HNHacker News
TopNewBestAskShowJobs

klabb3

8,765 karma · joined October 12, 2019

Working on https://payload.app/

contact at payload dot app

submissionscomments
klabb3··on What do Visa and Mastercard do? An intro to card networks
> VisaNet & friends make the modern consumer world go round.

I mean, as opposed to what? You could apply this to any infrastructure cartel like with AT&T in the 90s or Comcast or 100s of historical examples. The alternative to a bridge troll is not ”no bridge”.

klabb3··on Malicious Rust crate Arrayref runs a build-time payload
100% agree. Wow I can’t believe how many think sandbox builds is an actually good idea, on a per language basis too. There are completely standard QoL issues in cargo that have been open for years and nobody is working on. Maintaining a sandbox for idk 3 operating systems minimum that have virtually no sandboxing support? For extremely diverse workloads that typically invoke commands? I mean.. good luck.

There are still elephants (or rather mammoths) in the room for supply chain security, such as having 1500 nested deps for a standard project. It’s like we never woke up from the nightmare of leftpad.

If your project had code from 100s of individuals, new versions can be pushed instantly, and nobody wants to review the code, then you have a time bomb. And also other problems.

klabb3··on Mars Bar from 1991 found – and it's 20g bigger than today's
I believe that in all of EU you can just look at the ”comparison price” which is per-weight and listed below the normal price. It’s also very useful for quickly comparing similar products directly in-store. It’s a great piece of no-nonsense regulation that counters a lot of the deception, and instead favors competition on the price-quality axis, ie healthy market dynamics.
klabb3··on The coolest use for the Vision Pro
1000%. If you have the luxury/curse of _building_ the house on empty land simulating light is extremely important imo. It determines everything from layout of rooms to window placement to furnishing etc. (You probably don’t want eg sun behind TV). Even ants orient their dwellings with respect to sunlight.
klabb3··on Judge approves $1.5B Anthropic settlement for pirated books used to train Claude
This reminds me of this argument with libertarians/ancaps:

A: rich people pay less % in taxes than wage workers, we should close the loopholes

B: but taxes are immoral to begin with

A: ok, but can we do something now about the unequal enforcement? Unrealized gains, tax havens, trusts, fake charities, etc?

B: well a society based on property rights… ackhully you should read this book by Mises/Rothbard/Rand

klabb3··on Decoy Font
> Maybe the more interesting thing is how far people are going to 'fight' against AI?

All ”AI resistance” I’ve seen is not against the tech, but against human bad actors behind AI: unethical procurement of training data, reckless application, low effort high volyme spam, replacing humans, centralization of power, dependency on megacorps etc. I think a lot of people have become less tech-positive after the ad-tech era that brought us social media, unprecedented levels of surveillance, freemium rug pulls etc. It’s much easier to understand the resistance if you place it in that context, rather than imagining millions of sleeper agent luddites suddenly coming out of the woodworks.

klabb3··on I'm a USB-C Maximalist
There were two major flaws with the rollout of USB-C, none of them technical:

To have unmarked cables. This should have been explicitly forbidden by spec as non-compliant. Today unmarked is the norm, even with premium brands. And the few ones that actually mark their cables have their own markings (which I assume is because the official logos are so incredibly bad). So now instead of wondering if the charger will work, you’re wondering if the cable will work.

Secondly, the USB-C rollout was only successful on the sink (device) side. Almost all cheap gadgets come with an A-to-C cable, and chargers and PC ecosystems are very biased on the A ports for the host side. This created an awfully ugly side effect: devices are not always compliant with even basic charging. Since C-to-C should not have live 5V line active at all times, these devices don’t charge at all. I think they’re missing that resistor that tells a compliant charger to make it live. But in either case they only work with A-to-C.

klabb3··on Write code like a human will maintain it
Why stop there? If you _use_ handwritten products you’re ngmi. I only use vibe coded operating systems, JavaScript sandboxes, compilers, TLS libraries, databases, rendering engines..
klabb3··on AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
Im not a security engineer at all and I have an instant gut reaction to floats in regular code. ”How big can this get? Is it deserialized? What arithmetic ops are happening? Any risk of rounding error propagation?” etc.

Now, I wouldn’t necessarily mean I deem it bad practice in security contexts since again, I don’t know. But if an expert doesn’t consider those things, I would be surprised (and a little scared).

klabb3··on We Are the Last People Who Know How It Works
In engineering you have tolerances to deal with non-determinism. ”Within these bounds” and ”given these assumptions then…” is the foundation of building something _on top of_ those things. LLMs are the same, it relies on heavily exact Turing machines as input but its output is entirely unstable. Even if you can get determinism it will never get anything resembling ”bounds” out of the box. That makes it a poor foundation for building on top of. Ie it’s not a screwdriver, it’s the monkey who’s holding it.

I do not understand the need to argue that monkeys are better than screwdrivers at screwing. Just let the monkey be the best version of a monkey.

klabb3··on Vulnerability reports are not special anymore
It’s not necessarily symmetrical, and in fact would be very surprising if it was. It’s a probabilistic algorithm on both sides, so the energy use to find any working program vs all bugs in a working program are fundamentally different search spaces. Not to mention the false positive rate and the human verification effort. Then even the idea of incremental security checks is potentially flawed since many security issues are non-local (ie not localized to a single module).
klabb3··on Where to Find the Colors Your Screen Can't Show You
> Only very rarely I have seen examples with obvious differences between monitors when showing green objects, e.g. some documentaries with certain vividly colored animals, like some insects, birds, frogs or lizards.

According to the article you get purified greens from transmittance through foliage, ie backlight in eg a maple forest. This makes me suspect that it may be more important than just exotic animals, and maybe we are more sensitive to ”greens” than we think? For instance, a lot of my photography of trees/forests tend to feel much more ”green brown mess” and loses structure when going from reality to screen. (Another explanation is that my photos are bad, but I like that one less)

klabb3··on Where to Find the Colors Your Screen Can't Show You
This is truly an (accidental?) setback of color reproduction as it has progressed over time. For LED lights R9 is also crucial for skin tones which makes it so bad to just leave that out. Now, the mass produced LEDs are even optimized for CRI at all are virtually all excluding R9, which may be one of the main quality issues that many people perceive with LEDs vs eg incandescent. There’s of course more to it but R9 probably has a disproportionate effect for being a ”minor detail”.
klabb3··on W Social, public institutions and the theater of European digital sovereignty
> The report made it sound like it is some kind of semi-official EU-endorsed project, but its just... a closed source, for-profit social network?

This is so stupid. It’s really like truth social. Having a private company with closed source pretending to be open and sovereign (whatever that means), adding ID verification by scanning your passport, it’s like.. gasoline for conspiracy theories. They’re so incredibly tone deaf. It’s like being back in the early 2000s when the older generation didn’t understand the internet. But it’s 2026…

Just skip the extra steps of putting social media makeup on a centralized mouthpiece, and make it an official EU site with broadcast only comms. Like public announcements and the like. That would at least serve some value. You can’t have both the social part and the control of the narrative.

klabb3··on Midjourney Medical
> Sure, but the process is "what you do" which directly contradicts what you're saying.

”What you do” was just short for the _activity_ that you’re doing, eg ”I am coding” or ”I am building a car”, which does not determine the extent of how creative it is. Building ikea furniture from instructions would be low on the creative scale, whereas making a chair from woodworking might be higher, for most people.

> Sure but most programmers don't do [side projects]. My point is that you cannot reduce commercial work as not creative just because it's a 9-to-5.

Of course not, some people find that perfect match. That said, employment is not optimized for creativity, so it simply appears unusual that it’s conducive to highly creative work. This is my theory of why many programmers pick up hobbies outside of 9-5 where they have better preconditions, whether it’s side projects (same domain) or woodworking (different domain). Some find it at their 9-5, and some don’t feel much urge.

> we'll still consider them creative since it is a basic requirement at their 9-5. That is my point - both of them are creative. […] Degrees may vary depending on subjective perception but that was not what was being discussed.

I don’t think it’s even meaningful to discuss creativity without acknowledging that it’s both subjective and that degrees may vary. And yes, problem solving is probably always creative to some degree. But the degree is the important part.

So, I wouldn’t call _them_ creative or not, because again I don’t think it’s a personality trait nor binary. Only the person doing it can tell how creative it feels. Personally I felt mostly uncreative when doing corporate work. I would have loved for it to feel creative, but it didn’t.

klabb3··on Midjourney Medical
Both ”creative mythical noble artist” and ”creative work is just work” are unhelpful strawman arguments. One is elitist, the other is reductionist.

Creativity is neither a property of who you are or what you do. It’s about how you do it. It’s closer to a mindset of curiosity, wonder and play. For example, many programmers have a need for creativity within coding, but don’t feel they get it at their 9-5 job, and instead work a side project (like FOSS, indie game) because it’s a more creative experience. The point is: same person, same activity yet one is more creative than the other.

The art/artifact itself is not creative. It’s the process that’s creative. Building a car can be creative. Buying a car is not. That’s not romanticizing and gatekeeping people who don’t have time to build a car. It would be genuinely misleading to equate those things.

klabb3··on Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers
#0f0 #000
klabb3··on Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers
> What makes this so beautiful IMHO is that it's a trivial jail break, but also a close to unfixable.

It’s almost as if identifying security holes is a prerequisite for both fixing and exploiting them. But without knowing the color theme of the terminal, there is simply no way of knowing who is good and who is evil.

klabb3··on All 9,300 Japanese train station, animated by the year it opened (1872–2026)
I had a near-instant crash too, but different kind. Firefox iOS. The vibes are leaking
klabb3··on LLMs are eroding my software engineering career and I don't know what to do
This is such an obvious observation that I’m surprised to find it often missing. 0.1X is nothing compared to the destruction (ie negative X) you can do with the right combination of recklessness and managerial pressure. Definitely happens with engineers. Perhaps even more with PMs.
klabb3··on Did Claude increase bugs in rsync?
UB is especially bad but also not as big as all other concerns combined. Two of the most reliable software ever to exist, curl and SQLite, are C/C++. There are also cases in system programming, drivers etc where the unsafe is necessary and then your code is only as good as the boundary, and lots of bugs can seep in. Another issue with Rust is ecosystem - the dependency trees required to do fairly basic things are often deep and vast, meaning other risks.

That said if something like rsync was written today, I still think Rust may be a better choice. Mainly because a 95 percentile skilled Rust programmer is less dangerous than for C. The people that are skilled enough to be trusted with C are few and diminishing every year.

klabb3··on There's still no point in gigabit broadband
Video production. Gigabit is 125MB/s. If you’re shooting a day in 10bit 4k (pretty standard today) you have like ~1TB of data. If you need to get that footage to an editor or a post house it would take over 2h at max speed. That’s why many still ship hard drives with courier.

I’ve spent way too much time trying to solve the large file transfer problem using hybrid p2p. Check out https://payload.app/. It’s tested in controlled env for 10Gbps+ but have not been able to test that over WAN just yet. I have 10Gbit residential if someone wants to help benchmark.

klabb3··on Apple and Google developed a new HDR standard: Eclipsa Video
> None of HDR10, HDR10+, or DolbyVision ever answered the question of how to adapt for varying ambient brightness levels, either, which is again a very important question to answer for portable devices like phones, tablets, and laptops.

Those are extremely niche use cases. Most normal people watch their TikTok and YouTube on a perfectly calibrated wide gamut HDR OLED in their darkened color grading room.

klabb3··on SQLite is all you need for durable workflows
Round trip time is actually much faster than Postgres, since there’s no need to touch the network. You can get massive single threaded throughput. In order to achieve comparable throughput in Postgres you need a large amount of concurrent connections, since each conn spends most of its time passing messages, deserializing etc (with a much larger total amount of overhead). There are a surprising amount of bottlenecks and misconfiguration that can tank performance of networked systems, particularly DBs.

Like you suggest, the reason for not picking SQLite is not reliability, speed, etc. Networked DBs allow decoupling between app and db servers, which have operationally different characteristics. But most importantly, you can have multiple apps access the same DB at the same time. Eg analytics, one off queries, any 3p app that interacts with your data directly.

klabb3··on Please Use AI
> As you said it is hard to create with AI without losing your soul but that’s not inherent to the tech.

It definitely appears inherent so far. You could say infinite feeds optimized for engagement is just neutral tech too. The biggest mistake we made in the last tech revolution of ”social” media was to judge tech by its potential rather than the business model.

> You get to pick! How awesome is that?

It's awesome if you don’t derive meaning from the process. Like cheating in a single player game, you can just skip and watch the credits.

Ironically one of my most memorable game experiences ever is just walking and climbing for ages in Death Stranding, in poor weather, slipping, picking up baggage. It was miserable. But effort seems to create meaning.

klabb3··on The Zig project's rationale for their anti-AI contribution policy
> They could inspect stdlib source code to fix compatibility issues with newer compilers and quite prolific with idioms.

In order to even say this, you need to have knowledge and understanding about the language. I suspect you are not the intended target of this policy. They are defending their project with a harsh policy, knowing full well there are false negatives. Contributions for FOSS was already in borderline crisis mode before LLMs so it makes sense they’re desperate.

Their bet would be Venn diagram of LLM user overlaps with irresponsible. I think that’s correct, but not because good programmers suddenly become irresponsible when they use LLMs, but rather that an enormous barrage of bad programmers can participate in domains they otherwise wouldn’t even know where to begin.

klabb3··on Localsend: An open-source cross-platform alternative to AirDrop
Yeah I implemented my own in Go because I was unhappy with the 3p ones, so that’s why I reacted. It’s surprisingly hard to get right, in particular:

1. Backoff and timer logic to not flood network.

2. Caching entries for the same reason.

3. Handling multiple network interfaces, and detecting when they changed.

klabb3··on I won a championship that doesn't exist
The fun part is when it’s important you have the right information to make a decision. Eg Russia to invade Ukraine and all top generals claim they can do it in 2 weeks. Similar for a corporation with layers of middle management deception and self promotion, I don’t know how executives make decisions but it must be RNG basically, because it certainly isn’t fact.

Lying at scale is basically information noise.

klabb3··on Localsend: An open-source cross-platform alternative to AirDrop
No they don’t? There are several 3p libs for it but not in std. Unless I’m blind and didn’t get the memo.
klabb3··on Localsend: An open-source cross-platform alternative to AirDrop
Is this working seamlessly? Iirc you needed to switch settings to bypass the contacts only thing. Plus Apple can of course create more adversarial hurdles to lock other vendors out.

And, of course this only solves the phone - phone, and not even all of them. Desktops & laptops have less hope.

Page 1 of 34Next →