HNHacker News
TopNewBestAskShowJobs

waterTanuki

171 karma · joined March 6, 2024

submissionscomments
waterTanuki··on Malicious Rust crate Arrayref runs a build-time payload
> append-only-vec

> This is a pretty simple type, which is a vector that you can push into, but cannot modify the elements of. The data structure never moves an element once allocated, so you can push to the vec even while holding references to elements that have already been pushed.

This is the left-pad of rust. Reconsider your life decisions if you need to pull in an external dependency replicable with 30 lines of code:

    use std::vec::Vec;

    #[derive(Debug)]
    pub struct AppendOnlyVec<T> {
        inner: Vec<T>,
    }

    impl<T> AppendOnlyVec<T> {
        pub fn new() -> Self {
            Self {
                inner: vec![],
            }
        }

        pub fn push(&mut self, element: T) {
            self.inner.push(element);
        }

        pub fn clear(&mut self) {
            self.inner.clear();
        }
    }
waterTanuki··on Malicious Rust crate Arrayref runs a build-time payload
> I think we should be taking a more “batteries included” approach to language and library design. The entire reason we’re in this mess is because we’ve decided it’s ok or maybe even preferable if stdlibs are rail thin, rendering base languages near-unusable.

Rust is one of the better languages when it comes to batteries included in it's stdlib. Even then, it's impossible to have a 100% coverage batteries included language because nearly everyone on planet earth has some different/unique use case for their code that doesn't fit a stdlib.

waterTanuki··on The Citizen Developer
New person in sales joined my company a few months ago and on the very first introduction they handed me a vibe coded app and asked me to review it for them and put it into production. Haven't spoken to them since. They haven't proposed anything else since then either to engineering. You may think it harsh but they didn't even ask my name, what my specialization was, etc.

Engineering to these folks is a one-and-done endeavour. You just prompt and fire it off and ride off into the sunset, leaving the mess for someone else to clean up. They never see the work that goes on after the launch party. The midnight debugging sessions, the database migrations, the DNS failures, debates over which auth provider to use, the list goes on. Until the "citizen developer" is willing to engage in the less "sexy" part of software engineering, the world will move on without them as well.

waterTanuki··on Anti-AI fonts are useless and harmful
how can you make such a bold claim so early with 0 evidence? A successful (and much more realistic outcome) could be to make a font that is financially infeasible for LLMs to parse but easy for humans.
waterTanuki··on Beware Management Consultants
They are in the business of justifying blame from the executives to the frontline. Executives keep or increase their bonuses, layoffs ensue. If you are the decision maker of a company, and you can pay a team a few hundred thousand a year using company money, netting a 10 million increase in your own salary, its a deal too good to pass up.
waterTanuki··on Tracking down the 16-year-old WAL-reset SQLite bug
It's harder to leak multiple S3 keys than a single postgres key.
waterTanuki··on Incident with Github.com [resolved]
Anyone can re-create the hosting part of GitHub. This is not the difficult nor the expensive part.

It's the actions. The compute to run them isn't cheap at scale nor is the amount of auditing you need to do for security and compliance if you want enterprise/government customers.

waterTanuki··on Tracking down the 16-year-old WAL-reset SQLite bug
That's already how it works at the data-plane layer. I'm talking about the control-plane layer where tailscale needs to maintain a server that gets its state from somewhere (they need to know where to route your data, what your permissions ACLs are, device names, etc.). If everyone shared the same db cluster accessed over the network there is a real risk of an accident leaking the encryption keys (of the database itself, not your tailnet) to the db they would have to maintain, and leaking semi-sensitive info like these device names and IP addresses. Using sqlite means each tailnet's metadata is isolated to the container running it.
waterTanuki··on Delta
So the Zed team essentially sidelined numerous requests for a UI extension API to make something that will only ever be used in demos.

Good thing I can just fork the editor. This is how you lose the trust and goodwill of your users.

waterTanuki··on Tracking down the 16-year-old WAL-reset SQLite bug
Tailscale likely deals with a lot of security-sensitive traffic, given the nature of the service. I'm guessing one of the requirements they were given was to have a tiny blast radius in case encryption keys got leaked, and that meant isolating each customer's tailnet (meta)data to it's own sqlite db rather than letting everyone share a postgres cluster.
waterTanuki··on GitHub Actions and Pages are experiencing degraded availability
When the barrier to entry for software was high, free unlimited publicly hosted git repositories made sense. Not only did you have to have some basic understanding of software, but a grasp on git itself.

Now that the calculus has changed, I think we should start asking ourselves whether anyone has the right to unlimited free public repositories.

We can all agree that trying to attribute any single metric to repo quality is subject to Goodhart's Law[1] (e.g. what happened to GitHub stars) yet we can also agree that the Linux Project is a much more vital repository to keep public infrastructure availble for than say, someone's vibe-coded to-do app. Is it impossible then to make any quantitative distinction between these two? We can't have both an uncontrollable firehose of AI slop and unlimited free public storage/compute at the ready for it. I say we actually need to decide what software is worthy of using up these resources for free. We already have companies like JetBrains[2] using dynamic pricing for their products. It's time Github do the same. If you want a hosted VCS for vibe coded projects that aren't being used or depended upon widely, then host the repo yourself.

[1]: https://en.wikipedia.org/wiki/Goodhart%27s_law

[2]: https://www.jetbrains.com/community/opensource/

waterTanuki··on Zed DeltaDB
Adding onto this I and many others have asked for a ui extension API to actually make use of AI tools and they've adamantly refused. Until someone else with the time and resources to fork and maintain it comes along, it's just in maintenance mode. These "AI" features are not useful at all.

https://github.com/zed-industries/zed/discussions/53403#disc...

waterTanuki··on Nashville uses eminent domain to block data center near zoo
Good for the construction companies, the billion dollar corporations, and the whole 4 people needed to run each one.

Not once instance of these datacenters has proven to be beneficial for the communities and economies they're located in.

waterTanuki··on SwiftUI After 7 Years
I shipped an internal company application using SwiftUI a couple of years ago and the author pretty much nailed all of my pain points. At the very least in JavaScriptLand™ you are provided very opinionated ways to go about reactivity: choose your framework flavor and start shipping. In SwiftUI, you have all of these declarative macros, some of which do the same thing, so you spend hours going over whether you should do MVVM or MVC or some other thing to structure your code instead of actually writing the code.

It wasn't mentioned in the article but half if not more of swiftui's issues also stem from XCode being the worst IDE to work with. It's incredibly bloated, tries to drive you towards GUI-driven interactions instead of using CLI, and takes ages to explore and understand all the different features/settings. I've never had any other IDE or editor refuse to compile my code because of a memory overflow during the compilation step, yet for some reason, even when compiling swift on an M2 MAX with 64GB of ram in 2026, I regularly get these kinds of cryptic errors that tell me it can't compile. Likely due to misuse of some code expansion feature, but then it rarely tells me where the source of misuse is.

waterTanuki··on The Rust on ESP Book
Interesting pattern but it sounds like it's fundamentally incompatible with setups using embassy

https://embassy.dev/

waterTanuki··on The Rust on ESP Book
``` #![cfg_attr(not(test), no_std)] ```

Test code doesn't need to live on the device itself. You can call no_std code from std code and tell the compiler "hey, this code is only ran on hosts that have access to std" without trying to bundle the std library into your no_core code. You're not going to able to test I/O (does this function actually set Pin0 to HIGH or LOW) but you can test logic.

waterTanuki··on The coolest use for the Vision Pro
If you're using it for hobby projects and you're budget constrained yeah.

If you're making a sales pitch the $3500 is an investment in raising sales.

waterTanuki··on Kimi K3 Architecture Overview and Notes
Reading Claude's outputs is an 'attack'
waterTanuki··on Codex Security
Why does this need an entirely separate repo instead of being a feature in the existing Codex project?
waterTanuki··on Our position on open-weights models
The moat never was and will never be the models, it's the hardware. This is exactly like nuclear weapons: The recipe for a nuke isn't a hidden secret. Getting the infrastructure and materials is completely unreachable for non-state and non-corporate actors. This idea of a "rogue individual" using a frontier model to develop a bioweapon is a complete myth, because anyone with the capability to run the models without guardrails has to answer to/be audited by some entity already.
waterTanuki··on Startup founders urge U.S. government not to shut off Chinese open weight AI
The argument is that it will make $OAI and $ATHR billions of dollars because U.S. customers with deep pockets will have nowhere to go but the "vetted as safe and verified model providers" aka the duopoly. No one with two brain cells to rub together takes anything they or the current U.S. government has to say at face value.

This is a tale as old as the industrial revolution. I can only hope people see the trick for what it is this time.

waterTanuki··on I regret migrating to Codeberg
> If the maintainer of the largest and most consequential open-source project on the planet can treat LLMs as a tool to be judged on its results rather than a category to be banned on sight, a backyard code forge can manage the same.

Apples to Oranges here. Linus has himself and the entirety of the Linux Foundation maintainers + outside contributors to effectively review and gatekeep llm slop from making into ONE codebase.

Codeberg has presumably way less people working for it than the Linux Foundation, and has to monitor an avalanche of codebases for slop. Of course they aren't going to be able to pull off what Linux can do.

waterTanuki··on The arguments against open source AI are bad
When talking about "open source" models no one is talking about the legal framework and textual doctrine of open source. They simply want to know: "can I run this on hardware I own or no?" That's it. It's simply about control. If you don't think there's a difference between models you can download and run on hardware you own, regardless of how big it is, vs. models you can only talk to through an API, you are seeing the forest for the trees.

You are also indirectly helping the closed SOTA model toll-keepers by taking the focus away from their mass copyright theft and onto some pointless textbook definition.

waterTanuki··on AI Companies Are Trying to Hide a Staggering Amount of Debt
It is a given. Unless the Trump admin figures out how to ban 1s and 0s, you can't stop Chinese labs from open sourcing their models. They can certainly ban new providers from using the Chinese models, but they can't ban Canadian ones, European ones, other Asian countries etc. from setting up provider proxies and bypassing those rules. Then what, great firewall of USA? Block off all internet traffic to other countries? Bye bye economy.

I think the burden of proof is on the closed SOTA model providers to prove they have a moat, because common sense indicates they don't.

waterTanuki··on AI Agent – TRMNL
> Writing code is cool, but wouldn't it be cooler to type "build me a plugin showing populations around the world" and it Just Worked?

I can't think of a string of words more unfitting for this website and its audience than this.

waterTanuki··on Five US tech giants' hidden debts soar to $1.65T on opaque AI funding
So this is why Masayoshi Son was lashing out at critics recently.
waterTanuki··on Zig Creator Calls Spade a Spade, Anthropic Blows Smoke
> Battle-tested, mature code > fresh rewrite.

> Existing Zig codebase has seen X amount of battle-testing. Rust rewrite: 0 (except -I'm assuming- passing test suites).

Not taking a side here in the whole Bun vs. ZSF dispute, but isn't the entire selling point of Rust that you get a bunch of battle-tested guarantees simply from compiling the program? Is there even a metric for battle-tested? I would say something like sqlite is battle tested vs a vibe-coded network server in c, but does that mean rewriting anything in rust truly mean starting all the way back at square one?

Also, didn't Anthropic roll out a version of CC using the Rust rewrite of bun? Surely they didn't just say "works on my machine" and chuck it into production?

waterTanuki··on How we can reduce traffic congestion
I like XKCD but I don't really agree with the underlying premise of this one.

When I was in the Netherlands, one of the global gold standards in terms of urban planning and design, I noticed it wasn't only more pleasant as a pedestrian or cyclist, it was more pleasant as a driver as well. Lights were smart and did not sit on red forever if you were the only one waiting at an intersection.

This comic suggests there's some "invisible, massively complicated" mesh of signal interactions we can never possibly fathom, and therefore wasting precious hours over the course of our lives sitting at an intersection is the most optimal one.

The Dutch have figured this out, why can't North America?

waterTanuki··on Good for business or profit at any cost: Private equity's controversial side
Moore's responses read more like a politician who's been caught in a scandal and is deseperate to change the subject instead of tackling the questions head on.

> Michael Moore, the chief executive of UK Private Capital, an industry body and trade association, says private equity uses “leverage” responsibly. In finance, leverage is the use of debt to increase returns gained from an investment...

> ...Crucially, private equity firms succeed by building stronger, more valuable businesses over time, so it is firmly in their interests to ensure debt levels are sustainable.

Anyone can say these things. Demonstrate them with raw data and facts.

> When asked about the negative side-effects of private equity’s profit maximisation, Moore says: “Private equity firms professionalise businesses, helping them adapt to the challenges of the energy transition and tech disruption, with both the capital and expertise that makes them competitive.”

Hey UK Private Capital, hire me as the Chief Executive and I'll easily do Moore's job for 70% of his salary, cutting your costs as well and getting your investors a higher return.

That's your goal after all isn't it?

waterTanuki··on Postgres rewritten in Rust, now passing 100% of the Postgres regression tests
A more plausible explanation:

People were told for years they can't use Rust for their new projects because it hasn't been "proven" in industry yet. So the option was to sit back and wait (chicken and egg) or move to rewrite a bunch of projects so that it could actually be "proven". Not saying this is the only reason why it happens (every language has its Zealots) but it certainly makes more sense.

Due to the explosion of new programming languages over the past few decades your options are to either aggressively expand wherever possible or die out because you're not "proven".

← PreviousPage 2 of 7Next →