HNHacker News
TopNewBestAskShowJobs

Normal_gaussian

4,693 karma · joined February 15, 2016

submissionscomments
Normal_gaussian··on PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch
Its probably better to embed clearer strings in the binary that conform to some spec. Then searching over binaries would find them.

Trying to respond to a signal is a nightmare of routing and lifecycle bugs. Never mind the fact that most dependencies won't be registered. Currently file/process signature matching is ok for major runtimes, and tends to fail on specific version detection. This would effectively formalise that.

I could see it being a successful standardisation for major runtimes and many libraries that wouldn't currently be detected - but take up would never be universal. A kind of CVE search stamp.

Normal_gaussian··on Degraded availability for GitHub Actions, GitHub Pages and Webhooks
As it stands, customers aren't leaving because of the degraded performance. Free is generating paying customers.

Raising prices risks churn, reducing free tier risks lowering customer acquisition rate.

Normal_gaussian··on Linux 7.3
As someone who hasn't looked at the repositories in question;

> why don't you submit some PRs to help them improve?

Is often a non-starter. If you believe a codebase is poor quality, any changes to improve it have a strong risk of making it worse and/or wasting your own time. In the case that you aren't a key player in said codebase already, it is even more likely your attempts to make changes will fail. Its not impossible to improve these repositories however doing so is quite a different skill-set to identifying their failings.

Normal_gaussian··on Incident with Actions, Pull Requests and Issues
> Conversely, I would have no issues if GHA become a premium product.

This is a real problem for acquiring customers. CI/CD / Actions in general has a low initial perceived value and a high perceived value after use while being primarily a commodity product (serverless compute). To acquire customers they need to offer a free tier, to make money they need to charge their heavy users more, but because it is a commodity their heavy users will self-host runners or jump ship.

Action minutes is a really good proxy for value gain from cloud git services, where repo count, user count, file count/size, etc isn't.

Its a fun pricing puzzle.

Normal_gaussian··on 5x faster Edge Functions: V8 isolates to Firecracker MicroVMs
Smolvm with it's libkrun vmm provides significantly worse security positioning than slicervms use of firecracker, which leads to slicervm for any dangerous or secure workload.

https://github.com/libkrun/libkrun

Normal_gaussian··on 5x faster Edge Functions: V8 isolates to Firecracker MicroVMs
Balloon devices go a long way for ram sharing, though not all the way. CPU scheduling is great.

There's definitely a tradeoff, but IME it's not as drastic as you first think.

Normal_gaussian··on 5x faster Edge Functions: V8 isolates to Firecracker MicroVMs
Without commenting on v8 isolates specifically, this doesn't necessarily hold in any isolation situation; many customers are running code on behalf of their customers, which are often submitting jobs on behalf of theirs, and so on. Isolation breaches within a platform customer can result in significant cross-user data breaches.
Normal_gaussian··on 5x faster Edge Functions: V8 isolates to Firecracker MicroVMs
I've been using SlicerVM extensively - which is Firecracker MicroVMs for the regular person (and for the irregular with their platform offering) - to run local 'edge' style workloads locally and securly. Agents, local dev CI, etc. It slotted in and replaced my proxmox vm orchestrator, and now I have secure and and fast vms on my laptop wherever I go. It also supports dockerfile style builds if you're wanting a security upgrade from containers (which, you should if you're using agents).

Honestly, while I see firecracker replacing docker on the horizon I don't see firecracker replacing v8 isolates for most edge function execution. Firstly, this article's scenario is a bit unusual in that they were using someone else's isolates - so adding on a few hops; secondly isolates running JS/TS can be statically analyzed quite well, and at scale looking historically for issues and exploits, in many edge compute scenarios this is quite desirable. MicroVMs can have an awful lot more flexibility so to get the same benefit you have to really lock down what is available - the trade-offs for mid-size companies seems to benefit isolates. Obviously netlify is more than big enough and relies heavily on this that it leans in their favour.

Normal_gaussian··on You are no longer invited to dinner
> It depends who you invite.

True. If I invite nobody it about matches the night in.

Normal_gaussian··on You are no longer invited to dinner
> But what people (probably the ones that never bother) tend to forget is how unbelievably gratifying it is to get a bunch of people together, to feed them and to make them talk, laugh, dance, etc.

Nope. Its a bunch of work and stress and thoroughly beaten by a dull night in. If I want to bring people together, I'll pay for it to be done - e.g. a restaurant.

Normal_gaussian··on Transit rewards
> If you're with 1-3 other people, taking Waymo all the way is a no-brainer.

This is often the case for any mass transit vs personal transit option.

As for home -> taxi -> mass transit -> taxi -> destination; you have to have a pretty short journey on the mass transit for it to reliably work out cheaper to do home -> taxi -> destination, which pretty clearly restricts the pool of people that applies to.

Normal_gaussian··on Transit rewards
The answer to both of your points is that mass transit is used for most of the travel and the last mile is taxi equivalent. Being unable to do the last mile is a common reason not to take mass transit, so more usable taxi equivalents tends to increase mass transit use. And most directly, taxi equivalents are often significantly more expensive or significantly than mass transit at crossing cities.
Normal_gaussian··on I said no and Apple said yes
> long-life

> and durable keyboards

It wasn't that long ago they had terrible keyboard lifespans which could be a death knell for the laptop, and overheating CPUs which limited performance way behind spec. They've come far in recent years, and I certainly wouldn't be sad if it was my main machine yet I don't expect them to be an outlier forever.

In some dimension Apple (and any serious manufacturer) is always going to be ahead - and they certainly are in non-gaming portable CPU/GPU combos right now. Alas, they aren't ahead in many other dimensions; my Fedora X1 Carbon is my strong preference over my M4 macbook pro and a large part of that is the basic usability of the system and window manager (sway), which is something Apple will never match until we meaningfully switch interaction paradigms.

Normal_gaussian··on Spymarks, Not Watermarks
and on desktop for me
Normal_gaussian··on Spymarks, not Watermarks
Additionally, verifying that your generator doesn't add such a mark is practically impossible for the majority.
Normal_gaussian··on The Beauty of Roundabouts
Well we have very different experiences driving to, through, and around Salisbury. There's traffic, and it can get bad, but it isn't as bad as you say.

The council and national highways are working on it, but the problem is not one of roundabouts - its one of increases in traffic and lack of capability to make the roads bigger and/or build a bypass. Unless we're willing to knock down a load of housing and cultural sites we're stuck with something around or slightly more than the road capacity we have.

Normal_gaussian··on Dyson CameraJet electric toothbrush
cheap ones are in that range; the most expensive ones around $350/$400. I paid ~£200 for one about a year ago, which is ~$270 USD including sales tax. The top end takes the piss, but if you want certain features - particularly several in combination - its what they've segmented the market to.
Normal_gaussian··on No Man's Sky Cosmos
There are a many successful games companies and marketers in the games industry that have enough respect for others to not mislead like this. Many many marketing promotions go to significant effort to show how a thing actually works. There is a great interview with the Battlefield Bad Company people pre-release showing off destructible buildings where they go into what it is and what it isn't, and explain the trade-offs they had to make and how it makes the experience immersive.
Normal_gaussian··on No Man's Sky Cosmos
Spore was similarly misleading, yes.
Normal_gaussian··on A/I shuts down
While this is often the case, it is not clear how this group specifically functioned. Theory vs practice is always very interesting in these cases.
Normal_gaussian··on A Stupid Idea for AI Alignment We Came with by Looking at Specification Gaming
Further to 1, most tasks are much harder than dying and are not actually completed by modern LLMs. It is a case of underspecification.

"Who is the fastest person in the UK?" is underspecified. We would typically answer and accept a cursory search of records, but it is possible to see the question as an instruction to measure which would justify conquering the country.

Normal_gaussian··on No Man's Sky Cosmos
Its notable that you dichotomise using the promises of another unreleased game from the same people. Depth was part of the original NMS promise.

Obviously NMS's original marketing was bonkers and capitalised on saying technically true things in ways to mislead large numbers of people.

Normal_gaussian··on AirPods 5
And many of the mics built into good webcams and laptops are superior, so long as you aren't somewhere like a café.
Normal_gaussian··on AirPods 5
> They’ll turn off the moment you take them out on iPhones atleast. This is a small example of how the user experience in the Apple Ecosystem for AirPods has been kind of nuts.

Every 'pod' type headphones I've used do this. It's odd you admit to only knowing Apple, then use it to support Apple being superior.

Normal_gaussian··on A/I shuts down
It should be noted that this is a very sensible thing to say even if you are not stopping; the only case where you cannot say this is if you are carrying on with the same branding, which is typically necessary if you are carrying forwards funds (which have been seized) or brand recognition (which may not be important for a group who focuses on interpersonal relationships).
Normal_gaussian··on A/I shuts down
I wasn't aware of this group; https://en.wikipedia.org/wiki/Autistici/Inventati is their wiki article, but it is a little light on details.

Some of the claims are interesting - "Decision making in the group takes places collectively instead of through majority voting." - isn't explained by the sourced article.

Normal_gaussian··on Show HN: OwnTime – a chess clock for your day's priorities
This is a great (and tight) execution of a neat concept. I'm not in the garden of Apple so unfortunately I can't play with it, but the preview is thorough. I particularly like the voice integration. I sympathise with some of the time allocation issues you mention, particularly when it comes to important but not urgent things.

Relatedly - I've struggled a lot in the last year with time tracking for fixed price projects (not so important, but useful) and billable hours (very important) largely due to the amount of parallelism I now do; and I think this notion of a "chess clock" may unblock me on building my own tracker for this!

Normal_gaussian··on My local model setup on an M4 Pro Mac Mini

    $0 per-token bill
You still have electricity and capital investment. Envelope math suggests cheap electricity is costing you something like $0.50/mtok and the opportunity cost on the capital tied up and lost in the unit purchase and resale is going to cost you something like $2/mtok at 100% utilization (so, frontier model prices or higher at real utilization), and you don't benefit from any elasticity.

Hosted GLM 5.3 flash is like $0.15/mtok in $0.50/mtok out

Normal_gaussian··on Dyson CameraJet electric toothbrush
Unfortunately $500 isn't much on the scale of dental care if it actually works.
Normal_gaussian··on GitHub Outage Tracker: Is GitHub Cooked?
Actions aren't secondary to most paid GH users; and if they are down it usually means no deployments and no tests, which can often halt work.
Page 1 of 34Next →