HNHacker News
TopNewBestAskShowJobs

snorremd

648 karma · joined April 21, 2016

[ my public key: https://keybase.io/snorremd; my proof: https://keybase.io/snorremd/sigs/RMlpyZzus8WnfpnjPjplPvhTa_TxyyAk1mx7lGDFo1Y ]
submissionscomments
snorremd··on Gravatar leaks data on millions of users
Not surprised. I even made a privacy preserving proxy plug-in for Coral Talk, a comment system, that would hide the gravatars behind an UUID based parameter [1]. This was quite some time ago. I understand why Gravatar would choose to expose avatars using a hash of an email, but they could have used a more expensive hashing function.

[1] https://github.com/snorremd/talk-plugin-gravatar

snorremd··on .NET 6 Released
I needed to learn dotnet for my new job, and I use MacOS and Linux when developing. Took a course on dotnet and entity framework, and when it came time to set up the database stuff of course both the tutorial and documentation on the official dotnet framework page showed instructions specifically for Visual Studio. Had to do some googling and reading GitHub issues to find the command line solution.

When the .Net Foundation was announcing that they were going to drop the hotreload support from dotnet watch in favour of supporting it in the Visual Studio editor I was again reminded of how (some parts of) MSFT think that dotnet should still be a fully integrated development platform for Windows, rather than a multi platform, open community and open source project. I guess there might be some internal power struggle there between various business interests.

There are already more Linux VMs on Azure than there are Windows VMs. And if they still insist on making the dotnet experience on Linux and MacOS subpar compared to Windows they will very quickly find that people who develop for these OSs will move towards Java or other languages and frameworks with better support for these operating systems.

snorremd··on Sign arbitrary data with your SSH keys
I don't think using different keys per service or host buys you much in terms of security. Yes, an attacker that compromised your keys would have to brute-force your passphrase for N keys rather than one private key, but that just takes N times as long, not really an obstacle.

It would be better to use a hardware authenticator like a Yubikey to either generate a FIDO token-backed SSH key or a GPG key and use the gpg agent as your ssh agent. This way you get SSH keys that cannot reasonably be compromised by other means than physical attacks (someone steals your key and coerces you to reveal pin code).

snorremd··on Parcel v2
Say you're developing a big form with lots of different inputs. When you're iterating on the form you don't want to lose all your form state because you edited some code.

When you make the change you want to see what that change does to your form in its current state.

snorremd··on ES2022 feature: class static initialization blocks
Indeed. JavaScript was supposed to be scheme with its own object property inheritance model. Of course stakeholders co-opted the language and forced the Java style syntax (and name) upon the language. Now most of the syntax additions has been focused on turning it into some kind of C#/Java lookalike so people who don't like functional programming and the object paradigm used in JavaScript can pretend it's just like the OOP stuff they like.

Instead of trying to turn JavaScript into C#/Java, C# and Java should just support compiling to web assembly and provide a good standard library for working with browsers. /rant

snorremd··on Good Riddance, TurboTax. Americans Need a Real ‘Free File’ Program
Pretty much yeah. I guess there are some deductions which need to be filed manually as the government would have no way of knowing about them. Like if you have a really long commute to work you get to deduct a certain amount per KM from your taxes.

But mostly these days, unless you run a company, you don't really have to change much about your pre-filled tax statement. Only once have I experienced that my housing association made addendums to the yearly tax report that needed to be changed in my tax statement.

I also lost some money on micro loans last year that apparently I had to file deductions for myself, but it amounted to so little money that I just let the state keep that money.

snorremd··on Intuit will no longer be a part of IRS Free File program
Norway is technically not in the EU, just the EEA (European Economic Access) zone. But we do it the same way. Our tax authorities get all information they need from employers, banks, stock brokers, etc. Each citizen then get a tax settlement report and can submit a pre-filled tax statement online. You make any adjustments to taxable income or tax deductions that might be missing, and then you are done. Pretty simple.
snorremd··on SQLBolt – Interactive lessons and exercises to learn SQL
The blog post[1] by the author about ORMs was what convinced me to purchase the book. I've had too many discussions with colleagues and tech friends struggling with N+1 problems and processing too much stuff in the application when they use mainstream ORMs to think it is a good idea. ORMs make the regular CRUD stuff simpler, but seem to make some more complex queries and transactions harder. There also seems to be an impedance mismatch between SQLs relational model and the OOP object relationship model.

Edit: I know there are ways to avoid N+1 problems with ORMs, but it seems to more easily sneak into code when your SQL queries look just like your application level code and you could easily enumerate over some SQL result, perform some action, and think that it builds an efficient query.

I've recently been working with a hobby project where I use the Clojure HoneySQL[2] library which essentially lets you build SQL queries as you normally would, but in Clojure's EDN syntax. It treats SQL queries as data. You can super easily evaluate them to get the resulting raw SQL query strings. There is no magic behind it and it encourages you to use the full power of your db.

[1] https://theartofpostgresql.com/blog/2019-09-the-r-in-orm/ [2] https://github.com/seancorfield/honeysql

snorremd··on Ask HN: What novel tools are you using to write web sites/apps?
My blog/homepage is built using:

- Gatsby.js static site generator framework

- Posts written as md or mdx (markdown with jsx support)

- Github Actions to build the site

- Published to and served by Cloudflare workers

- Uses [sci](https://github.com/borkdude/sci) and ClojureScript to add a live Clojure REPL component that can be used in blog posts

- Tailwindcss is used for styling via emotion css-in-js and a tailwind plugin.

The setup mostly works ok, but as always with the JavaScript community the amount of breaking changes can be a bit taxing. Because Gatsby handles static site generation the blog works without JavaScript enabled for those that only want to access the static content.

snorremd··on Kill the Alarm Clock (2017)
I once used a mobile alarm clock app that would try to be smart about waking you up. You put it on your bed and it would measure your sleep cycles by your movement and try to maximise your sleep, but wake you up after a whole cycle had completed. The theory being that being woken from deep sleep is worse than being woken from the REM stage of sleep, and that it is more natural to wake up after a full cycle.

I can't remember if it actually helped that much, and I've since gone back to normal alarms.

snorremd··on Show HN: ustaxes.org – open-source tax filing webapp
As I understand it this is a result of big tax software companies and accounting firms lobbying to keep tax filing as complex as possible so there is still a market for them. If taxes were as easy to file as in countries like Norway and Sweden the market for accountants and tax filing software for private citizens would plummet.
snorremd··on Electric cars make up 54% of cars sold in Norway in 2020
The VAT discount as discussed in the links apply when a company acquires an electric bike for company use. It does not as far as I know apply to private citizens which pay the normal VAT rate.

There have been some municipal subsidy schemes for private citizen where you upon sending a receipt of an electric bike purchase will get some money back. They are however often temporary as they only budget a given amount for the scheme.

snorremd··on Norwegian Covid-19 contact tracing app banned by the Data Protection Authority
NIPH (Norwegian Institute of Public Health) has contracted Netcompany, the team behind the danish contact tracing app), to build it. https://www.fhi.no/en/news/2020/netcompany-to-develop-app-fo... So they won’t be starting quite from scratch.
snorremd··on Don't use third party auth to sign in
Fastmail is very good. The web client is pretty simple, but feels so darned responsive (as in fast) compared to what I was used to from GMail. And spam is so far a non-issue.
snorremd··on Notion Timeline View
I think you express the precise reason why I prefer markup formats like Markdown, ReDoc, and LaTeX. I get to write markup which completely eliminates the need to click around menus and buttons or do app-specific keyboard shortcuts for formatting.

Rich wysiwyg editors also seems to have issues where the visible editing and internal formatting state breaks or behaves in weird ways. Like when you insert links and it automatically formats it as a link in some cases, and not in others.

Edit: Personally I always though the split view was okay as long as the compile times weren't too bad. Having a markup editor and then a view of the result is what I do for coding, so why not when writing stuff as well.

snorremd··on Funkwhale – Decentralized, self-hosted music server
As others have said. There is nothing inherently illegal about the software. As long as you are licensed to share the music you host in the instance there is nothing illegal going on.

Though the RIAA might see it differently, as they have with other open-source software in the past (ref the recent DMCA takedown requests of youtube-dl GitHub repositories). They might argue the software is designed for copyright infringement and as such should be blocked.

snorremd··on Show HN: Nhost – Open source Firebase alternative with GraphQL
Sorry I fail to see the big distinction between Firebase realtime synchronization and graphql subscriptions. There might be one, and I just don't see it as I'm not intimately familiar with Firebase.

Firebase data retrieval definitions and graphql subscriptions look very similar too me. Both methods allow you to describe some data record(s) or document(s) to be fetched, fetches it, and then listens for server notifications about data changes for it including the changeset or new data.

https://firebase.google.com/docs/database/admin/retrieve-dat...

That clients receive events in milliseconds with Firebase and potentially with a second delay with Hasura is a performance detail. The functionality still serves the same general purpose? When one client modifies some document or record immediately notify all subscribing clients.

snorremd··on Show HN: Nhost – Open source Firebase alternative with GraphQL
https://docs.nhost.io/graphql/subscription

Nhost seems to be based on the Hasura GraphQL server so you would implement live synchronization of data using GraphQL subscriptions. Hasura runs each subscription in a per second poll to get live data for each subscription. If the data changes it passes down the result to the graphql client.

https://github.com/hasura/graphql-engine/blob/master/archite...

snorremd··on Cities sue Netflix, Hulu, Disney+, claim they owe cable “franchise fees”
Up until two or three years ago or so we used to have to pay a public TV license for the public TV and radio broadcaster in Norway if we had a TV or tuner capable of receiving TV signals. Some people just opted to not having TVs or disabling any receiver capabilities.

Then they simply moved the collection of the license to your taxes so you don't see it explicitly, and of course now it does not matter if you don't have a TV.

Everyone pays the TV tax regardless, but it is somewhat progressive with low income residents paying somewhat less than higher income ones. I don't really mind paying for the public broadcaster as they serve as a guarantee for public, independent news.

What does annoy me is that they compete for the rights to broadcast super expensive sports and culture events (olympics, various football leagues, eurovision, etc). This greatly increases their budgets while not providing essential news value to the public not equally well served by private media broadcasters. Some of their own tv-series productions are well made and would not get the green light at private broadcasters and channels, so I would rather they focus on those.

snorremd··on Gitlab Support is no longer processing MFA resets for free users
I use Lastpass for passwords and Authy for 2FA for this exact reason. If my Lastpass is compromised they only get my passwords, not my 2FA tokens. If Authy is compromised and they manage to get my 2FA backup they still don't have my passwords.
snorremd··on Microsoft adding support for custom '+' email addresses in Office 365
I used this for a few sites, but then stopped as I realized this would be a pain to change if I ever wanted to change to a different email provider.

Wish every provider would support this as I’m sure spammers have caught on to the plus addressing scheme.

snorremd··on How and why GraphQL will influence the Sourcehut alpha
Hasura is one example of a graphql server that uses the SQL joins pattern to optimize graphql queries. See https://hasura.io/blog/architecture-of-a-high-performance-gr.... It automatically generates graphql queries based on your own schema and translates it to efficient postgres sql queries. The post I linked also briefly discuss the Dataloader pattern for batching graphql resolvers to avoid the N + 1 problem.
snorremd··on A History of Clojure [pdf]
If you don't do aot compilation that might affect startup time negatively as Clojure will need to read and evaluate your code during startup.

And now with things like GraalVM and Babashka you can write programs and scripts that starts in a matter of milliseconds.

snorremd··on Norway: Soldiers' location history found in data sold by Tamoco
Not only could you see bases because of activity around an otherwise empty area. You could almost pinpoint the exact shape of the bases perimeter because soldiers would prefer to jog along the inside of the perimeter. Smartphones and location based apps and services are a security nightmare.
snorremd··on How Lisp Became God's Own Programming Language (2018)
Would Clojure fit your criteria? There are already a good chunk of Clojure libraries, but you can easily use Java libraries via interop, so all libraries on maven central is at your disposal.

It was made to be a pragmatical lisp for real world use and the syntax is somewhat modernised to make it a bit more readable and user friendly. Vectors and maps looks like they do in other languages. It also uses immutable data structures by default making concurrency and parallell execution very easy.

It also has reach running on the JVM, in the browser (ClojureScript), as native binaries (via GraalVM's native-image), and even as short lived scripts via a number of Clojure interpreters like Babashka, Joker, and others.

I've found Clojure to be a very enjoyable language. Granted I have not really worked with other lisps.

snorremd··on Write Libraries, Not Frameworks
I agree. Otherwise every library for languages with first class functions and callbacks would be frameworks.
snorremd··on Sonic Pi is a code-based music creation and performance tool
I agree.

I spent years of my childhood learning to play the piano. I did not have the patience to practice four hours a day , so I never became more than moderately proficient.

And learning to play an instrument does not necessarily mean learning to create music. While playing off sheet music and focusing on dexterity exercises can be rewarding, they are not creative activities.

With Sonic Pi you can focus on music creation and simple programming concepts. It is rewarding in a different way.

snorremd··on Luminus – A Clojure Web Framework
I think one thing re-frame does well is cascading events. One event might trigger other events, etc. There is also a library for orchestrating re-frame events: https://github.com/day8/re-frame-async-flow-fx

I think using re-frame rather than just building event loops yourself with channels and atoms give you some advantage in terms of existing libraries and utilities.

snorremd··on Ryzen 4000 Review
Just an anecdotal observation. I bought a micro ATX MSI motherboard (a relatively niche product) together with my Ryzen 1700X way back when and they provide support for the latest Ryzen CPUs via bios updates. I'd be surprised if other more popular boards did not get updates.

So I can run the latest 3000 series with my current first gen AM4 board which is great. As you point out though the 16 and 32 core chips might be too power hungry for some boards.

snorremd··on REPL Debugging: No Stacktrace Required (2017)
Everytime I've singled out the REPL as why I like Clojure so much when explaining why Clojure so great to my friends they seem to mention that other languages have repls too. Like F# or JavaScript. When I counter that Clojure's REPL is connected to the running app instance they are developing I don't think they really understand. Perhaps this is one of those things that you just have to try out to grok.
← PreviousPage 4 of 6Next →