bananapub

> April 28, 2026

> GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable

> Upgrade to GHES version 3.19.3 or later

https://docs.github.com/en/enterprise-server@3.19/admin/rele... :

> Enterprise Server 3.19.3 - March 10, 2026

88% of on-prem customers haven't applied a critical security fix from 7 weeks ago, that seems ... bad.

I'm asking about the infrastructure, obviously they chose for some reason to make my computer fans turn on to show some red and green lines on a text file.

> Git is pretty simple internally, and its ui is just knobs and levers to reach into that simple reliable internal structure.

that's not true either. originally it was simple internally - it was mostly shell scripts! writing text files! - but now it has all sorts of complicated optimisations.

the "middle" is somewhat simple for CS people, though - a graph of commits, you can put labels on them, you can send and receive strict appends to the graph to another repository. both the stuff under and above that is quite complicated in practice, but the UI does continue to improve - e.g. editing a past commit message until the release last week was ... complicated.

anyone who's actually worked there, could you explain why they're finding scalability and reliability so hard? naively it seems like 'repo groups', ie clusters of repositories linked by being mutual forks, would be fairly isolated for the whole git storage layer, and everything else feels pretty easily parallelisable (issues, actions, etc, modulo taking locks now and then to submit results or whatever). and given that, surely you can incrementally deploy changes across those many shards to avoid most big outages?

are there big conceptual serialisations that I've missed? is it just not well factored? was the move to Azure just a catastrophically bad idea? some other thing?

github added support for this in the last six hours - https://github.github.com/gh-stack/faq/#will-this-work-with-...

raph wrote about that already: https://raphlinus.github.io/rust/gui/2022/07/15/next-dozen-g...

why did you make it so complicated? magit has a `magit-wip-mode` that just silently creates refs in git intermittently so you can just use the reflog to get things back.

would diffusion models benefit from things like Cerebras hardware?

of course not, but it can often give a plausible answer, and it's possible that answer will actually happen to be correct - not because it did any - or is capable of any - introspection, but because it's token outputs in response to the question might semi-coincidentally be a token input that changes the future outputs in the same way.

> Do you get updates to the proprietary software stack if you go without a subscription license?

what proprietary software stack? they just publish it all on https://github.com/oxidecomputer/ .

it's simpler than that - making it faster means it becomes less of an asynchronous task.

current speeds are "ask it to do a thing and then you the human need find something else to do for minutes (or more!) while it works". at a certain point at it being faster you just sit there and tell it to do a thing and it does and you just constantly work on the one thing.

cerebras is just about fast enough for that already, with the downside of being more expensive and worse at coding than claude code.

it feels like absolute magic to use though.

so, depends how you price your own context switches, really.

which won't be surprising if you think about a little bit - 8.8.0/24 is anycasted, which just means that multiple independent locations around the world announce the IP range, so that your requests broadly go to a nearby instance of it. that's great for your inbound requests, but if it originated it's own DNS queries from that IP, then the replies would also get attracted to whatever instance of 8.8.8.0/24 is near the authoritative DNS server it just queried, not the instance of 8.8.8.0/24 that sent them.

also, even aside from that, having some large fraction of the entire world's DNS requests coming from one IP address would trigger everyone's anti-DOS filters and probably lead to some extremely funny router catastrophes as all traffic hashes to one bucket or whatever.

yes, OPs one has strictly less listings (diskprices.com does multiple countries).

why would you look at the "front page" if you only wanted to see things you subscribed to? that's what the "latest" and whatever the other one is for.

they have definitely made reddit far worse in lots of ways, but not this one.

> I have ADHD. I think.

then think about talking to a medical professional, and a therapist, and coming up with your own coping strategies.

> How do you manage the constant stream of thoughts and ideas?

take notes of ideas and come back to them later when you have time.

yes

Someone should IARC the internal one.

anything critical of the US regime is almost immediately flagged and downvoted.

it's uh pretty confronting!

yes, obviously?

anyone who is doing serious enough engineering that they have the rule of "one human writes, one human reviews" wants two humans to actually put careful thought in to a thing, and only one of them is deeply incentivised to just commit the code.

your suggestion means less review and worse incentives.

just another happy customer, from so long ago I can't find my signup email anymore. very glad there are still companies who just do a thing well without trying to tie me up with them further or cross-sell or sell themselves or make the product worse.

keep up the good work!

if you want anything other than "switch to another full terminal window, no splits, no status bar" then you want tmux or screen or zellij - this tool and the others like it are explicitly avoiding becoming (nested) terminal emulators like tmux and screen and zellij.

at least I think it would be possible to do "switch to another full terminal window, no splits, no status bar" without being a terminal emulator, I haven't tried.

for those looking for a simple and reliable self hosted S3 thing, check out Garage . it's much simpler - no web ui, no fancy RS coding, no VC-backed AI company, just some french nerds making a very solid tool.

fwiw while they do produce Docker containers for it, it's also extremely simple to run without that - it's a single binary and running it with systemd is unsurprisingly simple[1].

0: https://garagehq.deuxfleurs.fr/

1: https://garagehq.deuxfleurs.fr/documentation/cookbook/system...

it's not interesting at all - the comment is very stupid (jacobin is not "whole journal on literal communism") as well as such lazy both-sidesism everyone is dumber for having read it.

there's lots of stupid brigading on HN, but sometimes dumb comments get the downvotes they deserve.

you should care, he and his fellow nutters have siezed control of the USA and most tech-mega-corp leadership either agree with them or will go along with them.

a perhaps non-obvious option is to CNAME (or NS) the `_acme_challenge` record from your main zone to another zone you can control better and can't affect production traffic the same way the main zone could. `acme-dns` is a neat little tool for exactly this, that has an https api for your ACME client to request a cert from, and a dns server to respond to dns-01 challenges from your provider.

regular reminder: kagi is - above all else - a really really good search engine, and if google/etc, or even just the increasingly horrific ads-ocracy make you sad, you should definitely give it a go - the trial is here: https://kagi.com/pricing

if you like it, it's only $10/month, which I regrettably spend on coffee some days.

since this post has been immediately brigaded by far right lunatics, it's worth clarifying these people have resigned based on a far right wing pressure campaign over the way a trump speech was presented, in a third-party-produced current affairs show, that was broadcast last year.

this[0] article by the BBC covers the details of that fine. here's the meat of it, for the extremely lazy:

> In his speech in Washington DC on 6 January 2021, Trump said: "We're going to walk down to the Capitol, and we're going to cheer on our brave senators and congressmen and women."

> However, in Panorama's edit, he was shown saying: "We're going to walk down to the Capitol... and I'll be there with you. And we fight. We fight like hell."

> The two sections of the speech that were edited together were more than 50 minutes apart.

> The "fight like hell" comment was taken from a section where President Trump discussed how "corrupt" US elections were. In total, he used the words "fight" or "fighting" 20 times in the speech.

> After showing the president speaking, the programme played footage of flag-waving men marching on the Capitol, the Telegraph said.

> According to the leaked memo, this "created the impression President Trump's supporters had taken up his 'call to arms'". But that footage was in fact shot before the president had started speaking.

it is worth considering the bar that is being demanded here, and how every single other news source in the world would compare against that bar.

the reason this is in the news now is that someone "leaked" an internal memo from the BBC that discussed the show. the claim is that it was fundamentally unfair to suggest that trump was encouraging these people. since that day he has:

- explicitly claimed he supported them and what they did [1]

- given federal pardons to ~all of them, including ones who had commited previous crimes and then after being pardoned committed further crimes [2]

0: https://www.bbc.co.uk/news/articles/ckgzkyk7knzo

1: https://apnews.com/article/trump-jan-6-evolution-downplay-vi...

2: https://www.bbc.co.uk/news/articles/cjw4vjvlgxpo

you want to be using something like opencode in a terminal, not the web ui.

you’ll need to try it and see what the speed does to your workflow.

it's not weird at all - you need something sensible to run complicated things while bootstrapping the compiler. Rust does the same thing: https://rustc-dev-guide.rust-lang.org/building/how-to-build-...