Hacker News Reader

slrzon Generics can make your Go code slower

What is it that Go supposedly calls casting? The term (or its variations) does not show up in the language specification.

People sometimes use it for type conversions but that's in line with usage elsewhere, no?

slrzon The most important thing to understand about queues (2016)

I guess that basically everything you'd consider for production use allows you to configure queue sizes and related behaviour however you fancy.

slrzon Go’s major versioning sucks – From a fanboy

For example, debug/pe ImportedLibraries(), which is supposed to return all the libraries that a module imports, was stubbed out to return "nil, nil" in a minor release [1]

I just looked at the Git history and this is plain false. It already looked that way when the big source tree move (src/pkg/ -> src/) was done in 2014. Tracing it back further (to before Go 1.0 times, when there wasn't even a builtin error interface yet and the function returned os.Error), ImportedLibraries was *never* implemented in debug/pe.

slrzon Go Annoyances

> google's 'reference' layout

Nothing to do with Google here, by the way. It's just the default format of the Unix date command.

So if you can't remember the order, just switch to your shell and run `LC_ALL=C date`.

slrzon Podman in Linux

No longer true. Podman nowadays ships with an optional daemon that serves a Docker-compatible interface, so you can use docker-compose directly if that's what you want.

See for example: https://www.redhat.com/sysadmin/podman-docker-compose

slrzon The journey to controlling external monitors on M1 Macs

This was never an intended feature. If I understand the article correctly, they were using an undocumented ("private") API which happened to stop working.

slrzon QUIC is now RFC 9000

You can always use sendmmsg(2), writev(2) or other iovec-based APIs.

slrzon “They introduce kernel bugs on purpose”

I don't like it either but it's not as bad as it sounds: the ban almost certainly isn't enforced mindlessly and with no recourse for the affected.

I'm pretty sure that if someone from the University of Minnesota would like to contribute something of value to the Linux kernel, dropping a mail to GregKH will result in that being possible.

slrzon Ask HN: Why is the Linux community struggling to implement hibernation?

Most common distributions turn it on when running on a device with UEFI Secure Boot enabled.

slrzon Ask HN: Why is the Linux community struggling to implement hibernation?

So CentOS is actually getting better with a more open development model. Awesome.

slrzon GitHub investigating crypto-mining campaign abusing its server infrastructure

Getting a hold of someone's secrets is not possible just by doing a pull request. It's really only about resource usage, at least when the runners in question provide sufficient isolation (true at least for the Github-hosted ones, or we're all in big trouble).

Unfortunately, using self-hosted runners to provide additional capabilities not supported by Github-hosted ones is basically impossible (for public repos at least) as you can't restrict a runner to an organization or project. Set up a bare-metal runner and it will receive jobs from random forks.

slrzon Man who thought opening a TXT file is fine thought wrong

I don't think this is doing any HTTP. Autofs is generally used to mount remote file systems like NFS shares.

It's pretty common on Unix-like systems (especially in multi-user environments) and not at all specific to macOS.

References:

https://wiki.archlinux.org/index.php/autofs

https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5

https://access.redhat.com/documentation/en-us/red_hat_enterp...

slrzon Git's list of banned C functions

It basically expects a string as the source and a fixed-size, not necessarily zero-terminated, buffer as the destination.

slrzon Limiting Private API Availability in Chromium

> As a website owner myself, I’ve had to make changes about once a year to keep things running properly in Chrome due to deprecated APIs

Does this refer to standard Web APIs or Chrome-specific and more or less experimental interfaces?

slrzon Use `nproc` and not grep /proc/cpuinfo

This is asking for a different thing, though.

  % taskset 1 nproc
  1

  % taskset 1 getconf _NPROCESSORS_ONLN
  8

slrzon CSVs: The Good, the Bad, and the Ugly

Seems reasonable to me: this way, you don't have to duplicate the BOM stripping in the decoders of every single format you want to support.

It's also more general as there are other commonly-needed transformations that have an even weaker case for explicit support in the CSV library (charset conversion, dropping other bogus bytes, ...).

slrzon RFC 8905 – The 'payto' URI Scheme for Payments

This one is an informational RFC though. No internet standard.

slrzon Chrome is deploying HTTP/3 and IETF QUIC

No. QUIC is a transport protocol. Its purpose is roughly equivalent to TCP: provide a reliable byte stream transport over an unreliable datagram service (IP, though QUIC prepends a small UDP header mostly for compatibility with existing infrastructure).

You might be thinking of the HTTP server push functionality. That was introduced with HTTP/2 and has been deployed for years already over TCP transports (i.e. totally unrelated to QUIC).

Due to how advertising networks work, I'd be surprised if anyone used server push in the way you fear.

slrzon Is the C runtime and library a legitimate part of the Unix API? (2017)

Not libc. The stack probe was inserted by the compiler when compiling the vDSO (part of the kernel, but mapped into user processes) with certain ricer^Whardening flags enabled.

slrzon Stali is a static Linux distribution

Actually, it used to be called just that.

slrzon Reverse-engineering the first FPGA chip, the XC2064

Even for moderately complex designs the synthesis times are way too long for that to be feasible. Unfortunately, a lot of it is inherent to the problems/algorithms involved. So getting rid of the clumsiness of proprietary synthesis tools won't be sufficient, you are going to need another breakthrough.

slrzon Semantic Import Versioning is unsound

I find it somewhat odd that Peter ascribes the valuing of stability and backwards compat to some weird Google-specific mindset, unheard of in other circles.

Instead, you can observe the same thing with many other ecosystems/platforms once they have reached a certain scale. Ask Microsoft's Windows team or the Linux kernel maintainers about the importance of keeping existing programs running. Or maybe the stewards of other programming languages like C or C++ can tell you about the difficulty of evolving a language when you have a gazillion lines of pre-existing code to consider. How long does it take the world to phase out support for obsolete SSL/TLS versions, even in the presence of well-known weaknesses?

It seems to me that the more users something has, the more thought has to be put into how not to break them.

Isn't programming in the large exactly the kind of thing Go set out to tackle? Placing a high value on stability appears only logical then.

slrzon Gitlab Critical Security Release: 13.0.4, 12.10.9, 12.9.9

Any guesses on how to interpret the description?

> An authorization issue discovered in the CI jobs token handling allowed read access to public projects with restricted repositories. This issue is now mitigated in the latest release and is waiting for a CVE ID to be assigned.

A GitLab project can have multiple repositories? I don't think so. Is this just s/project/group/?

slrzon Ask HN: Looking for someone to help create a trusted CA

I'd be more optimistic if you had included a note that you know the history of CAcert (https://en.wikipedia.org/wiki/CAcert.org) and have a plan on how to tackle the issues that prevented its roots from getting into the common trust stores.

slrzon Google employee diagnosed with coronavirus

How is Google's work-from-home policy nowadays? Does it differ between Europe and the US?

slrzon Google to Samsung: Stop messing with Linux kernel code. It's hurting Android

ANSI C heavily mixed up the conversion rules for expressions involving both, signed and unsigned, integer types (value-preserving vs. unsigned-preserving in K&R C).

This might have been a factor here, given that most of Gosling's peers back then were probably still more familiar with K&R C and its different set of conversion rules.

slrzon Google to Samsung: Stop messing with Linux kernel code. It's hurting Android

They have become a lot better at upstreaming their changes.

Also note that the Zdnet headline seems bogus. Better look at the actual source[1] for their "news" which was posted to HN some time ago.

[1] https://googleprojectzero.blogspot.com/2020/02/mitigations-a...

slrzon Why Discord is switching from Go to Rust

And yet, maps and slices are implemented in Go.

https://golang.org/src/runtime/map.go

https://golang.org/src/runtime/slice.go

I don't see why you couldn't do something similar in your own Go code. It just won't be as convenient to use as the compiler wouldn't fill in the type information (element size, suitable hash function, etc.) for you. You'd have to pass that yourself or provide type-specific wrappers invoking the unsafe base implementation. More or less like you would do in C, with some extra care to abide by the rules required for unsafe Go code.

slrzon OpenWRT remote code execution via MITM due to bug in package manager

The SHA-2 checksums to verify packages against are delivered as part of the (signed) package index (as the article alludes to).

slrzon Let's Destroy C

> I think some undefined behaviour can also be detrimental to performance. If you pass two pointers to a function, and it's undefined whether they alias or not, there are optimisations you can't do.

I think this results from a misunderstanding of how undefined behaviour works in C. When a program exhibits undefined behaviour it is not a valid C program. The compiler may just assume (instead of having to prove) that it doesn't happen.

Example: the memcpy(3) standard library function. C says the behaviour is undefined if the given areas overlap. That means the implementation can perform optimizations "knowing" that there is no overlap. A valid C program can't possible invoke memcpy with buffers aliasing each other (because then, the program would be invalid). The compiler is not required to issue a diagnostic about these kinds of incorrect programs and just compiles your code assuming they don't exist.