billyhoffman

I run gemi.dev, so it was nice to see it here.

I recently built a Gemini client for people who like GUI's more than TUI's, and want a native macOS app

https://github.com/acidus99/MajorTom

I mean I'm all for smaller CSS and faster web performance, but comparing the size / information density of the binary data of a 36 year old video game console with the verbose human readable text of a DSL used to control presentation is a bit unfair.

Props to @sleepingNomad here, who has done 16 releases in the last 7 hours, incorporating feedback from HN on the fly!

* Don't like menubar apps? you you can run it as a normal app

* Don't like GUIs? Now you can run it on the command line

Just look at that Changelog:

https://github.com/darrylmorley/whatcable/releases?page=2

Sincere advice: Consider engaging with a community before trying to use it to promote your work.

You account is not even 3 months old. In that time you made 6 submissions, all of them appears to be to your own work. You have only commented 9 times, with almost all of them being comments about your work.

I mean it's cool your created a new CMS and all, but beyond the look of the admin interface and publishing flow, I don't see how this is a "Spirtual Successor" to WordPress at all.

Its a CMS, designed from scratch, for a serverless world. It has a stricter, well defined API that plugins are forced to use instead of directly calling/overriding core functionality like in WP. But that benefit comes with a CMS that's built on top of, and seems to prefer, a ton of CF proprietary capabilities (D1 Databases, R2 for image/media storage, their workers for running things).

The web need less consolidation on CF, not more.

For plugins, no.

1- EmDash plugins are written in TypeScript, not PHP

2- EmDash plugins have a specific permissions model, where they need to explicitly request access to certain things.

3- WordPress plugins just invoke things. EmDash plugins have a defined API you use to talk to different capabilitites

4- Those capabilities are totally different, and at a different abstraction, than what WordPress provides.

Beyond the look of the admin interface and publishing flow, I don't see how this is a "Spirtual Successor" to WordPress at all. Its a CMS, designed from scratch, for a serverless world, using CF proprietary capabilities (D1 Databases, R2 for image/media storage, their workers for running things).

There's a nice graph in this Six Colors article:

https://sixcolors.com/post/2026/03/apple-introduces-colorful...

Single Core performance: the A18 Pro is faster than an M3!

Multi Core performance: The A18 Pro is essentially the same as an M1.

This balance seems right for the target market of a $599 laptop.

For years Apple has been selling an M1 Apple MacBook Air for $649 via Walmart. It was still using the old wedge case design and is literally unchanged from fall of 2020 when it came out. It was the base model with 256 GB storage and 8 GB of RAM model, no upgrade options, no colors.

The price point was designed to get customers who would not pay for a $1000 computer into using a Mac. Sourcing those 2020 era M1 components, screens, etc, let alone M1's, was probably becoming a problem in 2026.

The Macbook Neo is a modern way to meet that price point. The video ad is more instructional about what macOS is, and how it would work with an iphone the customer may already have.

It does very basic Apple Intelligence (they show the photo editing in the video), but this is not for running models locally (they even show the ChatGPT native app and say "runs all your favorite AI apps")

People complaining about the 8 GB limit are missing who the target market is for this machine. Its a Mac, for $599!

Minor suggestion. I found this because the UI looked cool and I wanted to see a more zoomed in view of it. But right now the "Take control of your network today" is the only place with a really readable view of the UI. Perhaps add a gallery of screen shots, showing off different features?

Congratulations on shipping! Looks awesome.

Minor bug: I tried opening the WebP screen shots in another tab so I could zoom and see them more clearly, and it does not work. Chrome renders the WebP image data as text, and Safari prompts you to download it. This appears to be because the web server is not returning a `Content-Type` header for these URLs:

curl --head https://www.netviews.app/_astro/ss7.D8bYvHF6_1awjYx.webp

EDIT: Fixed! I see a Content-Type header now

There are real problems with the Torrent files for collections. They are automatically created when a collection is first created and uploaded, and so they only include the files of the initial upload. For very large collections (100+ GB) it is common for a creator to add/upload files into a collection in batches, but the torrent file is never regenerated, so download with the torrent results in just a small subset of the entire collection.

https://www.reddit.com/r/torrents/comments/vc0v08/question_a...

The solution is to use one of the several IA downloader script on GitHub, which download content via the collection's file list. I don't like directly downloading since I know that is most cost to IA, but torrents really are an option for some collections.

Turns out, there are a lot of 500BG-2TB collections for ROMs/ISOs for video game consoles through the 7th and 8th generation, available on the IA...

I built and run a search engine and a "Wayback Machine" for Gemini:

gemini://kennedy.gemi.dev

There are ~4K hosts and ~1M documents/images/files which make for nice playground with experimenting with crawlers, indexers, and more. Its a nice hobby. Lots of primarily static sites, and CGI is used to add some interactivity:

gemini://gemi.dev/cgi-bin/moon.py

In the early to mid 2000s I would believe this. But for a major e-commerce provider in 2012? That seems vanishing improbable.

PCI DSS is the data security standard required by credit card processors for you to be able to accept credit card payments online. Since version 1.0 came out in 2004, Requirement 4.1 has been there, requiring encrypted connections when transmitting card holder information.

There’s certainly was a time when you had two parts of a commerce website: one site all of the product stuff and catalogs and categories and descriptions which are all served over HTTP (www.shop.com) and then usually an entirely separate domain (secure.shop.com) where are the actual checkout process started that used SSL/TLS. This was due to the overhead of SSL in the early 2000s and the cost of certificates. This largely went away once Intel processors got hardware accelerated instructions for things like AES, certificates became more cost-effective, and then let’s encrypt made it simple.

Occasionally during the 2000s and 2010s you might see HTML form that were served over HTTP and the target was an HTTPS URL but even that was rare simply because it was a lot of work to make it that complex instead of having the checkout button just take you to an entirely different site

> Their response was better than 98% of other companies when it comes to reporting vulnerabilities. Very welcoming and most of all they showed interest and addressed the issues

This was the opposite of a professional response:

* Official communication coming from a Gmail. (Is this even an employee or some random contractor?)

* Asked no clarifying questions

* Gave no timelines for expected fixes, no expectations on when the next communication should be

* No discussion about process to disclose the issues publicly

* Mixing unrelated business discussions within a security discussion. While not an outright offer of a bribe, ANY adjacent comments about creating a business relationship like a sponsorship is wildly inappropriate in this context.

These folks are total clown shoes on the security side, and the efficacy of their "fix", and then their lack of communication, further proves that.

During my last semester at Georgia Tech, I had one remaining 3000-level English credit I needed to graduate. During the last week to register, I quickly found an open class titled "Modern Authors" and signed up.

But when I attended the first day, I learned that Gatech's online registration system had truncated the class title. The full title was "Modern Authors: James Joyce", and I was the only engineering student in a semester long class about James Joyce, which I had to take it and pass in order to graduate.

It was... pretty good actually.

Portrait of an Artist as a Young Man was enjoyable, as were his short stories. His style was unlike anything I had read before and it was musical in a way. However, I found Ulysses impenetrable: It rambled, and was difficult to understand what was even being described in the text, let alone the significance of it. Mostly it was just strange. Thankfully the majority of your grade was based participating in class discussion. Talking about it, seeing how confused everyone else was, and trying to make sense of it all together was a fun way to spend an afternoon in Skiles.

Oh snap! The same group behind last year’s Polyfill.io supply chain attack are back!

Krebs doesn’t mention it but The Register makes the connection;

https://www.theregister.com/2025/05/30/fbi_treasury_funnull_...

I mean there name is literally “Funnull”. They know exactly what they’re doing.

!!!

Message: DISPMORNING. NEED LEO TO MEET THE AC. A PAX WAS INAPPROPRIATELY TOUCHING ANOTHER PAX IN THE ROW INFRONT OF THEM. THE FAS HAVE THE SEAT NUMBER ANDMANIFEST. FYI AND THX

https://infosec.exchange/@acarsdrama/114195325338601167

[edit: Ahh, its a Frontier flight] https://www.jetphotos.com/photo/keyword/N387FR

Beyond just IPs, there is a giant class of "DNS record pointing to X shared cloud resource that organization no longer controls" issues. The bigger the company, the more widespread the problem. These resource names get released back into a common pool that anyone can register.

Think:

* CNAME pointing to an S3 bucket, and the S3 bucket gets released

* CNAME pointing to Azure Website/WebApp Instance

* A record to an non-elastic IP, and the box gets rebooted

* DNS name using a Route53 name server that no longer part of the org's AWS account

* CNAME pointing to a Heroku/Shopify/GitHub pages account and the account gets deleted/deactivated freely up those names for registration

* MX record pointing to old transaction email provider start up that dies, and someone else registers that domain name...

Why does that happen?

* Decentralization of IT means people spinning up infrastructure not knowing what they are doing

* Great a spinning up infra, but when decomissioning they forget about DNS

* Lots of subsidiaries, lots of brands, different groups, operating in different geographies. All this makes it difficult to discover and enforce proper policies

* Geo-specific websites/apps (Think of all the country-specific websites Coke runs)

* Using some 3rd party vendor and never telling security about it (Marketing spinning up some landing pages on some fly-by-night martech provider or wordpress host, and never turning them off)

I am the Field CTO at a venture backed Israeli cyber security company in this space. I was literally talking to a major computer part company yesterday about the dozen or so Indonesian gambling websites that are "running" on their domain names using their pagerank and links. This is a weekly conversation

I'm glad you are having success, but B2C is wildly different than B2B. I can't think of any B2C company that could do calls with customers. The economics don't make sense. Instead they use large advertising buys to communicate, one way, with current and prospective customers

So port knocking, but with also returning junk during the knocking process?

> OpenAI is the fastest growing startup by revenue, ever.

No it's not. Facebook hit $2B in Revenue in late 2010 - early 2011, ~5 years after its founding.

https://dazeinfo.com/2018/11/14/facebook-revenue-and-net-inc...

It started that way but wasn’t been for a while. In fact the last version was a rewrite using native macOS controls and optimized for Apple Silicon. Sad to see it go but heard great things about Rider for c# development.

Licensing. Common Crawl could change the license of how the data it produces is used.

Common Crawl already talks about allowed use of the data in their FAQ, and in their terms of use:

https://commoncrawl.org/terms-of-use/ https://commoncrawl.org/faq

While this doesn't currently discuss AI, they could. This would allow non-AI downstream consumers to not be penalized.

Common Crawl is shown in their screen shot of "Providers" along side OpenAI and Antropic. The challenge is that Common Crawl is used for a lot of things that are not AI training. For example, it's a major source of content for the Wayback machine.

In fact, that's the entire point of the Common Crawl project. Instead of dozens of companies writing and running their (poorly) designed crawlers and hitting everyone's site, Common Crawl runs once and exposes the data in industry standard formats like WARC for other consumers. Their crawler is quite well behaved (exponential backoff, obeys Crawl-Delay, will use SiteMaps.xml to know when to revisit, follows Robots.txt, etc.).

There are significant knock-on effects if CloudFlare starts (literally) gatekeeping content. This feels like a step down the path to a world where the majority of websites use sophisticated security products that gatekeep access to those who pay and those who don't, and that applied whether they are bots or people.

It would be interesting to get better SaaS metrics, specifically on customer churn. I can't find that in the linked document. They are growing, but how much of that marketing spend is needed for growth vs just maintaining the customer base?

I don't know what the customer makeup of Squarespace is. It could be that by volume their typical customers are business that fail a lot, or have a high amount of churn (think sole proprietorships, businesses with 1 - 10 employees without in house tech experience, or part-time/side businesses like Etsy or Instagram stores). Depending on the makeup, a significant amount of this marketing could be required just to maintain a constant customer base.

The game port was amazing. You got 4 ADCs (for the X axis and Y axis of a joystick, 2 joysticks supported) and you got 4 GPIO bins for the "buttons" (2 buttons per joystick, again 2 joysticks supported with 1 port).

If you didn't care about burning CPU, you could bit bang these "button" inputs and interface simple home-brew electronics. The clock line attaches to one "button" pin, the data line attaches to another "button" pin. When button 1 is "pressed" sample the state of button 2! Now you are reading a data stream.

I used this trick to interface magstripe readers directly to computers back in the early 2000s, and even wrote an article for the first issue of O'Reilly's Make Magazine about it. While professional readers/writers were hard to get, cost $100+, interfaced to the parallel or serial port, and used proprietary software, this let me do it for around ~$20 in parts and use my own software. I had quite a lot of fun learning what was stored on the various tracks of the cards I had, like my student id.

https://stripesnoop.sourceforge.net

Fun times of directly accessing hardware.

Mustard did an awesome analysis of this exactly this: Flying Cruise Ships, why we don’t have giant air ships

https://youtu.be/LyaYaFzSPac?si=hZ6HV0YuCOg-WUYT

Basically, the economics no longer work. Airships really can’t carry that much weight relative to their operational costs. They’re loud and they’re slow which isn’t a great customer experience. The amount of money you would have to pay for a ticket to make it economical would be more than a first class ticket on a modern jet, which would also get you there much faster.

(BTW all of Mustard’s videos are great. They have super high production value and are primarily about transportation technologies of the 50s 60s 70s and 80s. I recommend watching it on Nebula if you can.)

Seeing NewsWaffle mentioned here just made my day! I’m glad you find it helpful

Google Zürich also did Zopfli, a DEFLATE-compliant compressor that gets better ratios than gzip by taking longer to compress.

Apparently Zopfli = small sweet breat

https://en.wikipedia.org/wiki/Zopfli

EDIT: Ahh, I was wrong and missed the addition of "strerror"

The PR is pretty devious.

JiaT75 claims is "Added the error text when printing out warning and errors in bsdtar when untaring. Previously, there were cryptic error messages" and cites this as fixing a previous issue.

https://github.com/libarchive/libarchive/pull/1609

However it doesn't actually do that!

The PR literally removes a new line between 2 arguments on the first `safe_fprintf()` call, and converts the `safe_fprintf()` to unsafe direct calls to `fprintf()`. In all cases, the arguments to these functions are exactly the same! So it doesn't actually make the error messages any different, it doesn't actually solve the issue it references. And the maintainer accepted it with no comments!