time4tea

Been saying this for years!

All the security theatre!

False urgency is red flag when it comes to emails and sms.. I dont see why people don't see the same when it comes to dependency alerts.

The vast vast majority of alerts are totally useless, when it comes to your actual deployed system, unexploitable and irrelevant.

Rushing to update causes make-work, churn and loss of focus on the real.

Don't get me wrong, I love secure systems, but dependency theatre doesn't make it.

Very very occasionally, you'll get a high priority signal, and then yes act on it immediately. Your deployment systems should be designed so that this is just another release. No expedited short cuts, just another day.

Reducing dependencies, defense in depth, validation, type-safe, null-safe languages etc all good.. endless dependabot PRs with no understanding of the reason or impact, bad.

Real time pressure information is valuable when being reported from lots of geographically dispersed devices. Its a way of tracking weather fronts. The "discontinued" device is still a little google money printer.

In my personal experience, if you are being dazzled by headlights from behind, its a tesla.

They have always been that way. Im not accusing them of being involved in "headlightgate", but it would be great if somebody did some research.

Beam patterns are always checked when at rest, just like diesel particulate emissions..

Had to ban RU, CN, SG, and KR just cos of the volume of spam. The random referer headers has recently become a problem.

This is particularly annoying as knowing where people come from is important.

Its just another reason to give up making stuff, and give in to the FAANG and the AI enshittification.

:-(

1200/75 is enough for anyone? (0p)

Would be interested to know about the a11y story on web and other platforms. Does it integrate with screen readers, accessible navigation tools, a11y apis, etc.

This is somewhere quite a few tools fall down. For example, for web: Rendering to canvas doesn't create the dom nodes required to hook into the tools, and creating the nodes appropriately can have a significant performance impact.

What about native a11y tools and tech.. there are some ios specific ones that you'd expect on an ios app for example.

Relevant recent incident:

https://www.theguardian.com/uk-news/2025/nov/08/environmenta...

Obvs, uk gov does nothing

Its true that aws is very expensive for a lot of use cases, as long as you only count the cost of the servers.

However, in most (every?) large organisations, buying a server and putting it in a DC, and looking after it, is hugely time-consuming, lengthy and expensive.

You need to get quotes, approvals, purchase, rack, commission, maintain etc etc. It is usually close to 1 year to get a server.

In some companies, even getting a virtual server takes almost as long!

With AWS, once an account and service is approved, boom, you are done.

Perfetto is so nice.

Viztracer is a super library to capture perfetto compatible output from Python.

It helped me find perf issues in literally minutes.

https://raw.githubusercontent.com/time4tea/gopro-dashboard-o...

Result<T> is a built-in in kotlin, but this enforces that the error type is a Throwable

If you fancy that an error could be just a type, not necessarily a Throwable, you might like Result4k - it offers a Result<T,E>

https://github.com/fork-handles/forkhandles/tree/trunk/resul...

disclaimer: I contribute to this.

Super interesting to know. I wonder why they bothered!

Thanks for the info.

Proguard obfuscation, particularly when you get to aggressive renaming (there are a lot of valid characters for a java class or method), flattening, overloading and inlining, can make it very hard to understand what is actually happening.

Its great to make this step.

Agreed! But i didnt miss the example.... i also thought it was interesting that all the various examples of declarative or applicative did Date.now(), which i see as a big thing to avoid.

Not a single person in this thread commented on the use of Date.now() and similar - surely clock.now() - you never ever want to use global time in any code, how could you test it?

clock in this case is a thing that was supplied to the class or function. It could just be a function: () -> Instant.

(Setting a global mock clock is too evil, so don't suggest that!)

Quite conventional - its how FreeType works.

Computing a bitmap for a glyph is expensive because of all the splines and whatnot.

https://freetype.org/freetype2/docs/tutorial/step1.html#sect...

If you use aws control tower to set up your stuff, this will happen sort of automatically.

Its been recommended practice for ages...

Use SCP (service control policy) to disable any services and regions you dont use. Tada. Much harder to get unexpected bill, much easier to enforce audit etc.

Hetzner are great.

Cloud was a reaction to overlong procurement timeline in company managed DC. This is still a thing, it still takes half a year to get a server into a DC!!

However probably 99% of use cases dont need servers in your own DC, they work just fine on a rented server.

One thing though, a rented server can still have hardware failure, and it needs to be fixed, so deployment plans need to take that into account - fargate will do that for you.

Have you seen https://typeflows.io/

It takes your programming language version and turns it into github actions yaml, so you dont need to do any of that sort of thing.

Maybe its just that the allocator is absolutely fine for single thread programs, and that's what a lot of programs are...

Its not so long ago that the GNU libc had a very similar allocator too, and thats why you'd pop Hoard in your LD_PRELOAD or whatever.

Not every program is multi-threaded, and so not every program would experience thread contention.

Have switch2, very underwhelmed.

Wouldn't recommend tbh, yet.

This makes me sad, as I played super Mario world on one of the first imported consoles in uk, have snes, n64, game cube, Wii, Wii u, switch and switch2.. each of them had awesome launch titles and follow ups... switch 2 seems.... empty?

You can run docker swarm easy peasy. Its not that trendy, but anyone can manage it, and you can migrate to k8s later if you need to. Of course it doesn't do some of the things that k8s does, and thats why its less complicated...

Edit: you can run a lot on one or two hetzner servers for almost no money. Compare €60/month, vs about $1000/month for a couple of replicated fargate services.

Observable plot.

https://observablehq.com/plot/

Two main reasons i see:

- poor testing between front and backend so that ppl don't know what versions of apps can work on that versions of apis, so forcing updates, "just to be safe"

- security slop - forcing the update of apps because they have an insecure library, like curl, so inane policy forces them to update...

Any company that does this, but yaks on about 2fa/security is just gaslighting you.

Sane for those that only offer 2fa as part of cost plus deal.

SSO or 2fa are table stakes for companies that care about you - even at a free tier.

Both are effectively zero cost to deploy (once you create the login capability for one) ...

Loads of cool things happened with 9600, 14.4, 28.8, ahh courier hst!

Got an isdn link in 98, so fast.

500,000 - you can do a lot.

Then I hid it away.

This is an ad not a helpful announcement.

Mandatory £1000 fine per record lost. Would be company-terminal for companies with millions of customers - and thats right. Right now it's just cheaper to not care, then send a trite apology email when all the data inevitably gets stolen.

The status quo, nobody gives a crap, with the regulators literally doing nothing, cannot continue. In the UK, the ICO is as effective as Ofwat. (The regulator that was just killed for being pointlessly and dangerously usless)

(Edit: fix autocorrect)

So much of this is just normal stuff anyway, right? Signing CI output, tracking dependencies, using bundled resources..

Bit-for-bit reproducible builds are definitely doable, but mean including build dates is tricky, and care needs to be taken with archival file ordering.

Is this such a big departure from the norm? Curious what constitutes normal!

Tbh firefox is excellent.

Having an £1/month subscription that you could take any number of (including zero), would be easy and generate some income.

There have been some mis-steps to be sure, but also some cool stuff. People often focus on the negative.

Cycling is so much more effective than cars.. actually approx 5x more in terms of street usage. So when people move to bikes, the streets look way less busy. You'd need a 5x more bike traffic than car traffic for the two lanes to be equivalent.

Just worth bearing mind when people talk about streets being emptier - just emptier of cars