HNHacker News
TopNewBestAskShowJobs

FooBarWidget

7,890 karma · joined December 5, 2008

Co-founder of Phusion, developer of the Passenger application server for Ruby, Python and Node. Passionate about web development and computing infrastructure.

Twitter: @honglilai

Github: FooBarWidget

[ my public key: https://keybase.io/foobarwidget; my proof: https://keybase.io/foobarwidget/sigs/fW8xkjqf1o2IGTE7IiFu5wub8NYnF4_mxjmj38WXkQs ]

submissionscomments
FooBarWidget··on GLM 5.2 Is Out
Sorry, splitting up does not work for China, politically, geographically and culturally. Peaceful and prosperous times only come when there's a strong central government. If any current government advocates for splitting up, then they'll be toppled in no time and replaced with new guys, maybe even warlords, who strive for a united China. "The land, long divided, must unite. The land, long united, must divide."
FooBarWidget··on GLM 5.2 Is Out
If it's really as simple as allowing trade with the west then why are many other developing countries either stuck at the middle-income trap or not developing quite as fast as China? You're not gonna tell me Chinese are smarter, are you?
FooBarWidget··on GLM 5.2 Is Out
Distillation helps, but is only a minor part of overall training effectiveness. It's not like everything suddenly collapses if distillation is made impossible.
FooBarWidget··on Kimi K2.7-Code: open-source coding model with better token efficiency
And yet here we are with the US banning anything at will under the guise of national security. I'm not even discussing whether the national security label is legitimate, or whether your "everything is CCP-controlled" framing is legitimate. But you gotta be consistent and also adopt the position that US companies are "US state controlled", and consistently refer to them as such.

Also, I am pretty confused about your larger point. What exactly are you saying? Is it some variant of "only states with constitutionally protected freedoms are good, everything else is evil"? If that's your position, then where do you put the fact that the US bombs foreign countries at will? And that many western countries sponsor the killing of children in Gaza while arresting people who protest against it? We've seen that western democratic countries, and let's assume they're properly democratic domestically (disputed by their own populations, see Democracy Perception Index, but I digress), can be ruthlessly... let's call it "undemocratic"... abroad. Or the fact that ICE and US police officers detain/kill innocent people and are super abusive. This doesn't neatly fit into the simple "free states good unfree states bad" view. So what is your position in the larger context?

You also completely ignore the part where I said properly understanding China is important in order to defeat it. Do you... not wish to defeat China? Are you contend with merely stating that China is bad? Do you not support moving/developing more manufacturing to the west/US? If you want the latter to succeed, don't you need to have a super good understanding of what makes Chinese industrial policy and development successful? Or are you really contend with merely moralizing?

FooBarWidget··on Kimi K2.7-Code: open-source coding model with better token efficiency
I, too, can claim that "the spaghetti monster exists" is in the same ballpark as "UK is a parliamentary system".

Let's take a look at a related field: the accusation that Chinese car makers are subsidized/funded by "the CCP". It just so happens that the CF40 research forum recently published a study that shows there the money actually comes from, by analyzing the companies' financial reports. https://www.pekingnology.com/p/oecds-subsidy-centric-narrati... Turns out that they most rely on equity financing or alternative forms of financing (like delayed repayment to suppliers). They don't even make that much use of cheap credit from state banks.

More counter evidence: a new study based on 3+ years of fieldwork, 60+ interviews (with officials, entrepreneurs, and engineers), and rich first-hand accounts, shows that Chinese EV makers rose despite central government's efforts, not because of them. The central govt favored state-owned enterprises. Private firms had trouble getting state funding and even licenses. For example Geely operated illegally for years. But private industry and local mayors teamed up and created an alternative system. They then grew to a point where Beijing was like "ok you guys are obviously doing better, so we will not make a fuss about this and just legalize you".

https://x.com/i/status/2064717100229464188

https://www.journals.uchicago.edu/doi/10.1086/741394

This is in complete contrast to the usual western tropes that state that everything in China is tightly controlled by Xi or by the central govt. In fact, the central govt's merit is in being lenient to deviance and operating based on results rather than amount of control. The opposite of the "totalitarian" trope. All the while western pundits would predict something like "Xi has a huge ego and will never tolerate the humiliation that his plans are imperfect" or something like that.

So no, "of course everything is CCP funded and CCP controlled" is not a given, nor in the same league as "UK is a parliamentary system". If they got the car maker situation so, so wrong, then what else is wrong?

If you want to win against China, isn't your first step to properly understand who they are and how they operate, rather than doubling down on your imagination of who they might be? Know your enemy and all that (not saying that I agree with seeing them as an enemy, but if you do, then you sure are doing yourself a disservice)

FooBarWidget··on Kimi K2.7-Code: open-source coding model with better token efficiency
The burden of evidence is on the accuser.
FooBarWidget··on Moving beyond fork() + exec()
It says state. Copy on write still means it's O(number of page table entries) even if you don't copy the contents. It's a well known issue that forking a program with large virtual memory size is slow.
FooBarWidget··on The Pentagon is running an AI propaganda mill targeting Latin America
Do you think the fourth estate is working as it should?
FooBarWidget··on Did Claude increase bugs in rsync?
This. Best writeup I've seen on the topic of entitled/abusive users. You should publish this as a blog post or launch some sort of campaign or something, something people can refer to. I haven't encountered entitled users myself, but my gawd, I'm so annoyed at users who feel entitled to other open source maintainers. I'm raging with a drive to protest against people who treat the rsync maintainer with such disrespect.
FooBarWidget··on The Pentagon is running an AI propaganda mill targeting Latin America
What are you talking about? There are entire groups of renowned "journalists" that turn out to be CIA collaborators. The renowned New York Times admitted they receive approval from the US government. Bellingcat, renowed "independent investigative journalists", turns out to be CIA-funded, and is awfully quiet with their investigations in situations where it does not suit NATO allies' agenda.

There's a reason why the public distrusts journalists more and more. Many people still think the problems are limited to domestic journalism, and haven't connected the dots yet w.r.t. that foreign policy journalism is just as bad, if not worse.

FooBarWidget··on The Causes of Long Covid
Symptoms caused by sadness are not necessarily fake.
FooBarWidget··on Postmortem: TanStack NPM supply-chain compromise
No? The shell must be listed in /etc/shells, it can't be an arbitrary command. And after elevating privileges you have to run the malware (which could only be written to home or tmp) for it to work, but sudo already scrubs the environment.

So the main danger is that you're not running the real sudo.

I have an idea that I hope to implement one day to make sudo actually secure:

1. Authenticate with passkeys (webauthn) instead of passwords.

2. Sudo can only run an interactive root shell, not arbitrary commands. The session is time-bound, and the TTY output is recorded for auditing purposes.

This combination makes intercepting sudo largely useless. Passkey authentication cannot be replayed or relayed. The fact that sudo can only open an interactive shell makes it impossible for a sudo wrapper to pass a malicious to sudo. This way we're not dependent on whether the unprivileged shell is secured properly. It also solves approval fatigue (compared to running sudo separately for every command).

----

EDIT: now that I think about it: an attacker can still edit .bash_profile and reexec the shell in a malicious terminal emulator. Then when the user gets a sudo root shell, the malicious terminal emulator can inject malicious commands.

Looks like the only good way is to get a root privileges via a separate user account that doesn't have malware, and that also can't easily install malware (e.g. accidentally running npm, forgetting that that's not safe).

FooBarWidget··on Postmortem: TanStack NPM supply-chain compromise
I really wonder wtf Github is doing. Cache poisoning issues like this are so easily solved at the platform level by ensuring that pull_request_target caches live can only write cache changes to a different namespace that cannot be read from normal workflows. Furthermore, the fact that the cache actions can write caches even though the workflow only has read permissions is just bad security design.

Another worry that I've had recently is that anybody who is able to get Github push access, can push new releases with malicious assets. Even if you have branch protection and environments, it doesn't do anything: the attacker can simply create a new workflow, push to a branch (which runs that workflow), and then the workflow creates a new release. No merge to main needed, pull request reviews bypassed. I want a policy that says "only this environment can create releases" (and "this environment can only be triggered by this workflow from this branch") but that's not possible.

Github, please step up.

FooBarWidget··on Postmortem: TanStack NPM supply-chain compromise
It would be great if

1. shells support the notion of privileged commands, that can't be overridden with PATH manipulations, aliases or functions.

2. Sudo (or PAM actually) can authenticate with your identity provider (like Entra ID) instead of a local password. Then there is nothing to sniff and you can also use 2FA or passkeys.

FooBarWidget··on DeepClaude – Claude Code agent loop with DeepSeek V4 Pro
They expect inference prices to structurally drop once they receive their big batch of Huawei Ascend chips by the second half of the year.
FooBarWidget··on Investors pile into clean energy as Iran war drives push for energy security
This can be said of any human in any context. The juniors that work in your company can become your future competitors. Yet nobody concludes "never hire juniors".
FooBarWidget··on Investors pile into clean energy as Iran war drives push for energy security
Heck China has been in this exact predicament for decades. They imported all the foreign technology they can, while simultaneously learning all they can to make things themselves and stop being dependent. After 50 years it's finally paying off. They could not be where they are now had they blocked all foreign imports from the start.
FooBarWidget··on Investors pile into clean energy as Iran war drives push for energy security
How about you focus on increasing your own cheap production first instead of focusing on whether depency is problematic?

Dependency is only problematic if you lack an alternative, and nobody is developing alternatives.

My gawd, lots of people in Netherlands want to contribute to the green ecosystem but govt can't even get permitting straight and everything is gridlocked. The electric grid is full and new houses and companies can't be connected to the grid, wnd if you want to install a heat pump or an AC then there are thousands of rules and anybody else in the neighborhood can block you for the slightest thing.

Less talking and more doing. The Chinese at least are all do and almost no talk.

FooBarWidget··on DeepSeek v4
I'm not asking you to hear what they say, I'm asking you feel their fear (or lack thereof). If all the allegations are true then they don't need to say anything, you can feel the fear effortlessly, there's no hiding that. Also, nobody is stopping you from interacting with them in a place without cameras and witnesses.

Also, China has got nearly nothing in common with Russia. Don't lazily lump them together just because western popular thought likes to put the same label on them.

FooBarWidget··on DeepSeek v4
You can travel to Xinjiang and witness for yourself whether religious people and minorities live in daily fear of concentration camps and organ harvesting. There are no special travel restrictions beyond standard country-wide visa requirements. If you're in a western country then odds are you can enter visa-free.
FooBarWidget··on DeepSeek v4
You ought to travel to China and tell these things (just the parts about China and Taiwan, Russia/Korea etc irrelevant) to locals. In private, in a place with no cameras and no other onlookers, just to sooth your paranoia. People will laugh in your face. Maybe they'll even tell you where to find a church/mosque so you can attend a sermon or bid in the direction of Mecca or whatever.

While you're at it, go look for elderlies in their 80s or older, who were born before the People's Republic's founding. Maybe they even witnessed the democratic era of the early Republic (not People's Republic). Go tell them your maximalist thoughts about democracy and see how they respond.

FooBarWidget··on DeepSeek v4
Go travel to lower tier cities and rural places in China. The development those places have gotten in the past decade are huge. Go talk to regular people ask them to compare 10 years ago with now.
FooBarWidget··on DeepSeek v4
I find western obsession with "being able to critique X" very weird because it stops at just that. There's very little attention paid to whether the critique produces useful outcomes. While cost of living, energy scarcity, employment, education, wars, etc are all getting worse, people focus on being able to insult the president as the ultimate freedom, even when that achieves nothing.

Meanwhile in China, you can't change the ruling party but you can change policies. They restrict media and speech freedom, but they also work tirelessly to improve the livelihoods of the people.

If the west chooses the value empty talk over outcomes, fine, you have the right to choose that. But no need to force that value on other societies. China and Chinese society at large has the right value unity and livelihood over speech. They have the right to prefer what westerners call an "authoritarian" government that delivers on those values, without getting demonized. They're not forcing their way on you, no need for you to force your way on them.

FooBarWidget··on The RAM shortage could last years
That's only for normal RAM. I'm talking about broader aspect: HBM shortage and high prices have been around for longer, and Chinese manufacturers are also climbing up and expanding there.
FooBarWidget··on The RAM shortage could last years
You think this window is short? We've been dealing with this for years and years, and to me it seems more like incumbent manufacturers are too comfortable milking cash cows.
FooBarWidget··on Modern SQLite: Features You Didn't Know It Had
I've found FTSE5 not useful for serious fuzzy or subword full text search. For example I have documents saying "DaemonSet". But if the user searches for "Daemon" then there will be no results.
FooBarWidget··on Nvidia greenboost: transparently extend GPU VRAM using system RAM/NVMe
Then extend your disk space using DoubleSpace/DriveSpace!
FooBarWidget··on Beyond has dropped “meat” from its name and expanded its high-protein drink line
You are right. I assumed it would be full of junk like most meat substitute products. But I took a look at the ingredients list of the Dutch version, it seems the preservative (potassium lactate) is the only problem, everything else seems acceptable. I'm quite surprised by how decent the ingredients are.

Still, I don't really have a reason to buy it. I don't avoid meat. I specifically eat beef for, for example, creatine and iron. But I guess it is good for people who crave beef yet have an ideological resistance against meat, a niche which I'm not sure how big it is.

FooBarWidget··on Beyond has dropped “meat” from its name and expanded its high-protein drink line
> Health conscious folks would definitely choose these over hamburgers.

I don't know man. I'm a health conscious person and I could just as easily choose normal chicken meat, or a beef steak that's not a hamburger, or fatty fish (omega-3!!). Why would I choose a hamburger substitute? I don't even particularly crave hamburgers.

I took a look at the ingredients list of the Dutch version, and it seems to be okay when it comes to amount of industrial fillers. It seems the preservative (potassium lactate) is the only problem, everything else seems acceptable. So I guess it's not that bad, but I still don't still really have a reason to choose it.

On days when I don't particularly want to eat a lot of meat, I just eat more rice, vegetables and beans. It's not that hard?

I think the OP is right: their niche seemed to be people who crave something like a hamburger or at least real meat while having an ideological opposition against meat and enough money.

FooBarWidget··on Separating the Wayland compositor and window manager
And how would they be able to "push stuff down people's throats" if people could walk away towards alternatives? When such alternatives don't exist, that's exactly how "they do stuff for free and nobody else is putting in the work to make something else" looks like.

The problem isn't they "pushing stuff down your throats", it's nobody else (including you) making alternatives that you like better. You are voluntarily ingesting their stuff because your only alternative is starving.

← PreviousPage 4 of 34Next →