HNHacker News
TopNewBestAskShowJobs

n_e

515 karma · joined February 23, 2013

Contact: nicolas AT even.li

Site: https://www.even.li/

submissionscomments
n_e··on Axios compromised on NPM – Malicious versions drop remote access trojan
I haven't checked, but it would be surprising that the min-release-age applies to npm audit and equivalent commands
n_e··on Show HN: Sheet Ninja – Google Sheets as a CRUD Back End for Vibe Coders
> Cloud sql lowest tier is pennies a day

Unless things have improved it's also hideously slow, like trivial queries on a small table taking tens of milliseconds. Though I guess that if the alternative is google sheets that's not really a concern.

n_e··on A Faster Alternative to Jq
I process TB-size ndjson files. I want to use jq to do some simple transformations between stages of the processing pipeline (e.g. rename a field), but it so slow that I write a single-use node or rust script instead.
n_e··on Node.js worker threads are problematic, but they work great for us
> but so could FFI calls to another language for the CPU bound work

Worker threads can be more convenient than FFI, as you don't need to compile anything, you can reuse the main application's functions, etc.

n_e··on The three pillars of JavaScript bloat
I assume they were talking about the comments here, not the post which I agree is great.
n_e··on 3M's PFAS exit killed the supply chain for two-phase immersion cooling in DCs
PFAS are many different molecules.

For example PTFE is a large molecule with strong bonds, and as a consequence isn't very reactive and likely safe.

On the other hand, perfluoroalkyls such as PFOA have the same shape as fatty acids, so they bind to the same places such as in the liver, which makes them grave health hazards.

Many precursors used for making PFAS are also toxic, so for example, even if PTFE is safe, manufacturing it isn't.

n_e··on XML Is a Cheap DSL
What exactly do the developers need to keep in mind?
n_e··on XML Is a Cheap DSL
I think that you're missing that the parent poster and I are implicitly assuming that XML is validated the most common way, i.e. with XSD, and that I'm comparing XSD validation and Zod.
n_e··on XML Is a Cheap DSL
The "data" is part of the tax simulation source code, not untrusted input, so such an attack vector doesn't exist.
n_e··on XML Is a Cheap DSL
> JSON: No comments, no datatypes, no good system for validation.

I don't agree at all. With tools like Zod, it is much more pleasant to write schemas and validate the file than with XML. If you want comments, you can use JSON5 or YAML, that can be validated the same way.

n_e··on XML Is a Cheap DSL
After thinking a bit about the problem, and assuming the project's language is javascript, I'd write the fact graph directly in javascript:

  const totalEstimatedTaxesPaid = writable("totalEstimatedTaxesPaid", {
    type: "dollar",
  });
  
  const totalPayments = fact(
    "totalPayments",
    sum([
      totalEstimatedTaxesPaid,
      totalTaxesPaidOnSocialSecurityIncome,
      totalRefundableCredits,
    ]),
  );
  
  const totalOwed = fact("totalOwed", diff(totalTax, totalPayments));

This way it's a lot terser, you have auto-completion and real-time type-checking.

The code that processes the graph will also be simpler as you don't have to parse the XML graph and turn it into something that can be executed.

And if you still need XML, you can generate it easily.

n_e··on The Linux Foundation Certificate of Origin Is recursive

  (c) The contribution was provided directly to me by some other
      person who certified (a), (b) or (c) and I have not modified
      it.
n_e··on I'm reluctant to verify my identity or age for any online services
In which countries?
n_e··on A better streams API is possible for JavaScript
I found your article both interesting and readable.

It doesn't really matter what tools are used if the result is good

n_e··on A better streams API is possible for JavaScript
I have a SaaS project where the backend is in JS. I also have some data processing to do with large file (several TB). Doing it is in JS is more convenient as I can reuse code from the backend, and it is also the language I know best.

Performance-wise, I get about half the throughput I had with the same processsing done it rust, which doesn't change anything for my use-case.

However that's not really relevant to the context of the post as I'm using node.js streams which are both saner and fast. I'm guessing that the post is relevant to people using server-side runtimes that only implement web streams.

n_e··on What Is a Centipawn Advantage?
> but I still think the developers of both engines banter over who is really producing the True WDL numbers for a given position

In fact, stockfish's WDL is very rudimentary: it is a function of the centipawn evaluation of the position and the value of the remaining material.

See https://github.com/official-stockfish/Stockfish/blob/a6d055d...

n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
Kanel is great! That's what I used before pg-typesafe, and I still use it for dynamic queries.

Regarding the nominal/branded types, the typegen is configurable, so instead of e.g. mapping oid 20 to a bigint, you could map the field id of table foo to Foo["id"] from kanel.

see this example https://github.com/n-e/pg-typesafe?tab=readme-ov-file#type-j...

n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
I haven’t found a good way to handle dynamic queries in pg-typesafe yet.

For now, I type these manually, which is acceptable for my usage as they are pretty rare compared to static queries.

n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
That is the way node-postgres works. pg-typesafe adds type safety but doesn’t change the node-postgres methods
n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
PostgreSQL uses the format $1, $2 in the protocol, so I think it's just that nobody has bothered to implement named parameters in clients.

In another style, postgres.js uses calls such as sql`select * from t where id = ${variable}` (which is safe because it's a tagged template, not string interpolation).

n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
Unfortunately I haven't found a way to make it work.

It would be quite easy to extract the queries to compute the types, but TypeScript doesn't handle tagged template literals well enough to link the query passed to the sql`` template to the return type.

n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
Very interesting, thanks!

I see they use the same global approach as pg-typed (asking for a ParameterDescription / RowDescription, which aren't usually exposed by the PG drivers), but there are interesting differences in the details. Also this made me realise that I could also type enums automatically.

n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
I didn't look too much into sqlc-gen-typescript because the project looks abandoned (no commits in 2 years, many open PRs).

Regarding sqlc in general, it is focused on having the SQL queries in .sql files, while pg-typed is focused on having the queries inline (though I plan to add .sql file support). I like the latter approach better, as for small queries used in only one place, it is a little cumbersome to add them to a different file and find a name for them.

n_e··on Show HN: Pg-typesafe – Strongly typed queries for PostgreSQL and TypeScript
Kysely is a query builder: you build queries by calling javascript functions, while with pg-typesafe you write SQL directly.

I've used kysely before creating pg-typesafe, and came to the conclusion that writing SQL directly is more convenient.

A query builder works well for simple cases (db.selectFrom("t").where("id","=","1") looks a lot like the equivalent SQL), however, for more complicated queries it all falls apart. I often had to look at the docs to find how to translate some predicate from SQL to the required idiom. Also, I don't think kysely can automatically infer the return type of PostgreSQL functions, while pg-typed does (it asks PostgreSQL for it).

n_e··on Is Show HN dead? No, but it's drowning
Not sure if it would work for HN / how it could be adapted to HN, but something I noticed on opensource projects, is that once they hit a hurdle, submitters of low quality AI-written PRs don't try to solve it and go elsewhere.

For example, in one project, PRs have to be submitted to the "next" branch and not the default branch. This is written in the CONTRIBUTING.md file, which is linked in the PR template, with the mention that PRs that don't respect that will be close. Most if not all submitters of low-quality PRs don't do anything once their initial PR is closed.

Pretty bummed about that as I just submitted a show HN I'm pretty happy about (it solves an annoying problem I had for years, which I know many people have) and I was looking forward to talk about it (https://news.ycombinator.com/item?id=47050872)

n_e··on Oat – Ultra-lightweight, zero dependency, semantic HTML, CSS, JS UI library
An explanation that would fit both the old accounts and the artificial comments would be that they were encouraged by the author to comment (which is against the HN rules).
n_e··on GitHub Actions is slowly killing engineering teams
Controversial opinion: GitHub actions are good enough.

I have one job that runs a shell script that runs tests, a second one that builds and pushes the docker image, and a third one that triggers CD.

Could it be faster? Yes. Could the log viewer be better? Yes. Could the configuration file format be better? Yes. Could the credentials work better? Yes.

However they're well integrated with GitHub (including GHCR), work well and are affordable.

n_e··on Stay Away from My Trash
It depends what you're getting out of it. I've signed CLAs because it was more convenient for me to have my PR upstreamed rather than maintaining a fork.
n_e··on Stay Away from My Trash
I don't get it either. The LLM-generated issue from the above prompt is just the same information written more verbosely.
n_e··on GraphQL: The enterprise honeymoon is over
The issue is that the API itself is, I assume, badly designed.

Equivalent delete queries in rest / graphql would be

  curl -X DELETE 'https://api.example.com/users/123'
vs

  curl 'https://api.example.com/graphql?query={ deleteUser(id: 123) { id } }'
← PreviousPage 2 of 4Next →