HNHacker News
TopNewBestAskShowJobs

brewmarche

517 karma · joined August 5, 2018

submissionscomments
brewmarche··on A CVE Dispute
Maybe I was too harsh. It’s the CVE in conjunction with its high severity, the maintainers’ decision and the bundling of pip with CPython. In the end what can you do about it as a dev given that the pip maintainers have decided not to fix it? The only option is not to use pip at all (and sure, you can see the CVE as a critique of pip in a way), or discuss with your security team in hope for some exclusion. And since pip or at least ensurepip are part of Python you get a lot of these scan results

E: and if you decide not to use pip I don’t think there’s an official way to remove ensurepip, I typically rm -rf inside of site-packages, it works but doesn’t feel correct

brewmarche··on A CVE Dispute
Yes, I’ve also experienced this kind of attitude. Some scanning tools can detect that certain CVEs do not apply because the specific functionality is not used.

I hope your team was OK with you uninstalling the VMware package manually (this is actually not a bad outcome if you don’t use that package)

There are also ridiculous CVEs like CVE-2018-20225 for pip, which will not get fixed as that behaviour is by design (but here as well it might be a good idea to strip pip if it’s not used)

brewmarche··on Casey Muratori – The Root of the Root of All Evil – BSC 2026 [video]
In other videos Casey argues against the profile–fix–repeat workflow (I’m not saying that you necessarily meant this by measuring), instead arguing for estimating the theoretical maximum, then trying to get close enough to it. His argument is that the former might push you towards a local minimum without realising that you could do much better
brewmarche··on Asahi Linux Progress Report: Linux 7.2
Aren’t the shortcuts with the command key older than the PC ones (which started out as Shift+Insert etc. actually)? I wouldn’t call that desire to be different (also as mentioned below it has a lot of advantages in a terminal)
brewmarche··on A decades-old bug in Knuth's long division (TAOCP Vol II, Algorithm 4.3.1D)
There’s a funny explanation at the bottom:

> It turns out that only 9 of the first 275 checks that I've sent out since the beginning of 2006 have actually been cashed. The others have apparently been cached. So this change in policy will probably not affect too many people. On the other hand, I don't like to renege on promises, so I shall do my best to find a suitable way to send money to anyone who really prefers legal tender.

brewmarche··on Splitting a Git Commit
The Law Stack Exchange tags answers with the jurisdictions they apply to, but I think that’s the only StackExchange site that allows tags on answers.
brewmarche··on Splitting a Git Commit
These answers are ~15 years apart, so the vote difference is not surprising.

I personally sort by ‘date modified (newest first)’ on StackExchange sites.

brewmarche··on AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
I get scared when I see these string interpolations in GitHub Actions.

Use `env:` instead and just work with environment variables in your shell script.

Yes, you still need to vet your script. Quoting is a common source of problems. Use shellcheck. Do not call eval/source/python/perl/whatever with untrusted input.

But you removed one layer of problems already by not pasting a value into your shell script code directly.

brewmarche··on Moving integer division to floating-point is trivial
DIVSD latency 13–14 cycles, reciprocal throughput 4 cycles

Use this instead of x87’s FDIV

brewmarche··on As a Windows user, it's a surreal way to install a program
> but the decision to not ship with a regular installation UI in OG macOS X came with the tradeoff of not cleanly _uninstalling_ software either. config files etc were always left over.

But they have regular installers, they are called .pkg and look like a wizard. Programs distributed as a single .app don’t really need them though.

brewmarche··on Lost my phone at the office. Claude suggested tracking Bluetooth signal strength
I remember years ago before LLMs my colleague told me he was impressed by my Google-fu. I was just as speechless whenever I saw him type his search queries which led nowhere. Apparently it’s a skill
brewmarche··on Fixing a bug with byte order marks
PS: Did some research and while it is true that a ZWNBSP will break up ligatures in many systems, that’s not its intended use. It’s there to prevent line breaks (up to Unicode 3.2), nowadays only kept for compatibility outside of BOM. Modern Unicode uses U+2060 WORD JOINER to express the same intention.

The old Unicode rules for ZWNBSP are also quite tricky: you are not supposed to ignore the first ZWNBSP if you already know the encoding. Which means to express an initial actual ZWNBSP you need to write two of them if the encoding is unknown to the receiver and only one of them if known.

> Where the character set information is explicitly marked, such as in UTF-16BE or UTF-16LE, then all U+FEFF characters, even at the very beginning of the text, are to be interpreted as zero width no-break spaces. Similarly, where Unicode text has known byte order, initial U+FEFF characters are also not required and are to be interpreted as zero width no-break spaces. For example, for strings in an API, the memory architecture of the processor provides the explicit byte order. For databases and similar structures, it is much more efficient and robust to use a uniform byte order for the same field (if not the entire database), thereby avoiding use of the byte order mark. Systems that use the byte order mark must recognize that an initial U+FEFF signals the byte order; it is not part of the textual content. It should be removed before processing, because otherwise it may be mistaken for a legitimate zero width no-break space. To represent an initial U+FEFF ZERO WIDTH NO-BREAK SPACE in a UTF-16 file, use U+FEFF twice in a row. The first one is a byte order mark; the second one is the initial zero width no-break space.

— Unicode 3.0 Standard, p. 325 <https://www.unicode.org/versions/Unicode3.0.0/ch13.pdf>

(With modern Unicode you can write WJ or ZWNBSP,WJ and there is no problem)

brewmarche··on Fixing a bug with byte order marks
No, a ZWNBSP that’s not at the start is just a regular ZWNBSP. Can be used to break up ligatures for example
brewmarche··on Log is non-monotonic in PHP and Lua
> The usual "0.1 + 0.2 != 0.3" is _not_ imprecision.

Correct. That’s using the wrong base. Decimal floating point doesn’t have that problem.

brewmarche··on Self-contained highly-portable Python distributions
I install these Python builds into distroless containers with uv python install and it just works. (If you try this with Google’s images, use gcr.io/distroless/cc, libgcc/libstdc++ is needed for some extensions, like numpy)
brewmarche··on Ruff v0.16.0 – Significant new updates – 413 default rules up from 59
FWIW, ruff sees your line comment and keeps each item on its line. It only adds a trailing comma and additional space.

It also does not collapse lines when there’s a trailing comma.

Your output seems to be from black. IMO it’s insane to collapse lines when there are line comments.

  $ uvx ruff format --diff formatting.py
  --- formatting.py
  +++ formatting.py
  @@ -1,8 +1,4 @@
  -no_comma  = {
  -    "x": 3,
  -    "y": 42,
  -    "z": 2
  -}
  +no_comma = {"x": 3, "y": 42, "z": 2}
  
  with_comma = {
       "x": 3,
  @@ -12,6 +8,6 @@
  
  comment = {
       "x": 3,
  -    "y": 42, # Answer to the Ultimate Question!
  -    "z": 2
  +    "y": 42,  # Answer to the Ultimate Question!
  +    "z": 2,
   }
  
  1 file would be reformatted
(I intentionally switched to double quotes since that really is a stylistic choice in Python, you can escape in both, and if you use double quotes inside of single quotes ruff leaves it as-is)
brewmarche··on Em dashes are amazing
That’s how we distinguish the Cox–Zucker Machine [1] from other Cox-Zucker Machines (scnr)

[1]: https://en.wikipedia.org/wiki/Cox–Zucker_machine

brewmarche··on Show HN: Firefox in WebAssembly
Yes, you don’t get that far without it.
brewmarche··on Show HN: Firefox in WebAssembly
Can’t get it running on Firefox 152.0.6 (aarch64), no extensions.

  [chrome-demo] chrome assets ready
  [gecko] warning: unsupported syscall: __syscall_madvise
  [gecko] embed-xul: main() on the app pthread (PROXY_TO_PTHREAD)
  [gecko] embed-xul: GECKO_GL_PASSTHROUGH=1
  [gecko] embed-xul: GECKO_COARSE_CLOCK=1
  [gecko] embed-xul: GECKO_GPU=1 (GPU/WebRender->canvas rendering)
  [gecko] xul_init: GRE dir = /gre
  [gecko] Pthread 0x11051000 sent an error! blob:https://developer.puter.com/edc1bd0a-b844-4a18-a69a-63dd49dc304a:8906: SecurityError: Security error when calling GetDirectory
brewmarche··on TLS certificates for internal services done right
If scoping were actually viable, public CAs could also sign your private intermediate CA with a name constraint and it would be trusted everywhere.
brewmarche··on TLS certificates for internal services done right
Python for example, although nowadays you can simply install pip_system_certs to change that behaviour.

A lot of non-language tools bring their own certificate bundle as well, like uv, git, curl and Firefox. (I think they might all be the same Mozilla bundle even).

However, it seems like the situation here has improved slightly: git can read Windows certificates now once a flag has been set, Firefox has a flag for Windows and macOS, and it supports p11-kit. curl can be built with Windows/macOS support and respects OpenSSL environment variables. uv can be configured to use system-certs.

And obviously any VM or container has to be set up separately. That often includes stuff like pipelines in forges. As mentioned in the sibling comment, at least here it's definitely by design.

brewmarche··on Asahi Linux 7.1 Progress Report
MacPorts is still around and is a perfectly viable package manager, I prefer it over homebrew
brewmarche··on Asahi Linux 7.1 Progress Report
IIRC Apple actually helped with MacPorts in the beginning
brewmarche··on Google Hits 50% IPv6
And with ULAs (fd00::/8) you can pick your own prefix. Officially you should pick a random one to prevent collisions when you connect private networks, but you can choose something memorable if you don’t care about that
brewmarche··on Linux eliminates the strncpy API after six years of work, 360 patches
Now with Unicode we actually have even more:

NL Next line (from EBCDIC?)

LS Line separator (invented by Unicode)

PS Paragraph separator (same)

The Unicode standard says that in addition to CR, LF, CRLF and the above, vertical tabs and form feeds should also be treated as line separators.

brewmarche··on Windows UI evolution: Clicking an unassociated file
I wonder why in Windows 10 and 11 there is no obvious way to cancel this dialog. You can press Esc, but there are no buttons to do it.
brewmarche··on WWDC 2026: Apple is Folding
I was hoping for a small phone as well since I’ve read rumours about the display being 5.3in when folded. However it also said 7.8in unfolded, which implies 4.1in × 3.3in folded… quite big and squarish.
brewmarche··on On The <dl> (2021)
Your comment put me on a side quest to research the differences between i.e., e.g., viz. and sc. and I have to admit that I’m still not 100% sure
brewmarche··on Uv is fantastic, but its package management UX is a mess
Looks like I forgot to answer the other half :) Yes you can pin a specific Python like `uv python pin cpython-3.14.0-macos-aarch64-none`, it will create a `.python-version` file which will be respected when you’re in the directory.
brewmarche··on Uv is fantastic, but its package management UX is a mess
Yes you can set it via an environment variable (UV_NATIVE_TLS=true) or in your uv.toml (native-tls = true). However, check the docs, I think they are renaming it to sytem-certs.
← PreviousPage 2 of 9Next →