HNHacker News
TopNewBestAskShowJobs

madeofpalk

24,881 karma · joined March 27, 2012

submissionscomments
madeofpalk··on AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
Github Actions is actually so incredibly scary to have on public repo. It's full of so many footguns that's far from obvious.

It's a shame Github is buried under their current server issues, because it would be great to get improvements all of this - at least warning/erroring on these sorts of things themselves.

madeofpalk··on Accelerating GPT-5.6 Sol Ultrafast
Or an 'asbestos free!' label on a cereal box

https://news.ycombinator.com/item?id=49260655

madeofpalk··on App Store Rejection of the Week: Dark Hours
The question is whether it's possible for a genuinely new competitor to arrive. Back in the earlier days, before Apple and Google were so entrenched, competitors weren't able to do it.

The modern smartphone became popular and dislodged the previous status quo because they were genuinely new form factors and interfaces. They didn't just steal the market away from Blackberry and Windows Phone, they invented a new one and starved out the previous.

And if a new platform were to arrive, they're so broad that it's entirely possible they wouldn't even compete on the App Store. When companies squeeze out and screw over others, and the market isn't able to signal that its not good, it's time for regulators to step in.

madeofpalk··on App Store Rejection of the Week: Dark Hours
It can explain, but it can’t excuse.
madeofpalk··on App Store Rejection of the Week: Dark Hours
The criticism of monopolies is that market forces aren't able to let a failing system fail.

The App Store doesn't compete on its own merits because Apple actively prevents competition from letting it decide what the better system is.

madeofpalk··on Zed DeltaDB
Defining “it all” is exactly the problem here.
madeofpalk··on AI is a bubble, just like dot-com
The instructive part about the comparison is that believing "AI is a bubble" doesn't mean saying that AI is worthless. After all, after the dot-com bubble burst the internet still existed and continued to transform the whole world.
madeofpalk··on Web Security is Too Hard
The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations.

GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.

Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.

madeofpalk··on The Warp Agent CLI
I suspect most developers don’t care too much about cost because they’re just using what their company is just paying for whatever enterprise subscription/billing.
madeofpalk··on Keyv and friends compromised in active Shai-Hulud supply chain attack
Two out of three of your points - the first and last - are just incorrect.
madeofpalk··on Keyv and friends compromised in active Shai-Hulud supply chain attack
The latest version of all node package managers (npm, yarn, pnpm) now deny this by default. pnpm was ahead of the curve.
madeofpalk··on Apple says more ex-employees may have taken confidential data to OpenAI
I mean, they are dealing with it in the courts, right? This is the press picking up on public court filings https://www.courtlistener.com/docket/73602437/49/apple-inc-v...
madeofpalk··on Apple is getting this wrong
Is there any doubt this is exactly what happened?
madeofpalk··on Don't be a meat proxy
The problem is that it’s even easier to be stupid and lazy now, which encourages more people to do this more often.
madeofpalk··on Tailscale didn't stop the Hugging Face intrusion
“there’s no way I could do this better than Tailscale” is a much higher bar than "at least as good as I could do."
madeofpalk··on Google fixed more Chrome bugs in June than over the past two years, thanks to AI
"tests" here could mean have a benchmark the agent can run to determinately evaluate quality.

I don't strictly mean junit unit tests.

madeofpalk··on Google fixed more Chrome bugs in June than over the past two years, thanks to AI
Tests! Unit tests, integration tests, random adhoc scripts. You know - TDD!

I’ve been working on UI component improvements and it was doing a lousy job until i specifically told it to test in a headless browser to validate it works. I think somewhere in an AGENTS.md i have an instruction to “don’t state your guesses as fact - validate findings and results”.

madeofpalk··on Stacked PRs are now live on GitHub
it's basically a UI for a well-curated set of commits, and reviewing per commit.
madeofpalk··on Discovering Cryptographic Weaknesses with Claude
you're not wrong. there is a part to this that does feel like a devolution of engineering when we're just asking the computer really really nicely to do the thing we want.

on the otherhand, LLMs are a really easy way to get results that are previously fairly difficult. While i was tooking dinner last night I built a tool that turned movie puns like "the podchowski casters" into an actual director, using llms. it wasn't that hard.

madeofpalk··on The iPhone Upgrade Program is being replaced by Apple Upgrade
So, the phones arrived locked? You can't use them with any carrier you want?
madeofpalk··on The iPhone Upgrade Program is being replaced by Apple Upgrade
People are keeping their phones for longer and longer. This makes it as attractive as possible to pay for a new phone at a more frequent rate.

The bet here is that Apple would much rather you spend ~$35/month perpetually than $1200 every 4 years.

This is a 'good deal' if you're already someone who upgrades their phone frequently, but I would imagine this would end up getting a whole bunch of people to pay more money in the long run to Apple.

madeofpalk··on Google's Beyond Zero: Enterprise Security for the AI Era
Doesn’t encryption shift the attack vector to the key and/or the method?
madeofpalk··on Go Analysis Framework: modular static analysis by go team
It seems like an innocent mistake to me. I think there's a difference between actively ignoring something (like assigning an error to _), and ignoring something through omission. I think computers should try and prevent mistakes.

Go errors if you try to assign a number to a string, so it's clear there is some intention for the machine to catch when your brain makes a silly mistake.

madeofpalk··on Go Analysis Framework: modular static analysis by go team
I'm actually not all that fussed about Result or Option types. I don't mind Go's approach to error handling. I think it should just have language/analysis features built it to ensure that you do it 'correctly', so things don't blow up if you do not remember a part of the system ("this value is sometimes nil") or you forget to do something.

The fact that external tools exist that "every Go project tends to use" to fill common a gap in the type system indicates to me that maybe the language itself could be improved.

madeofpalk··on Go Analysis Framework: modular static analysis by go team
> So, you handle the error in the end, or forcefully and intentionally ignore it. Again, if the code goes boom, it's on the developer, not on Go.

Except Go doesn’t actually require you to handle the error. You can forget to handle the error, or forget to do a nil check. And Go won’t tell you until it crashes and explodes at runtime.

Technically the user’s fault, but good systems protect the users from their own mistakes.

madeofpalk··on If coding has been solved, why does software keep getting worse?
> * paid for directly by the user

hahahahah. Games are steering further and further to this not being true. Where each player explicitly doesn't pay for it, and instead they contain an increasing series of dark patterns in order to steer players to fleece their money in a series of microtransactions.

madeofpalk··on Claude Code uses Bun written in Rust now
How much extra money do you think they would make if Claude Code wasn’t JavaScript?
madeofpalk··on Fable 5 vs. GPT-5.6 Sol on an NP-Hard Problem: Does /goal help?
Adding a new lint rule that a lot of code violates.
madeofpalk··on New era for Gibraltar with removal of border controls with Spain
I mean they said pretty clearly that they should respect the wishes of sovereignty for Gibraltar, so presumably they would also extend the same to Ceuta and Melilla.

I think in a very abstract sense I agree that exclaves like this are weird and it would be cleaner if they didn't happen (Gibraltar returned to Spain, Ceuta and Melilla returned to Morocco), but that's thinking of this as a systems design problem rather than one that cares about people. I recognise that this is not an empathetic view, and my own opinion is worthless and I hold onto it very weakly.

madeofpalk··on The largest available Minecraft world, totalling 15 TB
looks a bit like chunky, maybe? https://chunky-dev.github.io/docs/
← PreviousPage 3 of 34Next →