howdydoo

Ideally our critical infrastructure would have a better security track record

For zero-crossings my first thought would be either bullet (•), to not break the visual flow; or multiply (×), since it's at least vertically centered

In C++, any concurrent filesystem access is undefined behavior (which seems pretty crazy to me)

https://en.cppreference.com/w/cpp/filesystem

> The behavior is undefined if the calls to functions in this library introduce a file system race, that is, when multiple threads, processes, or computers interleave access and modification to the same object in a file system.

---

Golang also seems vulnerable to the same issue

https://github.com/golang/go/blob/d15481b8c7f5f73a8b987a0c1d...

Line 78 checks that the path isn't a symlink (time-of-check). Then line 97 calls openFdAt which on line 174 opens the path by name, without NOFOLLOW (time-of-use).

I bet this is a pretty common vulnerability.

We spent our lives searching for the Creator, and in the end all we found was GitHub Copilot

If you think "→" misrepresents the meaning of "->", then certainly "->" also misrepresents the meaning of a semantic arrow "→". The set of symbols in 7-bit ASCII is somewhat arbitrary after all.

Let's say "→" misrepresents the meaning of "->" even as much as 0.1% of the time. Would you rather your risk of error be 99.9%, or 0.1%?

I'm sick of anti-ligature people telling everyone else not to enjoy their fonts, on every single post about a font. Ligatures have caught on for a reason.

> We learned that the key to a post reaching the front page was the content itself.

Well that's good news, at least

I predict we start seeing "Login with 1Password" buttons on random websites next to the google and facebook buttons. I also predict it never catches on.

The natural next step is adding ELIZA-like chat responses to your bots

I know that PioSolver is not a "poker AI" per se, but the article seems to say it can tell you what to do based on the table situation. Has anyone tried pitting pro players against PioSolver?

Or even better, turn on autovacuum (buy a roomba)

Definitely embellished. If you try to eat a live cat, it will scratch your face beyond recognition.

Wow you're right, that's quite a manifesto. Almost as provocative as this quicksort manifesto.

https://www.doc.ic.ac.uk/~mjw03/PersonalWebpage/pdfs/quickso...

> As of April 5th 2017 with the release of Windows 10 Version 1703, SetProcessDpiAwarenessContext used above is the replacement for SetProcessDpiAwareness, which in turn was a replacement for SetProcessDPIAware. Love the clear naming scheme.

This is the kind of thing I hate about "New Windows". Once upon a time MS used to strive for backward compatibility. These days every few years there's a new function you need to call. You can't get optimal behavior just by writing good code from the start. You need to do that, and also call the YesIKnowHowPixelsWork api call, and set <yesIAmCompetent>true</yesIAmCompetent> in your manifest to get what should be the default behavior. It's a mess.

I mean... no, the success of this burgeoning asset class does not depend on me convincing a single HN poster in a long-buried thread. And there never was a "manifesto", at least not one that I've ever heard about. But thanks anyway for the discussion I guess

Bitcoin is a technology that has various use cases. Just because some person gives a sales pitch, doesn't mean that sales pitch becomes the benchmark by which to measure the technology. Bitcoin is decentralized and does not have one stated goal. Many people use it for many different reasons.

If someone keeps changing their claims or is otherwise acting scummy, just ignore them. There are shysters in every industry.

People give sales pitches for lots of things. You don't have to listen to them.

> Are you sure about this?

Whether I'm sure or not... I think everyone should be given the choice.

Crypto isn't intented to remove middlemen. It's intended to give people the choice of who to trust. People can choose to trust an exchange, or to self-custody, and deal with the consequences in either direction.

If I choose to self-custody, it's much safer to memorize a seed phrase than to store cash in my mattress. Most people don't bother and use banks. But I think it's good that people now have a choice in the matter.

Many BTC addresses are owned by companies (e.g. exchanges, trusts, etc) and not by individuals. The Gini coefficient only looks at individuals, not companies. In other words, it doesn't treat Google as a person and compare its wealth directly to yours. So you can't directly compare those numbers.

Has anyone made a bot yet to automatically reply to stalebot so issues aren't closed?

Can you elaborate, what happened with Manjaro?

I just think it's weird that I can't have an LTS OS with non-LTS userland apps. But I guess I have to accept that.

Snap is a nonstarter for me for many reasons. Startup speed is important for shell pipelines, and also it's insane to bundle that much stuff just to run a statically-linked binary. And it wouldn't even solve the version problem, it looks like ripgrep on Snap is two years old. https://snapcraft.io/ripgrep

It looks like manjaro is the most recommended arch distro so I'll give it a try.

Are there any apps other than terminals that don't use ctrl-c? I can forgive that in a terminal app because it conflicts with SIGINT, but it would be very weird if a normal app like vscode did it differently.

The name "testing" kind of turns me off tbh. I want my OS to boot reliably. I don't want to be a test subject.

> How does scoop solve the problem?

It skips intermediate packaging steps and goes directly to the source. e.g. if the author publishes on GitHub, Scoop will request `github.com/ripgrep/releases/latest` (or whatever) and then download `ripgrep-$version.exe`. It has very primitive dependency handling, but I don't think that matters because I mostly install Go/Rust tools which are statically linked.

I honenstly think it's a genius solution. There's no wait time for updates, and you don't have to trust whatever user created the package on every version update.

Scoop installs directly from the first-party source, so you only need to write a package once per app, instead of once per version of each app. Are there any distros that work like that?

I heard rumors long ago that Arch has occasional stability problems caused by updates. Is that still true these days?

I guess that's ironic to hear considering my original question, but I appreciate a different update cadence between the OS (I want LTS, stable) and things like `ripgrep`, which if there's a bug, it won't keep me from booting my system and I can just downgrade if I notice it.

This is a little off-topic, but I've been wanting to switch from Windows to Linux and the one thing stopping me is the lack of a good package manager. WAIT, let me explain.

On Windows, you can just `scoop install ripgrep fzf jq` and you're in business. And updating all installed packages is one command away.

Meanwhile on Debian, the system packages are often years out of date. So authors have started making their own custom install scripts [1], or just telling you to `curl` the binary into /usr/bin [2]. To update these manually-curled binaries you need to run a different set of steps for every one. There's no way to list outdated apps, and there's no easy way to update everything.

On top of that, many apps I use aren't even packaged (k9s, broot are two random ones I just found). Sometimes you can find a third-party repo, but that's yet another person you rely on to get updates. Whereas with scoop, it fetches straight from the source, so there's never any waiting.

Is there some alternative to `apt` that everyone is using? Or how do people generally deal with this?

[1]: https://starship.rs/guide/

[2]: https://github.com/BurntSushi/ripgrep#installation

[3] is pretty insane. They have to scan my network to check for malware... does that mean I can scan their network to check for malware?

Are there any test pages where I can see if I'm vulnerable to this? I've been assuming that uMatrix prevents this, but this post is a good reminder to double-check

B2 itself is not $5 a month. That $5 service is a separate consumer-focused "unlimited" backup service from the same company. B2 just charges for storage and transfer. Yeah, the author was rambling a bit.

My dreams have been thorougly dashed. I cede.