HNHacker News
TopNewBestAskShowJobs

mdaniel

8,137 karma · joined May 23, 2010

https://MatthewDaniel.com/

[ my public key: https://keybase.io/mdaniel; my proof: https://keybase.io/mdaniel/sigs/ovUHBxc--eowJt65GiqARinI6Y6Hg3J8CRC2EgGA5kE ]

submissionscomments
mdaniel··on Luau – Fast, small, safe, gradually typed scripting language derived from Lua
heh, their custom package manager wrote its own dulwich https://github.com/PlutoLang/apm/blob/aca3620553ed7090552dbd...
mdaniel··on Help us raise $200k to free JavaScript from Oracle
> the biggest corporate users of both Java

I bet AWS would give them a good run for their money on that metric. I got the impression that Google was predominately a C++ shop, whereas the rumor mills tell me that most of the AWS control plane is in Java (I am pretty sure I've actually gotten a stack trace from an AWS API once or twice, but foolishly I didn't save it)

mdaniel··on Help us raise $200k to free JavaScript from Oracle
Another bullet dodged, since saying Ellison 3 times in a row would cause a gaggle of lawyers to appear in the room
mdaniel··on TernFS – An exabyte scale, multi-region distributed filesystem
That was interesting, thank you. Other folks may also enjoy its sibling dashboard showing the used capacity https://telemetry-public.ceph.com/d/ZFYuv1qWz/telemetry?orgI...
mdaniel··on TernFS – An exabyte scale, multi-region distributed filesystem
It claims to have it: https://github.com/seaweedfs/seaweedfs/wiki/S3-Conditional-O...
mdaniel··on TernFS – An exabyte scale, multi-region distributed filesystem
GPLv2-or-later, in case you were wondering https://github.com/XTXMarkets/ternfs/blob/7a4e466ac655117d24...
mdaniel··on Launch HN: Cactus (YC S25) – AI inference on smartphones
For fear of having dang show up and scold me, I'll just add the factual statement that I will never ever believe any open source claim in any Launch HN ever. I can now save myself the trouble of checking, because I can be certain it's untrue

I already knew to avoid "please share your thoughts," although I guess I am kind of violating that one by even commenting

mdaniel··on Java 25 officially released
Now available to even more audiences than before https://www.jetbrains.com/rider/#:~:text=free%20for%20non-co...
mdaniel··on Gluon: a GPU programming language based on the same compiler stack as Triton
Also it REALLY jams me up that this is a thing, complicating discussions: https://github.com/triton-inference-server/server
mdaniel··on Java 25 officially released
The very idea of those 3 things being disjoint is a supremely Microsoftian thing to do and makes discussions horrific
mdaniel··on Stategraph: Terraform state as a distributed systems problem
> easy to tell or predict what terraform will do

predict is the operative word there, because Terraform is so disconnected from the underlying provider's mental model that it is the expression "no plan survives first contact with the enemy" made manifest

Now, I am one million percent open to the pushback that "well, that's a provider's problem" but I also can't easily tell if they are operating within the bounds of TF's mental model, or is it literally that every provider ever is just that lazy?

mdaniel··on September 15, 2025: The Day the Industry Admitted AI Subscriptions Don't Work
Spoken like someone who hasn't tried one or perhaps both of those projects

Kiro is collaborative, but SpecKit is a bunch of templates and then wishes you good luck in your journey. It honestly reminds me of those unified process templates, which I guess all of those are great if one needs some structure to organize ones thoughts

As an alternative, SpecKit is also 0.x release so maybe in 9 months it'll be useful - or overcome by whatever 'ooh, shiny!' follows it

mdaniel··on Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
I wasn't trying to relate anything to the bigger conversation, I just meant to draw attention to the fact that GitHub is not golang's package manager

That said, I would guess the 'bigger conversation' is that it is much harder to tpyo <<import "github.com/DataaDog/datadog-api-client-go/v2/api/datadogV2">> than $(npm i dataadog) or similar in a "flat" package namespace (same for its $(uv pip install dataadog) friend)

None of those cited ones fix the dependency lineage issue, proving that release 1.1 was authored by the same chain of custody as release 1.0 of any given package. One can opt in to gpg verified dependencies in Maven, but it is opt-in. The .jar artifacts can also be cryptographically signed, but the risk that's trying to drive down is tamperproofing and not lineage, AFAIK

mdaniel··on Java 25 officially released
This must be satire
mdaniel··on Java 25 officially released
As a point of reference, JetBrains platform is on top of swing, and I'd guess that's a significant contributor to why they're able to deliver consistently across Linux, macOS, and Windows. Unlike Eclipse SWT which ships native code for all the platforms it targets
mdaniel··on Java 25 officially released

    $ cat Foo.java
    interface Foo {
        private String jimbo() {
            return "yup";
        }
    }

    $ javap -c -private Foo
    Compiled from "Foo.java"
    interface Foo {
      private java.lang.String jimbo();
        Code:
           0: ldc           #1                  // String yup
           2: areturn
    }
and

    interface Bar {
      default boolean isAwesome() {
        return true;
      }
    }
mdaniel··on Java 25 officially released
What's unexpected about that observation is that they have actually completely separated the presentation layer from the business logic because such a thing was required to have "Code with Me" and their "projector" project wherein one could use IJ from a browser https://jetbrains.github.io/projector-client/mkdocs/latest/a...

But, I am fully talking out of school because I don't know what the actual, no kidding, accessibility hurdles one faces when trying to do work in such a setup, nor what concessions VS Code has made to fix those problems

But I do know that YouTrack has a dedicated categorization for accessibility reports and I am sure they would welcome hearing about how they could win back those audiences https://youtrack.jetbrains.com/issues?q=%23%7BUI.%20Accessib...

mdaniel··on Java 25 officially released
I'm not them, but there are few things better for operational insight than the JVM. It has a boatload of tuneables, it has a very rich dynamic code load mechanism (Reflection, ClassLoaders, the new Modules system, and it used to have a strong sandboxing system but they killed that), and at the intersection of those two things is JMX, which is dynamically tuneable deployments via API. It's like having JVM-local feature-flags that one can twiddle without needing to bring down the JVM

And sure, it's not everyone's cup of tea, and/or plenty of people will chime in with "yes, but"s to defend golang or every other platform that isn't the JVM. I'm not yucking your yum! I'm just saying for me, the JVM is the bees knees

mdaniel··on Java 25 officially released
I don't think "was always" is an accurate statement

However, above and beyond free, it is also a collection of ECMA standards https://learn.microsoft.com/en-us/dotnet/fundamentals/standa...

Now, don't get me wrong: I have grave suspicions there is currently only one actual implementation of them (I don't count hobby, or abandonware, ones) but IMHO "actual standard" combined with "for real reference implementation" is way better than just reference implementation

---

since I'm still within the edit window, the MAUI referenced by the sibling comment is MIT licensed https://github.com/dotnet/maui

https://github.com/dotnet/blazor (Apache 2) is marked an archived, and points to https://github.com/dotnet/aspnetcore (MIT) but command-f blazor on its readme is nothing so :shrug:

mdaniel··on Things you can do with a Software Defined Radio (2024)
And its "last mile" friend of using the in-wall cable as Ethernet drops, too, e.g. https://www.tp-link.com/us/powerline/ (but I don't think it holds a candle to actually pulling cat 5 or 6, for clarity)
mdaniel··on Ask HN: Is Palantir Apollo just an AWS competitor?
It is a CD solution, there's no CI involved at all. However, it extends the 'delivery' portion of that phrase to also include so called "day 2" Kubernetes-centric functionality such as "how does my Secret content get populated?" and "how to I apply only certain values.yaml to certain Helm release versions?" Then, Mission Manager also gets into the game of "how do I ensure my cloud resources are present alongside the software?"

It also gets into the compliance side of things (arguably it's all about compliance) in that new releases, config changes, vulnerability mitigation, downtime windows, and a ton of other stuff are optionally gated by a review process. If you want to change the values.yaml for an existing release, you can choose whether that is a 4-eyes change

That latter bit also speaks to your question about "who is the target audience for this?" because, like many things Palantir, it's a lot of the defense industry and intelligence community, as they care a lot about having gates and controls in place. Apollo specifically also gets into "edge deployments," such as what software is running on a laptop that goes out into the field, comes back to base, and only then gets its updates pushed to it

I detest them with all my heart, but I'll be straight that Apollo does actually model the deployment concerns of software very well. Every place that I've been always hand-assembles their own CD story using off the shelf stuff, and so if one has compliance needs then Apollo allows to pay to have the "hand assembled" problem go away. That said, I have _absolutely no idea_ how much Apollo costs, so I'd also speculate that most organizations would be much happier just paying for a competent DevOps role to do the best they can to use off the shelf tools to hand assemble their own CD story, or use BigBang[1] which is at least open source and a standard (one may not like it, but it is at least consistent)

1: https://github.com/DoD-Platform-One/bigbang#readme

mdaniel··on Just Use HTML
relevant: Remove mentions of XSLT from the html spec - https://news.ycombinator.com/item?id=44952185 - Aug, 2025 (545 comments)
mdaniel··on Just Use HTML

  if (request.headers["user-agent"].Matches("Safari")) {
     // wheeeee
  else if (...Matches("Firefox")) {
     // those where good times
mdaniel··on Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
As hair splitting, that's actually not true: Go's package manager is just version control of which GitHub is currently the most popular hosting. And it also allows redirecting to your own version control via `go mod edit -replace` which leaves the sourcecode reference to GitHub intact, but will install it from wherever you like
mdaniel··on Show HN: Dagger.js – A buildless, runtime-only JavaScript micro-framework
I'd guess people are getting different results because of the varying A records https://dns.google/query?name=daggerjs.org

https://www.whois.com/whois/3.33.130.190 and https://www.whois.com/whois/15.197.148.33 are AWS

https://www.whois.com/whois/185.199.109.153 and similar are GitHub and is almost certainly this repo https://github.com/dagger8224/dagger8224.github.io/blob/main...

mdaniel··on Show HN: Dagger.js – A buildless, runtime-only JavaScript micro-framework
And a very cool CI toolkit https://github.com/dagger/dagger (Apache 2)

Link to the DI mentioned by the parent comment https://github.com/google/dagger (also Apache 2)

mdaniel··on Show HN: Dagger.js – A buildless, runtime-only JavaScript micro-framework
What are the criteria for $ interpolation? Is it everywhere?

  <div class="text">
        ${ winner ? 'Wins' : 'Draw' }!
  </div>
mdaniel··on Pgschema – Declarative schema migration for Postgres
What a journey:

AGPL https://github.com/pgschema/pgschema/blob/97f4bf5c00fd10add5...

MIT https://github.com/pgschema/pgschema/blob/53313057201931b2e8...

Whatever the fuck this is, that ain't community that's "I made up a licence how hard can it be": https://github.com/pgschema/pgschema/blob/6f5ce89cc1ac12f4a6...

mdaniel··on Proton Mail suspended journalist accounts at request of cybersecurity agency
> (the half baked password manager being one).

Or a very bizarre LLM offering: https://news.ycombinator.com/item?id=44657556

mdaniel··on Crates.io phishing attempt
I just realized that's an excellent opportunity for "reverse phishing:" you can mangle the first 4 digits of your card [or make one up wholesale] and if they say "thank you, sir" you know they are fake. The real bank will spot that mistake instantly since that prefix is per financial institution
Page 1 of 34Next →