Hacker News Reader

acidbaseextracton The modern packager’s security nightmare

The most frustrating thing is that pip doesn't make it easy to use more loose declared dependencies while freezing to actual concrete dependencies for deployment. Everybody rolls their own.

> Python libraries should not pin dependencies. _Applications_ can pin dependencies, including all recursive dependencies of their libraries.

Is the pypi package awscli an application or a library?

poetry is frustrating in that it doesn't allow you to override a library's declared requirements to break conflicts. They refuse to add support [1][2] for the feature too. awscli for example causes huge package conflict issues that make poetry unusable. It's almost impossible not to run into a requirement conflict with awscli if you're using a broad set of packages, even though awscli will operate happily with a more broad set of requirements than it declares.

[1] https://github.com/python-poetry/poetry/issues/697

[2] https://github.com/python-poetry/poetry/issues/697#issuecomm...

acidbaseextracton The modern packager’s security nightmare

It's maddening to hear people say things like, "Oh if everyone just used semantic versioning this wouldn't be a problem". Of course this cannot work. _Think about it_. There are innumerable ways two pieces of code can be incompatible. ... If you call these things "breaking" changes, you will constantly be increasing the major version.

One of the things that prompted the OP was this breakage in Python's cryptography package [1] (OP actually opened this issue) due to the introduction of a Rust dependency in a 0.0.x release. The dependency change didn't change the public API at all, but did still cause plenty of issues downstream. It's a great question on the topic of semver to think about how to handle major dependency changes that aren't API changes. Personally, I would have preferred a new major release, but that's exactly your point syllogism — it's a matter of opinion.

As a sidenote, Alex Gaynor, one of the cryptography package maintainers is on a memory-safe language crusade. Interesting to see how that crusade runs into conflict with the anti-static linking crusade that distro packagers are on. I find both goals admirable from a security perspective. This stuff is hard.

[1] https://github.com/pyca/cryptography/issues/5771

acidbaseextracton Why SELECT * is bad for SQL performance (2020)

I mean, 90% of my application is simple things. I mostly use the Django ORM and even more complicated joins, grouping and subqueries are predictable. I'm curious what ORM people are using that obscures the queries that are being emitted so much. For the 10% where things are complicated I will happily write SQL.

I wouldn't say the ORM is "for prototypes/pocs", but rather it should be the default and raw SQL is "complicated stuff only".

acidbaseextracton We Test PCIe 4.0 Storage: The AnandTech 2021 SSD Benchmark Suite

Love it, thank you — the article already had my upvote! In particular SLC cache-aware tests and the inclusion of latency information (both average and 99th percentile) were both heartening to see. Too much crappy storage benchmarking these days.

Looking forward to seeing what you pick in terms of application benchmarks. I think application benchmarks help to keep us honest in terms of real-world impact of storage upgrades. LTT seeing if people could tell the difference between SATA and NVMe for games was great. I'm interested in database workloads, and the reason I was asking about the SN850 is that in Postgres benchmarks I've seen it has smoked the 980 Pro.

acidbaseextracton We Test PCIe 4.0 Storage: The AnandTech 2021 SSD Benchmark Suite

Good benchmark suite, but missing two big PCIe 4 SSD contenders: the WD Black SN850 and the Sabrent Rocket 4 Plus!

acidbaseextracton Chipmaking Is Being Redesigned

Of course, and I agree that marketing traction matters. I should have said this is an idle hope that some of these fancier metrics get published/leaked about TSMC/Samsung/Intel processes rather than that they become the metric. I do think MT/mm^2 or whatever is a strong candidate to become the thing. "megatransistors" is an exciting word.

acidbaseextracton Chipmaking Is Being Redesigned

A nice approach I'm hoping will gain traction when discussing density across different types of logic is the "LMC" metric, as put forward by some TSMC and Stanford folks: https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9063714

Improved semiconductor device density directly translates into benefits for more advanced computing systems— the primary driver for progress in semiconductor technology. Thus, we propose the use of the following three-part number as a metric to gauge advancement of future semiconductor technologies: [DL, DM , DC ], where DL is the density of logic transistors (in #/mm2), DM is the bit density of main memory (currently the off-chip DRAM density, in #/mm2), and DC is the density of connections between the main memory and logic (in #/mm2). As an example, today’s leading edge technologies that are published in the literature [15]–[17] can be characterized by [38M, 383M, 12K]. As another example, 3-D stacking of multiple logic and memory dies can increase DL, DM, and DC .

acidbaseextracton The first blue pigment discovered in 200 years is now commercially available

https://en.wikipedia.org/wiki/Dimethylmercury

"Heh" is an obnoxious response, as if an organic chemistry class wouldn't teach the basics of organometallics and some of the things that make compounds more or less dangerous.

acidbaseextracton Ryzen 5800X vs. M1: Programming benchmarks

I would highly recommend Emery Berger's talks [1] for anyone interested in benchmarking software. The alignment and code layout in memory that huayra mentions has shockingly large performance implications.

[1] https://www.youtube.com/watch?v=r-TLSBdHe1A

acidbaseextracton React's UseRef Deep Dive

I've spent a lot of time in higher-order component and render prop hell — so many layers of indirection. The declarative behavior that HOCs and render props enable is one of the best parts of React, used in libraries like react-motion. But man, debugging layers of render props makes me itch.

Hooks have been a savior for me. I agree that there are a lot of sharp edges with hooks, but they're not magic. They're powerful and they compose really well. If you're doing anything behaviorally complicated on a React app, it's easy to build whatever abstraction is appropriate to your project.

acidbaseextracton REST vs. GraphQL – A search for evidence on which is better

> Have you used a web browser? Do you see how it handles known content types from a new website that you haven't previously visited seamlessly without you reading docs and telling it what to do with it?

I want to get my job done with an API, not browse it. I spend most of my time figuring out what order endpoints need to be called in and what data they need to be passed, not what the endpoints are.

The shittiest HTTP APIs I've used had full lists of endpoints but nonexistent documentation of arguments. If HATEOAS solves that I can get behind it, but I don't think it does.

acidbaseextracton Johnny.Decimal

Protip for people that spend a lot of time on Github: press the letter "t" when browsing a project to fuzzy find on filenames like fzf in Github.

acidbaseextracton Smash Training Retrospective

I think your self diagnosis is on point. Where games fit into your life is hard to address within a world of background judgemental thinking and self-criticism. It might be easier to focus on cultivating more self-compassion first, then reexamine your questions above.

I'm not affiliated, but check out the HealthyGamerGG channel on Youtube. He's a Harvard psychiatrist does interviews/counseling streams on twitch that are pretty cool, and deal with a lot of millenial/zoomer gamer mental health issues. Here's one that spoke to me about failure and expectations: https://youtu.be/hzkgIOzBP7w

acidbaseextracton Smash Training Retrospective

Highly recommend this book as well. The psychology he discusses I've found very relevant to life in general. Often I've wished something in my life was better and found self-imposed handicaps or my true goals differing from my stated goals (eg. really wanting esteem from peers even though business success is my stated goal) being the source of my difficulty. Exactly the "scrub mentality" Sirlin discusses in PtW: http://www.sirlin.net/ptw-book/introducingthe-scrub

acidbaseextracton Why not use GraphQL?

No. The server can inspect its GraphQL schema (what the frontend will be querying against) and emit Typescript types to type check against. If someone changes a field name on the backend, type checking the frontend will fail in all the places that expected the original name. No grepping around and chasing chains of passed data.

acidbaseextracton Why not use GraphQL?

But the entities, names, dates, and photo URLs in my database are exactly what I want to show on the frontend, by and large. Maybe a join, aggregation, or something in there.

acidbaseextracton Tobias Lutke still writes code for Shopify

Spotify != Shopify

acidbaseextracton AMD Zen 3 Ryzen Deep Dive Review

It was very model specific. 5950Xs and 5900Xs were gone within a few seconds, 5800Xs were up for a few minutes, and 5600Xs were available for almost an hour in some cases.

This aligns with reports of retailer inventory, where availability of high end models was extremely limited, but there were many more of the mid-tier models.

acidbaseextracton New study finds psilocybin greatly and quickly relieves depression

Eh... enjoyable is subjective. At subrecreational, subanesthetic doses, it can make you feel really fucking weird. It's not bad, and it's certainly survivable given that you're dissociated from it — but it makes me feel really weird.

As to monoideism's question: I'm not a doctor, but ketamine is more benign than many other anesthetics especially at the lower doses used in treating depression. Do your homework, but don't rule it out based upon prior experiences with other anesthetics.

acidbaseextracton New study finds psilocybin greatly and quickly relieves depression

I've struggled in past with major depression as well, and had a similar experience with ketamine. Though I had to resolve the life situations that contributed to the depression, ketamine lifted my existential apathy enough to help me get it done.

acidbaseextracton Apple announces ‘One More Thing’ event for November 10th

Cool — one of the major blockers on moving to Linux for me was fractional scaling support. I have 4K monitors but can't use them with tiny text.

I like PopOS a lot, but they didn't have fractional scaling support. It looks like they do now as of Oct 5!

acidbaseextracton Show HN: Csql – Python lib for composeable SQL queries

If you're an analyst, I second the recommendation for dbt. Here's a podcast interview with the CEO of the company behind dbt that explains a lot of the philosophy, and I think will help you even if you don't end up using dbt: https://softwareengineeringdaily.com/2020/03/09/dbt-data-bui...

acidbaseextracton Most companies developing AI capabilities have yet to gain significant benefits

Check out https://github.com/metabase/metabase . I'm not clear on their open source vs paid model, but I'm pretty sure you can host it yourself and their core is open source.

acidbaseextracton Applying “make invalid states unrepresentable”

There's a library: https://sumtypes.readthedocs.io/en/latest/

It's serviceable, and even does static checking of total coverage of cases. I will say that it makes linters freak out.

acidbaseextracton Applying “make invalid states unrepresentable”

The representational debt the parent comment is referring to is akin to that quip, "if I had more time, I would have written a shorter letter."

I find that both types of representational debt are common.

acidbaseextracton What is the best dumb TV?

The one recommended in the article via Amazon is the model U518CV-UM while that one at Walmart is the model U515CV-U. No idea what the difference is.

acidbaseextracton Why is Snowflake so Valuable?

Not at all. I'd highly recommend CMU's 15-445/645 Intro to Database Systems course (sponsored by Snowflake lol) because they put all their lectures online on YouTube [1]! Here's what's involved in making fast databases from the syllabus [2]:

This course is on the design and implementation of database management systems. Topics include data models (relational, document, key/value), storage models (n-ary, decomposition), query languages (SQL, stored procedures), storage architectures (heaps, log-structured), indexing (order preserving trees, hash tables), transaction processing (ACID, concurrency control), recovery (logging, checkpoints), query processing (joins, sorting, aggregation, optimization), and parallel architectures (multi-core, distributed). Case studies on open-source and commercial database systems are used to illustrate these techniques and trade-offs. The course is appropriate for students that are prepared to flex their strong systems programming skills.

[1] https://www.youtube.com/playlist?list=PLSE8ODhjZXjbohkNBWQs_...

[2] https://15445.courses.cs.cmu.edu/fall2020/syllabus.html

acidbaseextracton Rust 2021: GUI

I came to HN for the lisp fanboy culture when it washed out of reddit, and stayed for the great moderation.

acidbaseextracton Bleeding-edge tech will kill your startup

I had my first startup fail in the late 2000s because we built a sales prediction software that sounded cool, but nobody actually wanted. We even had a large paid pilot with a major auto manufacturer, but they didn't renew when it turned out that none of their employees had actually used the software.

Making something nobody wants is a classic startup mistake. I resolved not to make it again and read a great deal about market validation and building products.

I have one recommendation for those reading this thread: Steve Blank's "Four Steps to the Epiphany". It contrasts Product Development (focusing on a product with no customers) vs Customer Development (focusing on customer problems and building software around those). Honestly you don't even need the whole book, there's a PDF with the first couple chapters floating around [1]. I had a bunch of "holy shit, that's exactly what I did wrong" moments while reading it.

Eric Ries' "Lean Startup" is also an excellent book on this topic.

[1] http://web.stanford.edu/group/e145/cgi-bin/winter/drupal/upl...

acidbaseextracton A Time Leap Challenge for Sat Solving

I really wish that book was a little cheaper. It looks really interesting and I've had my eye on it for months, but there aren't really any used copies of it floating around to bring down the price.