HNHacker News
TopNewBestAskShowJobs

jallmann

2,122 karma · joined March 27, 2010

joshua.allmann at gmail

Currently working on:

otpguard.com - multi-factor authentication for Github PRs

ephemeralpostal.com - disposable E-mail for developers

submissionscomments
jallmann··on Ask HN: Are there AI models for generating sounds based on a text and reference?
Daydream Music - https://daydream.live

The DEMON realtime engine is open source. The hosted service has a number of integrations with popular audio tools. (I'm on the team)

jallmann··on Cloudflare Quick Tunnels
git : github :: wireguard : tailscale
jallmann··on HTML over WebSockets: real-time SPAs with barely any JavaScript
> I believe the poster was referring to requests from the client to the server having to traverse the HTTP stack, not data coming down from the server via the SSE stream.

Ah that's probably correct, I mis-read.

jallmann··on HTML over WebSockets: real-time SPAs with barely any JavaScript
Sure, but SSE connections in the browser - the typical use case - are persistent, so there shouldn't be frequent re-connecting.

Unlike WebSockets, browser SSE also has a built-in recovery mechanism so you don't miss events across reconnects (`Last-Event-ID` header), although this does require explicit support from the server-side app.

Given that the WebSocket handshake has an additional round-trip, SSE would typically be faster in terms of time-to-first-byte.

> you’re still travelling through an entire HTTP stack implementation rather than the incredibly simple WebSocket protocol

Both protocols have their own minimal framing, but "an entire HTTP stack" is a stretch. It's hard to argue that `data:value\n\n` is more complex than the WebSocket binary protocol. Simplistic, sure (no binary payloads), but also simple enough to, say, pipe through a regex. Good luck doing that with WebSocket.

jallmann··on The Valley of Webhooks
> I find that if you put a decent bit of engineering effort into that "disaster recovery" synchronisation, it can often act as the main or only synchronisation process for quite a lot of systems.

Another benefit is that you get to exercise those disaster recovery mechanisms regularly as part of the normal functioning of the system, rather than a specialized path that is only rarely exercised (and thus may be broken when you need it the most).

jallmann··on The Billable Usage API: programmatic cost visibility for Cloudflare
A while ago, I noticed some very small oscillations in my Cloudflare R2 bill (1-2 cents / month) and decided to ask about it out of curiosity. Support was tepid - understandable for my $1 / month account - and it wasn't until later that I realized the difference probably had to do with the number of days in the month.

Would this API have helped?

jallmann··on Taking OCaml and Eio for a Spin
Depending on the error, the grammar, and the parser, it may not be possible to close the function body. Most compilation units are file-based for this reason.
jallmann··on Passkeys were invented by engineers with zero understanding of consumer brain
That leads to the cross-device usability issues from the original post. Even for an experienced engineer, it's a headache to manage multiple devices across multiple sites.

With the "cloud password manager" angle there is some hope of being user friendly, although we're certainly not there yet for most folks.

jallmann··on OpenAI mandates hardware-backed passkeys for Trusted Access Cyber members
> want without a PR process that requires hardware authentication or proof of presence

Just curious, what do you use for this?

I built OTP Guard [1] a few years ago for exactly this problem, although I haven't seen any alternatives in the space. Does GitHub have something built-in now?

The original framing was more "local malware compromising your GitHub account" ... it never occurred to me that the malware could be a LLM. I really should update the page.

[1] https://otpguard.com

jallmann··on Nintendo has raised its employees base salary by 10%
I thought the same, too. Generally some small amount of inflation is preferable to encourage spending, rather than deflation which discourages it.

If you know a $100 item will probably cost $102 later then you're more likely to buy it now. But if that item will cost $98 in a deflationary environment, then maybe you'll wait to buy it later. Wages also tend to fall in deflation, which makes it harder to pay back debt, so lending slows down - people won't buy houses or cars, etc. Businesses hold back on capital spending. The economy slows to a standstill: if no one is spending money, how can anyone make money?

jallmann··on Dostoyevsky isn't difficult
Which translations would you recommend for Crime and Punishment or Dostoyevsky in general?

When I'm starting to read a non-English novel, the process of deciding which translation to use is half the fun. The Kent and Berbera (revised Garnett) version of Anna Karenina was mesmerizing.

jallmann··on San Diego photologs from the 1970s
Agreed it's a bummer.

There's a lot of low-density sprawl in San Diego county which makes effective transit difficult, and because you have to drive everywhere, sentiment trends anti-bicycle. The previous CEO of SANDAG tried to push a mobility-centric vision but left because of intense pushback from folks who wanted more funding for roads and freeways, rather than transit and bike paths.

jallmann··on Crypto in 2026: Oh, This Is the Bad Place
> I believe with x402 and USDC you can pay as low as $0.000001 per HTTP request with no fees.

On-chain transactions are still not free. x402 isn't settled in batches or rolled up anywhere AFAIK, so large volumes of tiny payments are still not cost-effective. Facilitators such as Coinbase only subsidize transactions up to a point: https://docs.cdp.coinbase.com/x402/core-concepts/facilitator

There are ways around this, but with tradeoffs.

jallmann··on CISA Admin Leaked AWS GovCloud Keys on GitHub
The accepted norm is, increasingly, full disk access, regardless of how bad of an idea it is. At a minimum, agents typically will have a way of obtaining new access tokens.

Refresh tokens don't solve anything in this case; they just shuffle the problem around, and introduce other complications of their own.

What you want are capability scoped credentials that are enforced on the backend. That is agnostic to credential issuance mechanism, although passkeys are the best.

Using these credentials effectively still presupposes hygiene that might not exist in a typical developer environment, eg no root credentials (or access to such) sitting anywhere. There's probably a good product and market for whoever can solve this in a low-friction way.

jallmann··on CISA Admin Leaked AWS GovCloud Keys on GitHub
> OAuth with refresh tokens.

Then the LLM slurps up your refresh token. What's next?

jallmann··on Durable queues, streams, pub/sub, and a cron scheduler – inside your SQLite file
With SQLite, you're basically funneled towards a single-writer / single-process design anyway ... in which case why not use a more traditional condvar + mutex rather than polling?
jallmann··on When moving fast, talking is the first thing to break
This describes my team to a T ... are we working at the same place?!?

We actually talk more now which helps, but it is still hard to keep up when everyone is barreling ahead doing their own thing. In addition to more talking, there needs to be a semblance of strategy that everyone is aligned on and understands their role in.

A high-agency, high-functioning team has always been a superpower, but mastering this capability is what will make or break organizations that are trying to run lean with AI. It's a "people problem" at its core, and no amount of technology can fix that.

jallmann··on Goodbye to Sora
This is where curation matters, eg in a newsroom or gallery. Provenance is their job, and if done well, can connect people in a way that an unfiltered social media firehose can't.
jallmann··on OCaml as my primary language
> That seems pretty hard to read at a glance, and easy to mistype as a definition.

YMMV but let expressions are one of the nice things about OCaml - the syntax is very clean in a way other languages aren't. Yes, the OCaml syntax has some warts, but let bindings aren't one of them.

It's also quite elegant if you consider how multi-argument let can be decomposed into repeated function application, and how that naturally leads to features like currying.

> Also, you need to end the declaration with `in`?

Not if it's a top level declaration.

It might make more sense if you think of the `in` as a scope operator, eg `let x = v in expr` makes `x` available in `expr`.

> Then, semicolons...

Single semicolons are syntactic sugar for unit return values. Eg,

  print_string "abc";

is the same as

  let () = print_string "abc" in
jallmann··on OCaml as my primary language
The way I always think about it is in terms of scope. With:

  let x = v in expr
`x` is now available for use in `expr`

In essence, an OCaml program is a giant recursive expression, because `expr` can have its own set of let definitions.

In the REPL, this is where the double semicolons come in, as a sort of hint to continue processing after the expression.

jallmann··on Linear sent me down a local-first rabbit hole
Linear is actually so slow for me that I dread having to go into it and do stuff. I don’t care if the ticket takes 500ms to load, just give me the ticket and not a fake blinking cursor for 10 seconds or random refreshes while it (slowly) tries to re-sync.

Everything I read about Linear screams over-engineering to me. It is just a ticket tracker, and a rather painful one to use at that.

This seems to be endemic to the space though, eg Asana tried to invent their own language at one point.

jallmann··on What'll happen if we spend nearly $3T on data centres no one needs?
The delta might not be that large these days, with the AI suggestions that Google is placing on search result pages.
jallmann··on Cloudflare 1.1.1.1 Incident on July 14, 2025
Good writeup.

> It’s worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com, configured manually or through their browser, to access the public DNS resolver, rather than by IP address.

Interesting, I was affected by this yesterday. My router (supposedly) had Cloudflare DoH enabled but nothing would resolve. Changing the DNS server to 8.8.8.8 fixed the issues.

jallmann··on Show HN: Pangolin – Open source alternative to Cloudflare Tunnels
Yes, this exactly - I wouldn't call it nitpicky, it is really buried in there. I understand Cloudflare has a ton of other products and features, but the discoverability for CF Tunnels really could be better.

Just checked and it's:

Dashboard home > Zero Trust > Networks > Tunnels > [tunnel] > Public Hostname

And if it ends up provisioning a new DNS record, I always have to remember to go back to the domain's DNS screen and label it with the tunnel.

In general I use a tiny silver of Cloudflare's capabilities; it would be nice if the primary dashboard could bubble up the parts that I do use.

jallmann··on Gene therapy restored hearing in deaf patients
I can't say anything about the specifics of this treatment, but in terms of their ability to fully benefit from hearing, it would depend on when they became deaf, and the severity of their deafness.

If they were born deaf, or lost hearing as a young child during the language development stage, then it would probably be a long adjustment. Things would just be noise and it would take a lot of training to distinguish sounds, speech, etc. And unlike a cochlear implant, you couldn't just take it off to give your brain a rest.

If they had hearing loss later in life, or some residual hearing, then they probably have a better chance of re-adjusting to hearing.

jallmann··on The Business of Betting on Catastrophe
Manipulation of reported economic numbers has been an issue in the past, see LIBOR.
jallmann··on iPhone customers upset by Apple Wallet ad pushing F1 movie
Uber is blatantly abusing push notifications for marketing, it is so bad ... for smaller apps this would be an App Store ToS violation and grounds for removal. The double standard with larger apps is very upsetting.
jallmann··on OxCaml - a set of extensions to the OCaml programming language.
> This is what I like to call a dialect of OCaml. We speak in sometimes and sometimes we gently say it’s zero alloc OCaml. And the most notable thing about it, it tries to avoid touching the garbage collector ...
jallmann··on OxCaml - a set of extensions to the OCaml programming language.
The linked podcast episode mentions it.
jallmann··on CivitAI Policy Update: Removal of Real-Person Likeness Content
Yes! The book "One From Many" from Dee Hock, the Visa founder, discusses this formation in depth. For a long time, Visa's governance structure was quite unusual due to it being a consortium of stakeholders, some with very different interests.

Somewhat ironically, Hock's "chaordic" management philosophy has strong parallels with ethos of decentralization held by some crypto idealists.

Page 1 of 22Next →