HNHacker News
TopNewBestAskShowJobs

raggi

2,842 karma · joined December 24, 2009

submissionscomments
raggi··on TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
Yes
raggi··on TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
The fact that there is no portable way to link the relevant functions that works reliably across all distributions of Linux is a failure of POSIX and GNU, and unfortunately is largely the Linux distribution story in a nutshell.

Your answer is mostly correct, except that when you tug on that thread the shelf comes off the wall, the plaster comes with it, and then it cracks the water pipes on the way to the floor.

raggi··on TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
http://github.com/tailscale/tailscale/commit/e4144230f410204...
raggi··on We’re making Bunny DNS free
I have been fed up with DNSimple for a long time. Can any folks share positive experiences with Bunny?
raggi··on Linux latency measurements and compositor tuning
fwiw I’ve been running lots of stuff under niri with proton Wayland mode for the last ~6 months on nvidia with a vrr display and it’s been fine.

Can’t diagnose here, and not meaning any descent to your experience, just a different user experience for me.

raggi··on sqlite: A CGo-free port of SQLite/SQLite3
that’s really not true when the database is all in memory, statements are prepared, and so on.

but the overheads also stack up, the database/sql api is fairly allocation heavy too unless you do a lot of work and that friction increases quite a bit with the ffi boundary.

this is not to suggest “modernc is faster” - it’s not for a lot a workloads.

there are opportunities for optimization all over both approaches.

raggi··on Coreutils for Windows
Wat?

winget install uutils.coreutils

raggi··on Coreutils for Windows
uutils coreutils was/is already available and more complete than this
raggi··on The IBM-ification of Google?
i was responding to the article, i hadn't bothered to read railways pm as it's not super interesting, anyway, i've read it now, here: https://blog.railway.com/p/incident-report-may-19-2026-gcp-a... and indeed they weren't at fault
raggi··on The IBM-ification of Google?
> Look at the Railway GCP account ban situation. A literally billion dollar startup running on Google Cloud and Google just randomly snaps their fingers and deletes their account. Zero warning. No phone number to call. No account rep. Poof. Gone. It is actual insanity to me. A billion dollar customer gets the exact same automated middle finger as a low effort spam bot. Your B2B business is completely cooked if that is how you treat people. The enterprise cloud gravy train is right there and Google is standing on the tracks begging to get hit by the train.

If you've been around a while you know that at any business critical scale at all you establish a relationship with your cloud provider and get an account manager. When you do this, you have a number to call.

A billion dollar startup not doing this is a keen lesson for the CTO.

Yes, Google likely screwed up here, but being unprepared for account problems, having no established relationship with your provider is a critical mistake.

The article goes on to talk about Hetzner as an example: their pricing is great for individuals but they literally don't even offer account management relationships - even at scale they actively refuse them. There are equivalent stories of account terminations with Hetzner, which is also a key point: this isn't just a big business problem, at all.

raggi··on 'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens
subtree is better for this case, you want to encourage actual reading before running. reading won't catch everything but it catches a lot, and the burden isn't as high as people always complain about before they try it.
raggi··on 'No way to prevent this,' says only package manager where this regularly happens
nope, doesn't help. signatures and removal of script points have zero net effect on the value of the target that the ecosystem has, or how easy/hard it is to write a worm. the package code gets run, this is statistically true, and the exploited developers/environments will sign packages, this is also statistically true.
raggi··on 'No way to prevent this,' says only package manager where this regularly happens
none. they just have smaller target populations.
raggi··on 'No way to prevent this,' says only package manager where this regularly happens
install scripts are a distraction, just like package signatures are a distraction. adding/removing either feature has no significant impact on the wormability of this package ecosystem. installed npm code is run, with nearly zero exceptions.
raggi··on Googlebook
7/25 on the merged page at time of writing are L/XL in size. Again I can't validate your claims against reality.
raggi··on CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
yeah, and it's not like people recently launched a coffee shop that accepts payments over tofu ssh and a shell provider doing the same
raggi··on Googlebook
45 commits landed in the repository so far today, it's mid way through the work day in the valley. https://fuchsia-review.googlesource.com/q/status:merged

Zircon is still under development with recent RFC's extending the memory synchronization and attribution model for processes.

There was also more extension added to one of the key disk formats in March which has an eye to more flexible long term evolution and adaptation to particular device form factors.

The publicly available evidence does nothing to support your claims, entirely the opposite.

I used to work on Fuchsia, I have not for many years now and have no idea what their current roadmap looks like, but I do know where to actually look up what's been done recently, which is all public and you could do as well.

Anyway I have no idea if this has any fuchsia code in it.

raggi··on Lib0xc: A set of C standard library-adjacent APIs for safer systems programming
A vast number of C++ programs import C and POSIX headers directly, so the language level distinction you wish to make isn’t all that relevant to the subject matter.
raggi··on Lib0xc: A set of C standard library-adjacent APIs for safer systems programming
there are no good reasons we don't do this in the standards themselves, C, C++, and POSIX should all be working on editions that add safer APIs and mark unsafe APIs as deprecated, to start a long term migration. we know how to do this, we've had a lot of success with this. there are real engineering concerns, sure, but they're not reasons to not do it. compilers and library chains can retain support for less safe variants for plenty of time.
raggi··on Who owns the code Claude Code wrote?
Lawyers I have spoken to have stated strongly that they believe collective works doctrine will provide strong protections for most mature and sizable software. I see no mention of these considerations here.
raggi··on "cat readme.txt" is not safe if you use iTerm2
multiple times
raggi··on Veracrypt project update
Cachy pushed a Limine update last weekend without any testing. It broke everyone with secure boot signing. Head proton versions are great, but games tend to turn into a laggy mess after a couple of hours and need regular restarts.

It's decent, but it's not all roses at all, and I wouldn't inflict it on non-techies yet.

raggi··on Claude Managed Agents
Same for me in firefox and chrome. I'm sure it's one of the DNS block lists I have and some really crappy marketing tracking code.

Edit: confirmed, loads with a public DNS provider that has no blocklists.

raggi··on Vibe-Coded Ext4 for OpenBSD
that's not a statement from a lawyer, and it's confused. there is one true thing in there which is that at least under US considerations the LLM output may not be copyrightable due to insufficient human involvement, but the rest of the implications are poorly extrapolated.

there are lots of portions of code today, prior to AI authorship, that are already not copyrightable due to the way they are produced. the existence of such code does not decimate the copyright of an overall collective work.

raggi··on Passengers who refuse to use headphones can now be kicked off United flights
Ok, but how about kicking sick people off of flights, particularly trans continental?
raggi··on Ask HN: How do you deal with people who trust LLMs?
this. llm's aren't that special, access _maybe_, but there's plenty of access to terrible rumor mills.
raggi··on No, it doesn't cost Anthropic $5k per Claude Code user
Many techniques are documented in papers, particularly those coming out of the Asian teams. I know of work going on in western providers that is similarly advanced. In short, read the papers.
raggi··on Is legal the same as legitimate: AI reimplementation and the erosion of copyleft
If that occurs and it’s a substantial enough body of output that it is itself copyrightable and not covered by fair use. Confluence of those conditions is intentionally rare.
raggi··on No, it doesn't cost Anthropic $5k per Claude Code user
Deployments like bedrock have no where near SOTA operational efficiency, 1-2 OOM behind. The hardware is much closer, but pipeline, schedule, cache, recomposition, routing etc optimizations blow naive end to end architectures out of the water.
raggi··on Fast-Servers
Exactly this. The kernel alloc’d buffers can help but if that was a primary concern you’re in driver territory. Anything still userspace kind of optimization domain the portion of syscalls for large buffers in a buffered flow is heavily amortized and not overly relevant.
← PreviousPage 2 of 25Next →