Hacker News Reader

brewmarcheon NetBSD adds a new beginner-friendly text editor called atto

> Unless they need Linux GPU/WIFI/BT drivers to make things work, of course. Then it's fine.

The parts of Linux that get integrated into BSDs should not be GPL-licensed, e.g. <https://github.com/torvalds/linux/blob/c339f4010dea8b0d754f8...> and its siblings use MIT.

brewmarcheon Ten days later, Git on macOS still trusts the compromised eMudhra certificates

I think it’s possible to add intermediate certificates with distrust marker attributes to bundles with OpenSSL. But other libraries consuming the bundle would not understand it, so the problem remains.

brewmarcheon Apple's git still trusts the compromised eMudhra certificates

Apple’s own security framework is supported by curl with OpenSSL or GnuTLS (build with ./configure --with-apple-sectrust). That blocks the intermediate certificates via the same mechanism Safari uses for example.

Not sure why macOS doesn’t ship such a build of curl.

brewmarcheon Who killed the EV cert? A browser whodunit for Halloween

Maybe we should do registered trademarks? For disambiguation location and class of goods/services might still be needed, but a certificate showing as “Google (search engines, US)” (taken from [0], picking Nice class 42) would be recognisable to many users, I guess.

[0]: https://branddb.wipo.int/en/brand/US502016086912587

brewmarcheon Show HN: Steal My Bitcoin

I’m not sure I’m understanding this comment [0] correctly, but even back then it seemed possible to get PHP involved?

[0]:<https://news.ycombinator.com/item?id=50225861>

brewmarcheon There is no official XScreenSaver GitHub repository

https://github.com/xscreensaver/xscreensaver/issues/3

This was linked in the blog

brewmarcheon There is no official XScreenSaver GitHub repository

Just delete the cookies of jwz.org (to be specific, the cookie called HN)

brewmarcheon BIPM decides to stop adding leap seconds to UTC

I’d say most ‘mainstream’ libraries pretend that every day, even a day with leap seconds, has 86400 regular-length seconds. But I thought that within UT1 the length of a second varies every day, so I would not have called that UT1.

brewmarcheon BIPM decides to stop adding leap seconds to UTC

Didn’t Julia choose UT1 for their standard date time library? Although they might want to reconsider with this decision

brewmarcheon Apple/macOS silently removed from official Unix registry

IIRC there were some UNIX Linux distributions in the past but the certification wasn’t renewed

brewmarcheon Why don't more developers “use the platform”?

> Landscapers sometimes accommodate desire paths by paving them, thereby integrating them into the official path network rather than blocking them.[…] Sometimes, land planners have deliberately left land fully or partially unpathed, waiting to see what desire paths are created, and then paving those.

from <https://en.wikipedia.org/w/index.php?title=Desire_path&oldid...>

brewmarcheon Ask HN: Who wants to be hired? (October 2026)

  Location: Germany (UTC +1/+2), EU citizen
  Remote: preferred
  Willing to relocate: no
  Technologies: C# and previously C++ and Java, I like functional programming and data-oriented where appropriate. I know SQL, Azure, Docker, high performance computing (Monte Carlo simulations), see also CV
  CV: https://pub.999568.xyz/wwtbh/rcv-202610-vfay7k0zano.pdf
  Email: see CV

I work in mathematical finance so I have domain knowledge in that area (derivatives, pricing, probability theory), but other domains are also welcome.

Happy to provide you with an unredacted CV personally.

brewmarcheon cp: -r or -R?

I remember that macOS/FreeBSD’s cp -R behaves differently depending on the trailing slash (it’s pointed out in the man page). But when I compared with GNU coreutils and busybox they did not, so it’s something to look out for.

brewmarcheon Microsoft agentically ports Copilot runtime to Rust for $120K

Just checked it and I underestimated. Just before the split it was at 54k LOC: <https://github.com/dotnet/runtime/blob/b96f3cc738f7fca9474fb...>

I’ve also read that a first version of the file came from a Common Lisp to C++ code generation step: <https://news.ycombinator.com/item?id=23295041>

brewmarcheon Microsoft agentically ports Copilot runtime to Rust for $120K

Until recently the .NET garbage collector used to be a single 30,000+ line C++ file. And it was maintained by one person if I remember correctly.

brewmarcheon Small programming tricks

Didn’t know about that one, and can’t find any references, but works in my fish

I’ve always used Ctrl+U, it’s an Emacs shortcut, so it works in many shells and other prompts (especially since readline supports it) by default.

(For example Ctrl+Opt+- doesn’t seem to work in the Python REPL whereas Ctrl+U does.)

brewmarcheon We got admin access to Baseten's production GitHub

Yeah I have seen this issue a few times. If you use Docker build arguments that way add `--provenance=false` to get rid of all that build metadata. Build secrets are still better since they allow you to scope the secret inside of the Dockerfile. Also, the metadata can be useful to inspect images.

brewmarcheon Why is the x86 undefined instruction called ud2? Why 2?

I thought MS-DOS had special handling for A: and B: since it allowed you to copy from A: to B: even with just one floppy drive.

brewmarcheon Asahi Linux on M3

Apologies, I focused on LLVM as a whole. You are right about clang (and I didn’t know about the arm64 backend)

brewmarcheon Asahi Linux on M3

They asked about ‘originated’ in particular.

brewmarcheon Asahi Linux on M3

Swift comes to mind, and this website has more https://opensource.apple.com/projects/ (it lists WebKit, but I guess they count WebKit after it split from KHTML, I’d agree with you there)

Also, Bonjour originated at Apple and it is cross-platform, although Avahi probably is more popular

CUPS is associated with Apple as well, but it seems that it also did not originate there

brewmarcheon .gitignore Everything by Default

https://github.com/github/gitignore/blob/main/Global/macOS.g...

brewmarcheon .gitignore Everything by Default

But they do: https://github.com/github/gitignore/blob/main/Global/VisualS...

You need to merge the relevant ignore files to create one specific for you, so if you use VSCode on macOS VisualStudioCode.gitignore (e.g., .vscode) + macOS.gitignore (e.g., .DS_Store). There are files for other OSs and editors as well. Technically their README says that the Global folder is intended for user-specific ignore files. But you can still use them for the repo .gitignore.

There is also this API which you can curl: https://gitignore.io/api/macos,vscode

Some of the templates seem to be identical, but I think they are not in sync.

brewmarcheon A CVE Dispute

One could argue that this is not an issue with pip, the software, but of the index used. I mean, if you control both index and extra-index there is no problem (and one solution to this is to use your own mirror with a set resolution order). This could very well be addressed in PyPI, for example NuGet allows to reserve package prefixes.

We also do not create a CVE for curl because you can use it to download the wrong bash script. If this was an alert for suspicious usages of pip instead of pip itself, I’d be less critical of it.

brewmarcheon A CVE Dispute

For the attack you mentioned (reusing internal packages in a public repository) prefix reservation is one possible solution. Unfortunately PyPI does not support it.

brewmarcheon A CVE Dispute

Maybe I was too harsh. It’s the CVE in conjunction with its high severity, the maintainers’ decision and the bundling of pip with CPython. In the end what can you do about it as a dev given that the pip maintainers have decided not to fix it? The only option is not to use pip at all (and sure, you can see the CVE as a critique of pip in a way), or discuss with your security team in hope for some exclusion. And since pip or at least ensurepip are part of Python you get a lot of these scan results

E: and if you decide not to use pip I don’t think there’s an official way to remove ensurepip, I typically rm -rf inside of site-packages, it works but doesn’t feel correct

brewmarcheon A CVE Dispute

Yes, I’ve also experienced this kind of attitude. Some scanning tools can detect that certain CVEs do not apply because the specific functionality is not used.

I hope your team was OK with you uninstalling the VMware package manually (this is actually not a bad outcome if you don’t use that package)

There are also ridiculous CVEs like CVE-2018-20225 for pip, which will not get fixed as that behaviour is by design (but here as well it might be a good idea to strip pip if it’s not used)

brewmarcheon Casey Muratori – The Root of the Root of All Evil – BSC 2026 [video]

In other videos Casey argues against the profile–fix–repeat workflow (I’m not saying that you necessarily meant this by measuring), instead arguing for estimating the theoretical maximum, then trying to get close enough to it. His argument is that the former might push you towards a local minimum without realising that you could do much better

brewmarcheon Asahi Linux Progress Report: Linux 7.2

Aren’t the shortcuts with the command key older than the PC ones (which started out as Shift+Insert etc. actually)? I wouldn’t call that desire to be different (also as mentioned below it has a lot of advantages in a terminal)

brewmarcheon A decades-old bug in Knuth's long division (TAOCP Vol II, Algorithm 4.3.1D)

There’s a funny explanation at the bottom:

> It turns out that only 9 of the first 275 checks that I've sent out since the beginning of 2006 have actually been cashed. The others have apparently been cached. So this change in policy will probably not affect too many people. On the other hand, I don't like to renege on promises, so I shall do my best to find a suitable way to send money to anyone who really prefers legal tender.