades in the Java ecosystem. If npm proponents want the ecosystem to survive, they need to demand / create better and stop making excuses.
gred··on Maybe you shouldn't install new software for a bit
The future may be distributed quite unevenly here, as they say, with a divergence between a small amount of "responsible" code in systems which leverage AI defensively, and a larger amount of vibe-coded / prompt-engineered code in systems which don't go through the extra trouble, and in fact create additional risk by cutting corners on human review. I personally know a lot of people using AI to create software faster, but none of them have created special security harnesses a la Mozilla (https://arstechnica.com/information-technology/2026/05/mozil...).
gred··on Why IPv6 is so complicated
They should have had the UTF-8 guys tackle IPv6. Talk about elegant.
gred··on Tell HN: docker pull fails in spain due to football cloudflare block
> run your systems outside of Spain

So much for digital sovereignty :-)

gred··on EFF is leaving X
Disagree with so much here. But if, in your mind, the US is turning authoritarian, this is a "cut off your nose to spite your face" move. They should be taking the fight where it most needs fighting. They should not be making donors like myself question whether we still share objectives.
gred··on EFF is leaving X
> they have been silenced by the platform

Where do you see that? All I see is a claim that it no longer makes sense from a financial standpoint (but no comparative numbers provided for the other platforms they are keeping, which is sus, especially given their presence on very niche platforms like Bluesky), and vague justifications based on identity politics and "community care" loci, which is either nonsense or deep argot unsuitable for the intended audience.

gred··on EFF is leaving X
He's saying that they have ideological concerns beyond the ideological concerns you would tend to associate with the EFF (digital privacy, open source, patent trolling, etc). I for one am sad to see that this is the case. There are fewer and fewer organizations protecting civil rights without being dragged into left/right tribalism.
gred··on Show HN: Brutalist Concrete Laptop Stand (2024)
> this obviously doesn't make any sense

That's debatable, but it's a moot point; it's pastiche, so it doesn't have the same goals or motivations as the original.

https://en.wikipedia.org/wiki/Pastiche

gred··on Our commitment to Windows quality
Three years too late, in my case. I've moved on.
gred··on Porsche sold more electrified cars in Europe in 2025 than pure gas-powered cars
Madrid, Spain. It's theoretically very EV-friendly. These days I tend to rent hybrids. I don't even care if the battery actually works. They check the "green" legal checkbox which allows you to go downtown without getting a ticket, and you can rely on the ICE engine to get you where you need to go.
gred··on Porsche sold more electrified cars in Europe in 2025 than pure gas-powered cars
> Practicality beats enthusiasm for 95% of car use.

About two years ago I rented an electric car for a few days. I felt like I wasted a ton of time finding a charging station, jumping through phone app hoops to get the charging process started, and then waiting for the car to charge. I've stayed away from electric rentals since, even though they're often cheaper.

gred··on Statement from Jerome Powell
> It's the Supreme Court that has expanded the powers of the President

Sort of, but Congress also wrote a bunch of pretty broad, vague laws, delegating a significant amount of power to the executive via agency rulemaking, and it turns out the agencies are part of the executive branch and have to do what the head of the executive branch says they have to do (within the limits of those broad, vague laws). If Congress can't get back to smaller, simpler, more specific laws, and they continue to pass the burden of this complexity over to the executive branch to figure out, the executive branch will continue to wield outsize power.

gred··on 2026: The Year of Java in the Terminal?
> AbstractCommandlineParserFactoryBeanServicePatternFactory

...Locator

gred··on The Legacy of Nicaea
Thanks for the links.

Regarding "real presence", and speaking only for myself as a Christian who doesn't believe this -- my attitude to this is similar to my attitude to disagreements on creation in 6 days vs 6 eras, disagreements over where the end-of-times millennium will fall in the overall sequence of events of Christ's return, and disagreements on how or whether to celebrate Christmas.

For all of these topics I have a belief, and I'll argue it happily, but I also know that none of these are central to salvation. I'm not so sure about Mariology, which seems to veer dangerously close to idolatry and appears to cloud Jesus' central (and exclusive) role in salvation.

gred··on The Legacy of Nicaea
It's a little ironic to label a call to "stop adding new things" as a "new thing" itself, no?
Page 1 of 12Next →