Hacker News Reader

cientificoon A modern approach to preventing CSRF in Go

Killing all the fun.

Remember when you could trick a colleague into posting in Twitter, Facebook... by just sending a link?

CSRF fixes are great for security - but they've definitely made some of the internet's harmless mischief more boring

cientificoon AI-powered open-source code laundering

The license was MIT until two months ago.

That gives anyone the right to get the source code of that commit and do whatever.

The article does not specified if the company is still using the code AFTER the license change.

The rest of the points are still valid.

cientificoon Launch HN: Cactus (YC S25) – AI inference on smartphones

Because that’s literally the definition of open source:

> Open-source software is software released under a license where the copyright holder grants users the rights to use, study, change, and distribute the software and its source code, for any purpose.

That’s the first result you get on Google—and it’s exactly why so many companies relicensed their projects (Redis, HashiCorp, Elasticsearch, MongoDB…).

If it’s open source, you can sell it, host it, or give it away for free. The only difference is which obligations the license attaches:

GPL → you must keep the license.

AGPL → you must keep it and extend it to hosted services.

BSD/MIT → do almost whatever you want.

But the core right is always the same: distribute, host, and sell. Courts have even confirmed this is the accepted definition of “open source.”

cientificoon Launch HN: Cactus (YC S25) – AI inference on smartphones

Can you clarify the following sentence:

> We are open-source (https://github.com/cactus-compute/cactus). Cactus is free for hobbyists and personal projects, with a paid license required for commercial use.

If it is open-source, one is free to distribute even for commercial use by definition. Which one is correct and what's your business model?

cientificoon Graceful Shutdown in Go: Practical Patterns

We've adopted Google Wire for some projects at JustWatch, and it's been a game changer. It's surprisingly under the radar, but it helped us eliminate messy shutdown logic in Kubernetes. Wire forces clean dependency injection, so now everything shuts down in order instead... well who knows :-D

https://go.dev/blog/wire https://github.com/google/wire

cientificoon Less Htmx Is More

I like Hotwire/Turbo more than HTMX because of its core philosophy: start by building a fully functional page without any JavaScript, and then layer in enhancements only as needed. That approach has stayed consistent for years and feels really straightforward to work with.

cientificoon Ask HN: Who is hiring? (February 2025)

Justwatch | golang | Berlin | https://www.justwatch.com/talent/jobs/tech/streamingguide-ju...

Backend development at justwatch. Looking for all levels, not only junior.

Go, postgress, kubernetes.

No remote.

Feel free to contact: guillermo.alvarez at justwatch.com

cientificoon Why and how we’re migrating many of our servers from Linux to the BSDs

It’s like driving a car. Most people can drive without needing to understand the internals, and it’ll still get them from point A to B. But just like some people enjoy diving deep into car mechanics, others enjoy understanding the intricacies of software.

For me, that deeper knowledge is an advantage. It helps me quickly evaluate tradeoffs between databases, debug at the OS level, or dismiss a library still relying on select if I expect heavy load. This insight saves time and increases efficiency.

cientificoon Why and how we’re migrating many of our servers from Linux to the BSDs

I completely agree! If you're looking to deeply understand how Linux works under the hood, I highly recommend trying out Linux From Scratch. It gave me invaluable insight into the system, especially when I first explored it 20 years ago. Building everything from the ground up—without relying on prepackaged distros or libc—was a game changer.

Check it out: https://www.linuxfromscratch.org/

cientificoon TotalRecall: Extracts and displays data from the Windows 11 Recall feature

If an intruder gets into my local account, I'm far more worried about them stealing my cookies or accessing company IP than my browser history.

With cookies and browser access, they could get into my emails, family photos, bank accounts, and even read desktop notifications from my phone's SMSs.

For developers, the real risk lies in the variety of dependencies our apps have, which could get compromised.

So, this isn't really news. There are also tools to access all your iMessage history from a Mac, for example.

I believe the feature is really useful, and for sure you can turn it off.

cientificoon Ask HN: Who is hiring? (June 2024)

Justwatch | Golang eng (Junior/Senior) and Senior ML engineer | Berlin (min 2days in office) | full time Hi. I am Guillermo, backend developer of StreamingGuide. We try to make justwatch.com the best streaming guide worldwide.

We predominantly utilize Golang and Kubernetes, interfacing with GRPC APIs from teams such as Content (housing "the" database) and Martech (for ad display). Additionally, we work with databases like Scylla and Elasticsearch, ensuring seamless operation even under high loads exceeding 5k requests per second.

We're tackling challenges like integrating video ads, fortifying against scraping, enhancing response times, and optimizing the click-through rate for our recommender engine.

My colleagues from the content team, are also looking for a ML expert that help us finding the right recommendations.

If you in, write me (guillermo.alvarez@justwatch.com) or visit: https://www.justwatch.com/talent/jobs/tech/streamingguide-se... (Junior offer to be open soon).

cientificoon Hotwire: HTML Over The Wire

If you have discipline, probably none.

The difference is developer behavior that each framework encourages.

While htmx/turbo focus in just couple of helpers and then leave you with the full HTML/JS, in a react ecosystem you end having with 3 party components, and a state management system and build system that will change in 10 months. I don't say it isn't justify and that it have its pros, but it's a rabbit hole in my experience, where you easily end fighting with the framework than focusing on business.

cientificoon Hotwire: HTML Over The Wire

For sure, there are cases in which a PWA focus is to add offline support, and you are totally right there.

However, I will argue that 80% of PWA exist to have proper push notifications, or faster development than native.

cientificoon Hotwire: HTML Over The Wire

Phoenix live view is awesome. If you use Phoenix that's the way to go. If you don't want to go to the erlangvm, htmx or hotwire/turbo are the only options I would consider.

cientificoon Hotwire: HTML Over The Wire

This is by far the easiest way to do PWA without getting into the rabbit hole of react/Vue/svelte. I used them, and are awesome, don't misunderstand me.

While comparing with htmx it feels more developer focus than tech focus, but I believe the race between the two will depend on which one is integrated with your backend framework.

cientificoon Ask HN: Who is hiring? (May 2024)

Justwatch | Golang eng | Berlin (min 2days in office) | full time

Hi. I am Guillermo, backend developer of StreamingGuide. We try to make justwatch.com the best streaming guide worldwide.

We're tackling challenges like integrating video ads, fortifying against scraping, enhancing response times, and optimizing the click-through rate for our recommender engine.

If you in, write me (guillermo.alvarez@justwatch.com) or visit: https://www.justwatch.com/talent/jobs/tech/streamingguide-se...

cientificoon Dali owner file petition to cap liability in Baltimore bridge collapse at $43.7M

I can tell you how is going to play out. The people with less money for lawyers will be held liable. Normally the captain.

cientificoon Not able to click on map during Google search why did they change this (in EU)

I understand the frustration, but there is nothing preventing Google from adding a link to Google maps and other competitors in the search results.

I will personally love to see a link to openstreetmaps that tends to be more detail in my area.

This feels more like being evil, than trying to provide a good experience to the user and being nice. (Maybe they are working on that already)

cientificoon Ask HN: Who is hiring? (March 2024)

Justwatch| Go React ML SRE engineers | Berlin | Full-time | justwatch.com

If you saw an ad for a movie we probably did it. Justwatch is the biggest and most up to date streaming guide.

Company size: about 300. Engineering: about 40. No VC behind. 8 cofounders. 10 years old. Profitable.

In my team we build scraping protection improve SEO, grahpql, improve ad campaigns. Microservices, k8s... that kind of things.

All levels.

Also looking for devops, sre, frontend and ML, but can't provide details for thoose.

More info here https://www.justwatch.com/talent/jobs/tech or write me: guillermo.alvarez @ justwatch.com

cientificoon OpenAI – Application for US trademark “GPT” has failed

I find it surprising how quickly we rush to pass judgment on OpenAI's actions without understanding the motivations behind their attempt to trademark. It's possible that they are seeking protection against others who might register the same, or it could be a measure to prevent customers from unknowingly sharing sensitive company data with a GPT indexer unrelated to OpenAI. If anyone has evidence of OpenAI acting in bad faith, please share it.

cientificoon Ask HN: What are good books/blogs to read for a first time CTO?

There was this related post in hn that might help you.

https://news.ycombinator.com/item?id=37971795

cientificoon Ask HN: Freelancer? Seeking freelancer? (December 2023)

  Location: Berlin
  Remote: Optional
  Willing to relocate: No
  Technologies: go, rails...
  Résumé/CV: 20y experience https://de.linkedin.com/in/galvarez
  Email: guillermo@cientifico.net

cientificoon Ask HN: Who wants to be hired? (December 2023)

  Location: Berlin
  Remote: Optional
  Willing to relocate: No
  Technologies: go, rails...
  Résumé/CV: 20y xp. https://de.linkedin.com/in/galvarez
  Email: guillermo@cientifico.net

cientificoon Being Introvert Founder

Can't talk about your speech. If you want, you will improve if you really need that. Find coaches. At founder level they are a lot.

What I wanted to say is to take a lot of care to not define your self by your weaknesses. If you have several startups with other people you are already awesome.

Then consider that there is nothing bad with your speech. Instead there is something bad with the expectations. You are a founder so you set the expectations. Setting meetings with agenda, not improvise decisions, maybe your focus should be more in expectation management for meetings than improving your speech.

And last. Consider if there is really a fit. I probably will love working with you. Other people might not.

Look also for a fit. I will like to work with you. I like to have a meeting, reflect, and come to conclusions after several sort sessions. Other people (not looking at sales), tend to prefer (in my short experience) meetings without agendas and fast decision making. The CEO should bring versatility to the approach.

Long live to slow thinkers! https://sive.rs/slow

cientificoon Startup CTO's Handbook

That's the plan.

cientificoon Startup CTO's Handbook

Here I take the blame. I ask from day one to work on some kind of vision. She said that we can't talk for days, so better do it fast.

I said yes (instead doing what I wanted that was to invest the time needed to agree on a vision).

Then I continued saying yes again and again, until without realizing it, I put my self in an employee mindset. Waiting for her to decide what I work as she blocked everything.

I need to move back to founder mindset and start setting some boundaries.

cientificoon Startup CTO's Handbook

I still have a couple of things to try... But you are right. If it doesn't work so early...

Thanks for your comment.

cientificoon Startup CTO's Handbook

I recently became CTO, and one of the biggest struggles I have is communication with the CEO. (Sorry if covered by the book, just read the index)

On 8 months so far, the CEO:

  * Don't want to have any alignment meeting.
  * Don't want to plan anything.
  * Don't want to drive vision.
  * Want to focus only in the killer feature.
  * Don't want to build mockups or prototypes to test with users.
  * If we do, they have to be beautiful.
  * Don't want to work on anything that takes more than a week.
  * Rejected to have any effective meeting.

</Frustration>

What I want to say in this message is that I miss exactly the things that are not in the book.

Edit: we are just 3 cofounders!

cientificoon Kopia: Fast and secure open-source backup software

For database, in my experience, is better to dump the whole database and backup the dump for the reasons you explained

cientificoon Ask Microsoft: Are you using our personal data to train AI?

I'm my experience GDPR is relevant.

I need to inform my customers what I do with their personal data. That includes to which companies I share that data with.

Having an excel with customer data is providing that data to Microsoft. So I need, as responsible of the data, to know how they will use it. Any use case that isn't obvious have to be cleared stated in the data privacy agreement. Including moving data outside EU into other countries like America (where US government can request that data without even informing us) or using their data to train AI.

Come'on. If we need to inform that we used chatgpt (just in case they provide PI), why we will not need to inform about Microsoft.