HNHacker News
TopNewBestAskShowJobs

everforward

3,011 karma · joined December 10, 2021

submissionscomments
everforward··on OpenClaw isn't fooling me. I remember MS-DOS
I have the voice assistant on Mike hooked up to Claude and it does most of the things I’d want OpenClaw to do.

I’m not generally interested in having it read my email or calendar. I have a digital calendar in the kitchen, and I rarely get important email. I do really enjoy being able to control my house by voice in natural language. I had it set all my lights to Easter colors a while back in a single instruction.

everforward··on Anthropic downgraded cache TTL on March 6th
This is a messaging issue on their part, which I think is partially intentional.

It’s not unreasonable for people to expect the most expensive subscription plan to be “premium”. That’s how it works everywhere else. They typically have better margins on the premium plans, and the monthly payment gives them reliable cash flow at that higher margin.

You’re right that that’s not true at Anthropic (or really most AI providers). You’re not even really buying tokens because you get billed whether you use it or not, the tokens don’t carry over like buying API tokens, and they get to dictate what an acceptable way to use those tokens is. They are cheaper though, assuming you actually use them. Which Anthropic et al would really prefer you didn’t.

everforward··on Open source security at Astral
I think any of the webhook-based providers are better, because you can isolate your secrets. PRs go to a PR webhook that runs in an environment that just doesn’t have access to any secrets.

Releases go to the release webhook, which should output nothing and ideally should be a separate machine/VM with firewall rules and DNS blocks that prevent traffic to anywhere not strictly required.

Things are a lot harder to secure with modern dynamic infrastructure, though. Makes me feel old, but things were simpler when you could say service X has IP Y and add firewall rules around it. Nowadays that service probably has 15 IP addresses that change once a week.

everforward··on Employers use your personal data to figure out the lowest salary you'll accept
The information asymmetry is sort of wild to me. I can't really figure out an angle why this isn't bad for the same reasons insider trader is bad. I'm even okay with them having the info, I just think companies should be required to publish everyone's salaries. Redacting names is fine, but I should be able to look up the team I would join and see titles and salaries for everyone on the team.
everforward··on 81yo Dodgers fan can no longer get tickets because he doesn't have a smartphone
> They want actual season-long fans, so now if you transfer too many games they can track it and ban you. This is essentially anti-scalping. There's a legit justification.

This doesn't track to me. I can send someone else my QR code to use without actually transferring the tickets to them unless they're checking ID, and if they're checking ID then it doesn't matter whether the tickets are paper or digital.

I can't really see a way that digital tickets prevent something paper ones don't.

> At some point, you have to cut off previous technologies because virtually everyone's moved to something better. You also can't buy tickets any more by snail mail with an enclosed check.

That happens way less often than you'd think. I can still ride a horse on the road, I can still heat/cook with wood, I can still call customer support on a landline, I can still use email over landline. There are tons of things that were superseded decades ago that we still support.

It's certainly their choice to make (unless someone can make an ADA complaint or some kind of age discrimination case) but it seems like a shitty thing to do. If he can't use a computer or cellphone, they're clearly willing to _sell_ him tickets non-digitally like at a ticketing counter. Throw a cheap printer behind that counter and have the employee print them off. With the amount this guy is spending for tickets he'd probably buy the printer for them.

everforward··on German men 18-45 need military permit for extended stays abroad
Only if you ignore free will. Feels unlikely that women will suddenly abandon monogamy and forced procreation à la the draft is probably very unpopular especially given that women would be a majority. Not that they’re wrong to disagree, but there are more conditions here than the biology of procreation.

The modern answer would be immigration, and that’s gender-agnostic.

everforward··on The FAA’s flight restriction for drones is an attempt to criminalize filming ICE
> If anything is restores state-sovereignty in one narrow scenario, a scenario no signatory ever believed was an intended feature.

The most direct fault leading to that is the massive expansion of the Commerce Clause and the following elevation of every major issue to the federal level. The founders never expected this because the federal government wasn’t even supposed to be able to dictate most intra-state things.

The idea of the Senate makes sense, at least to me. States give up some sovereignty to be in the union, the Senate gives each state equal representation because they’ve each given up the same level of self-governance. The House reflects people equally as members of the union, and the Senate reflects states equally as members of the union.

Without the Senate, small states are giving up way more sovereignty than larger ones. Eg Rhode Island would have practically no sovereignty, they’d just be captives of Texas, California, etc. They don’t have enough people to swing a vote, so no federal party is going to campaign there or listen to what they want.

Making more states dilutes power in the Senate, and I don’t see a clean way to do that. If we allow arbitrary divisions of states, we invoke a race to the bottom where states can just fragment into a million tiny states and chaos ensues. If we enforce a lower population limit then the Senate just reflects the populace and becomes a pointless copy of the House.

everforward··on ESP32-S31: Dual-Core RISC-V SoC with Wi-Fi 6, Bluetooth 5.4, and Advanced HMI
Can't you just underpower the antenna on a 2.4 radio if you need networks that don't bleed into each other as badly? Unless it's an issue because of the tiny antennas that usually come on microcontrollers.
everforward··on EmDash – A spiritual successor to WordPress that solves plugin security
I've managed a couple of WordPress installs for friends and family and my experience has largely been the opposite in that there's very little truly dynamic content. Of the dynamic content, the vast majority could just be an API (either home-grown or paid 3rd party SaaS).

The flip side of the dynamic content is that every Wordpress I've ever worked on is a horrifying mountain of plugins managed by the world's worst package manager. Plugin A needs to be updated because it has a vulnerability, which requires plugin B to be updated, but the theme hasn't gotten updates in 6 years and plugin B is using new stuff the theme doesn't support, so either the site has to be re-built with a new theme or plugin A just needs to be left at a vulnerable version.

Static sites get around some of that because vulnerable plugins only exist at build-time. I'm not worried about using an old version of Hugo or Jekyll, but I'm very worried about using old Wordpress plugins.

everforward··on Scotty: A beautiful SSH task runner
Ansible exists because it makes things idempotent, which is great when you have to do a thing on 1,000 servers because you can just fix the role and re-run it.

Bash can be idempotent but isn’t by default, so you either spend time making and idempotent bash script or you spend time learning Ansible to accomplish the same thing in a reusable way

everforward··on Axios compromised on NPM – Malicious versions drop remote access trojan
This is only true if you aren’t internally mirroring those packages.

Most places I’ve worked have Artifactory or something like it sitting between you and actual PyPI/npm/etc. As long as someone has pulled that version at some point before the internet goes out, it’ll continue to work after.

everforward··on Police used AI facial recognition to wrongly arrest TN woman for crimes in ND
This isn’t how it works, you can invoke your right to a speedy trial at any point you want. You can spend 2 months waiting and then invoke it if you want.

The timer starts from when you invoke it, though.

The 2 issues, which she may be caught in, are that it’s “speedy” from the perspective of a court, and that it really means “free from undue delays”.

There is no general definition of a speedy trial, but I think the shortest period any state defines is a month (with some states considering several months to still be “speedy”).

A trial can still be speedy even past that window if the prosecution can make a case that they genuinely need more time (like waiting for lab tests to come back).

It’s basically only ever not speedy if the prosecution is just not doing anything.

everforward··on We haven't seen the worst of what gambling and prediction markets will do
Xmage is basically an unofficial variant of MTGO that does support actual multiplayer. All the cards are free, you don’t even have to grind to get them.

It is ugly as sin, but so is MTGO.

everforward··on My minute-by-minute response to the LiteLLM malware attack
I think that article proves the opposite.

> While xz is commonly present in most Linux distributions, at the time of discovery the backdoored version had not yet been widely deployed to production systems, but was present in development versions of major distributions.

Ie if you weren’t running dev distros in prod, you probably weren’t exposed.

Honestly a lot of packaging is coming back around to “maybe we shouldn’t immediately use newly released stuff” by delaying their use of new versions. It starts to look an awful lot like apt/yum/dnf/etc.

I would wager in the near future we’ll have another revelation that having 10,000 dependencies is a bad thing because of supply chain attacks.

everforward··on Antimatter has been transported for the first time
It’s a fundamentally different and riskier paradigm. Nuclear weapons at rest are inert, and can even be disarmed. If the lock falls off the gate at the compound, the nukes won’t spontaneously explode.

Antimatter is always “armed” and is only rendered safe by containment. If containment fails, it explodes. It’s more like keeping a massive stockpile of fluorine, but somehow worse and harder to contain.

everforward··on Goodbye to Sora
> They just want their invoicing system to just f-ing work for a change.

Time will tell, but I'm dubious this will hold longer-term. I don't doubt that Claude can write the code, but I am dubious Claude can manage it sanely. Does it have backups? Does the guy that wrote it know how to restore those, or can Claude do it? Can Claude upgrade the backend and/or migrate the data when the backend changes, or is this going to be running known CVEs in a month?

This has sort of always been a thing via hiring CS students as interns. I don't doubt most of them could jam out something that looks like Slack or Gmail. The problems aren't apparent immediately, they become apparent when you realize it doesn't handle invalid responses well and the backups are hosed so you just lost a bunch of data.

everforward··on GitHub is once again down
Even that doesn’t really make sense to me, unless they’ve done it in a way where everything has to move at once.

Everywhere I’ve worked, if a migration is causing this much downtime then you kill the migration or slow it down. If every change has a 10% chance of bringing the site down, you only do a change every week or two until you can work out the kinks.

everforward··on America tells private firms to “hack back”
I wouldn’t bet my freedom on the current US admin sticking their neck out to save me. Domestically, they’re hemorrhaging polling numbers and can’t eat the PR hit of “innocent people in a random country died because of what we said”. Abroad, we are in a much weaker position than we were a couple years ago both in terms of alliances and economics. We feel very vulnerable to foreign tariffs with the economy as it is.
everforward··on America tells private firms to “hack back”
Hacks that need to cross an air gap are often self-replicating. Ie you get an email with a compromised PDF, and your phone starts distributing it to everything else on the same network so if you connect your phone to the air gapped network it can get in.

Then you end up with collateral damage if your wife or roommate or whatever works at a hospital and they take their infected device to work.

everforward··on What young workers are doing to AI-proof themselves
You may be surprised how many people can't mentally disassemble basic mechanical systems. I just helped a family member change the handle/arm on their toilet, and they'd been waiting a month for someone else to help. My mom is currently waiting for me to pick up some drywall anchors to re-mount a (small, lightweight) light fixture.

There are a lot of people who don't understand this stuff to a degree where they don't even know whether a repair is dangerous or not. My family member was afraid that if they messed up installing the toilet arm they'd flood their house.

Those people are very capable of having a few repairs a month, just on random stuff. Cabinet hinge screws wore out their hole and just needs a bigger screw, shower curtain mounting is loose and needs new anchors, an outdoor light fixture with a bulb cover needs a new lightbulb and they can't figure out how to get the cover off, etc.

everforward··on America tells private firms to “hack back”
Even better, why would they bother? If it's a non-monetary hack (i.e. for data), hacking them back won't undo leaking the data. If it's a monetary hack, there are surely much better recovery options than trying to do a hack-in-kind to take it back.

It also seems incredibly risky. This US admin might be okay with it, but will the next? For multi-national corporations, will other nations be okay with it? I wouldn't think countries unassociated with the conflict would be happy with digital privateering.

everforward··on Node.js worker threads are problematic, but they work great for us
The problematic part is mostly in nomenclature. They’re called “threads” but don’t really behave the way you’d expect threads to.

They’re heavy, they don’t share the entire process memory space (ie can’t reference functions), and I believe their imports are separate from each other (ie reparsed for each worker into its own memory space).

In many ways they’re closer to subprocesses in other languages, with limited shared memory.

It’s not “clean” to spin up thousands of threads, but it does work and sometimes it’s easier to write and reason about than a whole pipeline of distributing work to worked threads. I probably wouldn’t do it in a server, but in a CLI I would totally do something like spawn a thread for each file a user wants to analyze and let the OS do task scheduling for me. If they give me a thousand files, they get a thousand threads. That overhead is pretty minimal with OS threads (on Linux, Windows is a different beast).

everforward··on Astral to Join OpenAI
Static analysis just requires that you don't actually execute the code. It's possible (sometimes) to infer what methods/properties would be create without actually statically analyzing the code.

E.g. mypy has a plugin to read the methods and return types of SQLAlchemy records, I believe without actually executing them.

Obviously not globally true, but in limited domains/scenarios you can see what would exist without actually executing the code.

everforward··on Astral to Join OpenAI
Writing a literal parser isn’t too hard (and there’s presumably an existing one in the source code for the language).

Writing something that understands all the methods that come in a Django model goes way beyond parsing the code, and is a genuine struggle in language where you can’t execute the code without worrying about side effects like Python.

Ty should give them a base for that where the model is able to see things that aren’t literally in the code and aren’t in the training data (eg an internal version of something like SQLAlchemy).

everforward··on Astral to Join OpenAI
I don’t think they’re targeting the C suite with it, because they don’t use uv and Microsoft already has Copilot for the “it’s bad but bundled with stuff you’re already paying for” market.
everforward··on Astral to Join OpenAI
I don't think this holds because we're talking about developers who know how to use a package manager, on a piece of software you have to install anyways. The friction of "uv add $other_llm_software" is too low for it to have a real impact.

I think they're more into the extra context they can build for the LLM with ruff/ty.

everforward··on Astral to Join OpenAI
I think this is more about `ruff` than `uv`. Linting is all about parsing the code into something machines can analyze, which to me feels like something that could potentially be useful for AI in a similar way to JetBrains writing their own language parsers to make "find and replace" work sanely and what not.

I'm sort of wondering if they're going to try to make a coding LLM that operates on an AST rather than text, and need software/expertise to manage the text->AST->text pipeline in a way that preserves the structure of your files/text.

everforward··on US Court of Appeals: TOS may be updated by email, use can imply consent [pdf]
TOS are in a weird spot. The ruling contends that a “reasonably prudent Internet user” would have noticed and read the email, but I would contend the opposite with the acknowledgement that it would make TOS effectively obsolete.

A reasonably prudent internet user gets half a dozen of these a day, and prudence would dictate the obvious futility of reading all of them, much less remembering the terms bound by each service.

It does mean that TOS would be almost wholly unenforceable, but that may be a bridge we need to cross as a society. These documents have gotten too large and updated too frequently to reasonably bind the population at large.

everforward··on Living human brain cells play DOOM on a CL1 [video]
I haven’t looked into it deeply either.

To my knowledge, we understand how an individual neuron works quite well. We just don’t really understand macro effects in large networks of neurons.

The video seems buzz wordy. Without looking into this too deeply, it seems like they’re using neurons individually or in small groups rather than creating a true “brain”. I would guess they’re using neurons or small groups of them sort of like transistors that do a single basic thing rather than a full “brain” that they just feed images to.

everforward··on Living human brain cells play DOOM on a CL1 [video]
The fear is that we don’t really understand what causes consciousness. I think that’s a valid fear, because we can’t know ahead of time whether we will inadvertently create a “person” inside the machine.

Unless your proposition is that no collection of human neurons outside of live birth can become sentient, and I’m not sure how you’d arrive at that conclusion without invoking some kind of spiritual argument.

← PreviousPage 11 of 34Next →