HNHacker News
TopNewBestAskShowJobs

avg_dev

1,405 karma · joined October 28, 2016

submissionscomments
avg_dev··on How I Made a Heap Overflow in Curl
i really feel that the first sentence in that quote is an apt way to sum up a part of how learning and attention work for us as humans.

personally i've spent some time thinking about how in my life it is very easy for me to pay attention as hard as i can manage and still miss so many things. i feel like things like code review are a great way to work on this sort of thing (attention training, global and contextual awareness, etc.). for example, there is this place that i've been walking by regularly for a couple of years and someone maintains a nice flowerbed there and i pause to take a glance at it and have been doing so for about a year since i first noticed it. but a couple months ago i noticed that there is a companion flowerbed a few feet away that i just had never noticed because i was so focused on the first one. was that companion flowerbed there all along? i suspect that it was! but i have no idea because i didn't even know it existed.

i have tried to extrapolate this to knowledge across humanity in general. i suspect sometimes it takes just one person to notice something, to make an observation that informs their behavior, and it begins to disseminate to us all. sometimes it takes several tries and a long time to happen. and i wonder how much low-hanging fruit there is out there that just none of us have noticed yet. and i think about how integrating a simple, fundamental set of best practices already established by others who have been paying attention can improve the low-bar for us all.

i think that julia evans touched on this in https://jvns.ca/blog/2023/10/06/new-talk--making-hard-things... which was discussed here recently and so did dan luu in his https://danluu.com/p95-skill/ which has also been discussed here somewhere.

and, to conclude, i too have a lot of gratitude for stenberg and all the folks who've worked on curl, and many other parts of our internet infrastructure that i usually take for granted every day.

avg_dev··on Engineered material can reconnect severed nerves
Thanks to both of you for the amazing descriptions. And continued good luck.
avg_dev··on Engineered material can reconnect severed nerves
Very clear mental image there. Thanks for phrasing it that way.
avg_dev··on Making Hard Things Easy
a part of me agrees with the aim of what you say: why not start afresh with something that is less prone to accidents? and i do agree with that idea. but i think it is also somewhat impractical to ignore that pretty much every server i've ever interacted with has a default, vanilla, bash installed, and if i know how to use that, it helps me get by.

not to say we can't and shouldn't try to do better.

avg_dev··on Making Hard Things Easy
that was fantastic. i didn't watch the talk, i opened up the transcript and thought to myself i would read a few slides and see if i enjoyed it. that was maybe 20-30 mins ago and i finished it all. really well done, i enjoyed it from start to finish.

i like the way she broke it down. i feel like the author addressed ways to learn and communicate effectively and also grounded it in very concrete terms. i don't want to get too much into psychology or anything which i really am not qualified to talk about but i feel like going through these types of ways of learning and communicating is a continued exercise in ego deflation and in pragmatic problem solving.

i liked the SQL order-of-query-operations thing, the bash and shellcheck thoughts (i will use `-o all` from now on), i am curious to play with the DNS tool (the article links to https://messwithdns.com/ but the actual URL - taken from the text - is https://messwithdns.net/ , FYI), and i enjoyed the part about HTTP (i was hoping she would talk about SPDY and whatnot, i have not even begun to explore such things and am curious what that is all about).

i am going to read the two posts linked the behind-the-scenes on "hello, world".

thanks for the link!

edit: two things this made me think of:

1. the XKCD comic "ten thousand": https://xkcd.com/1053/

2. Mark Russinovich on git: https://twitter.com/markrussinovich/status/15784512452490526...

avg_dev··on Ron Patrick's Street-Legal Jet Powered Volkswagen Beetle (2006)
I see

> I don't know how fast the car will go and probably never will. The car was built to thrill me, not kill me. That doesn't stop me from the occasional blast on the highway though.

but I am unsure if that means he has never driven it using the jet engine, or whether the engine even will power the car or just kinda runs on its own. I'm curious to see it go at all under jet engine power.

Edit: maybe this is it https://www.youtube.com/watch?v=R-ipYAl3o40

avg_dev··on Ron Patrick's Street-Legal Jet Powered Volkswagen Beetle (2006)
nice... does anyone remember a K Car with a supercar engine? that was not quite as crazy as this one, no jet engine, but it was nice. i can't seem to find it but i remember reading about this "sleeper car".
avg_dev··on Bing ChatGPT image jailbreak
i love it
avg_dev··on Compile-time safety for enumerations in Go
i appreciate this counter-example; thanks. i was hoping there was a way to get real enums in go.
avg_dev··on What was behind Microsoft's layoffs of over 20k people in the last year?
I don't know, for me, the link posted here seems to be a tweet thread, and each post in the thread shows a screenshot of some of the post.
avg_dev··on Chrome: Heap buffer overflow in WebP
I guess my thinking was based off of this:

> Each entry contains (nbits, value) where `nbits` is # bits to be consumed and `value` is normally a symbol, but if `nbits` exceeds N `value` is interpreted as a table index and `nbits` is reinterpreted as the longest code length in that subtree. So each subsequent table should have `2^(nbits - N)` entries (the root table is always fixed to 2^N entries).

Given that, wouldn't it be only natural to construct a test where nbits exceeds N, so that you exercise the code where `value` was being interpreted as an index, and `nbits` as the longest code length in that subtree?

Hmm, I guess that this could have been done and perhaps was done (I took a quick glance at the code and didn't really grok it in a couple mins), and the issue would be that even if you did do what I suggest, you would likely not exceed the maximum fixed size with your crafted test, and thus not catch the bug.

avg_dev··on Chrome: Heap buffer overflow in WebP
Thanks for your explanation.

I’m not a C programmer over the past decade+ and was never very good at it anyway. But I was thinking, based on your description, I agree that a bounds check would have caught the issue, but I’m also curious if an automated test could have been constructed to catch this sort of thing. I personally work with code where you could factor out some calculations to their own function and test them in isolation. Perhaps that would be tough to do here because of performance; I am really not sure.

avg_dev··on I wired up my bike's GPS to order me pizza during a gravel race
Really interesting. I wouldn’t have conceived of this. But it only makes sense.
avg_dev··on Leaked Google pay data shows how much employees report making
Often people take what’s offered, whether it is a fair deal or not. Everybody isn’t out there negotiating their best possible rate all the time. Corporations have long taken advantage of whomever they can to earn a buck - it’s a time honored “tradition”.
avg_dev··on I wired up my bike's GPS to order me pizza during a gravel race
i cannot tell you how much i enjoyed this article. it was very funny. it had so many great elements. a fun tech problem, pizza, getting me to look up what “s-tier” meant, a dash of humor (as if the premise wasn’t already hilarious), the mea culpa at the end and the ideas as to what the bug was (his theory sounds plausible to me, but idk).
avg_dev··on Did you know Git was originally created in 10 days?
Well, this is too is pretty clearly highlighted in the article... I mean it doesn't really matter too much, but

> He aimed to create a tool that was:

> Distributed: [...]

> Compatible: The new tool would incorporate as many features and workflows as BitKeeper.

> Secure: [...]

and there is another quote from Linus Torvalds contained in the article:

> 'Well, it was obviously designed for our workflow, so that is part of it. I’ve already mentioned the whole “distributed” part many times, but it bears repeating. But it was also designed to be efficient enough for a biggish project like Linux, and it was designed to do things that people considered “hard” before git – because those are the things I do every day.'

avg_dev··on Did you know Git was originally created in 10 days?
i enjoyed your article; thanks. one small note: I think when you say

> (queue heart attack)!

you actually mean to say

> (cue heart attack)!

avg_dev··on Did you know Git was originally created in 10 days?
well, this quote from Linus Torvalds is in the article:

> "So I’d like to stress that while it really came together in just about ten days or so (at which point I did my first kernel commit using git), it wasn’t like it was some kind of mad dash of coding. The actual amount of that early code is actually fairly small, it all depended on getting the basic ideas right. And that I had been mulling over for a while before the whole project started. I’d seen the problems others had. I’d seen what I wanted to avoid doing."

avg_dev··on Did you know Git was originally created in 10 days?
heh, i browsed the tag history on github to see if i could track it down, but github gave me a 500 error on this link: https://github.com/git/git/releases/tag/v0.99
avg_dev··on Did you know Git was originally created in 10 days?
i have used cvs, subversion, and git, and to a much lesser extent, darcs and hg. i would have to agree with both the article that this (d)vcs is a breath of fresh air compared to cvs and svn and also with your post and this tweet https://twitter.com/markrussinovich/status/15784512452490526... .

i believe that i notice some nice changes have been coming to git over the years. and i believe i'm largely comfortable with the toolset it offers and occasionally i advance my knowledge of it. i mostly use: git diff, git status, git commit, git rebase, git pull, git log, occasionally git merge or once in a rare while git reflog or whatever else comes up when i try to look up "how do i get back commits from a stash i popped and then checked out" (losing the changes within the stash). i actually did that again the other day and i think i may have tried git reflog and git fsck for the first time on my Windows Subsystem Linux Ubuntu machine (no idea if that is relevant) and i could not find my lost stash at all, and just ended up recreating the changes.

git is nice in the distributed sense, it is fast for my use, git lfs has been quite a pain for me in the past (but maybe it has improved). but i do find the commands quite arcane and it was very hard for me to get used to it. i am all in now and i appreciate the ux changes the project has made (and likely will make) over the years - the git command output often seems to give a short education message about what command to execute in replacement of some arcane thing i've been using for some years and there are often good blog posts describing how to use new commands, but i spent a lot of time figuring out what the hell i was doing that it would be nice if i could have spent another way.

avg_dev··on Four Lectures on Standard ML (1989) [pdf]
i took that course. it was a whole lot of fun. i still have yet to take parts B and C.
avg_dev··on Rockstar is selling cracked game copies on Steam
man that is absolutely brutal
avg_dev··on On Craft
i remember my third year of coding as a pro, i had just taken a job in palo alto and was settling in after moving. i was at my new job and a bunch of the coders at the company i was working at went out for lunch and i was getting to know them.

one guy who was younger than i was was talking about how he had a degree from a liberal arts college, and had just been coding on his own for a while, and that when he moved out there for work and was interacting with other coders in real-life for the first time (previously it had been only over the internet) he was learning how to pronounce the names of various daemons, libraries, projects, etc., and that he had understood the pronunciations differently when he was physically on his own. in my head i silently said to myself, "this guy is a junior coder and won't amount to too much" and made a note to try to associate with some of the heavy hitters to try and boost my career and status (and i guess if i'm being charitable to myself, also to learn).

that guy left the company maybe a year later. the company he went to, i think he started as a dev, later became CTO, and eventually CEO. while he was CEO, the company sold for over a billion dollars. and even when we were still working together, i did learn quite a few things from him. so yeah, i think it is easy for people to pigeonhole others, or to think that they are in a place of skill that others perhaps can't easily get to, but sometimes that kind of thinking is quite wrong. (also, at his new company he wrote some great blog posts on software development and operations practices that i really enjoyed and learned quite a bit from)

avg_dev··on The WordPress 100 Year Plan
That is really great context. I appreciate you taking the time to help me understand this all.

I'm going to bookmark your post so I have it now. This is all interesting and exciting to think about, and it makes me think of "Should I perhaps set up another VPS?" and "Should I look into becoming a website builder using some of these tools?" or maybe "Should I learn about the WP plugin ecosystem and consider becoming a plugin developer?" and many more. I do know from past experience though that going down any of these routes could turn into something that is quite time intensive and quite likely would not yield immediate results (and my time is, at the moment, mostly spoken for, and I have a full-time job). Still, it is definitely something I am thinking about, and I guess another thought that came about after reading your post was: "Wouldn't it be cool if there was a low-or-no-cost (low-cost most likely) way for non-tech-people to self-host things?" A sort of community anti-cloud VPS thing. Maybe run by some devops folks for very cheap, with the option of providing support and resiliency features at some cost. You just made me think: The idea of a small business or restaurant needing a low-touch website with the capability to self-update it is of course a very good one that makes total sense. And taking it a step further, wouldn't it be neat if stores could run their own online shopping sites without the need to pay someone like Shopify the large amount they do, and if restaurants could run their own delivery logistics without restoring to DoorDash, Uber Eats, or Skip the dishes? I guess I lean to the free open-source direction and envision a tech community that could keep wiki docs on how to self-host these things and the folks who ran them could update the docs as needed, and write code as needed, and so on. I don't know if what I'm saying is at all realistic; I just like a few things you have said, like Vanilla WP being one of the best things to happen to the web; I am guessing it just gives so many people the ability to have a nice website... I think it's a nice avenue of exploration and I am getting fed up with the centralization of all things web.

avg_dev··on The WordPress 100 Year Plan
Thanks. This is quite helpful context. (As for myself I used to write quite a bit of PHP; haven't touched it in some time but I'm rather fond of the language. I don't know anything about React, I think I built a tic tac toe tutorial once. I like the idea of htmx but mostly I do back-end development these days.)

Just one question as an aside: Would you recommend self-hosting WP these days?

I am curious about the market and who buys license for the theme builders also, but only if you would care to write about that.

avg_dev··on The WordPress 100 Year Plan
Hi, can you perhaps explain what Gutenberg, Divi, Elementor, Aveda, and Salient do?

Just a curious party without much knowledge. I hosted WP on a VPS maybe a decade ago. I wasn’t very skilled with it but my friends needed a site. I forgot about it for a while and I guess it wasn’t at the time evergreen/self-updating and eventually it was used to send a lot of spam emails somehow. That’s about the extent of my knowledge of WP. I tried building a simple static site generator once on that same VPS where you could have HTML page headers and footers and page content templates, and it worked fine for me, but I tried to get a non-tech user to use it and they could not, and were ecstatic after I finally suggested that they try WP.com - they loved it.

avg_dev··on Screen Apnea
i remember that article from may (linda stone from this NYT article wrote that blog post). it really made sense to me then and it does now. i used to smoke 25+ cigarettes a day and i believe it was not uncommon for me to have a heart rate of 115+bpm while sitting around doing nothing after smoking a cigarette. i also have been mostly working from home for a decade or more and i barely moved for many of those years. i started getting into yoga a while back and learned a breathing technique called ujjayi. i also started going on a lot of long walks. and since 2018 i've been playing a wind instrument again. i quit smoking some time ago as well. my breath is so much deeper and my general health - physical and mental - is so much better than it used to be. i actually just did a deep inhale recalling how things were for me and reflecting on how much better they are for me now.

i'm curious if anyone has any experience with that butyeko thing in particular...

avg_dev··on Ask HN: Where do I find good code to read?
This is an interesting article on the subject of reading code by the coder and writer Peter Seibel (he also wrote a nice book called Coders at Work with interviews with some programmers who have worked on interesting and widely used software): https://gigamonkeys.com/code-reading/

I’m sure I’ve seen some HN posts about this article, but I can’t remember the content of such.

avg_dev··on SeaGlass: City-Wide IMSI-Catcher Detection (2017)
beautiful image at the top of the page. I realize that it is a map, meant to convey some information. but I just like it
avg_dev··on Modern Computer Architecture and Organization - Second Edition (2022)
I managed to get my hands on a really old version of this book (maybe 20 yrs old - no ARM I don't think). Do you think that is still good? Or should I just get the new one?
← PreviousPage 5 of 15Next →